From: Herbert Xu on gitlab.com
Merge Request: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1304
NOTE: Truncated patchset since committer email 'herbert(a)gondor.apana.org.au'
does not match the submitter's GitLab public email address
'herbert.xu(a)redhat.com'.
Upstream: RHEL only
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1984784
The RHEL FIPS certification effort ran into an show-stopper with
/dev/urandom and getrandom(2) not being FIPS-compliant. At this
point there is no realistic chance of making them FIPS-compliant
upstream. It has also been deemed unrealistic to change user-space
to use the FIPS-compliant RNG through the Crypto API.
Therefore this patch series overrides /dev/*random as well as
getrandom(2) with the Crypto API RNG so that FIPS certification
can proceed.
Signed-off-by: Herbert Xu <herbert.xu(a)redhat.com>
---
crypto/rng.c | 73 ++++++++++++++++++++++++++++++-
drivers/char/random.c | 115 +++++++++++++++++++++++++++++++++++++++++++++++++
include/linux/random.h | 7 ++
3 files changed, 194 insertions(+), 1 deletions(-)
From: Don Zickus <dzickus(a)redhat.com>
Add wildcard macros -baseonly -gcov
There are multiple usecases for -baseonly and -gcov on various
targets in the Makefile. Instead of calling those targets out
repeatedly, lets generalize them a bit.
Allow adding -baseonly and -gcov to:
dist-rpm
dist-srpm
dist-brew
dist-koji
distg-brew
distg-koji
Gcov is useful for adding code coverage. Baseonly is useful to only
build the kernel for debugging purposes without userspace tools.
Signed-off-by: Don Zickus <dzickus(a)redhat.com>
diff --git a/redhat/Makefile b/redhat/Makefile
index blahblah..blahblah 100644
--- a/redhat/Makefile
+++ b/redhat/Makefile
@@ -297,6 +297,12 @@ dist-sources: dist-kabi dist-kabi-dup sources-rh
dist-test-patch: generate-testpatch-tmp
@mv $(TESTPATCH).tmp $(TESTPATCH);
+%-baseonly: RPMBUILDOPTS=--target $(MACH) --without debug --without debuginfo --without vdso_install --without bpftool --without perf --without tools --without selftests -bb
+%-baseonly: BUILDOPTS+=-debug -debuginfo -vdso_install -bpftool -perf -tools -selftests
+
+%-gcov: BUILDID=".gcov"
+%-gcov: BUILDOPTS+="+gcov"
+
do-rpmbuild: dist-sources
$(RPMBUILD) --define "_sourcedir $(SOURCES)" --define "_builddir $(RPM)/BUILD" --define "_srcrpmdir $(RPM)/SRPMS" --define "_rpmdir $(RPM)/RPMS" --define "_specdir $(RPM)/SPECS" --define "dist $(DIST)" $(RPMBUILDOPTS) $(RPM)/SOURCES/$(PACKAGE_NAME).spec
@@ -306,9 +312,9 @@ dist-all-rpms: dist-sources do-rpmbuild
dist-srpm: RPMBUILDOPTS=--nodeps -bs
dist-srpm: dist-sources do-rpmbuild
-dist-srpm-gcov: BUILDID=".gcov"
-dist-srpm-gcov: BUILDOPTS+="+gcov"
-dist-srpm-gcov: dist-srpm
+dist-srpm-%: dist-srpm
+ @# phony command to force this to be a target and not variable
+ @FOO=BAR
dist-rpms: RPMBUILDOPTS=--target $(MACH) -bb
dist-rpms: dist-sources do-rpmbuild
@@ -322,8 +328,7 @@ dist-prep: dist-sources do-rpmbuild
dist-perf: RPMBUILDOPTS=--without up --without smp --without zfcpdump --without debug --without doc --without headers --without --without doc --without debuginfo --target $(MACH) -bb
dist-perf: dist-sources do-rpmbuild
-dist-rpm-baseonly: RPMBUILDOPTS=--target $(MACH) --without debug --without debuginfo --without vdso_install --without bpftool --without perf --without tools -bb
-dist-rpm-baseonly: dist-sources do-rpmbuild
