[Buildroot] [PATCH 0/1] package/e2fsprogs: fix fsverity build error slightly differently

[Buildroot] [PATCH 0/1] package/e2fsprogs: fix fsverity build error slightly differently

[Markus Mayer via buildroot]

This is the follow-up to the mailing list discussion at [1].

The only thing I undid about Thomas' patch was to remove
0001-configure.ac-check-for-FS_IOC_READ_VERITY_METADATA-a.patch

The change to e2fsprogs.mk remains with the comment slightly tweaked.

Please feel free to adjust the commit message if needed.

[1]: https://lists.buildroot.org/pipermail/buildroot/2025-November/790482.html

Markus Mayer (1):
  package/e2fsprogs: fix fsverity build error slightly differently

 ...ck-for-FS_IOC_READ_VERITY_METADATA-a.patch | 103 --------------
 .../0001-lib-add-kern_compat.h.patch          | 134 ++++++++++++++++++
 package/e2fsprogs/0002-Generated-files.patch  |  63 ++++++++
 package/e2fsprogs/e2fsprogs.mk                |   4 +-
 4 files changed, 199 insertions(+), 105 deletions(-)
 delete mode 100644 package/e2fsprogs/0001-configure.ac-check-for-FS_IOC_READ_VERITY_METADATA-a.patch
 create mode 100644 package/e2fsprogs/0001-lib-add-kern_compat.h.patch
 create mode 100644 package/e2fsprogs/0002-Generated-files.patch

-- 
2.51.2

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [PATCH 1/1] package/e2fsprogs: fix fsverity build error slightly differently

[Markus Mayer via buildroot]

Turns out Thomas and I were working concurrently on two different ways
to fix the e2fsprogs 1.47.3 build error with regards to fsverity not
being present in older kernels.

Thomas' patch disables the fsverity functionality in e2fsprogs based on
the kernel headers used for compilation while my patch aims to provide
the missing definitions if the kernel doesn't.

By providing the missing definitions whenever the kernel headers don't,
fsverity related features can be compiled in even if the kernel headers
are too old. This allows binaries to run on newer kernels with full
functionality, but it relies on e2fsprogs to properly handle -ENOTSUPP
errors at runtime if the kernel doesn't support the ioctl.[1]

We both submitted our respective patches to Ted T'so but haven't heard
back as of yet. After a brief discussion on the Buildroot mailing list,
we are trying my approach for now.

[1]: Compiling binaries against older kernel headers, but exclusively
running them on newer kernels, can happen if one's toolchain comes with
older kernel headers in the sysroot for increased compatibility across
multiple kernel versions (e.g. the same toolchain & sysroot are used to
build root file systems with Linux 5.4 and 6.12).

Signed-off-by: Markus Mayer <mmayer@broadcom.com>
---
 ...ck-for-FS_IOC_READ_VERITY_METADATA-a.patch | 103 --------------
 .../0001-lib-add-kern_compat.h.patch          | 134 ++++++++++++++++++
 package/e2fsprogs/0002-Generated-files.patch  |  63 ++++++++
 package/e2fsprogs/e2fsprogs.mk                |   4 +-
 4 files changed, 199 insertions(+), 105 deletions(-)
 delete mode 100644 package/e2fsprogs/0001-configure.ac-check-for-FS_IOC_READ_VERITY_METADATA-a.patch
 create mode 100644 package/e2fsprogs/0001-lib-add-kern_compat.h.patch
 create mode 100644 package/e2fsprogs/0002-Generated-files.patch

