kernel-6.18: enable fips modules

packages/kernel-6.18/1008-kbuild-use-SRCARCH-in-crypto-module-folders.patch

@@ -0,0 +1,46 @@
+From e13ac255c923a1afa33edf85f115795117d549c1 Mon Sep 17 00:00:00 2001
+From: Jay Wang <wanjay@amazon.com>
+Date: Mon, 3 Aug 2026 20:37:47 +0000
+Subject: [PATCH] kbuild: use SRCARCH in crypto-module-folders
+
+The fips140 object collection matches crypto directories against
+crypto-module-folders, which named the arch folder arch/$(ARCH)/crypto.
+Kernel source paths are keyed by SRCARCH, not ARCH: when the kernel is
+built with ARCH=x86_64 (as kernel.spec does), ARCH stays x86_64 while
+the real directory is arch/x86/crypto, so the directory check fails.
+
+As a result, arch/x86/crypto/crypto-module.a was never aggregated into
+the top-level crypto-module.a. With CRYPTO_FIPS140_EXTMOD=y keeping
+crypto-objs-y out of obj-y, every builtin object under arch/x86/crypto
+(aesni-intel) was silently linked into neither vmlinux nor fips140.ko,
+leaving all AES-NI implementations (ecb/cbc/ctr/cts/xts-aes-aesni,
+AES-GCM, and their AVX/VAES variants) absent from the running kernel
+on x86_64. Native builds without ARCH= were unaffected because
+SUBARCH maps x86_64 to x86, and arm64 was unaffected because there
+ARCH equals SRCARCH.
+
+Use SRCARCH so the folder list matches the real source layout for
+every ARCH spelling.
+
+Fixes: 9d2856e86e54 ("build: special compilation rule for building the standalone crypto module")
+Signed-off-by: Jay Wang <wanjay@amazon.com>
+---
+ scripts/Makefile.build | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/Makefile.build b/scripts/Makefile.build
+index 01d46c58303a7..1f0a73eec5c20 100644
+--- a/scripts/Makefile.build
++++ b/scripts/Makefile.build
+@@ -31,7 +31,7 @@ subdir-ccflags-y :=
+
+ crypto-objs-flags-y := -DFIPS_MODULE=1
+ crypto-objs-y :=
+-crypto-module-folders := crypto arch/$(ARCH)/crypto lib/crypto certs
++crypto-module-folders := crypto arch/$(SRCARCH)/crypto lib/crypto certs
+ # Global crypto directory checking logic
+ # Use relative paths so this works with both in-tree and O= out-of-tree builds
+ define is-crypto-related-dir
+-- 
+2.52.0
+

packages/kernel-6.18/check-fips-modules.drop-in.conf.in

@@ -0,0 +1,3 @@
+[Unit]
+Requires=fips-modprobe@__FIPS_MODULE__.service
+After=fips-modprobe@__FIPS_MODULE__.service

packages/kernel-6.18/fipsmodules-aarch64

@@ -0,0 +1,41 @@
+sha1
+sha224
+sha256
+sha384
+sha512
+sha3-224
+sha3-256
+sha3-384
+sha3-512
+crc32c
+ghash
+xxhash64
+ghash-ce
+sha3-ce
+cipher_null
+des3_ede
+aes
+dh
+ecdh
+aes-arm64
+aes-ce-blk
+aes-ce-ccm
+aes-ce-cipher
+aes-neon-blk
+aes-neon-bs
+ecb
+cbc
+ctr
+xts
+gcm
+ccm
+authenc
+hmac
+cmac
+cts
+lzo
+essiv
+seqiv
+tcrypt
+crypto_user
+rsa

packages/kernel-6.18/fipsmodules-x86_64

@@ -0,0 +1,34 @@
+sha1
+sha224
+sha256
+sha384
+sha512
+sha3-224
+sha3-256
+sha3-384
+sha3-512
+crc32c
+ghash
+xxhash64
+ghash_clmulni_intel
+cipher_null
+des3_ede
+aes
+dh
+ecdh
+ecb
+cbc
+ctr
+xts
+gcm
+ccm
+authenc
+hmac
+cmac
+cts
+lzo
+essiv
+seqiv
+tcrypt
+crypto_user
+rsa

packages/kernel-6.18/kernel-6.18.spec

@@ -27,6 +27,12 @@ Source111: config-full-bottlerocket-aarch64-on-aarch64
 Source112: config-full-bottlerocket-x86_64-on-x86_64
 Source113: config-full-bottlerocket-aarch64-on-x86_64
 
