kernel January 2024

kernel@lists.fedoraproject.org

5 participants
85 discussions

[OS-BUILD PATCH 0/2] random: Add hook to override device reads and getrandom(2)
by Herbert Xu (via Email Bridge) 12 Feb '25

12 Feb '25

From: Herbert Xu on gitlab.com Merge Request: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2757 Upstream Status: RHEL only Restore the changes to /dev/random which were reverted after 5.18. This reverts commit 900f11e054896bae7b0146055698656e3d1e20a6 and 297bcb88233101e8d5062729ff3a5f989bad1c3b. This also brings the code up-to-date with respect to centos-stream commit 9de3a7339793d3c516b9305a8854267156f90c53 so that changes that were made after the kernel-ark revert have been brought in. Signed-off-by: Herbert Xu <herbert.xu(a)redhat.com> --- crypto/drbg.c | 18 ++++- crypto/rng.c | 149 +++++++++++++++++++++++++++++++++++++++++++----- drivers/char/random.c | 122 ++++++++++++++++++++++++++++++++++++++++ include/linux/crypto.h | 1 + include/linux/random.h | 10 +++ 5 files changed, 281 insertions(+), 19 deletions(-)

5 8

[OS-BUILD PATCHv3 0/0] random: Override random with FIPS RNG in FIPS mode
by Herbert Xu (via Email Bridge) 30 Jan '25

30 Jan '25

From: Herbert Xu on gitlab.com Merge Request: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1304 NOTE: Truncated patchset since committer email 'herbert(a)gondor.apana.org.au' does not match the submitter's GitLab public email address 'herbert.xu(a)redhat.com'. Upstream: RHEL only Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1984784 The RHEL FIPS certification effort ran into an show-stopper with /dev/urandom and getrandom(2) not being FIPS-compliant. At this point there is no realistic chance of making them FIPS-compliant upstream. It has also been deemed unrealistic to change user-space to use the FIPS-compliant RNG through the Crypto API. Therefore this patch series overrides /dev/*random as well as getrandom(2) with the Crypto API RNG so that FIPS certification can proceed. Signed-off-by: Herbert Xu <herbert.xu(a)redhat.com> --- crypto/rng.c | 73 ++++++++++++++++++++++++++++++- drivers/char/random.c | 115 +++++++++++++++++++++++++++++++++++++++++++++++++ include/linux/random.h | 7 ++ 3 files changed, 194 insertions(+), 1 deletions(-)

3 5

[OS-BUILD PATCH] Add wildcard macros -baseonly -gcov
by Don Zickus (via Email Bridge) 18 Sep '24