diff --git a/package/e2fsprogs/0001-configure.ac-check-for-FS_IOC_READ_VERITY_METADATA-a.patch b/package/e2fsprogs/0001-configure.ac-check-for-FS_IOC_READ_VERITY_METADATA-a.patch
deleted file mode 100644
index 36442a53b81e..000000000000
--- a/package/e2fsprogs/0001-configure.ac-check-for-FS_IOC_READ_VERITY_METADATA-a.patch
+++ /dev/null
@@ -1,103 +0,0 @@
-From 1a2ce8cd956065106ae27a36a5000f00ebc4591f Mon Sep 17 00:00:00 2001
-From: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
-Date: Sat, 22 Nov 2025 21:12:23 +0100
-Subject: [PATCH] configure.ac: check for FS_IOC_READ_VERITY_METADATA
- availability
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Commit 6bfa843b4435334ac073e42950b48d8bacb54977 ("mke2fs: enable
-copying of fs-verity metadata") introduced support for reading
-fs-verity metadata, which requires using the
-FS_IOC_READ_VERITY_METADATA.
-
-The code is conditionally compiled when the kernel headers have
-<linux/fsverity.h> available. Unfortunately, this check is not
-sufficient: <linux/fsverity.h> was introduced in Linux 5.10, but the
-FS_IOC_READ_VERITY_METADATA was not introduced before 5.12, so if one
-is using 5.10 or 5.11 kernel headers, the build fails with:
-
-./../misc/create_inode.c: In function ‘copy_fs_verity_data’:
-./../misc/create_inode.c:589:10: error: variable ‘arg’ has initializer but incomplete type
-  589 |   struct fsverity_read_metadata_arg arg = {
-      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~
-[...]
-./../misc/create_inode.c:600:20: error: ‘FS_IOC_READ_VERITY_METADATA’ undeclared (first use in this function)
-  600 |   size = ioctl(fd, FS_IOC_READ_VERITY_METADATA, &arg);
-      |                    ^~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-This commit therefore extends the configure.ac check to ensure that
-not only <linux/fsverity.h> exists but also that it defines the
-FS_IOC_READ_VERITY_METADATA ioctl.
-
-Upstream: https://github.com/tytso/e2fsprogs/pull/256
-Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
----
- configure.ac        | 18 ++++++++++++++++++
- misc/create_inode.c |  6 +++---
- 2 files changed, 21 insertions(+), 3 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index a0171163..3e5586a3 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -1997,6 +1997,24 @@ OS_IO_FILE=""
- esac]
- AC_SUBST(OS_IO_FILE)
- 
-+dnl Check for fsverity ioctl
-+if test "${ac_cv_header_linux_fsverity_h}" = "yes"; then
-+   AC_MSG_CHECKING([for FS_IOC_READ_VERITY_METADATA ioctl])
-+   AC_PREPROC_IFELSE(
-+   [AC_LANG_PROGRAM([[
-+#include <linux/fsverity.h>
-+#ifndef FS_IOC_READ_VERITY_METADATA
-+# error "FS_IOC_READ_VERITY_METADATA not available"
-+#endif
-+]], [])], [
-+   AC_DEFINE([HAVE_FS_IOC_READ_VERITY_METADATA], [1], [Define to 1 if FS_IOC_READ_VERITY_METADATA ioctl is available])
-+   AC_MSG_RESULT([yes])
-+   ],
-+   [
-+   AC_MSG_RESULT([no])
-+   ])
-+fi
-+
- dnl
- dnl Make our output files, being sure that we create the some miscellaneous 
- dnl directories
-diff --git a/misc/create_inode.c b/misc/create_inode.c
-index 624efc03..a7918873 100644
---- a/misc/create_inode.c
-+++ b/misc/create_inode.c
-@@ -30,7 +30,7 @@
- #ifdef HAVE_SYS_SYSMACROS_H
- #include <sys/sysmacros.h>
- #endif
--#ifdef HAVE_LINUX_FSVERITY_H
-+#if defined(HAVE_LINUX_FSVERITY_H) && defined(HAVE_FS_IOC_READ_VERITY_METADATA)
- #include <linux/fsverity.h>
- #include <linux/fs.h>
- #endif
-@@ -569,7 +569,7 @@ out:
- }
- #endif /* FS_IOC_FIEMAP */
- 
--#ifdef HAVE_LINUX_FSVERITY_H
-+#if defined(HAVE_LINUX_FSVERITY_H) && defined(HAVE_FS_IOC_READ_VERITY_METADATA)