+# This list of FIPS modules is extracted from /etc/fipsmodules in the initramfs
+# after placing AL2023 in FIPS mode.
+Source200: check-fips-modules.drop-in.conf.in
+Source201: fipsmodules-x86_64
+Source202: fipsmodules-aarch64
+
 # Adjust kernel-devel mount behavior if not squashfs.
 Source210: var-lib-kernel-devel-lower.mount.drop-in.conf.in
 
@@ -76,6 +82,8 @@ Patch1005: 1005-drm-simpledrm-Select-prerequisites-for-gpu-drivers.patch
 # Disable incomplete measurement into PCR 9 on aarch64.
 Patch1006: 1006-efi-libstub-don-t-measure-kernel-command-line-into-P.patch
 Patch1007: 1007-Revert-selinux-fix-overlayfs-mmap-and-mprotect-acces.patch
+# Fix incorrect FIPS crypto module path for x86_64 builds.
+Patch1008: 1008-kbuild-use-SRCARCH-in-crypto-module-folders.patch
 
 BuildRequires: bc
 BuildRequires: elfutils-devel
@@ -103,9 +111,6 @@ Conflicts: %{_cross_os}image-feature(external-kmod-development)
 # Legacy iptables support is not enabled in this kernel.
 Conflicts: %{_cross_os}iptables-legacy
 
-# FIPS certification is not yet available for this kernel.
-Conflicts: %{_cross_os}image-feature(fips)
-
 # Pull in expected modules.
 Requires: %{name}-modules = %{version}-%{release}
 
@@ -123,6 +128,9 @@ Requires: (%{name}-modules-neuron if (%{_cross_os}variant-platform(aws) without
 
 Requires: %{_cross_os}kmod-6.18-efa
 
+# Pull in FIPS-related files if needed.
+Requires: (%{name}-fips if %{_cross_os}image-feature(fips))
+
 %global _cross_ksrcdir %{_cross_usrsrc}/kernels/%{version}
 %global _cross_kmoddir %{_cross_libdir}/modules/%{version}
 
@@ -165,6 +173,14 @@ Summary: Header files for the Linux kernel for use by glibc
 %description headers
 %{summary}.
 
+%package fips
+Summary: FIPS related configuration for the Linux kernel
+Requires: (%{_cross_os}image-feature(fips) and %{name})
+Conflicts: %{_cross_os}image-feature(no-fips)
+
+%description fips
+%{summary}.
+
 %if "%{_cross_arch}" == "x86_64"
 %package modules-neuron
 Summary: Modules for the Linux kernel with Neuron hardware
@@ -475,6 +491,20 @@ ln -rs %{buildroot}%{_cross_kmoddir} %{buildroot}%{_cross_libdir}/modules/%{kmaj
 # Install a copy of System.map so that module dependencies can be regenerated.
 install -p -m 0600 System.map %{buildroot}%{_cross_kmoddir}
 
+# Ensure that each required FIPS module is loaded as a dependency of the
+# check-fips-module.service. The list of FIPS modules is different across
+# kernels but the check is consistent: it loads the "tcrypt" module after
+# the other modules are loaded.
+mkdir -p %{buildroot}%{_cross_unitdir}/check-fips-modules.service.d
+i=0
+for fipsmod in $(cat %{_sourcedir}/fipsmodules-%{_cross_arch}) ; do
+  [ "${fipsmod}" == "tcrypt" ] && continue
+  drop_in="$(printf "%03d\n" "${i}")-${fipsmod}.conf"
+  sed -e "s|__FIPS_MODULE__|${fipsmod}|g" %{S:200} \
+    > %{buildroot}%{_cross_unitdir}/check-fips-modules.service.d/"${drop_in}"
+  (( i+=1 ))
+done
+
 # Create the mount point for the runtime kernel-devel directory, and populate
 # with the linker script that driverdog needs.
 install -d %{buildroot}%{_cross_datadir}/bottlerocket/kernel-devel/%{version}/scripts
@@ -569,6 +599,9 @@ install -p -m 0644 %{S:222} %{S:224} %{buildroot}%{_cross_unitdir}
 %{_cross_kmoddir}/build
 %attr(775, root, builder) %{_cross_ksrcdir}/scripts/*
 
+%files fips
+%{_cross_unitdir}/check-fips-modules.service.d/*.conf
+
 %files bootconfig-aws
 %{_cross_bootconfigdir}/05-aws.conf