flatcar · sayanchowdhury · May 5, 2026 · May 5, 2026 · Jun 5, 2026 · Jun 18, 2026
@@ -0,0 +1,167 @@
+# Copyright 2026 The Flatcar Container Linux Maintainers
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+COREOS_SOURCE_REVISION=""
+inherit coreos-kernel toolchain-funcs
+
+DESCRIPTION="CoreOS Linux kernel"
+KEYWORDS="amd64 arm64"
+RESTRICT="userpriv" # dracut (via bootengine) needs root
+
+RDEPEND="
+	=sys-kernel/coreos-modules-${PVR}
+	sys-apps/kbd
+"
+BDEPEND="
+	sys-kernel/dracut
+"
+DEPEND="
+	${RDEPEND}
+	${BDEPEND}
+	app-alternatives/awk
+	app-alternatives/gzip
+	app-arch/xz-utils
+	app-arch/zstd
+	app-crypt/clevis
+	app-shells/bash
+	coreos-base/afterburn
+	coreos-base/coreos-init:=
+	net-misc/iputils
+	sys-apps/azure-vm-utils[dracut]
+	sys-apps/baselayout
+	sys-apps/busybox
+	sys-apps/coreutils
+	sys-apps/findutils
+	sys-apps/grep
+	sys-apps/hwdata
+	sys-apps/ignition:=
+	sys-apps/iproute2
+	sys-apps/kexec-tools
+	sys-apps/less
+	sys-apps/nvme-cli
+	sys-apps/sed
+	sys-apps/shadow
+	sys-apps/systemd[cryptsetup]
+	sys-apps/seismograph
+	sys-apps/util-linux[cryptsetup,udev]
+	sys-block/open-iscsi
+	sys-fs/btrfs-progs
+	sys-fs/cryptsetup[udev]
+	sys-fs/e2fsprogs
+	sys-fs/lvm2[udev]
+	sys-fs/mdadm
+	sys-fs/xfsprogs
+	>=sys-kernel/bootengine-0.0.38-r37:=
+	>=sys-kernel/coreos-firmware-20180103-r1:=
+	sys-process/procps
+	virtual/udev
+	amd64? (
+		app-admin/google-guest-configs
+		sys-firmware/intel-microcode:=
+	)
+"
+
+src_prepare() {
+	default
+
+	# KV_OUT_DIR points to the minimal build tree installed by coreos-modules
+	# Pull in the config and public module signing key
+	cp -v "${KV_OUT_DIR}/.config" build/ || die
+	validate_sig_key
+
+	config_update 'CONFIG_INITRAMFS_SOURCE="bootengine.cpio"'
+
+	# include all intel and amd microcode files, avoiding the signatures
+	local fw_dir="${ESYSROOT}/lib/firmware"
+	use amd64 && config_update "CONFIG_EXTRA_FIRMWARE=\"$(find ${fw_dir} -type f \
+		\( -path ${fw_dir}'/intel-ucode/*' -o -path ${fw_dir}'/amd-ucode/*' \) -printf '%P ')\""
+	use amd64 && config_update "CONFIG_EXTRA_FIRMWARE_DIR=\"${fw_dir}\""
+}
+
+src_compile() {
+	local BE_ARGS=()
+
+	if [[ -n ${SYSROOT} ]]; then
+		BE_ARGS+=( -r "${SYSROOT}" )
+		export DRACUT_ARCH="${CHOST%%-*}"
+
+		# We may need to run ldconfig via QEMU, so use the wrapper. Dracut calls
+		# it with -r, which chroots and confuses the sandbox, so calm it down.
