nvidia drivers bump

.github/workflows/portage-stable-packages-list

@@ -744,6 +744,8 @@ virtual/ssh
 virtual/tmpfiles
 virtual/udev
 
+x11-drivers/nvidia-drivers
+
 x11-libs/pixman
 
 x11-misc/makedepend

changelog/security/2025-06-26-nvidia-drivers.md

@@ -0,0 +1 @@
+- nvidia-drivers-service ([CVE-2025-23244](https://www.cve.org/CVERecord?id=CVE-2025-23244))

changelog/updates/2025-06-26-nvidia-drivers.md

@@ -0,0 +1,3 @@
+- base, dev: nvidia-drivers-service (amd64) ([535.247.01](https://docs.nvidia.com/datacenter/tesla/tesla-release-notes-535-247-01/index.html))
+- base, dev: nvidia-drivers-service (arm64) (570.153.02 (includes [570.148.08](https://docs.nvidia.com/datacenter/tesla/tesla-release-notes-570-148-08/index.html), [570.133.20](https://docs.nvidia.com/datacenter/tesla/tesla-release-notes-570-133-20/index.html), [570.124.06](https://docs.nvidia.com/datacenter/tesla/tesla-release-notes-570-124-06/index.html)))
+- sysext-nvidia-drivers-570, sysext-nvidia-drivers-570-open: nvidia-drivers (570.153.02)

sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/make.defaults

@@ -57,9 +57,9 @@ USE="${USE} bindist"
 # linux-fw-redistributable - license for sys-kernel/coreos-firmware
 # freedist - license for sys-kernel/coreos-kernel
 # intel-ucode - license for sys-firmware/intel-microcode
-# NVIDIA-r2 - license for x11-drivers/nvidia-drivers
+# NVIDIA-2023 - license for x11-drivers/nvidia-drivers
 ACCEPT_LICENSE="${ACCEPT_LICENSE} no-source-code
-    linux-fw-redistributable freedist intel-ucode NVIDIA-r2"
+    linux-fw-redistributable freedist intel-ucode NVIDIA-2023"
 
 # Favor our own mirrors over Gentoo's
 GENTOO_MIRRORS="

sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/files/nvidia-390.conf

@@ -1,9 +1,10 @@
 # NVIDIA drivers options
 # See /usr/share/doc/nvidia-drivers-*/README.txt* for more information.
 
-# nvidia-drivers and nouveau cannot be used at same time.
-# Comment out the following line if you wish to allow nouveau.
+# nvidia-drivers and nouveau / nova cannot be used at same time.
+# Comment out the following lines if you wish to allow either.
 blacklist nouveau
+blacklist nova_core
 
 # !!! Security Warning !!!
 # Do not change the DeviceFile options unless you know what you are doing.

sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/files/nvidia-470.conf

@@ -1,9 +1,10 @@
 # NVIDIA drivers options
 # See /usr/share/doc/nvidia-drivers-*/README.txt* for more information.
 
-# nvidia-drivers and nouveau cannot be used at same time.
-# Comment out the following line if you wish to allow nouveau.
+# nvidia-drivers and nouveau / nova cannot be used at same time.
+# Comment out the following lines if you wish to allow either.
 blacklist nouveau
+blacklist nova_core
 
 # Kernel Mode Setting (needed for wayland but is hardly usable with legacy 470)
 # Enabling may possibly cause issues with SLI and Reverse PRIME.

sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/files/nvidia-545.conf

@@ -1,9 +1,10 @@
 # NVIDIA drivers options
 # See /usr/share/doc/nvidia-drivers-*/README.txt* for more information.
 
-# nvidia-drivers and nouveau cannot be used at same time.
-# Comment out the following line if you wish to allow nouveau.
+# nvidia-drivers and nouveau / nova cannot be used at same time.
+# Comment out the following lines if you wish to allow either.
 blacklist nouveau
+blacklist nova_core
 
 # Kernel Mode Setting (notably needed for fbdev and wayland).
 # Enabling may possibly cause issues with SLI and Reverse PRIME.

sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/files/nvidia-570.conf

@@ -1,9 +1,10 @@
 # NVIDIA drivers options
 # See /usr/share/doc/nvidia-drivers-*/README.txt* for more information.
 