18 Sep '24

From: Don Zickus <dzickus(a)redhat.com> Add wildcard macros -baseonly -gcov There are multiple usecases for -baseonly and -gcov on various targets in the Makefile. Instead of calling those targets out repeatedly, lets generalize them a bit. Allow adding -baseonly and -gcov to: dist-rpm dist-srpm dist-brew dist-koji distg-brew distg-koji Gcov is useful for adding code coverage. Baseonly is useful to only build the kernel for debugging purposes without userspace tools. Signed-off-by: Don Zickus <dzickus(a)redhat.com> diff --git a/redhat/Makefile b/redhat/Makefile index blahblah..blahblah 100644 --- a/redhat/Makefile +++ b/redhat/Makefile @@ -297,6 +297,12 @@ dist-sources: dist-kabi dist-kabi-dup sources-rh dist-test-patch: generate-testpatch-tmp @mv $(TESTPATCH).tmp $(TESTPATCH); +%-baseonly: RPMBUILDOPTS=--target $(MACH) --without debug --without debuginfo --without vdso_install --without bpftool --without perf --without tools --without selftests -bb +%-baseonly: BUILDOPTS+=-debug -debuginfo -vdso_install -bpftool -perf -tools -selftests + +%-gcov: BUILDID=".gcov" +%-gcov: BUILDOPTS+="+gcov" + do-rpmbuild: dist-sources $(RPMBUILD) --define "_sourcedir $(SOURCES)" --define "_builddir $(RPM)/BUILD" --define "_srcrpmdir $(RPM)/SRPMS" --define "_rpmdir $(RPM)/RPMS" --define "_specdir $(RPM)/SPECS" --define "dist $(DIST)" $(RPMBUILDOPTS) $(RPM)/SOURCES/$(PACKAGE_NAME).spec @@ -306,9 +312,9 @@ dist-all-rpms: dist-sources do-rpmbuild dist-srpm: RPMBUILDOPTS=--nodeps -bs dist-srpm: dist-sources do-rpmbuild -dist-srpm-gcov: BUILDID=".gcov" -dist-srpm-gcov: BUILDOPTS+="+gcov" -dist-srpm-gcov: dist-srpm +dist-srpm-%: dist-srpm + @# phony command to force this to be a target and not variable + @FOO=BAR dist-rpms: RPMBUILDOPTS=--target $(MACH) -bb dist-rpms: dist-sources do-rpmbuild @@ -322,8 +328,7 @@ dist-prep: dist-sources do-rpmbuild dist-perf: RPMBUILDOPTS=--without up --without smp --without zfcpdump --without debug --without doc --without headers --without --without doc --without debuginfo --target $(MACH) -bb dist-perf: dist-sources do-rpmbuild -dist-rpm-baseonly: RPMBUILDOPTS=--target $(MACH) --without debug --without debuginfo --without vdso_install --without bpftool --without perf --without tools -bb -dist-rpm-baseonly: dist-sources do-rpmbuild +dist-rpm-%: dist-sources do-rpmbuild # unless you know what you're doing, you don't want to use the next four ones dist-release-finish: setup-source @@ -388,9 +393,25 @@ distg-koji: BUILD_FLAGS ?= $(KOJI_FLAGS) $(TEST_FLAGS) dist-brew dist-koji: dist-%: dist-srpm $* $(BUILD_PROFILE) build $(BUILD_FLAGS) $(BUILD_TARGET) $(SRPMS)/$(PACKAGE_NAME)-$(KVERSION)-$(PKGRELEASE)$(DIST).src.rpm $(OUTPUT_FILE) +dist-brew-%: dist-brew + @# phony command to force this to be a target and not variable + @FOO=BAR + +dist-koji-%: dist-koji + @# phony command to force this to be a target and not variable + @FOO=BAR + distg-brew distg-koji: distg-%: $* $(BUILD_PROFILE) build $(BUILD_FLAGS) $(BUILD_TARGET) "$(RHGITURL)?redhat/koji#$(RHGITCOMMIT)" +distg-brew-%: dist-brew + @# phony command to force this to be a target and not variable + @FOO=BAR + +distg-koji-%: dist-koji + @# phony command to force this to be