Build wireguard-linux-compat on SLES15 (s390x)

Build wireguard-linux-compat on SLES15 (s390x)

[Faustin Lammler]

[-- Attachment #1: Type: text/plain, Size: 2845 bytes --]

Hi!

I am trying to compile wireguard-linux-compat on SLES15 (s390x) without
success. Maybe I should try to install it directly from packages but I
am not expert with SLES and I did not find how so far.

I managed to install wireguard-tools but the kernel does not provide
the wireguard module, see bellow:
| $ uname -r
| 5.3.18-24.83-default
| $ lsmod | grep wireguard
| $ sudo wg-quick up /etc/wireguard/wg0.conf
| [#] ip link add wg0 type wireguard
| Error: Unknown device type.
| Unable to access interface: Protocol not supported
| [#] ip link delete dev wg0
| Cannot find device "wg0"

Here is the build error:
| $ cd /tmp && git clone https://git.zx2c4.com/wireguard-linux-compat
| $ make -C wireguard-linux-compat/src -j$(nproc)
| make: Entering directory '/tmp/wireguard-linux-compat/src'
|   CC [M]  /tmp/wireguard-linux-compat/src/main.o
|   CC [M]  /tmp/wireguard-linux-compat/src/noise.o
|   CC [M]  /tmp/wireguard-linux-compat/src/device.o
|   CC [M]  /tmp/wireguard-linux-compat/src/peer.o
|   CC [M]  /tmp/wireguard-linux-compat/src/timers.o
|   CC [M]  /tmp/wireguard-linux-compat/src/queueing.o
|   CC [M]  /tmp/wireguard-linux-compat/src/send.o
|   CC [M]  /tmp/wireguard-linux-compat/src/receive.o
|   CC [M]  /tmp/wireguard-linux-compat/src/socket.o
|   CC [M]  /tmp/wireguard-linux-compat/src/peerlookup.o
|   CC [M]  /tmp/wireguard-linux-compat/src/allowedips.o
|   CC [M]  /tmp/wireguard-linux-compat/src/ratelimiter.o
|   CC [M]  /tmp/wireguard-linux-compat/src/cookie.o
|   CC [M]  /tmp/wireguard-linux-compat/src/netlink.o
|   CC [M]  /tmp/wireguard-linux-compat/src/crypto/zinc/chacha20/chacha20.o
|   CC [M]  /tmp/wireguard-linux-compat/src/crypto/zinc/poly1305/poly1305.o
|   CC [M]  /tmp/wireguard-linux-compat/src/crypto/zinc/chacha20poly1305.o
| In file included from <command-line>:
| /tmp/wireguard-linux-compat/src/compat/compat.h:859:31: error: expected identifier or ‘(’ before ‘{’ token
|   859 | #define genl_dumpit_info(cb) ({ \
|       |                               ^
| /usr/src/linux-5.3.18-24.83/include/net/genetlink.h:138:1: note: in expansion of macro ‘genl_dumpit_info’
|   138 | genl_dumpit_info(struct netlink_callback *cb)
|       | ^~~~~~~~~~~~~~~~
| make[3]: *** [/usr/src/linux-5.3.18-24.83/scripts/Makefile.build:282: /tmp/wireguard-linux-compat/src/netlink.o] Error 1
| make[3]: *** Waiting for unfinished jobs....
| make[2]: *** [/usr/src/linux-5.3.18-24.83/Makefile:1655: _module_/tmp/wireguard-linux-compat/src] Error 2
| make[1]: *** [../../../linux-5.3.18-24.83/Makefile:179: sub-make] Error 2
| make: *** [Makefile:26: module] Error 2
| make: Leaving directory '/tmp/wireguard-linux-compat/src'

Any help would be really appreciated.
Cheers!

-- 
Faustin
GPG: F652 BCD1 1AA8 8975 F010 48A5 390A 2F27 832A 5C79

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: Build wireguard-linux-compat on SLES15 (s390x)

[Faustin Lammler]

[-- Attachment #1: Type: text/plain, Size: 350 bytes --]

Hi!

FYI,
I have managed to build wireguard by removing the #define.
https://git.zx2c4.com/wireguard-linux-compat/tree/src/compat/compat.h#n859

I am not a C dev, so I am not sure what the implications are but I
understand that it's a kind of debugging structure and it's also not
defined on CENTOS8 so, I guess it should be OK.

Cheers!

--
Faustin

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: Build wireguard-linux-compat on SLES15 (s390x)

[CW]

Hi,
If I didn’t remember wrong, wg should be included in kernel with 15sp3.