+		export DRACUT_LDCONFIG="${CHOST}-ldconfig"
+		local f; for f in /etc/ld.so.cache{,~} /var/cache/ldconfig/aux-cache{,~}; do
+			addwrite "${f}"
+		done
+	fi
+
+	tc-export PKG_CONFIG
+	"${ESYSROOT}"/usr/bin/update-bootengine -k "${KV_FULL}" -o "${S}"/build/bootengine.cpio "${BE_ARGS[@]}" || die
+	# Copy full initrd over to /usr as filesystem image
+	mkdir "${S}"/build/bootengine || die
+	pushd "${S}"/build/bootengine || die
+	lsinitrd --kver SILENCEERROR --unpack "${S}"/build/bootengine.cpio || die
+	mksquashfs . "${S}"/build/bootengine.img -noappend -xattrs-exclude ^btrfs. || die
+	popd || die
+	# No early cpio, drop full initrd
+	> "${S}"/build/bootengine.cpio
+	# Create minimal initrd
+	mkdir "${S}"/build/minimal || die
+	pushd "${S}"/build/minimal || die
+	mkdir -p {etc,dev,proc,sys,dev,usr/bin,usr/lib,usr/lib64,realinit,sysusr/usr} || die
+	ln -s usr/bin bin || die
+	ln -s usr/bin sbin || die
+	ln -s bin usr/sbin || die
+	ln -s usr/lib lib || die
+	ln -s usr/lib64 lib64 || die
+	# Instead from ESYSROOT we can also copy kernel modules from the dracut pre-selection
+	mkdir -p lib/modprobe.d/ || die
+	cp "${S}"/build/bootengine/lib/modprobe.d/* lib/modprobe.d/ || die
+	# Only include modules related to mounting /usr and for interacting with the emergency console
+	pushd "${S}/build/bootengine/usr/lib/modules/${KV_FULL}" || die
+	find kernel/drivers/{ata,block,hid,hv,input/serio,message/fusion,mmc,nvme,pci,scsi,usb} kernel/fs/{btrfs,overlayfs,squashfs} kernel/security/keys -name "*.ko.*" -printf "%f\0" | DRACUT_NO_XATTR=1 xargs --null "${BROOT}"/usr/lib/dracut/dracut-install --destrootdir "${S}"/build/minimal --kerneldir . --sysrootdir "${S}"/build/bootengine/ --firmwaredirs "${S}"/build/bootengine/usr/lib/firmware --module dm-verity dm-mod virtio_console || die
+	popd || die
+	# Double compression only makes the image bigger and slower
+	find . -name "*.ko.xz" -exec unxz {} + || die
+	depmod -a -b . "${KV_FULL}" || die
+	echo '$MODALIAS=.*	0:0 660 @/sbin/modprobe "$MODALIAS"' > ./etc/mdev.conf || die
+	# We can't use busybox's modprobe because it doesn't support the globs in module.alias, breaking module loading
+	DRACUT_NO_XATTR=1 "${BROOT}"/usr/lib/dracut/dracut-install --destrootdir . --sysrootdir "${ESYSROOT}" --ldd /bin/veritysetup /bin/dmsetup /bin/busybox /sbin/modprobe || die
+	cp -a "${ESYSROOT}"/usr/bin/minimal-init ./init || die
+	# Make it easier to debug by not relying too much on the first commands
+	ln -s busybox ./bin/sh || die
+	mknod ./dev/console c 5 1 || die
+	mknod ./dev/null c 1 3 || die
+	mknod ./dev/tty c 5 0 || die
+	mknod ./dev/urandom c 1 9 || die
+	mknod ./dev/random c 1 8 || die
+	mknod ./dev/zero c 1 5 || die
+	# No compression because CONFIG_INITRAMFS_COMPRESSION_XZ should take care of it
+	# (Note: The kernel build system does not support prepending an uncompressed microcode early cpio here)
+	find . -print0 | cpio --null --create --verbose --format=newc >> "${S}"/build/bootengine.cpio || die
+	popd || die
+	kmake "$(kernel_target)"
+
+	# sanity check :)
+	[[ -e build/certs/signing_key.pem ]] && die "created a new key!"
+}
+
+src_install() {
+	# coreos-postinst expects to find the kernel in /usr/boot
+	insinto "/usr/boot"
+	newins "$(kernel_path)" "vmlinuz-${KV_FULL}"
+	dosym "vmlinuz-${KV_FULL}" "/usr/boot/vmlinuz"
+
+	insinto "/usr/lib/modules/${KV_FULL}/build"
+	doins build/System.map
+
+	insinto "/usr/lib/debug/usr/boot"
+	newins build/vmlinux "vmlinux-${KV_FULL}"
+	dosym "../../../boot/vmlinux-${KV_FULL}" "/usr/lib/debug/usr/lib/modules/${KV_FULL}/vmlinux"
+
+	# For easy access to vdso debug symbols in gdb:
+	#   set debug-file-directory /usr/lib/debug/usr/lib/modules/${KV_FULL}/vdso/
+	kmake INSTALL_MOD_PATH="${ED}/usr/lib/debug/usr" vdso_install
+
+	insinto "/usr/lib/flatcar"
+	doins build/bootengine.img
+}
@@ -0,0 +1,63 @@
+# Copyright 2026 The Flatcar Container Linux Maintainers
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+COREOS_SOURCE_REVISION=""
+inherit coreos-kernel savedconfig
+
+DESCRIPTION="CoreOS Linux kernel modules"
+KEYWORDS="amd64 arm64"
+RDEPEND="!<sys-kernel/coreos-kernel-4.6.3-r1"
+
+src_prepare() {
+	default
+	restore_config build/.config
+	if [[ ! -f build/.config ]]; then
+		local archconfig="$(find_archconfig)"
+		local commonconfig="$(find_commonconfig)"
+		elog "Building using config ${archconfig} and ${commonconfig}"
+		cat "${archconfig}" "${commonconfig}" | envsubst '$MODULE_SIGNING_KEY_DIR' >> build/.config || die
+	fi
+	cpio -ov </dev/null >build/bootengine.cpio
+
+	# Check that an old pre-ebuild-split config didn't leak in.