a target and not variable + @FOO=BAR + .PHONY: $(REDHAT)/rpm/SOURCES/$(PACKAGE_NAME).spec $(REDHAT)/rpm/SOURCES/$(PACKAGE_NAME).spec: @echo "dist-sources" @@ -469,34 +490,30 @@ dist-full-help: @echo 'Building targets:' @echo ' All RPM/SRPM files will be put under the redhat/rpm/ directory.' @echo '' - @echo ' dist-srpm - Create a source RPM and put it into the redhat/rpm/SRPMS/' + @echo ' dist-srpm@ - Create a source RPM and put it into the redhat/rpm/SRPMS/' @echo ' directory. See the dist-brew target for available options.' - @echo ' dist-srpm-gcov - Create a source RPM with gcov enabled and put it into the' - @echo ' redhat/rpm/SRPMS/ directory.' - @echo ' dist-brew - Create a kernel SRPM and then call brew to build the' + @echo ' dist-brew@ - Create a kernel SRPM and then call brew to build the' @echo ' created SRPM. Add BUILDOPTS="+<opt> -<opt> [...]" to' @echo ' enable/disable build options.' @echo ' Available <opt>s and their default values:' \ $$(sed -n -e 's/^%define with_$[^ \t]*$.*\?_without_.*/+\1/p' \ -e 's/^%define with_$[^ \t]*$.*\?_with_.*/-\1/p' kernel.spec.template | \ grep -v 'only$$') | fmt -80 - @echo ' dist-koji - Create a kernel SRPM and then call koji to build the' + @echo ' dist-koji@ - Create a kernel SRPM and then call koji to build the' @echo ' created SRPM. See the dist-brew target for available' @echo ' options.' - @echo ' distg-brew - Pass HEAD of the current git branch to brew to build an' + @echo ' distg-brew@ - Pass HEAD of the current git branch to brew to build an' @echo ' RPM set. Do not forget to push to the remote repository' @echo ' first. Preceed make command by RHGITCOMMIT=<commitID>' @echo ' specify commit ID to use.' @echo ' To set the remote repo, invoke:' @echo ' git config rhg.url git://<repo_path>' - @echo ' distg-koji - Pass HEAD of the current git branch to koji to build an' + @echo ' distg-koji@ - Pass HEAD of the current git branch to koji to build an' @echo ' RPM set. Do not forget to push to the remote repository' @echo ' first. See the distg-brew target for options and' @echo ' configuration.' - @echo ' dist-rpms - Create the binary RPMS for the kernel.' + @echo ' dist-rpms@ - Create the binary RPMS for the kernel.' @echo ' See the dist-brew target for available options.' - @echo ' dist-rpm-baseonly - Create the binary RPMS for the kernel and modules' - @echo ' (no userspace tools or debuginfo).' @echo ' dist-kernel-<type> - Create binary RPMS for a particular kernel type.' @echo ' Available <type>s:'\ $$(sed -n 's/^%define with_$[^ ]*only$.*/\1/p' kernel.spec.template) @@ -524,6 +541,12 @@ dist-full-help: @echo ' dist-rhel-configs - build ELN configs' @echo ' dist-fedora-configs - build Fedora configs' + @echo '' + @echo 'Wildcard targets: [indicated by '@' above]' + @echo ' *-baseonly - builds only the kernel (disables userspace and debuginfo)' + @echo ' - Examples: dist-srpm-baseonly, dist-brew-baseonly' + @echo ' *-gcov - builds a kernel with gcov enabled' + @echo ' - Examples: dist-srpm-gcov, dist-brew-gcov' @echo '' @echo 'kABI targets:' @echo ' dist-kabi - Create kABI stablelist files in redhat/kabi/kabi-rhel*/' -- https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1444

