Skip to content

linux, linux-esx: make canister_build work against the current kernel #1675

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dcasota wants to merge 2 commits into
base: 5.0
Choose a base branch
from
Open

linux, linux-esx: make canister_build work against the current kernel #1675

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1e115b3
linux, linux-esx: share the canister/.config logic via canister_confi…
dcasota Aug 31, 2026
2590191
linux: rebase the canister patch series onto 6.12.107
dcasota Sep 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions ...nux/canister_builder/patches/1004-Move-__bug_table-section-to-fips_canister_wrapper.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -290,8 +290,8 @@ index bfde0f28c..a631b4905 100644
const unsigned int digest_size = req->dst_len;
int err;

- if (WARN_ON(req->dst) || WARN_ON(!digest_size) ||
+ if (fcw_warn_on(req->dst) || fcw_warn_on(!digest_size) ||
- if (WARN_ON(req->dst) || !digest_size ||
+ if (fcw_warn_on(req->dst) || !digest_size ||
!ctx->key_size || sig_size != ctx->key_size)
return -EINVAL;

Expand Down
2 changes: 1 addition & 1 deletion .../canister_builder/patches/1010-rsa-pkcs1pad-Add-invalid_hash_len-check-in-sign-veri.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,7 +86,7 @@ index 9cac0a06b..d9b6d7d1d 100644
const unsigned int digest_size = req->dst_len;
int err;

if (fcw_warn_on(req->dst) || fcw_warn_on(!digest_size) ||
if (fcw_warn_on(req->dst) || !digest_size ||
- !ctx->key_size || sig_size != ctx->key_size)
+ !ctx->key_size || sig_size != ctx->key_size ||
+ pkcs1pad_invalid_hash_len(digest_size, digest_info))
Expand Down
34 changes: 34 additions & 0 deletions SPECS/linux/canister_config.inc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,34 @@
%dnl Shared canister/.config manipulation for the Photon kernel flavours.
%dnl
%dnl Included by both SPECS/linux/linux.spec and SPECS/linux/linux-esx.spec so
%dnl that the FIPS canister Kconfig handling cannot diverge between the two
%dnl flavours again. Historically linux.spec had no fips=0 branch at all, so on
%dnl aarch64 (fips=0) the canister "is not set" comments were left in .config;
%dnl "make olddefconfig" silently drops symbols that do not exist in the tree
%dnl and the check_for_config_applicability.inc diff guard then failed.
%dnl
%dnl Expects, from the including spec:
%dnl fips 1 => build a FIPS kernel carrying the crypto canister
%dnl canister_build 1 => the canister is built from source in this build
%dnl canister_usage 1 => link against a prebuilt canister object file
%dnl (derived: !canister_build when fips=1, else 0)
%dnl
%dnl Expects .config to be in place already (cp of the flavour config Source).
%dnl
%dnl The GCC_PLUGIN_MATCH_CANISTER_STRUCTS / GCC_PLUGIN_PAD_CANISTER_STRUCTS
%dnl Kconfig symbols only exist once the fips canister plugin patches have been
%dnl applied, i.e. only when fips=1.
%if 0%{?canister_build}
sed -i "s/# CONFIG_GCC_PLUGIN_PAD_CANISTER_STRUCTS is not set/CONFIG_GCC_PLUGIN_PAD_CANISTER_STRUCTS=y/" .config
sed -i "/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/d" .config
%endif

%if 0%{?canister_usage}
sed -i "s/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS=y/" .config
%endif

%if 0%{?fips} == 0
# Clean up .config of FIPS related configs
sed -i "/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/d" .config
sed -i "/# CONFIG_GCC_PLUGIN_PAD_CANISTER_STRUCTS is not set/d" .config
%endif
29 changes: 21 additions & 8 deletions SPECS/linux/linux-esx.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,10 +26,21 @@
%global fips 0
%endif

# The esx flavour never builds the canister itself, it always links against the
# prebuilt canister object file. Mirror linux.spec's derived flag model so the
# shared canister_config.inc behaves identically for both flavours.
%if 0%{?fips}
%global canister_build 0
%global canister_usage 1
%else
%global canister_build 0
%global canister_usage 0
%endif

Summary: Kernel
Name: linux-esx
Version: 6.12.107
Release: 4%{?dist}
Release: 5%{?dist}
URL: http://www.kernel.org
Group: System Environment/Kernel
Vendor: VMware, Inc.
Expand All @@ -44,6 +55,8 @@ Source2: initramfs.trigger
# contains pre, postun, filetriggerun tasks
Source3: scriptlets.inc
Source4: check_for_config_applicability.inc
# shared canister/.config handling, also included by linux.spec
Source5: canister_config.inc

