feat: backport kernel 6.10 form yocto 5.1

[fnerdman]

No description provided.

[MoeMahhouk]

small nit: The title refers to the current yocto as 5.1 but we actually running version 6.6.35.

[fnerdman]

with yocto version 5.1 I'm referring to the yocto version. Scarthgap is 5.0.3, the next non LTS release is 5.1. Ofc. kernel version is different here.

[MoeMahhouk]

the CVE exclusion list seems quite big.
Could you refer me to where you got it and are all the listed vulnerabilities in it false-positives or accepted risks?

[fnerdman]

sure: https://git.openembedded.org/openembedded-core/commit/?id=0b47b5900df9b808a7fe47b8c5054164b579ec00

[MoeMahhouk]

this seems a duplicate to the one from line 7

[fnerdman]

Mitigation config parameters have been renamed in kernel 6.9: https://www.phoronix.com/news/Linux-6.9-CONFIG-MITIGATIONS

[MoeMahhouk]

It looks good to me but have you tested it with building the whole image with some evm layers or searcher layer to see if nothing break them?
Specially the meta-custom-podman layer adds some necessary kernel configurations for it to work. I wonder if that would break or is still backward compatible. It is probably important for the other projects

[fnerdman]

Haven't tested this yet, no.

These are the warnings I get when compiling linux-tiny with 6.10:

WARNING: linux-yocto-tiny-6.10+git-r0 do_kernel_configcheck: [kernel config]: This BSP contains fragments with warnings:


[INFO]: Fragments with badly formatted configuration options:
    - fragment configs/v6.10/standard/tiny/./security-mitigations.cfg has the following issues: # CONFIG_FINEIBT should consider enabling this at some point - above are 6.8 and lower, below are 6.9 and higher configurations

[INFO]: the following symbols were not found in the active configuration:
     - CONFIG_EMBEDDED
     - CONFIG_SPECULATION_MITIGATIONS
     - CONFIG_PAGE_TABLE_ISOLATION
     - CONFIG_RETPOLINE
     - CONFIG_RETHUNK
     - CONFIG_CPU_UNRET_ENTRY
     - CONFIG_CALL_DEPTH_TRACKING
     - CONFIG_CPU_IBPB_ENTRY
     - CONFIG_CPU_IBRS_ENTRY
     - CONFIG_CPU_SRSO
     - CONFIG_SLS
     - CONFIG_GDS_FORCE_MITIGATION

These are all vars that have been replaced in 6.9 (except of the embedded one, but that has been there before)
So, we can try to at least build the bob vm and see what the output of kernel compilation will be.