Skip to content

Commit 18dd756

Browse files
rlmengerlmenge
authored
Add kernel-mos with AMDGPU drivers (#6714)
This change introduces a new x86_64 kernel, kernel-mos, for the purpose of offering a kernel which has newer drivers available then those offered in 5.15 LTS. These newer drivers include newer AMDGPU drivers. This change does not provide an ARM64 kernel. Kernel-mos pulls from a different source than the generic kernel RPM. The kernel-mos RPM uses the rolling-lts/mariner-2-mos/5.15.y.w tag which contains the additional feature branch for amdgpu drivers. The kernel-mos.spec also introduces the following subpackages: kernel-mos-devel: includes the source needed to build kernel-level software kernel-mos-drivers-accessibility: contains drivers under accessibility kernel-mos-drivers-gpu: contains drivers under gpu (including amdgpu) kernel-mos-drivers-sound: contains drivers under sound kernel-mos-docs: contains the kernel docs kernel-mos-tools: common linux tools such as cpufreq kernel-mos-python3-perf: contains the python perf tools kernel-mos-bpftool: contains bpftool used to inspect btf data Kernel-mos-signed.spec is also being introduced to allow for signing of the kernel to enable secureboot.
1 parent 92a5d7b commit 18dd756

12 files changed

+8260
-2
lines changed

‎SPECS-SIGNED/kernel-mos-signed/kernel-mos-signed.spec

+155
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
%global debug_package %{nil}
2+
%global sha512hmac bash %{_sourcedir}/sha512hmac-openssl.sh
3+
%global buildarch x86_64
4+
%define uname_r %{version}-%{release}
5+
Summary: Signed Linux Kernel for MOS systems
6+
Name: kernel-mos-signed-%{buildarch}
7+
Version: 5.15.136.1
8+
Release: 1%{?dist}
9+
License: GPLv2
10+
Vendor: Microsoft Corporation
11+
Distribution: Mariner
12+
Group: System Environment/Kernel
13+
URL: https://github.com/microsoft/CBL-Mariner-Linux-Kernel
14+
# This spec purpose is to take an input kernel rpm and input secure-boot-signed
15+
# kernel binary from the same build and generate a new "kernel" rpm with the
16+
# signed kernel binary + all of the other original kernel files, triggers,
17+
# scriptlets, requires, provides, etc.
18+
#
19+
# We need to ensure the kernel modules and kernel binary used are from the exact
20+
# same build because at build time the kernel modules are signed with an
21+
# ephemeral key that the kernel enrolls in its keyring. We enforce kernel
22+
# module signature checking when we enable security features like kernel
23+
# lockdown so our kernel can only load those specific kernel modules at runtime.
24+
#
25+
# Additionally, to complete the UEFI Secure Boot chain, we must PE-sign the
26+
# kernel binary. Ideally we would enable secure-boot signing tools like pesign
27+
# or sbsign to be callable from inside the rpmbuild environment, that way we can
28+
# secure-boot sign the kernel binary during the kernel's rpmbuild. It is best
29+
# practice to sign as soon as possible. However there are issues getting that
30+
# secure boot signing infrastructure in place today. Hence we sign the
31+
# resulting kernel binary and "repackage" the kernel-mos RPM (something rpm itself
32+
# actively tries to make sure you never do...generally for good reasons).
33+
#
34+
# To achive this repackaging, this spec creates a new subpackage named
35+
# "kernel-mos". To retain all of the initial kernel-mos package behaviors, we make sure
36+
# the subpackage has the same requires, provides, triggers, post steps, and
37+
# files as the original kernel package.
38+
#
39+
# This specific repackaging implementation leaves room for us to enable the
40+
# more ideal secure-boot signing flow in the future without introducing any
41+
# sort of breaking change or new packaging. Users still install a "kernel-mos"
42+
# package like they normally would.
43+
#
44+
# Maintenance Notes:
45+
# - This spec's "version" and "release" must reflect the unsigned version that
46+
# was signed. An important consequence is that when making a change to this
47+
# spec or the normal kernel-mos spec, the other spec's version version/release must
48+
# be increased to keep the two versions consistent.
49+