-# nvidia-drivers and nouveau cannot be used at same time.
-# Comment out the following line if you wish to allow nouveau.
+# nvidia-drivers and nouveau / nova cannot be used at same time.
+# Comment out the following lines if you wish to allow either.
 blacklist nouveau
+blacklist nova_core
 
 # Kernel Mode Setting (notably needed for fbdev and wayland).
 # Enabling may possibly cause issues with SLI and Reverse PRIME.

sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/files/nvidia-drivers-570.153.02-kernel-6.15.patch

@@ -0,0 +1,71 @@
+Only needed with USE=-kernel-open to avoid GPL-only __vma_start_write,
+not really runtime-tested but at least code does nothing for stable users
+with <6.15..
+
+https://github.com/NVIDIA/open-gpu-kernel-modules/issues/840#issuecomment-2906864735
+https://github.com/CachyOS/kernel-patches/commit/914aea4298e3
+--- a/kernel/nvidia/nv-mmap.c
++++ b/kernel/nvidia/nv-mmap.c
+@@ -24,8 +24,15 @@
+ #define  __NO_VERSION__
+
++#include <linux/version.h>
++
+ #include "os-interface.h"
+ #include "nv-linux.h"
+ #include "nv_speculation_barrier.h"
+
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 15, 0)
++#define nv_vm_flags_set(v, f) vm_flags_reset((v), (v)->vm_flags | (f))
++#define nv_vm_flags_clear(v, f) vm_flags_reset((v), (v)->vm_flags & ~(f))
++#endif
++
+ /*
+  * The 'struct vm_operations' open() callback is called by the Linux
+--- a/kernel/nvidia-drm/nvidia-drm-gem-user-memory.c
++++ b/kernel/nvidia-drm/nvidia-drm-gem-user-memory.c
+@@ -45,4 +45,11 @@
+ #endif
+
++#include <linux/version.h>
++
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 15, 0)
++#define nv_vm_flags_set(v, f) vm_flags_reset((v), (v)->vm_flags | (f))
++#define nv_vm_flags_clear(v, f) vm_flags_reset((v), (v)->vm_flags & ~(f))
++#endif
++
+ static inline
+ void __nv_drm_gem_user_memory_free(struct nv_drm_gem_object *nv_gem)
+--- a/kernel/nvidia-drm/nvidia-drm-gem.c
++++ b/kernel/nvidia-drm/nvidia-drm-gem.c
+@@ -52,4 +52,11 @@
+ #include "nv-mm.h"
+
++#include <linux/version.h>
++
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 15, 0)
++#define nv_vm_flags_set(v, f) vm_flags_reset((v), (v)->vm_flags | (f))
++#define nv_vm_flags_clear(v, f) vm_flags_reset((v), (v)->vm_flags & ~(f))
++#endif
++
+ void nv_drm_gem_free(struct drm_gem_object *gem)
+ {
+--- a/kernel/nvidia-uvm/uvm.c
++++ b/kernel/nvidia-uvm/uvm.c
+@@ -22,4 +22,6 @@
+ *******************************************************************************/
+
++#include <linux/version.h>
++
+ #include "uvm_api.h"
+ #include "uvm_global.h"
+@@ -41,4 +43,9 @@
+ #define NVIDIA_UVM_DEVICE_NAME          "nvidia-uvm"
+
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 15, 0)
++#define nv_vm_flags_set(v, f) vm_flags_reset((v), (v)->vm_flags | (f))
++#define nv_vm_flags_clear(v, f) vm_flags_reset((v), (v)->vm_flags & ~(f))
++#endif
++
+ static dev_t g_uvm_base_dev;
+ static struct cdev g_uvm_cdev;

sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/metadata.xml

@@ -11,10 +11,10 @@
 	</maintainer>
 	<use>
 		<flag name="kernel-open">
-			Use the open source variant of the drivers
-			(Turing/Ampere+ GPUs only, aka GTX 1650+ --
-			recommended with >=560.xx drivers if usable and
-			it may be required for 50xx Blackwell+ GPUs)
+			Use the open source variant of the drivers (only
+			works for Turing/Ampere or newer GPUs, aka GTX 1650+
+			-- recommended with >=560.xx drivers if usable and
+			is *required* for 50xx Blackwell or newer GPUs)
 		</flag>
 		<flag name="persistenced">Install the persistence daemon for keeping devices state when unused (e.g. for headless)</flag>
 		<flag name="powerd">Install the NVIDIA dynamic boost support daemon (only useful with specific laptops, ignore if unsure)</flag>
@@ -30,4 +30,12 @@
 		<remote-id type="github">NVIDIA/nvidia-xconfig</remote-id>
 		<remote-id type="github">NVIDIA/open-gpu-kernel-modules</remote-id>
 	</upstream>
+	<slots>
+		<subslots>
+			Subslot is primarily used to identify branches, at most
+			rebuilding reverse dependencies on bumps would only be
+			for the static library (not essential to) given other
+			headers are provided by nvidia-cuda-toolkit instead.
+		</subslots>
+	</slots>
 </pkgmetadata>

sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-390.157.ebuild

@@ -4,7 +4,7 @@
 EAPI=8
 
 MODULES_OPTIONAL_IUSE=+modules
-inherit desktop eapi9-pipestatus flag-o-matic linux-mod-r1 multilib
+inherit desktop dot-a eapi9-pipestatus flag-o-matic linux-mod-r1 multilib
 inherit readme.gentoo-r1 systemd toolchain-funcs unpacker user-info
 
 MODULES_KERNEL_MAX=6.1
@@ -152,6 +152,8 @@ src_compile() {
 	tc-export AR CC CXX LD OBJCOPY OBJDUMP PKG_CONFIG
 	local -x RAW_LDFLAGS="$(get_abi_LDFLAGS) $(raw-ldflags)" # raw-ldflags.patch
 
+	use static-libs && lto-guarantee-fat
+
 	# dead branch that will never be fixed and due for eventual removal,
 	# so keeping lazy "fixes" (bug #921370)
 	local kcflags=(
@@ -324,6 +326,7 @@ documentation that is installed alongside this README."
 
 	if use static-libs; then
 		dolib.a nvidia-settings/src/libXNVCtrl/libXNVCtrl.a
+		strip-lto-bytecode
 
 		insinto /usr/include/NVCtrl
 		doins nvidia-settings/src/libXNVCtrl/NVCtrl{Lib,}.h

sdk_container/src/third_party/portage-stable/x11-drivers/nvidia-drivers/nvidia-drivers-470.256.02-r2.ebuild

@@ -4,7 +4,7 @@
 EAPI=8
 
 MODULES_OPTIONAL_IUSE=+modules
-inherit desktop eapi9-pipestatus flag-o-matic linux-mod-r1 multilib
+inherit desktop dot-a eapi9-pipestatus flag-o-matic linux-mod-r1 multilib
 inherit readme.gentoo-r1 systemd toolchain-funcs unpacker user-info
 
 MODULES_KERNEL_MAX=6.6
@@ -149,8 +149,8 @@ src_compile() {
 	CC+=" $(test-flags-CC "${kcflags[@]}")"
 	use modules && KERNEL_CC+=" $(CC=${KERNEL_CC} test-flags-CC "${kcflags[@]}")"
 
+	# extra flags for the libXNVCtrl.a static library
 	local xnvflags=-fPIC #840389
-	# lto static libraries tend to cause problems without fat objects
 	tc-is-lto && xnvflags+=" $(test-flags-CC -ffat-lto-objects)"
 
 	NV_ARGS=(
@@ -294,6 +294,7 @@ documentation that is installed alongside this README."
 
 	if use static-libs; then
 		dolib.a nvidia-settings/src/out/libXNVCtrl.a
+		strip-lto-bytecode
 
 		insinto /usr/include/NVCtrl
 		doins nvidia-settings/src/libXNVCtrl/NVCtrl{Lib,}.h