summaryrefslogtreecommitdiff
path: root/scripts/package-build/linux-kernel
AgeCommit message (Collapse)Author
6 daysMerge pull request #1238 from c-po/kernel-update-6.18.38rollingChristian Breunig
Kernel: T9067: Update Linux Kernel to 6.18.38
6 daysKernel: T9067: Update Linux Kernel to 6.18.38Christian Breunig
10 dayskernel: T8940: disable HYPERV_VTL_MODE and restore Hyper-V vPCI driverAlex Kudentsov
13 daysaccel-ppp-ng: T9039: update the commit hashDaniil Baturin
for the fix for legacy hash algorithm loading to make MS-CHAP work correctly again
2026-06-26Merge pull request #1227 from c-po/bnx2-patchViacheslav Hletenko
Kernel: T8914: add support for 2.5G pluggables on BCM57810S
2026-06-26Merge pull request #1189 from c-po/l2tpv3Daniil Baturin
Kernel: T8605: net/l2tp: allow unmanaged tunnel setup without route to peer
2026-06-25Kernel: T8914: add support for 2.5G pluggables on BCM57810SChristian Breunig
Add the well-known JAMESMTL kernel module patch for bnx2x to advertise 2.5Gbit/s capabilities on Broadcom NetXtreme2-X cards with BCM57810S chipset. This is useful for ISP GPON access networks that use 2.5Gbit/s pluggables and need the NIC to negotiate beyond 1000baseT/Full, avoiding the 940Mbit/s practical cap on overprovisioned 1G services. References: * https://hack-gpon.org/broadcom-57810s/ * https://github.com/JAMESMTL/snippets/blob/dceb2fee74d80c66d/bnx2x/patches/bnx2x_warpcore_8727_2_5g_sgmii_txfault.patch
2026-06-25Kernel: T9010: update existing patches to remove "hunk off" noticesChristian Breunig
2026-06-23Kernel: T9010: remove Intel NIC Debian postinstall file after buildChristian Breunig
2026-06-23Kernel: T9010: update Intel OOT module driversChristian Breunig
Update versions: * igb v5.20.28 * ixgbe v6.4.4 * ixgbevf v5.3.36 * i40e v2.30.18 * ice v2.6.6 * iavf v4.13.35
2026-05-28Kernel: T8938: consolidate build time options for amd64 and arm64 WWANChristian Breunig
2026-05-23Kernel: T8919: Update Linux Kernel to 6.18.33Christian Breunig
The Kernel 6.18.33 now has an upstream fix for the fragnesia vulnerability
2026-05-18Merge pull request #1194 from c-po/kernel-sourceAndrii Klymenko
Kernel: T8880: reduce size of Kernel source TAR
2026-05-18Kernel: T8879: add missing Hyper-V drivers after 6.18 upgrade (#1193)Christian Breunig
* Kernel: T8846: consolidate config for CPU/Task time and stats accounting * Kernel: T8879: add config section for hypervisor Virtual Socket Protocol * Kernel: T8879: add missing Hyper-V drivers after 6.18 upgrade Add drivers for Hyper-V hypervisor which got lost in transition from 6.6 to 6.18 Kernel upgrade.
2026-05-17Kernel: T8880: reduce size of Kernel source TARChristian Breunig
Enable "make mrproper" before packaging kernel source tarball. After enabling PWRU support in T8496, the auto-generated kernel source tarball grew from under 1 GB to ~4 GB, largely due to intermediate build artifacts (for example, vmlinuz.o growing from 54 MB to 618 MB with additional debug symbols). Since the tarball is intended to contain kernel sources and custom patches and not intermediate objects, we now clean the tree with "make mrproper" before creating the tarball. This keeps package size down while preserving rebuildability.