Sent from my iPhone


> On 19 Oct 2021, at 12:05, Faustin Lammler <faustin@fala.red> wrote:
> 
> Hi!
> 
> FYI,
> I have managed to build wireguard by removing the #define.
> https://git.zx2c4.com/wireguard-linux-compat/tree/src/compat/compat.h#n859
> 
> I am not a C dev, so I am not sure what the implications are but I
> understand that it's a kind of debugging structure and it's also not
> defined on CENTOS8 so, I guess it should be OK.
> 
> Cheers!
> 
> --
> Faustin

Re: Build wireguard-linux-compat on SLES15 (s390x)

[Jason A. Donenfeld]

Hi Faustin,

Isn't WireGuard already in the SLES kernel?

Jason

Re: Build wireguard-linux-compat on SLES15 (s390x)

[Faustin Lammler]

[-- Attachment #1: Type: text/plain, Size: 608 bytes --]

Hi Jason!

"Jason A. Donenfeld" <Jason@zx2c4.com>,
19/10/2021 – 17:51:01 (-0600):

> Isn't WireGuard already in the SLES kernel?

My understanding is that it should, that's why I was surprised to have
to build it. But apparently not.

This may be related to a specific kernel from IBM LinuxONE cloud
infrastructure?

| $ uname -r
| 5.3.18-24.86-default

But again, my knowledge of SLES is very limited (and s390x architecture
even more) so I don't have any idea why this was needed.

I'll be happy to help you if you need me to do some tests on the
machine.

Cheers!

-- 
Faustin

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: Build wireguard-linux-compat on SLES15 (s390x)

[Samu Voutilainen]

[-- Attachment #1: Type: text/plain, Size: 396 bytes --]

Faustin Lammler kirjoitti keskiviikkona 20. lokakuuta 2021 12.00.48 EEST:
> Hi Jason!
> 
> My understanding is that it should, that's why I was surprised to have
> to build it. But apparently not.
> 
> This may be related to a specific kernel from IBM LinuxONE cloud
> infrastructure?
> 

Hi,

At least on x86_64 SLE, the module is in kernel-*-extra package, for example 
in kernel-default-extra.

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: Build wireguard-linux-compat on SLES15 (s390x)

[Jason A. Donenfeld]

Hi Daniel,

Do you think you could chime in here regarding the apparent absence of
wireguard on s390x? The thread began as a discussion of building it
yourself there, but I'm wondering why it isn't already there, seeing
as it's on the other archs.

Jason

On Wed, Oct 20, 2021 at 3:01 AM Faustin Lammler <faustin@fala.red> wrote:
>
> Hi Jason!
>
> "Jason A. Donenfeld" <Jason@zx2c4.com>,
> 19/10/2021 – 17:51:01 (-0600):
>
> > Isn't WireGuard already in the SLES kernel?
>
> My understanding is that it should, that's why I was surprised to have
> to build it. But apparently not.
>
> This may be related to a specific kernel from IBM LinuxONE cloud
> infrastructure?
>
> | $ uname -r
> | 5.3.18-24.86-default
>
> But again, my knowledge of SLES is very limited (and s390x architecture
> even more) so I don't have any idea why this was needed.
>
> I'll be happy to help you if you need me to do some tests on the
> machine.
>
> Cheers!
>
> --
> Faustin

Re: Build wireguard-linux-compat on SLES15 (s390x)

[Faustin Lammler]

[-- Attachment #1: Type: text/plain, Size: 387 bytes --]

Samu Voutilainen <wireguard@smar.fi>,
20/10/2021 – 19:25:49 (+0300):

> At least on x86_64 SLE, the module is in kernel-*-extra package, for example 
> in kernel-default-extra.

Zypper does show kernel-default-extra but:
| kernel-default-base | The Standard Kernel - base modules | package

That is not installed, maybe this is where the wireguard module is?

-- 
Faustin

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: Build wireguard-linux-compat on SLES15 (s390x)

[Samu Voutilainen]

[-- Attachment #1: Type: text/plain, Size: 968 bytes --]

Faustin Lammler kirjoitti torstaina 21. lokakuuta 2021 10.44.28 EEST:
> Samu Voutilainen <wireguard@smar.fi>,
> 
> 20/10/2021 – 19:25:49 (+0300):
> > At least on x86_64 SLE, the module is in kernel-*-extra package, for
> > example in kernel-default-extra.
> 
> Zypper does show kernel-default-extra but:
> | kernel-default-base | The Standard Kernel - base modules | package
> 
> That is not installed, maybe this is where the wireguard module is?

kernel-default-base is kind of minimal version of default kernel, usable in 
certain virtualization setups, for example. 