3 2

[OS-BUILD PATCHv2] Fix binutils breakage
by Don Zickus (via Email Bridge) 15 Aug '24

15 Aug '24

From: Don Zickus <dzickus(a)redhat.com> Fix binutils breakage The binutils package in Rawhide has stricter checks about PIE/PIC code and will start reporting errors if it detects mixing and matching no-PIE with PIE binaries (especially around bpf binaries). Example errors look like: /usr/bin/ld: /tmp/ccL7dkfR.o: relocation R_X86_64_32S against `.rodata' can not be used when making a PIE object; recompile with -fPIE /usr/bin/ld: failed to set dynamic section sizes: bad value collect2: error: ld returned 1 exit status Fix this by adding more CFLAGS to force PIE/PIC generated binaries to bpf releated selftests, tools and samples. This patch was provided by Carlos O'Donell and understands how it works. I am just the middle man. All -fPIE errors are resolved except for one about libbpf.a. The static version of the library doesn't take CFLAGS so it can't be forced to build with PIE/PIC. This error is ignored by the spec file, so it is ignored by this patch too. Signed-off-by: Don Zickus <dzickus(a)redhat.com> diff --git a/redhat/kernel.spec.template b/redhat/kernel.spec.template index blahblah..blahblah 100644 --- a/redhat/kernel.spec.template +++ b/redhat/kernel.spec.template @@ -2769,7 +2769,7 @@ if [ ! -f include/generated/autoconf.h ]; then %{make} %{?_smp_mflags} modules_prepare fi -%{make} %{?_smp_mflags} ARCH=$Arch V=1 M=samples/bpf/ VMLINUX_H="${RPM_VMLINUX_H}" || true +%{make} %{?_smp_mflags} TPROGS_USER_CFLAGS="%{?build_hostcflags}" TPROGS_USER_LDFLAGS="%{?build_hostldflags}" EXTRA_CFLAGS="%{?build_hostcflags}" EXTRA_LDFLAGS="%{?build_hostldflags}" ARCH=$Arch V=1 M=samples/bpf/ VMLINUX_H="${RPM_VMLINUX_H}" || true # Prevent bpf selftests to build bpftool repeatedly: export BPFTOOL=$(pwd)/tools/bpf/bpftool/bpftool @@ -2783,7 +2783,7 @@ pushd tools/testing/selftests force_targets="" %endif -%{make} %{?_smp_mflags} ARCH=$Arch V=1 TARGETS="bpf mm livepatch net net/forwarding net/mptcp netfilter tc-testing memfd drivers/net/bonding" SKIP_TARGETS="" $force_targets INSTALL_PATH=%{buildroot}%{_libexecdir}/kselftests VMLINUX_H="${RPM_VMLINUX_H}" install +%{make} %{?_smp_mflags} USERCFLAGS="%{?build_hostcflags}" USERLDFLAGS="%{?build_hostldflags}" ARCH=$Arch V=1 TARGETS="bpf mm livepatch net net/forwarding net/mptcp netfilter tc-testing memfd drivers/net/bonding" SKIP_TARGETS="" $force_targets INSTALL_PATH=%{buildroot}%{_libexecdir}/kselftests VMLINUX_H="${RPM_VMLINUX_H}" install # 'make install' for bpf is broken and upstream refuses to fix it. # Install the needed files manually. -- https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2749

4 6

[OS-BUILD PATCHv2 0/6] secure boot signing updates
by Jan Stancek (via Email Bridge) 02 Apr '24

02 Apr '24

From: Jan Stancek on gitlab.com Merge Request: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2849 Forward port secure boot signing changes from c9s to ARK. eln scratch: https://koji.fedoraproject.org/koji/taskinfo?taskID=111509830 rawhide scratch: https://koji.fedoraproject.org/koji/taskinfo?taskID=111494146 Signed-off-by: Jan Stancek <jstancek(a)redhat.com> --- redhat/keys/redhatsecureboot003.cer | Bin redhat/keys/redhatsecureboot301.cer | Bin redhat/keys/redhatsecureboot401.cer | Bin redhat/keys/redhatsecurebootca1.cer | Bin redhat/keys/redhatsecurebootca2.cer | Bin redhat/keys/redhatsecurebootca4.cer | Bin redhat/keys/secureboot_ppc.cer | Bin redhat/keys/secureboot_s390.cer | Bin redhat/Makefile | 7 +- redhat/kernel.spec.template | 113 +++++++++++++++-------------------- 10 files changed, 51 insertions(+), 69 deletions(-)

2 9

[OS-BUILD PATCHv3 0/5] Add libperf packages and build kernel tools for Fedora
by Justin M. Forbes (via Email Bridge) 02 Feb '24

02 Feb '24

From: Justin M. Forbes on gitlab.com Merge Request: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2907 When kernel-tools was split out to a separate package in Fedora, it was due to several factors. Most of those issues have been mitigated in other ways, and there are advantages to building tools with the kernel build. Let's turn on tools for Fedora. To do so, we need to add the libperf packages, but this enables them for Fedora only. It is worth noting that the Fedora package for bpftool will retain the upstream kernel versioning. This is because the bpftool versioning scheme is incompatible with the stable Fedora process. --- redhat/kernel.spec.template | 78 ++++++++++++++++++++++++++++++++++++++++++-- 1 files changed, 74 insertions(+), 4 deletions(-)