+	grep -q "^CONFIG_INITRAMFS_SOURCE=" build/.config && \
+		die "CONFIG_INITRAMFS_SOURCE must be removed from kernel config"
+	config_update 'CONFIG_INITRAMFS_SOURCE="bootengine.cpio"'
+}
+
+src_compile() {
+	# Generate module signing key
+	setup_keys
+
+	# Build both vmlinux and modules (moddep checks symbols in vmlinux)
+	kmake vmlinux modules
+}
+
+src_install() {
+	local build="lib/modules/${KV_FULL}/build"
+
+	# Install modules to /usr.
+	# Stripping must be done here, not portage, to preserve sigs.
+	kmake INSTALL_MOD_PATH="${ED}/usr" \
+		  INSTALL_MOD_STRIP="--strip-debug" \
+		  modules_install
+
+	# Install to /usr/lib/debug with debug symbols intact
+	kmake INSTALL_MOD_PATH="${ED}/usr/lib/debug/usr" \
+		  modules_install
+	rm "${ED}/usr/lib/debug/usr/lib/modules/${KV_FULL}"/{build,modules.*} || die
+
+	# Replace the broken /lib/modules/${KV_FULL}/build symlink with a copy of
+	# the files needed to build out-of-tree modules.
+	rm "${ED}/usr/${build}" || die
+	kmake run-command KBUILD_RUN_COMMAND="${KERNEL_DIR}/scripts/package/install-extmod-build ${ED}/usr/${build}"
+
+	# Install the original config because the above doesn't.
+	insinto "/usr/${build}"
+	doins build/.config
+
+	# Not strictly required but this is where we used to install the config.
+	dosym "../${build}/.config" "/usr/boot/config-${KV_FULL}"
+	dosym "../${build}/.config" "/usr/boot/config"
+}
@@ -0,0 +1,140 @@
+# CONFIG_ACPI_AC is not set
+CONFIG_ACPI_APEI=y
+CONFIG_ACPI_APEI_ERST_DEBUG=m
+CONFIG_ACPI_APEI_GHES=y
+CONFIG_ACPI_APEI_MEMORY_FAILURE=y
+CONFIG_ACPI_APEI_PCIEAER=y
+# CONFIG_ACPI_BATTERY is not set
+CONFIG_ACPI_BUTTON=m
+CONFIG_ACPI_FAN=m
+CONFIG_ACPI_HOTPLUG_MEMORY=y
+CONFIG_ACPI_IPMI=m
+CONFIG_ACPI_PCI_SLOT=y
+CONFIG_ACPI_PROCESSOR_AGGREGATOR=y
+CONFIG_AMD_IOMMU=y
+CONFIG_AQTION=m
+CONFIG_ARCH_MEMORY_PROBE=y
+CONFIG_AUTOFS_FS=y
+CONFIG_BLK_DEV_IO_TRACE=y
+CONFIG_BOOTPARAM_HARDLOCKUP_PANIC=y
+CONFIG_CMDLINE_BOOL=y
+CONFIG_CONNECTOR=y
+CONFIG_CRASH_DUMP=y
+CONFIG_CRYPTO_AES_NI_INTEL=m
+CONFIG_DCDBAS=m
+CONFIG_DEBUG_BOOT_PARAMS=y
+CONFIG_DELL_RBU=m
+CONFIG_DRM_I915=m
+CONFIG_EDAC_AMD64=m
+CONFIG_EDAC_DECODE_MCE=m
+CONFIG_EDAC_E752X=m
+CONFIG_EDAC_I3000=m
+CONFIG_EDAC_I3200=m
+CONFIG_EDAC_I5100=m
+CONFIG_EDAC_I5400=m
+CONFIG_EDAC_I7300=m
+CONFIG_EDAC_I7CORE=m
+CONFIG_EDAC_I82975X=m
+CONFIG_EDAC_SBRIDGE=m
+CONFIG_EDAC_X38=m
+CONFIG_FB_VESA=y
+CONFIG_FCOE_FNIC=m
+CONFIG_FUNCTION_PROFILER=y
+CONFIG_GART_IOMMU=y
+CONFIG_GVE=m
+CONFIG_HANGCHECK_TIMER=m