2026-05-15Kernel: T8871: Update Linux Kernel to 6.18.31Christian Breunig
This fixes the LPE https://github.com/0xdeadbeefnetwork/ssh-keysign-pwn
2026-05-15kernel: T8871: add a patch for the ptrace vulnerabilityDaniil Baturin
that allows unprivileged users to read files owned by any other user
2026-05-14Kernel: T8864: add patch for "fragnesia" local privilege escalationChristian Breunig
Fragnesia is a universal Linux local privilege escalation exploit, discovered with V12 by William Bowling with the V12 team. Fragnesia is a member of the Dirty Frag vulnerability class. This is a separate bug in the ESP/XFRM from dirtyfrag which has received its own patch. However, it is in the same surface and the mitigation is the same as for dirtyfrag. It abuses a logic bug in the Linux XFRM ESP-in-TCP subsystem to achieve arbitrary byte writes into the kernel page cache of read-only files, without requiring any race condition. The technique extends the page-cache write bug class that includes Dirty Pipe: when a TCP socket transitions to espintcp ULP mode after data has already been spliced from a file into the receive queue, the kernel processes the queued file pages as ESP ciphertext. The AES-GCM keystream byte at counter block position 2, byte 0 is XORed directly into the cached file page. By selecting the IV nonce to produce a desired keystream byte, any target byte in the file can be set to any value — one byte per trigger invocation. From: https://github.com/v12-security/pocs/blob/532994fc003a7/fragnesia/README.md
2026-05-13Merge pull request #1178 from SuperQ/superq/psiDaniil Baturin
kernel: T8847: Enable PSI metric data
2026-05-11Enable PSI metric dataSuperQ
Enable the kernel [Pressure Stall Information][PSI] accounting feature. This allows users to gather data on CPU and memory starvation. It's very useful to help find cases where the system performance is impacted by overloaded CPUs. [PSI]: https://docs.kernel.org/accounting/psi.html Signed-off-by: SuperQ <superq@gmail.com>
2026-05-08Kernel: T8605: net/l2tp: allow unmanaged tunnel setup without route to peerChristian Breunig
Kernel-created L2TPv3 tunnels (genetlink L2TP_CMD_TUNNEL_CREATE without L2TP_ATTR_FD) used udp_sock_create() and kernel_connect(), which invoke __ip4_datagram_connect() / __ip6_datagram_connect(). Those paths insist on a successful FIB lookup at connect time. If no route to the configured remote existed yet, tunnel and interface creation failed. The data path already resolves routes on transmit (e.g. __ip_queue_xmit(), inet6_csk_route_socket()). This change defers requiring a route until packets are sent. Details: - UDP encapsulation: bind with udp_sock_create() after zeroing peer_udp_port, then l2tp_udp_sk_set_peer() sets daddr/dport and socket "connected" state without caching sk_dst from connect. - IPv4 L2TP/IP (l2tp_ip): on -ENETUNREACH / -EHOSTUNREACH from __ip4_datagram_connect(), l2tp_ip_connect_deferred() installs peer and bind-table updates without a connect-time route. - IPv6 L2TP/IP (l2tp_ip6): same for __ip6_datagram_connect(), including IPv4-mapped peers and scope / bound-device checks aligned with the normal connect path. Forwarding still only happens once the FIB can reach the peer. Until then outgoing packets follow the existing no-route drop path. Assisted-by: Cursor:claude-4.6-opus Signed-off-by: Christian Breunig <christian@breunig.cc>
2026-05-08Kernel: T6847: add Intel IAVF out-of-tree Kernel driver with custom patchesChristian Breunig
The Intel iavf driver (formerly i40evf) is the Linux virtual function driver for modern Intel Ethernet adapters supporting SR-IOV, including the X700/E800 series. Renamed to iavf to support future devices, it replaced i40evf entirely by 2019. The driver facilitates high-performance networking in virtualized environments. This commit contains custom patches to make the driver build.
2026-05-08Kernel: T6847: use common build_intel_nic helper functionChristian Breunig
Instead of one build function per driver (ixgbe, i40, ice) which will anyways result in the same Python code path to be executed - use one common helper name: build_intel_nic
2026-05-08Kernel: T6847: add Intel ICE out-of-tree Kernel driver with custom patchesChristian Breunig
The current version of the Intel ice driver does not compile with a recent LTS Kernel due to missing internal Kernel API adjustments in the Intel driver. This commit contains custom patches to make the driver build.
2026-05-08Kernel: T6847: add Intel I40E out-of-tree Kernel driver with custom patchesChristian Breunig
The current version of the Intel i40e driver does not compile with a recent LTS Kernel due to missing internal Kernel API adjustments in the Intel driver. This commit contains custom patches to make the driver build.
2026-05-08Kernel: T6847: cleanup comments to not trigger config merge warningChristian Breunig
2026-05-08Kernel: T6847: cleanup Intel QAT driver source after buildChristian Breunig
2026-05-06Kernel: T8147: extract common CONFIG_* options to be reusedChristian Breunig
It does not make sense to have the common VyOS functionality for e.g VXLAN, GENEVE, PPP, WireGuard, filesystems crypto or module signing duplicated for both arm64 and x86_64. Split out common configuration parts to be defined only once.