+dist-rpm-%: dist-sources do-rpmbuild
# unless you know what you're doing, you don't want to use the next four ones
dist-release-finish: setup-source
@@ -388,9 +393,25 @@ distg-koji: BUILD_FLAGS ?= $(KOJI_FLAGS) $(TEST_FLAGS)
dist-brew dist-koji: dist-%: dist-srpm
$* $(BUILD_PROFILE) build $(BUILD_FLAGS) $(BUILD_TARGET) $(SRPMS)/$(PACKAGE_NAME)-$(KVERSION)-$(PKGRELEASE)$(DIST).src.rpm $(OUTPUT_FILE)
+dist-brew-%: dist-brew
+ @# phony command to force this to be a target and not variable
+ @FOO=BAR
+
+dist-koji-%: dist-koji
+ @# phony command to force this to be a target and not variable
+ @FOO=BAR
+
distg-brew distg-koji: distg-%:
$* $(BUILD_PROFILE) build $(BUILD_FLAGS) $(BUILD_TARGET) "$(RHGITURL)?redhat/koji#$(RHGITCOMMIT)"
+distg-brew-%: dist-brew
+ @# phony command to force this to be a target and not variable
+ @FOO=BAR
+
+distg-koji-%: dist-koji
+ @# phony command to force this to be a target and not variable
+ @FOO=BAR
+
.PHONY: $(REDHAT)/rpm/SOURCES/$(PACKAGE_NAME).spec
$(REDHAT)/rpm/SOURCES/$(PACKAGE_NAME).spec:
@echo "dist-sources"
@@ -469,34 +490,30 @@ dist-full-help:
@echo 'Building targets:'
@echo ' All RPM/SRPM files will be put under the redhat/rpm/ directory.'
@echo ''
- @echo ' dist-srpm - Create a source RPM and put it into the redhat/rpm/SRPMS/'
+ @echo ' dist-srpm@ - Create a source RPM and put it into the redhat/rpm/SRPMS/'
@echo ' directory. See the dist-brew target for available options.'
- @echo ' dist-srpm-gcov - Create a source RPM with gcov enabled and put it into the'
- @echo ' redhat/rpm/SRPMS/ directory.'
- @echo ' dist-brew - Create a kernel SRPM and then call brew to build the'
+ @echo ' dist-brew@ - Create a kernel SRPM and then call brew to build the'
@echo ' created SRPM. Add BUILDOPTS="+<opt> -<opt> [...]" to'
@echo ' enable/disable build options.'
@echo ' Available <opt>s and their default values:' \
$$(sed -n -e 's/^%define with_\([^ \t]*\).*\?_without_.*/+\1/p' \
-e 's/^%define with_\([^ \t]*\).*\?_with_.*/-\1/p' kernel.spec.template | \
grep -v 'only$$') | fmt -80
- @echo ' dist-koji - Create a kernel SRPM and then call koji to build the'
+ @echo ' dist-koji@ - Create a kernel SRPM and then call koji to build the'
@echo ' created SRPM. See the dist-brew target for available'
@echo ' options.'
- @echo ' distg-brew - Pass HEAD of the current git branch to brew to build an'
+ @echo ' distg-brew@ - Pass HEAD of the current git branch to brew to build an'
@echo ' RPM set. Do not forget to push to the remote repository'
@echo ' first. Preceed make command by RHGITCOMMIT=<commitID>'
@echo ' specify commit ID to use.'
@echo ' To set the remote repo, invoke:'
@echo ' git config rhg.url git://<repo_path>'
- @echo ' distg-koji - Pass HEAD of the current git branch to koji to build an'
+ @echo ' distg-koji@ - Pass HEAD of the current git branch to koji to build an'
@echo ' RPM set. Do not forget to push to the remote repository'
@echo ' first. See the distg-brew target for options and'
@echo ' configuration.'
- @echo ' dist-rpms - Create the binary RPMS for the kernel.'
+ @echo ' dist-rpms@ - Create the binary RPMS for the kernel.'
@echo ' See the dist-brew target for available options.'
- @echo ' dist-rpm-baseonly - Create the binary RPMS for the kernel and modules'
- @echo ' (no userspace tools or debuginfo).'
@echo ' dist-kernel-<type> - Create binary RPMS for a particular kernel type.'