+CONFIG_HARDLOCKUP_DETECTOR=y
+CONFIG_HID=m
+CONFIG_HOTPLUG_PCI_ACPI_IBM=m
+CONFIG_HPET=y
+CONFIG_HW_RANDOM_AMD=y
+CONFIG_HW_RANDOM_INTEL=y
+CONFIG_HW_RANDOM_VIA=y
+CONFIG_HYPERVISOR_GUEST=y
+CONFIG_IA32_EMULATION=y
+CONFIG_IGC=m
+CONFIG_INFINIBAND_USER_ACCESS=m
+CONFIG_INFINIBAND_USNIC=m
+CONFIG_INT340X_THERMAL=m
+CONFIG_INTEL_IDLE=y
+CONFIG_INTEL_IOATDMA=y
+CONFIG_INTEL_IOMMU=y
+CONFIG_INTEL_MEI_ME=m
+CONFIG_INTEL_MEI_TXE=m
+CONFIG_INTEL_RAPL=m
+CONFIG_IP_VS_MH=m
+CONFIG_IRQ_REMAP=y
+CONFIG_ISCSI_IBFT=y
+CONFIG_ISCSI_IBFT_FIND=y
+CONFIG_ITCO_VENDOR_SUPPORT=y
+CONFIG_ITCO_WDT=m
+CONFIG_KERNEL_XZ=y
+CONFIG_KEXEC_FILE=y
+CONFIG_KPROBES_ON_FTRACE=y
+CONFIG_KVM=m
+CONFIG_KVM_AMD=m
+CONFIG_KVM_INTEL=m
+CONFIG_MEMORY_FAILURE=y
+CONFIG_MEM_SOFT_DIRTY=y
+CONFIG_MMC_SDHCI_ACPI=m
+# CONFIG_MOUSE_PS2_LIFEBOOK is not set
+CONFIG_MTRR_SANITIZER_ENABLE_DEFAULT=1
+CONFIG_NET_DROP_MONITOR=m
+CONFIG_NVRAM=m
+CONFIG_OPTPROBES=y
+CONFIG_PARAVIRT_SPINLOCKS=y
+CONFIG_PCI_MMCONFIG=y
+CONFIG_PHYSICAL_ALIGN=0x1000000
+CONFIG_PMIC_OPREGION=y
+# CONFIG_PNP_DEBUG_MESSAGES is not set
+CONFIG_POWERCAP=y
+CONFIG_PREEMPT_VOLUNTARY=y
+CONFIG_PTP_1588_CLOCK_VMW=m
+CONFIG_PVPANIC=y
+CONFIG_PVPANIC_MMIO=m
+CONFIG_SCHED_TRACER=y
+CONFIG_SCSI_BUSLOGIC=m
+CONFIG_SCSI_ISCI=m
+CONFIG_SENSORS_CORETEMP=m
+CONFIG_SENSORS_FAM15H_POWER=m
+CONFIG_SENSORS_I5500=m
+CONFIG_SENSORS_K10TEMP=m
+CONFIG_SENSORS_K8TEMP=m
+CONFIG_STACK_TRACER=y
+CONFIG_TCG_INFINEON=m
+CONFIG_TCG_NSC=m
+CONFIG_UPROBE_EVENTS=y
+CONFIG_USB_OHCI_HCD_SSB=y
+CONFIG_VFIO_PCI_IGD=y
+CONFIG_VFIO_PCI_VGA=y
+CONFIG_VHOST_VSOCK=m
+CONFIG_VMWARE_BALLOON=m
+CONFIG_VMWARE_PVSCSI=m
+CONFIG_VMWARE_VMCI=m
+CONFIG_VMWARE_VMCI_VSOCKETS=m
+CONFIG_VMXNET3=m
+# CONFIG_X86_16BIT is not set
+CONFIG_X86_ACPI_CPUFREQ=m
+# CONFIG_X86_ACPI_CPUFREQ_CPB is not set
+CONFIG_X86_AMD_FREQ_SENSITIVITY=m
+CONFIG_X86_AMD_PSTATE=y
+# CONFIG_X86_BOOTPARAM_MEMORY_CORRUPTION_CHECK is not set
+CONFIG_X86_CHECK_BIOS_CORRUPTION=y
+CONFIG_X86_CPUID=m
+# CONFIG_X86_EXTENDED_PLATFORM is not set
+CONFIG_X86_INTEL_LPSS=y
+CONFIG_X86_INTEL_PSTATE=y
+# CONFIG_X86_INTEL_TSX_MODE_OFF is not set
+CONFIG_X86_INTEL_TSX_MODE_ON=y
+# CONFIG_X86_MPPARSE is not set
+CONFIG_X86_MSR=m
+CONFIG_X86_PCC_CPUFREQ=m
+CONFIG_X86_PLATFORM_DRIVERS_DELL=y
+CONFIG_X86_REROUTE_FOR_BROKEN_BOOT_IRQS=y
+CONFIG_X86_X2APIC=y
+CONFIG_XDP_SOCKETS=y
+CONFIG_XEN_BALLOON_MEMORY_HOTPLUG=y
+CONFIG_XEN_DEBUG_FS=y
+CONFIG_XEN_MCE_LOG=y
+CONFIG_XEN_PCIDEV_FRONTEND=m
+CONFIG_XEN_PVH=y