- openSUSE Kernel

Kernel:stable repository
by -pj 14 Jan '25

14 Jan '25

Hi, openSUSE Tumbleweed here. I am interested in installing Kernel:stable via OBS. The reason is for an amdgpu issue I brought up here :< https://bugzilla.suse.com/show_bug.cgi?id=1235668 Following the link here: https://build.opensuse.org/project/show/Kernel:stable Attempt to download repository path for x86_64 results in *error*. Following URL :< https://download.opensuse.org/repositories/Kernel:/stable/QA Shows: Resource is no longer available! The requested URL is no longer available on this server and there is no forwarding address. Please inform the author of the referring page that the link is outdated. If you think this is a server error, please contact the webmaster. Error 404 download.opensuse.org Apache How I can find the correct repository information for OBS Kernel:stable (64 bit machine here), so that I can add the repository? Then I can install kernel 6.12.9 to hopefully circumvent the particular amdgpu bug. -Regards

3 2

Disabling /dev/fb0 on TW
by Thomas Zimmermann 06 Jan '25

06 Jan '25

tl;dr: Disable fbdev userspace interfaces on TW Hi, the upcoming Linux kernel v6.6 will contain the option to disable fbdev userspace interfaces in the kernel configuration. [1] I intent to enable this and thereby switch off /dev/fb0 et al. The tracker bug is boo#1212947. [2] * Why? The old fbdev subsystem is an endless source of bugs. For example, we recently had an out-of-bounds access in the fbdev emulation, where userspace could write beyond the end of the framebuffer memory. [3] Fbdev is under-maintained. I've been doing improvements in recent kernel releases, but only where it benefits the DRM subsystem. Disabling fbdev userspace interfaces will also help weeding out any programs that still contain hard dependencies on them. * What changes? Enabling the new kernel option disables all fbdev userspace interfaces. These are * the device files, such as /dev/fb0 * the sys files under /sys/class/graphics/fb[0-9]+ * /proc/fb * What are the effects on userspace programs? Userspace applications run on the desktop via Wayland or X. There will be no change to them. Xorg and Wayland compositors run on DRM interfaces. A few programs run on SDL, which has no dependency on fbdev either. Any fbdev support in these mid-layer components should be disabled as well. There's one known affected program: TW's text-mode installer can use the tool fbiterm to display CJK symbols during installation. This comes from a time when some low-end systems where not able to boot graphics installation. fbiterm has been unmaintained for >15 years and is ready for retirement. But there's no good drop-in replacement. I propose to simply remove fbiterm and let the graphics installer handle CJK. * What about the framebuffer console? The kernel-provided framebuffer console does not change. The kernel will still show the regular console. Userspace interfaces in /sys/class/graphics/fbcon are still available. For questions and discussion, please comment here or in boo#1212947. Best regards Thomas [1] https://elixir.bootlin.com/linux/v6.6-rc1/source/drivers/video/fbdev/core/K… [2] https://bugzilla.opensuse.org/show_bug.cgi?id=1212947 [3] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -- Thomas Zimmermann Graphics Driver Developer SUSE Software Solutions Germany GmbH Frankenstrasse 146, 90461 Nuernberg, Germany GF: Ivo Totev, Andrew Myers, Andrew McDonald, Boudien Moerman HRB 36809 (AG Nuernberg)

1 2

No lockdown on Secure Boot with kernel:Stable?
by Andrei Borzenkov 17 Dec '24

17 Dec '24

On the very same system Tumbleweed kernel boots with lockdown enabled while kernel-default from kernel:Stable (currently 6.12.4) boots with lockdown disabled. I do not see any difference in options, LOCK_DOWN_IN_EFI_SECURE_BOOT is set in both cases. Is it intentional? What option controls it if not LOCK_DOWN_IN_EFI_SECURE_BOOT?

4 7

Request For Insights On Kernel Security Hardening Practices In openSUSE
by Yinhao Hu 13 Dec '24