@echo ' Available <type>s:'\
$$(sed -n 's/^%define with_\([^ ]*only\).*/\1/p' kernel.spec.template)
@@ -524,6 +541,12 @@ dist-full-help:
@echo ' dist-rhel-configs - build ELN configs'
@echo ' dist-fedora-configs - build Fedora configs'
+ @echo ''
+ @echo 'Wildcard targets: [indicated by '@' above]'
+ @echo ' *-baseonly - builds only the kernel (disables userspace and debuginfo)'
+ @echo ' - Examples: dist-srpm-baseonly, dist-brew-baseonly'
+ @echo ' *-gcov - builds a kernel with gcov enabled'
+ @echo ' - Examples: dist-srpm-gcov, dist-brew-gcov'
@echo ''
@echo 'kABI targets:'
@echo ' dist-kabi - Create kABI stablelist files in redhat/kabi/kabi-rhel*/'
--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1444
From: Sabrina Dubroca on gitlab.com
Merge Request: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1619
This MR introduces a new kABI macro, RH_KABI_EXCLUDE_WITH_SIZE. The
implementation is identical to RH_KABI_EXTEND_WITH_SIZE, but the meaning is
more in line with RH_KABI_EXCLUDE. The size check and reserved space allows us
to exclude an element embedded inside a kABI-protected structure while
reserving space for it to grow in the future.
The size checks that are part of multiple kABI macros are currently not
enabled because the config option to turn them on is missing. Those size
checks only make sense on regular builds, so they're disabled on debug
kernels.
Signed-off-by: Sabrina Dubroca <sdubroca(a)redhat.com>
---
include/linux/rh_kabi.h | 26 ++++++++++
redhat/configs/ark/debug/CONFIG_RH_KABI_SIZE_ALIGN_CHECKS | 1 +
redhat/configs/ark/generic/CONFIG_RH_KABI_SIZE_ALIGN_CHECKS | 1 +
redhat/configs/ark/kgcov/CONFIG_RH_KABI_SIZE_ALIGN_CHECKS | 1 +
redhat/configs/common/generic/CONFIG_RH_KABI_SIZE_ALIGN_CHECKS | 1 +
Kconfig.redhat | 9 +++
6 files changed, 39 insertions(+), 0 deletions(-)
From: Mark Langsdorf <mlangsdo(a)redhat.com>
redhat/configs: enable ChromeOS ACPI driver
Provide a device interface for exporting ACPI data on x86 Chromebooks.
Signed-off-by: Mark Langsdorf <mlangsdo(a)redhat.com>
diff --git a/redhat/configs/ark/generic/arm/aarch64/CONFIG_CHROMEOS_ACPI b/redhat/configs/ark/generic/arm/aarch64/CONFIG_CHROMEOS_ACPI
new file mode 100644
index blahblah..blahblah 100644
--- /dev/null
+++ b/redhat/configs/ark/generic/arm/aarch64/CONFIG_CHROMEOS_ACPI
@@ -0,0 +1 @@
+CONFIG_CHROMEOS_ACPI=y
--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2153
From: Josh Poimboeuf <jpoimboe(a)redhat.com>
redhat/configs: Enable CONFIG_X86_KERNEL_IBT for Fedora and ARK
Kernel IBT is a nice kernel hardening feature with virtually no
performance impact. Since commit 4fd5f70ce14d ("x86/Kconfig: Enable
kernel IBT by default"), its now enabled by default upstream. Enable it
in Fedora and ARK as well.
Signed-off-by: Josh Poimboeuf <jpoimboe(a)redhat.com>
diff --git a/redhat/configs/common/generic/x86/CONFIG_X86_KERNEL_IBT b/redhat/configs/common/generic/x86/CONFIG_X86_KERNEL_IBT
index blahblah..blahblah 100644
--- a/redhat/configs/common/generic/x86/CONFIG_X86_KERNEL_IBT
+++ b/redhat/configs/common/generic/x86/CONFIG_X86_KERNEL_IBT
@@ -1 +1 @@
-# CONFIG_X86_KERNEL_IBT is not set
+CONFIG_X86_KERNEL_IBT=y
--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2346
From: Philipp Rudo <prudo(a)redhat.com>
kernel.spec: Fix UKI naming to comply with BLS
The Boot Loader Specification (BLS) [1] suggests that type #2 entries (UKIs)
shall have the same names like type #1 entries with the exception of
the suffix being .efi instead of .conf. In particular this means that
the name for installed UKIs should be
<entry-token-or-machine-id>-<version>.efi. The same naming convention is
used by kernel-installs 90-uki-copy.install [2] in systemd v253.