- static inline off_t round_up(off_t n, off_t blksz, off_t bias)
- {
-   return ((n - bias + (blksz - 1)) & ~(blksz - 1)) + bias;
-@@ -738,7 +738,7 @@ static errcode_t copy_file(ext2_filsys fs, int fd, struct stat *statbuf,
- 		err = copy_file_chunk(fs, fd, e2_file, 0, statbuf->st_size, buf,
- 				      zerobuf);
- 
--#ifdef HAVE_LINUX_FSVERITY_H
-+#if defined(HAVE_LINUX_FSVERITY_H) && defined(HAVE_FS_IOC_READ_VERITY_METADATA)
- 	if (!err && (flags & EXT4_VERITY_FL))
- 		err = copy_fs_verity(fs, fd, e2_file, statbuf->st_size);
- #endif
--- 
-2.51.1
-
diff --git a/package/e2fsprogs/0001-lib-add-kern_compat.h.patch b/package/e2fsprogs/0001-lib-add-kern_compat.h.patch
new file mode 100644
index 000000000000..50d019bcbead
--- /dev/null
+++ b/package/e2fsprogs/0001-lib-add-kern_compat.h.patch
@@ -0,0 +1,134 @@
+From 0b369bce2318921cf99455df516f0981d7d4f9f3 Mon Sep 17 00:00:00 2001
+From: Markus Mayer <mmayer@broadcom.com>
+Date: Fri, 21 Nov 2025 12:17:08 -0800
+Subject: [PATCH 1/2] lib: add kern_compat.h
+To: Ted Ts'o <tytso@mit.edu>
+
+Add a new header file (lib/kern_compat.h) to declare data structures and
+constants from the Linux kernel that may not be present in older kernels
+but are needed by e2fsprogs.
+
+Providing a fallback mechanism to declare these data structures and
+constants allows users to compile e2fsprogs against older kernel headers
+for increased compatibility. In addition, e2fsprogs built against older
+kernels will still have all of its functionality when running on a newer
+system.
+
+Some e2fsprogs tools may experience runtime failures on older kernels
+(rather than compile time failures), if an ioctl is not supported, for
+instance.
+
+Signed-off-by: Markus Mayer <mmayer@broadcom.com>
+---
+ configure.ac        | 10 +++++++
+ lib/kern_compat.h   | 63 +++++++++++++++++++++++++++++++++++++++++++++
+ misc/create_inode.c |  2 ++
+ 3 files changed, 75 insertions(+)
+ create mode 100644 lib/kern_compat.h
+
+diff --git a/configure.ac b/configure.ac
+index bdd5f1f69d26..f2e0291b0887 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -1177,6 +1177,16 @@ dnl
+ AC_CHECK_HEADERS([inttypes.h])
+ AC_CHECK_TYPES(intptr_t)
+ dnl
++dnl Check if we need to declare some newer kernel structs ourselves
++dnl
++AC_CHECK_TYPE(struct fsverity_descriptor,[AC_DEFINE(HAVE_FSVERITY_DESCRIPTOR, 1,
++		[Define to 1 if struct fsverity_descriptor is declared])],,
++		[#include <linux/fsverity.h>])
++AC_CHECK_TYPE(struct fsverity_read_metadata_arg,
++		[AC_DEFINE(HAVE_FSVERITY_READ_METADATA_ARG, 1,
++		[Define to 1 if struct fsverity_read_metadata_arg is declared])],,
++		[#include <linux/fsverity.h>])
++dnl
+ dnl See if struct stat has a st_flags field, in which case we can get file
+ dnl flags somewhat portably.  Also check for the analogous setter, chflags().
+ dnl
+diff --git a/lib/kern_compat.h b/lib/kern_compat.h
+new file mode 100644
+index 000000000000..c263185d5614
+--- /dev/null
++++ b/lib/kern_compat.h
+@@ -0,0 +1,63 @@
++/*
++ * kern_compat.h - declare structs and constants unavailable in older kernels
++ *
++ * The definitions in this file were taken straight from linux/fsverity.h. The
++ * "#ifdef __KERNEL" directives have been removed.
++ */
++
++/*
++ * Introduced into the kernel by
++ *     commit bde493349025ca0559e2fff88592935af3b8df19
++ *     Author: Eric Biggers <ebiggers@google.com>
++ *     Date:   Fri Nov 13 13:19:18 2020 -0800
++ *
++ *     fs-verity: move structs needed for file signing to UAPI header
++ * for Linux 5.11.
++ */
++#ifndef HAVE_FSVERITY_DESCRIPTOR
++struct fsverity_descriptor {
++	__u8 version;		/* must be 1 */
++	__u8 hash_algorithm;	/* Merkle tree hash algorithm */
