diff --git a/packages/kernel-6.18/1008-kbuild-use-SRCARCH-in-crypto-module-folders.patch b/packages/kernel-6.18/1008-kbuild-use-SRCARCH-in-crypto-module-folders.patch new file mode 100644 index 00000000..fc6cc648 --- /dev/null +++ b/packages/kernel-6.18/1008-kbuild-use-SRCARCH-in-crypto-module-folders.patch @@ -0,0 +1,46 @@ +From e13ac255c923a1afa33edf85f115795117d549c1 Mon Sep 17 00:00:00 2001 +From: Jay Wang +Date: Mon, 3 Aug 2026 20:37:47 +0000 +Subject: [PATCH] kbuild: use SRCARCH in crypto-module-folders + +The fips140 object collection matches crypto directories against +crypto-module-folders, which named the arch folder arch/$(ARCH)/crypto. +Kernel source paths are keyed by SRCARCH, not ARCH: when the kernel is +built with ARCH=x86_64 (as kernel.spec does), ARCH stays x86_64 while +the real directory is arch/x86/crypto, so the directory check fails. + +As a result, arch/x86/crypto/crypto-module.a was never aggregated into +the top-level crypto-module.a. With CRYPTO_FIPS140_EXTMOD=y keeping +crypto-objs-y out of obj-y, every builtin object under arch/x86/crypto +(aesni-intel) was silently linked into neither vmlinux nor fips140.ko, +leaving all AES-NI implementations (ecb/cbc/ctr/cts/xts-aes-aesni, +AES-GCM, and their AVX/VAES variants) absent from the running kernel +on x86_64. Native builds without ARCH= were unaffected because +SUBARCH maps x86_64 to x86, and arm64 was unaffected because there +ARCH equals SRCARCH. + +Use SRCARCH so the folder list matches the real source layout for +every ARCH spelling. + +Fixes: 9d2856e86e54 ("build: special compilation rule for building the standalone crypto module") +Signed-off-by: Jay Wang +--- + scripts/Makefile.build | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/scripts/Makefile.build b/scripts/Makefile.build +index 01d46c58303a7..1f0a73eec5c20 100644 +--- a/scripts/Makefile.build ++++ b/scripts/Makefile.build +@@ -31,7 +31,7 @@ subdir-ccflags-y := + + crypto-objs-flags-y := -DFIPS_MODULE=1 + crypto-objs-y := +-crypto-module-folders := crypto arch/$(ARCH)/crypto lib/crypto certs ++crypto-module-folders := crypto arch/$(SRCARCH)/crypto lib/crypto certs + # Global crypto directory checking logic + # Use relative paths so this works with both in-tree and O= out-of-tree builds + define is-crypto-related-dir +-- +2.52.0 + diff --git a/packages/kernel-6.18/check-fips-modules.drop-in.conf.in b/packages/kernel-6.18/check-fips-modules.drop-in.conf.in new file mode 100644 index 00000000..c5585479 --- /dev/null +++ b/packages/kernel-6.18/check-fips-modules.drop-in.conf.in @@ -0,0 +1,3 @@ +[Unit] +Requires=fips-modprobe@__FIPS_MODULE__.service +After=fips-modprobe@__FIPS_MODULE__.service diff --git a/packages/kernel-6.18/fipsmodules-aarch64 b/packages/kernel-6.18/fipsmodules-aarch64 new file mode 100644 index 00000000..df45c2c4 --- /dev/null +++ b/packages/kernel-6.18/fipsmodules-aarch64 @@ -0,0 +1,41 @@ +sha1 +sha224 +sha256 +sha384 +sha512 +sha3-224 +sha3-256 +sha3-384 +sha3-512 +crc32c +ghash +xxhash64 +ghash-ce +sha3-ce +cipher_null +des3_ede +aes +dh +ecdh +aes-arm64 +aes-ce-blk +aes-ce-ccm +aes-ce-cipher +aes-neon-blk +aes-neon-bs +ecb +cbc +ctr +xts +gcm +ccm +authenc +hmac +cmac +cts +lzo +essiv +seqiv +tcrypt +crypto_user +rsa diff --git a/packages/kernel-6.18/fipsmodules-x86_64 b/packages/kernel-6.18/fipsmodules-x86_64 new file mode 100644 index 00000000..f85d5ecf --- /dev/null +++ b/packages/kernel-6.18/fipsmodules-x86_64 @@ -0,0 +1,34 @@ +sha1 +sha224 +sha256 +sha384 +sha512 +sha3-224 +sha3-256 +sha3-384 +sha3-512 +crc32c +ghash +xxhash64 +ghash_clmulni_intel +cipher_null +des3_ede +aes +dh +ecdh +ecb +cbc +ctr +xts +gcm +ccm +authenc +hmac +cmac +cts +lzo +essiv +seqiv +tcrypt +crypto_user +rsa diff --git