Adjust the workaround to install UKIs in the kernel.spec to follow the
same naming convention in order to prevent breaking user space tools
that rely on it.
[1] https://uapi-group.org/specifications/specs/boot_loader_specification/
[2] https://github.com/systemd/systemd/blob/v253/src/kernel-install/90-uki-copy…
Signed-off-by: Philipp Rudo <prudo(a)redhat.com>
diff --git a/redhat/kernel.spec.template b/redhat/kernel.spec.template
index blahblah..blahblah 100644
--- a/redhat/kernel.spec.template
+++ b/redhat/kernel.spec.template
@@ -3033,10 +3033,12 @@ touch %{_localstatedir}/lib/rpm-state/%{name}/installing_core_%{KVERREL}%{?-v:+%
%define kernel_uki_virt_scripts() \
%{expand:%%posttrans %{?1:%{1}-}uki-virt}\
mkdir -p /boot/efi/EFI/Linux\
-cp /lib/modules/%{KVERREL}%{?1:+%{1}}/vmlinuz-virt.efi /boot/efi/EFI/Linux/vmlinuz-%{KVERREL}%{?1:+%{1}}-virt.efi\
+entry_token=$(kernel-install inspect | grep KERNEL_INSTALL_ENTRY_TOKEN: | cut -d ' ' -f2)\
+cp /lib/modules/%{KVERREL}%{?1:+%{1}}/vmlinuz-virt.efi /boot/efi/EFI/Linux/${entry_token}-%{KVERREL}%{?1:+%{1}}.efi\
%{nil}\
%{expand:%%postun %{?1:%{1}-}uki-virt}\
-rm -f /boot/efi/EFI/Linux/vmlinuz-%{KVERREL}%{?1:+%{1}}-virt.efi\
+entry_token=$(kernel-install inspect | grep KERNEL_INSTALL_ENTRY_TOKEN: | cut -d ' ' -f2)\
+rm -f /boot/efi/EFI/Linux/${entry_token}-%{KVERREL}%{?1:+%{1}}.efi\
%{nil}
#
--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2391
From: David Arcari <darcari(a)redhat.com>
redhat/configs: enable CONFIG_INTEL_TCC_COOLING for RHEL
It turns out that we want this driver enabled for x86 on RHEL.
Signed-off-by: David Arcari <darcari(a)redhat.com>
diff --git a/redhat/configs/fedora/generic/x86/CONFIG_INTEL_TCC_COOLING b/redhat/configs/common/generic/x86/CONFIG_INTEL_TCC_COOLING
rename from redhat/configs/fedora/generic/x86/CONFIG_INTEL_TCC_COOLING
rename to redhat/configs/common/generic/x86/CONFIG_INTEL_TCC_COOLING
index blahblah..blahblah 100644
--- a/redhat/configs/fedora/generic/x86/CONFIG_INTEL_TCC_COOLING
+++ b/redhat/configs/common/generic/x86/CONFIG_INTEL_TCC_COOLING
--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2390
Hi, we tested your kernel and here are the results:
Overall result: PASSED
Merge: OK
Compile: OK
Test: OK
Tested-by: CKI Project <cki-project(a)redhat.com>
Kernel information:
Brew / Koji Task ID: 99336928
You can find all the details about the test run at
https://datawarehouse.cki-project.org/kcidb/checkouts/83038
One or more kernel tests failed:
We also see the following known issues which are not related to your changes:
Issue: avc: denied { name_bind } for pid=897864 comm="rpcbind" src=63924 scontext=system_u:system_r:rpcbind_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=udp_socket permissive=1
URL: https://bugzilla.redhat.com/show_bug.cgi?id=1983604#c3
Affected tests:
x86_64 - xfstests - nfsv4.2
Issue: Storage blktests - blk: scsi/007: Reading from scsi_debug failed
URL: https://bugzilla.redhat.com/show_bug.cgi?id=2027550
Affected tests:
s390x - Storage - blktests - blk
Issue: (kernel-fedora) Storage - blktests - nvmeof-mp: FAIL: Configured NVMe target driver
URL: https://gitlab.com/redhat/centos-stream/tests/kernel/kernel-tests/-/issues/…
Affected tests:
ppc64le - Storage - blktests - nvmeof-mp
If you find a failure unrelated to your changes, please ask the test maintainer to review it.
This will prevent the failures from being incorrectly reported in the future.
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________