2026-05-03Kernel: T8147: upgrade to 6.18Christian Breunig
* Forwared port all out-of-tree driver patches * Add Intel QAT patch to make it compile for LInux 6.18 * Remove out-of-tree OpenVPN DCO module - now available upstream
2026-05-03Kernel: T8147: bump out-of-tree Intel NIC driver versionsChristian Breunig
2026-05-03Kernel: T8147: bump nat-rtsp commit id to support 6.18 API changesChristian Breunig
2026-05-03Kernel: T8147: bump linux-firmware package version to 20260410xChristian Breunig
2026-05-03Kernel: T8147: rename WWAN config snippet positionChristian Breunig
2026-05-03Kernel: T8147: use common WireGuard module in 10-networking.configChristian Breunig
2026-05-03Kernel: T8147: drop out-of-tree INOTIFY_STACKFS patchChristian Breunig
The inotify support for overlayfs is no longer needed. Native upstream support landed in kernel 4.16 (commit 31747eda41ef/764baba80168 in 2018, which made overlayfs hash inodes by their lower inode so fsnotify works on overlay mounts), and kernel 6.8 (commit bc2473c90fca in 2023) extended it so fsnotify generates events for operations on the real underlying files of an overlay. The patch was an out-of-tree workaround that never went upstream and predates these solutions.
2026-04-30Merge pull request #1169 from robinchrist/T8506-use-kconfig-merge-config-shDaniil Baturin
linux-kernel: T8506: Use scripts/kconfig/merge_config.sh for merging kernel config fragments
2026-04-28linux-kernel: T8506: Use scripts/kconfig/merge_config.sh for merging config ↵Robin Christ
fragments Using scripts/kconfig/merge_config.sh for merging config fragments provides validation and insights compared to the previously used simple concatenation
2026-04-28Kernel: T861: add custom VyOS CA to Kernel builds for later module signingChristian Breunig
With this addition we can always sign a Kernel module later and ship it if needed, without re-compiling the Kernel. Kernel will report: [ 1.223891] Loaded X.509 cert 'VyOS Networks Secure Boot Signer 2025 - linux: 6ca57e2add335babd08da69b48c70693edd2b037' Issuer: CN = VyOS Networks Secure Boot CA Validity Not Before: Apr 26 09:07:06 2025 GMT Not After : Apr 24 09:07:06 2035 GMT Subject: CN = VyOS Networks Secure Boot Signer 2025 - linux
2026-04-27linux-kernel: T8496: Add kernel config needed for PWRURobin Christ
PWRU (https://github.com/cilium/pwru) is a very useful tool to debug complex networking issues on Linux, as it allows you to trace how packets travel through the kernel functions
2026-04-03Jool: T8299: upgrade version to 4.1.15Christian Breunig
2026-03-30accel-ppp: T8439: update the commit referenceDaniil Baturin
for the memory corruption vulnerability
2026-03-26Merge pull request #1146 from sever-sever/T8410Christian Breunig
T8410: Fix typos and mistakes in scripts and comments
2026-03-26T8410: Fix typos and mistakes in scripts and commentsViacheslav Hletenko
Fix typos and mistakes in the comments No functional changes
2026-03-25Kernel: T8427: Update Linux Kernel to 6.6.130Christian Breunig
The custom patch "nft_ct: Added nfct_seqadj_ext_add() for DNAT'ed - conntrack." is now available upstream in the Kernel tree.
2026-03-12T8376: Add ARM kernel options for system time udpateViacheslav Hletenko
Add CONFIG_RTC_DRV_EFI, CONFIG_RTC_DRV_PL031 kernel options for system time update
2026-03-12T8377: Update kernel ARM config for Marvell Octeon 10 CN10308Viacheslav Hletenko
Enable several additional kernel modules required for specific hardware platforms. Network: - CONFIG_OCTEONTX2_AF - CONFIG_OCTEONTX2_PF eMMC: - CONFIG_MMC_SDHCI_CADENCE LED: - CONFIG_GPIO_PCA953X - CONFIG_LEDS_PCA955X_GPIO I2C: - CONFIG_I2C_THUNDERX These drivers are built as modules to provide support for Marvell OCTEON TX2 network devices, Cadence SDHCI eMMC controllers, PCA95xx GPIO/LED expanders, and ThunderX I2C controllers.
2026-03-05Kernel: T8345: Update Linux Kernel to 6.6.128Christian Breunig
2026-03-03Kernel: T8332: consolidate WWAN configuration for ARM64 and X86Christian Breunig
Re-use a building block for WWAN support to de-duplicate individual configs for both ARM64 and AMD64/X86.
2026-02-17Kernel: T8134: consolidate common Kernel features for ARM64 and X86Christian Breunig
Both architectures share common Kernel features - place them in single config snippets so we have to maintain them only once. This can for sure be further improved.
2026-02-17Realtek: T8134: update r8152 driver version to 2.21.4Christian Breunig
generated by cgit v1.2.3 (git 2.39.1) at 2026-07-15 02:44:36 +0000