13 Dec '24

Dear All, We are academic researchers from Huazhong University of Science and Technology, China. To foster a healthier Linux kernel community and enhance the overall security of Linux distributions, we are conducting a study on kernel security hardening deployments across various Linux distributions. In our research, we analyzed kernel config files and the /proc filesystem by installing and running multiple distribution ISO images. This allowed us to enumerate the default deployment of kernel defense mechanisms at runtime. So far, we have cataloged over 50 kernel security hardening features and documented inconsistencies in their deployment across different distributions. The results of our analysis are accessible via the following link: https://docs.google.com/spreadsheets/d/17QRr04pqK1K4-VoHXW2-9KgPd4uV8Q4I-NN…. Given openSUSE's reputation for exceptional performance and rich features, we conducted a detailed investigation into its kernel security hardening strategies. To further deepen our understanding, we would greatly appreciate your input on the following questions: 1. Effectiveness of Kernel Security Hardening 1.1 Do you consider deploying kernel security hardening features to be an effective strategy for ensuring operating system security? 2. Configuration Strategy for Default Kernel Security Hardening Options 2.1 What are the primary criteria for selecting kernel security hardening options in your distribution? 2.2 How are configurable security hardening features (e.g., unprivileged_bpf_disabled) typically set (e.g., 0, 1, or 2), and what are the main considerations involved? 2.3 How do you balance the trade-off between side-effects (e.g., performance overhead) and the enhanced security introduced by kernel security hardening? 2.4 Does the tolerance for performance overhead vary across different application scenarios? 2.5 Are there other negative factors, such as compatibility issues, that are considered when enabling security hardening features? 3. Customized Configurations 3.1 Do you provide different kernel security hardening configurations tailored to specific user groups? 4. Best Practices and Recommendations 4.1 Are there any best practices or recommendations you can share regarding kernel security hardening? 4.2 Are there relevant documents or materials available for reference? The purpose of these questions is to gain a deeper understanding of your security protection strategies. Your insights would be immensely valuable to our study. Thank you for taking the time to review our questions. We look forward to your response. Best regards, Yinhao Hu, PhD candidate huyinhaodd(a)gmail.com Huazhong University of Science and Technology

1 0

tires
by monkawlac＠proton.me 30 Oct '24

30 Oct '24

Привіт усім. Буду радий порекомендувати вам чудовий сайт де ви зможете придбати якісні шини для вашого авто - https://goroshina.ua/ . НА цьому сайті просто найркащі шини, і чудові ціни на них. Я вже давно корситуюся цим сайтом для покупки шин, і цей сайт мені дуже подобається адже він ніколи мене не підводив.

1 0

Option CONFIG_THERMAL_CORE_TESTING
by Jean Delvare 22 Oct '24

22 Oct '24

Hi Michal, I see that you have set CONFIG_THERMAL_CORE_TESTING=m in all kernel config files when updating to 6.12-rc1. I don't think we need this in default kernels, this is clearly a debugging module. Would it be OK with you (and others) if I disable it in the default flavor and only enable it in the debug flavor? Thanks, -- Jean Delvare SUSE L3 Support

1 0

tumbleweed upstream kernel
by S Kosner 15 Oct '24

15 Oct '24

Hi, It seems tumbleweed does not (normally) use a pure upstream kernel, as kernel-default includes patches. Although, is kernel-vanilla pure upstream like it sounds (albeit maybe compiled with custom options)? Thanks

4 8

Kernel 6.11
by Frank Krüger 19 Sep '24

19 Sep '24

Hi there, Is there any chance to see version 6.11 in Kernel:stable soon? Thank you! Regards, Frank

1 0

[opensuse-kernel] kernel-default-base-2.6.29-5.2.x86_64 rpm errors
by Dave Plater 18 Jul '24