Source19: spec_install_post.inc

Expand Down Expand Up @@ -427,20 +440,15 @@ tar -xvf /usr/lib/fips-canister/fips-canister-%{fips_canister_version}.tar.bz2
# corresponding .cmd file. Empty content is ok, since we are not going
# to rebuild it.
touch crypto/.fips_canister.o.cmd

sed -i "s/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS=y/" .config
%else
# Clean up .config of FIPS related configs
sed -i "/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/d" .config
sed -i "/# CONFIG_GCC_PLUGIN_PAD_CANISTER_STRUCTS is not set/d" .config

sed -i "s/# CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_2 is not set/CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_2=y/" .config
sed -i "s/CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_32=y/# CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_32 is not set/" .config

sed -i "s/CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKS=128/CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKS=64/" .config
sed -i "s/CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKSIZE=256/CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKSIZE=32/" .config
%endif

%dnl canister/.config handling, shared with linux.spec
%include %{SOURCE5}
%ifarch x86_64
sed -e "s,@@NAME@@,%{name},g" \
-e "s,@@VERSION_RELEASE@@,%{version}-%{release},g" \
Expand Down Expand Up @@ -559,6 +567,11 @@ ln -sf linux-%{uname_r}.cfg /boot/photon.cfg
%{_usrsrc}/linux-headers-%{uname_r}

%changelog
* Mon Sep 07 2026 Daniel Casota <dcasota@gmail.com> 6.12.107-5
- Move canister/.config handling into shared canister_config.inc (Source5),
included by both linux.spec and linux-esx.spec so the two flavours cannot
diverge again. Behaviour-preserving here: this spec already handled fips=0
correctly in its else branch, and that logic is what the include adopts.
* Mon Sep 07 2026 Brennan Lamoreaux <brennan.lamoreaux@broadcom.com> 6.12.107-4
- Fixes CVE-2026-72288, CVE-2026-72355
* Wed Sep 02 2026 Brennan Lamoreaux <brennan.lamoreaux@broadcom.com> 6.12.107-3
Expand Down
29 changes: 20 additions & 9 deletions SPECS/linux/linux.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,7 +80,7 @@
Summary: Kernel
Name: linux
Version: 6.12.107
Release: 4%{?acvp_build:.acvp}%{?kat_build:.kat}%{?dist}
Release: 6%{?acvp_build:.acvp}%{?kat_build:.kat}%{?dist}
URL: http://www.kernel.org/
Group: System Environment/Kernel
Vendor: VMware, Inc.
Expand All @@ -99,6 +99,8 @@ Source3: https://github.com/amzn/amzn-drivers/archive/refs/tags/ena_linux
%define efa_version 3.1.0
Source4: https://github.com/amzn/amzn-drivers/archive/refs/tags/efa_linux_%{efa_version}.tar.gz

# shared canister/.config handling, also included by linux-esx.spec
Source5: canister_config.inc
# contains pre, postun, filetriggerun tasks
Source6: scriptlets.inc
Source7: check_for_config_applicability.inc
Expand Down Expand Up @@ -693,14 +695,7 @@ cat %{SOURCE20} %{SOURCE21} > photon-cert-bundle.pem

sed -i 's/CONFIG_LOCALVERSION=""/CONFIG_LOCALVERSION="-%{release}"/' .config

%if 0%{?canister_build}
sed -i "s/# CONFIG_GCC_PLUGIN_PAD_CANISTER_STRUCTS is not set/CONFIG_GCC_PLUGIN_PAD_CANISTER_STRUCTS=y/" .config
sed -i "/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/d" .config
%endif

%if 0%{?canister_usage}
sed -i "s/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS=y/" .config
%endif
%include %{SOURCE5}

%ifarch x86_64
sed -e "s,@@NAME@@,%{name},g" \
Expand Down Expand Up @@ -983,6 +978,22 @@ ln -sf linux-%{uname_r}.cfg /boot/photon.cfg
%endif

%changelog
* Mon Sep 07 2026 Daniel Casota <dcasota@gmail.com> 6.12.107-6
- Rebase canister-creation patches 1004 and 1010 onto 6.12.107. Upstream
dropped the WARN_ON() wrapper around !digest_size in pkcs1pad_verify(), and
that single line is context for both patches, so %prep failed at --fuzz=0
with "1 out of 2 hunks FAILED -- crypto/rsa-pkcs1pad.c.rej". canister_build
could not build against the shipping kernel. In 1004 the conversion is not
cosmetic: WARN_ON emits a __bug_table entry and that patch exists to keep
__bug_table out of the canister.
* Mon Sep 07 2026 Daniel Casota <dcasota@gmail.com> 6.12.107-5
- Move canister/.config handling into shared canister_config.inc (Source5),
included by both linux.spec and linux-esx.spec so the two flavours cannot
diverge again. This also fixes the fips=0 path here: linux.spec had two
independent canister_build/canister_usage blocks and no else branch, so on
aarch64 nothing stripped the GCC_PLUGIN_{MATCH,PAD}_CANISTER_STRUCTS
comments before olddefconfig and the check_for_config_applicability.inc
diff guard failed prep. linux-esx.spec had always handled this correctly.
* Mon Sep 07 2026 Brennan Lamoreaux <brennan.lamoreaux@broadcom.com> 6.12.107-4
- Fixes CVE-2026-72288, CVE-2026-72355
* Wed Sep 02 2026 Brennan Lamoreaux <brennan.lamoreaux@broadcom.com> 6.12.107-3
Expand Down
Loading