#
50+
# - Make sure the kernel-mos subpackage's Requires, Provides, triggers, post/postun
51+
# scriptlets, and files match the normal kernel-mos spec's. The kernel subpackage
52+
# should contain the same content as the input kernel-mos package but replace the
53+
# kernel binary with our signed kernel binary. Since all the requires, provides,
54+
# etc are the same, this new kernel-mos package can be a direct replacement for the
55+
# normal kernel-mos package and RPM will resolve packages with kernel-mos dependencies
56+
# correctly.
57+
#
58+
# To populate the input sources:
59+
# 1. Build the unsigned packages as normal
60+
# 2. Sign the desired binary
61+
# 3. Place the unsigned package and signed binary in this spec's folder
62+
# 4. Build this spec
63+
Source0: kernel-mos-%{version}-%{release}.%{buildarch}.rpm
64+
Source1: vmlinuz-%{uname_r}
65+
Source2: sha512hmac-openssl.sh
66+
BuildRequires: cpio
67+
BuildRequires: openssl
68+
BuildRequires: sed
69+
70+
%description
71+
This package contains the Linux kernel package with kernel signed with the production key
72+
73+
%package -n kernel-mos
74+
Summary: Linux Kernel for MOS
75+
Group: System Environment/Kernel
76+
Requires: filesystem
77+
Requires: kmod
78+
Requires(post): coreutils
79+
Requires(postun): coreutils
80+
81+
%description -n kernel-mos
82+
The kernel-mos package contains the signed Linux kernel for MOS.
83+
84+
%prep
85+
86+
%build
87+
mkdir rpm_contents
88+
pushd rpm_contents
89+
90+
# This spec's whole purpose is to inject the signed kernel binary
91+
rpm2cpio %{SOURCE0} | cpio -idmv
92+
cp %{SOURCE1} ./boot/vmlinuz-%{uname_r}
93+
94+
popd
95+
96+
%install
97+
pushd rpm_contents
98+
99+
# Don't use * wildcard. It does not copy over hidden files in the root folder...
100+
cp -rp ./. %{buildroot}/
101+
102+
popd
103+
104+
# Recalculate sha512hmac for FIPS
105+
%{sha512hmac} %{buildroot}/boot/vmlinuz-%{uname_r} | sed -e "s,$RPM_BUILD_ROOT,," > %{buildroot}/boot/.vmlinuz-%{uname_r}.hmac
106+
cp %{buildroot}/boot/.vmlinuz-%{uname_r}.hmac %{buildroot}/lib/modules/%{uname_r}/.vmlinuz.hmac
107+
108+
%triggerin -n kernel-mos -- initramfs
109+
mkdir -p %{_localstatedir}/lib/rpm-state/initramfs/pending
110+
touch %{_localstatedir}/lib/rpm-state/initramfs/pending/%{uname_r}
111+
echo "initrd generation of kernel %{uname_r} will be triggered later" >&2
112+
113+
%triggerun -n kernel-mos -- initramfs
114+
rm -rf %{_localstatedir}/lib/rpm-state/initramfs/pending/%{uname_r}
115+
rm -rf /boot/initrd.img-%{uname_r}
116+
echo "initrd of kernel %{uname_r} removed" >&2
117+
118+
%postun -n kernel-mos
119+
if [ ! -e /boot/mariner.cfg ]
120+
then
121+
ls /boot/linux-*.cfg 1> /dev/null 2>&1
122+
if [ $? -eq 0 ]
123+
then
124+
list=`ls -tu /boot/linux-*.cfg | head -n1`
125+
test -n "$list" && ln -sf "$list" /boot/mariner.cfg
126+
fi
127+
fi
128+
129+
%post -n kernel-mos
130+
/sbin/depmod -a %{uname_r}
131+
ln -sf linux-%{uname_r}.cfg /boot/mariner.cfg
132+
133+
%files -n kernel-mos
134+
%defattr(-,root,root)
135+
%license COPYING
136+
%exclude %dir %{_libdir}/debug
137+
/boot/System.map-%{uname_r}
138+
/boot/config-%{uname_r}
139+
/boot/vmlinuz-%{uname_r}
140+
/boot/.vmlinuz-%{uname_r}.hmac
141+
%config(noreplace) /boot/linux-%{uname_r}.cfg
142+
%config %{_localstatedir}/lib/initramfs/kernel/%{uname_r}
143+
%defattr(0644,root,root)
144+
/lib/modules/%{uname_r}/*
145+
/lib/modules/%{uname_r}/.vmlinuz.hmac
146+
%exclude /lib/modules/%{uname_r}/build
147+
%exclude /lib/modules/%{uname_r}/kernel/drivers/accessibility
148+
%exclude /lib/modules/%{uname_r}/kernel/drivers/gpu
149+
%exclude /lib/modules/%{uname_r}/kernel/sound
150+
%exclude /module_info.ld
151+
152+
%changelog
153+
* Wed Nov 08 2023 Rachel Menge <[email protected]> - 5.15.136.1-1
154+
- Original version for CBL-Mariner.
155+
- License verified

‎SPECS-SIGNED/kernel-mos-signed/sha512hmac-openssl.sh

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#!/bin/bash
2+
3+
# Mocks sha512hmac using the openssl tool.
4+
# Only for use during RPM build.
5+
6+
openssl sha512 -hmac FIPS-FTW-RHT2009 -hex "$1" | cut -f 2 -d ' ' | echo "$(cat -) $1"

0 commit comments

Comments
 (0)