a/packages/kernel-6.18/kernel-6.18.spec b/packages/kernel-6.18/kernel-6.18.spec index 36cc483b..8fe85c20 100644 --- a/packages/kernel-6.18/kernel-6.18.spec +++ b/packages/kernel-6.18/kernel-6.18.spec @@ -27,6 +27,12 @@ Source111: config-full-bottlerocket-aarch64-on-aarch64 Source112: config-full-bottlerocket-x86_64-on-x86_64 Source113: config-full-bottlerocket-aarch64-on-x86_64 +# This list of FIPS modules is extracted from /etc/fipsmodules in the initramfs +# after placing AL2023 in FIPS mode. +Source200: check-fips-modules.drop-in.conf.in +Source201: fipsmodules-x86_64 +Source202: fipsmodules-aarch64 + # Adjust kernel-devel mount behavior if not squashfs. Source210: var-lib-kernel-devel-lower.mount.drop-in.conf.in @@ -76,6 +82,8 @@ Patch1005: 1005-drm-simpledrm-Select-prerequisites-for-gpu-drivers.patch # Disable incomplete measurement into PCR 9 on aarch64. Patch1006: 1006-efi-libstub-don-t-measure-kernel-command-line-into-P.patch Patch1007: 1007-Revert-selinux-fix-overlayfs-mmap-and-mprotect-acces.patch +# Fix incorrect FIPS crypto module path for x86_64 builds. +Patch1008: 1008-kbuild-use-SRCARCH-in-crypto-module-folders.patch BuildRequires: bc BuildRequires: elfutils-devel @@ -103,9 +111,6 @@ Conflicts: %{_cross_os}image-feature(external-kmod-development) # Legacy iptables support is not enabled in this kernel. Conflicts: %{_cross_os}iptables-legacy -# FIPS certification is not yet available for this kernel. -Conflicts: %{_cross_os}image-feature(fips) - # Pull in expected modules. Requires: %{name}-modules = %{version}-%{release} @@ -123,6 +128,9 @@ Requires: (%{name}-modules-neuron if (%{_cross_os}variant-platform(aws) without Requires: %{_cross_os}kmod-6.18-efa +# Pull in FIPS-related files if needed. +Requires: (%{name}-fips if %{_cross_os}image-feature(fips)) + %global _cross_ksrcdir %{_cross_usrsrc}/kernels/%{version} %global _cross_kmoddir %{_cross_libdir}/modules/%{version} @@ -165,6 +173,14 @@ Summary: Header files for the Linux kernel for use by glibc %description headers %{summary}. +%package fips +Summary: FIPS related configuration for the Linux kernel +Requires: (%{_cross_os}image-feature(fips) and %{name}) +Conflicts: %{_cross_os}image-feature(no-fips) + +%description fips +%{summary}. + %if "%{_cross_arch}" == "x86_64" %package modules-neuron Summary: Modules for the Linux kernel with Neuron hardware @@ -475,6 +491,20 @@ ln -rs %{buildroot}%{_cross_kmoddir} %{buildroot}%{_cross_libdir}/modules/%{kmaj # Install a copy of System.map so that module dependencies can be regenerated. install -p -m 0600 System.map %{buildroot}%{_cross_kmoddir} +# Ensure that each required FIPS module is loaded as a dependency of the +# check-fips-module.service. The list of FIPS modules is different across +# kernels but the check is consistent: it loads the "tcrypt" module after +# the other modules are loaded. +mkdir -p %{buildroot}%{_cross_unitdir}/check-fips-modules.service.d +i=0 +for fipsmod in $(cat %{_sourcedir}/fipsmodules-%{_cross_arch}) ; do + [ "${fipsmod}" == "tcrypt" ] && continue + drop_in="$(printf "%03d\n" "${i}")-${fipsmod}.conf" + sed -e "s|__FIPS_MODULE__|${fipsmod}|g" %{S:200} \ + > %{buildroot}%{_cross_unitdir}/check-fips-modules.service.d/"${drop_in}" + (( i+=1 )) +done + # Create the mount point for the runtime kernel-devel directory, and populate # with the linker script that driverdog needs. install -d %{buildroot}%{_cross_datadir}/bottlerocket/kernel-devel/%{version}/scripts @@ -569,6 +599,9 @@ install -p -m 0644 %{S:222} %{S:224} %{buildroot}%{_cross_unitdir} %{_cross_kmoddir}/build %attr(775, root, builder) %{_cross_ksrcdir}/scripts/* +%files fips +%{_cross_unitdir}/check-fips-modules.service.d/*.conf + %files bootconfig-aws %{_cross_bootconfigdir}/05-aws.conf