18 Jul '24

Hi, I'm busy updating to the latest factory kernel and have received the following errors from kernel-default-base installation (I did insert a blank dvd during the installation of the rpm by zypper):- WARNING: /lib/modules/2.6.29-rc8-5-default/kernel/drivers/scsi/sd_mod.ko needs unknown symbol crc_t10dif WARNING: /lib/modules/2.6.29-rc8-5-default/kernel/drivers/scsi/sr_mod.ko needs unknown symbol register_cdrom WARNING: /lib/modules/2.6.29-rc8-5-default/kernel/drivers/scsi/sr_mod.ko needs unknown symbol cdrom_ioctl WARNING: /lib/modules/2.6.29-rc8-5-default/kernel/drivers/scsi/sr_mod.ko needs unknown symbol cdrom_media_changed WARNING: /lib/modules/2.6.29-rc8-5-default/kernel/drivers/scsi/sr_mod.ko needs unknown symbol cdrom_get_media_event WARNING: /lib/modules/2.6.29-rc8-5-default/kernel/drivers/scsi/sr_mod.ko needs unknown symbol cdrom_release WARNING: /lib/modules/2.6.29-rc8-5-default/kernel/drivers/scsi/sr_mod.ko needs unknown symbol cdrom_open WARNING: /lib/modules/2.6.29-rc8-5-default/kernel/drivers/scsi/sr_mod.ko needs unknown symbol unregister_cdrom WARNING: /lib/modules/2.6.29-rc8-5-default/kernel/drivers/scsi/sr_mod.ko needs unknown symbol cdrom_number_of_slots And then these errors which I think IIRC happened before when the kernel was first split into three:- Kernel image: /boot/vmlinuz-2.6.29-rc8-5-default Initrd image: /boot/initrd-2.6.29-rc8-5-default Root device: /dev/disk/by-id/ata-WDC_WD800JB-00JJC0_WD-WMAM9RA78067-part3 (/dev/sda3) (mounted on / as xfs) Resume device: /dev/disk/by-id/ata-WDC_WD800JB-00JJC0_WD-WMAM9RA78067-part2 (/dev/sda2) FATAL: Module processor not found. WARNING: no dependencies for kernel module 'processor' found. FATAL: Module thermal not found. WARNING: no dependencies for kernel module 'thermal' found. FATAL: Module ata_generic not found. WARNING: no dependencies for kernel module 'ata_generic' found. FATAL: Module piix not found. WARNING: no dependencies for kernel module 'piix' found. FATAL: Module ide_pci_generic not found. WARNING: no dependencies for kernel module 'ide_pci_generic' found. FATAL: Module fan not found. WARNING: no dependencies for kernel module 'fan' found. FATAL: Module xfs not found. WARNING: no dependencies for kernel module 'xfs' found. FATAL: Module usbhid not found. WARNING: no dependencies for kernel module 'usbhid' found. Kernel Modules: scsi_mod libata ata_piix edd ahci sd_mod usbcore ohci-hcd ehci-hcd uhci-hcd WARNING: /dev/shm/mkinitramfs.0drQsZ/mnt/lib/modules/2.6.29-rc8-5-default/kernel/drivers/scsi/sd_mod.ko needs unknown symbol crc_t10dif Features: block usb resume.userspace resume.kernel Bootsplash: openSUSE (1280x1024) 22669 blocks Should I open a bug report about the errors which are possibly from inserting a dvd while the kernel rpm was installing? Regards Dave P -- To unsubscribe, e-mail: opensuse-kernel+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-kernel+help(a)opensuse.org

2 2

How to maintain kernel-source packages on OBS?
by Shung-Hsi Yu 27 Jun '24

27 Jun '24

Hi, I'm looking into maintaining a kernel based on out-of-tree patchset[1] on the openSUSE's build service (OBS) with Fredrik. While I work with kernel-source regularly, I have no idea on the process or publish/release the kernel. From the openSUSE:Kernel git[2] documentation and my understanding it goes down to: git clone https://github.com/openSUSE/kernel-source/ cd kernel-source git checkout $BRANCH # stable or master # Do some work here ... # Create source package scripts/tar-up.sh # Upload to OBS, need --enable-debug here otherwise BTF won't be # available scripts/osc_wrapper upload --enable-debug $PROJECT Once built, user should be able add the OBS repo, and install the kernel package I suppose? Or is there any additional that has to be done on the OBS project? Also there's two kernel branch I'd be working with: scx-kernel-releases[3] which is based on the latest stable, and sched_ext[4] which is based on bpf-next[5]. And it would be great to have suggestion on how to maintain them in practice within kernel-source. Since scx-kernel-releases is based on stable, it seems rather straight forward to maintain. I'd fork from the kernel-source's stable branch, add another directory (patches.sched-ext perhaps), add the patches there, modify series.conf to include the sched-ext patches so they are applied, and update the kernel configuration in config/ accordingly. After that it should be mostly just merging from kernel-source's stable as it changes, I hope. On the other hand sched_ext being based on the development branch bpf-next seems a bit more daunting. I could base off of kernel-source's master, but then I had to take all the patches in bpf-next[5] (which includes netdev/net-next[6]) in addition to sched-ext ones, and bpf-next could change rather often. Is there a better way to do this? Could I simply grab a tarball from the sched_ext GitHub repository[4] and use it instead? Or maybe it's just not worth the effort? Feedbacks, suggestions, and pros & cons are all welcome. Thanks, Shung-Hsi Yu 1: https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/message… 2: https://en.opensuse.org/openSUSE:Kernel_git#Using_the_kernel-source_reposit… 3: https://github.com/sched-ext/scx-kernel-releases 4: https://github.com/sched-ext/sched_ext 5: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/log/?h=for… 6: https://kernel.googlesource.com/pub/scm/linux/kernel/git/netdev/net-next/

7 10