Actually it looks like in SLE-15-SP3 wireguard.ko is in kernel-default rather 
in -extra. That was case in SP2.

$ rpm -ql kernel-default | ag wireguard.ko
/lib/modules/5.3.18-59.27-default/kernel/drivers/net/wireguard/wireguard.ko.xz

If the module is not present, maybe it is not compiled for s390x. Maybe SUSE’s 
support could enlighten why such choice has been made?

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: Build wireguard-linux-compat on SLES15 (s390x)

[Faustin Lammler]

[-- Attachment #1: Type: text/plain, Size: 707 bytes --]

Hi Samu!

Samu Voutilainen <wireguard@smar.fi>,
21/10/2021 – 11:07:44 (+0300):

> kernel-default-base is kind of minimal version of default kernel, usable in 
> certain virtualization setups, for example. 
> 
> Actually it looks like in SLE-15-SP3 wireguard.ko is in kernel-default rather 
> in -extra. That was case in SP2.
> 
> $ rpm -ql kernel-default | ag wireguard.ko
> /lib/modules/5.3.18-59.27-default/kernel/drivers/net/wireguard/wireguard.ko.xz
Ok, thanks you.

> If the module is not present, maybe it is not compiled for s390x. Maybe SUSE’s 
> support could enlighten why such choice has been made?
I believe that Jason already asked Daniel to check for it.

-- 
Faustin

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: Build wireguard-linux-compat on SLES15 (s390x)

[Daniel Wagner]

Hi,

On Wed, Oct 20, 2021 at 11:56:49AM -0600, Jason A. Donenfeld wrote:
> Do you think you could chime in here regarding the apparent absence of
> wireguard on s390x? The thread began as a discussion of building it
> yourself there, but I'm wondering why it isn't already there, seeing
> as it's on the other archs.

Sure, let me try to figure out what's happening. I usually try to stay
away from them the distro making business, so it's a bit of a closed
book for me.

> On Wed, Oct 20, 2021 at 3:01 AM Faustin Lammler <faustin@fala.red> wrote:
> >
> > Hi Jason!
> >
> > "Jason A. Donenfeld" <Jason@zx2c4.com>,
> > 19/10/2021 – 17:51:01 (-0600):
> >
> > > Isn't WireGuard already in the SLES kernel?
> >
> > My understanding is that it should, that's why I was surprised to have
> > to build it. But apparently not.
> >
> > This may be related to a specific kernel from IBM LinuxONE cloud
> > infrastructure?
> >
> > | $ uname -r
> > | 5.3.18-24.86-default

This is SLE15-SP2 and the corresponding branch has the patches and the
s390x config does have CONFIG_WIREGUARD=m. So this looks good.

  https://github.com/openSUSE/kernel-source/tree/SLE15-SP2/patches.suse

grep for bsc#1169021 to see the list.

> > But again, my knowledge of SLES is very limited (and s390x architecture
> > even more) so I don't have any idea why this was needed.
> >
> > I'll be happy to help you if you need me to do some tests on the
> > machine.

I see the module is marked as not supported in supported.conf. After
looking at our spec file, I think the modules is packaged into the
kernel-extra rpm. At it might be that you need to enable the not
supported modules explicitly:

from https://github.com/openSUSE/kernel-source/blob/master/rpm/kernel-binary.spec.in

%if 0%{?sle_version} >= 150000
    # By default, loading unsupported modules is disabled on SLE through
    # /etc/modprobe.d/10-unsupported-modules.conf from the suse-module-tools
    # package.
    # modules in kernel-$flavor-extra don't have the supported flag set,
    # yet loading them should be possible if the package is installed.
    # CAUTION PACKAGERS: The file content below must not change between
    # kernel versions, otherwise file conflicts might arise with
    # multiversion(kernel).

    mkdir -p %buildroot/etc/modprobe.d
    cat >%buildroot/etc/modprobe.d/20-kernel-%{build_flavor}-extra.conf <<EOF
# This file overrides the default from 10-unsupported-modules.conf.
# This is necessary to load kernel modules from the
# kernel-%{build_flavor}-extra package.
#
# WARNING: loading unsupported modules may compromise SLE support.
# Please read the comments in 10-unsupported-modules.conf.
allow_unsupported_modules 1
EOF
    echo "%%dir /etc/modprobe.d" >> %my_builddir/kernel-extra.files
    echo '%%config(noreplace) /etc/modprobe.d/20-kernel-%{build_flavor}-extra.conf' >> %my_builddir/kernel-extra.files
%endif

HTH,
Daniel