3 7

[OS-BUILD PATCHv5 0/2] spec: use jsut-built bpftool for vmlinux.h generation
by Artem Savkov (via Email Bridge) 02 Feb '24

02 Feb '24

From: Artem Savkov on gitlab.com Merge Request: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2884 Forwardport from rhel9. Bugzilla: http://bugzilla.redhat.com/2120968 Upstream status: RHEL-only With the latest toolchain update build fails due to libbpf missing btf enum64 support. 5.19 update contains libbpf update but the spec uses buildroot's (old) bpftool. Switch to use the just-built bpftool. The snippet cannot be moved below bpftool build since vmlinux.h is needed to build_tools. Credits to Felix Maurer <fmaurer(a)redhat.com> Signed-off-by: Yauheni Kaliuta <ykaliuta(a)redhat.com> --- redhat/kernel.spec.template | 11 ++++++----- 1 files changed, 6 insertions(+), 5 deletions(-)

2 3

[OS-BUILD PATCH] configs: make CONFIG_EDAC_GHES a module
by Aristeu Rozanski (via Email Bridge) 31 Jan '24

31 Jan '24

From: Aristeu Rozanski <arozansk(a)redhat.com> configs: make CONFIG_EDAC_GHES a module Since 802e7f1dfed7cc7fb309995e0c4138f08977fdfc it's possible to build ghes_edac as module and this is useful for customers that want to unload it during runtime. Signed-off-by: Aristeu Rozanski <arozansk(a)redhat.com> diff --git a/redhat/configs/common/generic/CONFIG_EDAC_GHES b/redhat/configs/fedora/generic/CONFIG_EDAC_GHES rename from redhat/configs/common/generic/CONFIG_EDAC_GHES rename to redhat/configs/fedora/generic/CONFIG_EDAC_GHES index blahblah..blahblah 100644 --- a/redhat/configs/common/generic/CONFIG_EDAC_GHES +++ b/redhat/configs/fedora/generic/CONFIG_EDAC_GHES diff --git a/redhat/configs/rhel/generic/CONFIG_EDAC_GHES b/redhat/configs/rhel/generic/CONFIG_EDAC_GHES new file mode 100644 index blahblah..blahblah 100644 --- /dev/null +++ b/redhat/configs/rhel/generic/CONFIG_EDAC_GHES @@ -0,0 +1 @@ +CONFIG_EDAC_GHES=m -- https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2914

2 3

[OS-BUILD PATCH] gitlab-ci: enable native tools for Rawhide CI
by Michael Hofmann (via Email Bridge) 31 Jan '24

31 Jan '24

From: Michael Hofmann <mhofmann(a)redhat.com> gitlab-ci: enable native tools for Rawhide CI With [1], the kernel tools build are built from the kernel package. Enable them in the CI pipelines as well. [1] https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2907 Signed-off-by: Michael Hofmann <mhofmann(a)redhat.com> diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index blahblah..blahblah 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -95,6 +95,7 @@ workflow: variables: name: rawhide-ark builder_image: quay.io/cki/builder-rawhide + native_tools: 'true' kpet_tree_name: rawhide .trigger_eln: -- https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2915

1 0

[OS-BUILD PATCHv2 0/4] Add libperf packages and build kernel tools for Fedora
by Justin M. Forbes (via Email Bridge) 30 Jan '24

30 Jan '24

From: Justin M. Forbes on gitlab.com Merge Request: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2907 When kernel-tools was split out to a separate package in Fedora, it was due to several factors. Most of those issues have been mitigated in other ways, and there are advantages to building tools with the kernel build. Let's turn on tools for Fedora. To do so, we need to add the libperf packages, but this enables them for Fedora only. It is worth noting that the Fedora package for bpftool will retain the upstream kernel versioning. This is because the bpftool versioning scheme is incompatible with the stable Fedora process. --- redhat/kernel.spec.template | 81 +++++++++++++++++++++++++++++++++++++++++++- 1 files changed, 78 insertions(+), 3 deletions(-)

3 45

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

kernel January 2024