++	__u8 log_blocksize;	/* log2 of size of data and tree blocks */
++	__u8 salt_size;		/* size of salt in bytes; 0 if none */
++	__le32 __reserved_0x04;	/* must be 0 */
++	__le64 data_size;	/* size of file the Merkle tree is built over */
++	__u8 root_hash[64];	/* Merkle tree root hash */
++	__u8 salt[32];		/* salt prepended to each hashed block */
++	__u8 __reserved[144];	/* must be 0's */
++};
++#endif
++
++/*
++ * Introduced into the kernel by
++ *     commit e17fe6579de023725ec22a16965e9099e4a05ac9
++ *     Author: Eric Biggers <ebiggers@google.com>
++ *     Date:   Fri Jan 15 10:18:16 2021 -0800
++ *
++ *     fs-verity: add FS_IOC_READ_VERITY_METADATA ioctl
++ * for Linux 5.12.
++ */
++#ifndef HAVE_FSVERITY_READ_METADATA_ARG
++struct fsverity_read_metadata_arg {
++	__u64 metadata_type;
++	__u64 offset;
++	__u64 length;
++	__u64 buf_ptr;
++	__u64 __reserved;
++};
++#endif
++
++#ifndef FS_VERITY_METADATA_TYPE_MERKLE_TREE
++#define FS_VERITY_METADATA_TYPE_MERKLE_TREE	1
++#endif
++#ifndef FS_VERITY_METADATA_TYPE_DESCRIPTOR
++#define FS_VERITY_METADATA_TYPE_DESCRIPTOR	2
++#endif
++#ifndef FS_VERITY_METADATA_TYPE_SIGNATURE
++#define FS_VERITY_METADATA_TYPE_SIGNATURE	3
++#endif
++
++#ifndef FS_IOC_READ_VERITY_METADATA
++#define FS_IOC_READ_VERITY_METADATA \
++	_IOWR('f', 135, struct fsverity_read_metadata_arg)
++#endif
+diff --git a/misc/create_inode.c b/misc/create_inode.c
+index 624efc0380a4..77fdcceccca1 100644
+--- a/misc/create_inode.c
++++ b/misc/create_inode.c
+@@ -45,6 +45,8 @@
+ 
+ #include "create_inode_libarchive.h"
+ 
++#include "kern_compat.h"
++
+ /* 64KiB is the minimum blksize to best minimize system call overhead. */
+ #define COPY_FILE_BUFLEN	65536
+ 
+-- 
+2.51.2
+
diff --git a/package/e2fsprogs/0002-Generated-files.patch b/package/e2fsprogs/0002-Generated-files.patch
new file mode 100644
index 000000000000..145b9fbad9f9
--- /dev/null
+++ b/package/e2fsprogs/0002-Generated-files.patch
@@ -0,0 +1,63 @@
+From 9e152290af8f81f4bebaf8c2d1c2ae648d1f1dcc Mon Sep 17 00:00:00 2001
+From: Markus Mayer <mmayer@broadcom.com>
+Date: Fri, 21 Nov 2025 13:17:28 -0800
+Subject: [PATCH 2/2] Generated files
+To: Ted Ts'o <tytso@mit.edu>
+
+Files automatically generated by the changes from the previous commit.
+
+Signed-off-by: Markus Mayer <mmayer@broadcom.com>
+---
+ configure       | 18 ++++++++++++++++++
+ lib/config.h.in |  6 ++++++
+ 2 files changed, 24 insertions(+)
+
+diff --git a/configure b/configure
+index 2ed61db3602d..63ece1f68b11 100755
+--- a/configure
++++ b/configure
+@@ -13091,6 +13091,24 @@ then :
+ printf "%s\n" "#define HAVE_INTPTR_T 1" >>confdefs.h
+ 
+ 
++fi
++
++ac_fn_c_check_type "$LINENO" "struct fsverity_read_metadata_arg" "ac_cv_type_struct_fsverity_read_metadata_arg" "#include <linux/fsverity.h>
++"
++if test "x$ac_cv_type_struct_fsverity_read_metadata_arg" = xyes
++then :
++
++printf "%s\n" "#define HAVE_FSVERITY_READ_METADATA_ARG 1" >>confdefs.h
++
++fi
++
++ac_fn_c_check_type "$LINENO" "struct fsverity_descriptor" "ac_cv_type_struct_fsverity_descriptor" "#include <linux/fsverity.h>
++"
++if test "x$ac_cv_type_struct_fsverity_descriptor" = xyes
++then :
++
++printf "%s\n" "#define HAVE_FSVERITY_DESCRIPTOR 1" >>confdefs.h
++
+ fi
+ 
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether struct stat has a st_flags field" >&5
+diff --git a/lib/config.h.in b/lib/config.h.in
+index 480717abd9b4..494c2a4b5a43 100644
+--- a/lib/config.h.in
++++ b/lib/config.h.in
+@@ -127,6 +127,12 @@
+ /* Define to 1 if you have the `fstat64' function. */
+ #undef HAVE_FSTAT64
+ 
++/* Define to 1 if struct fsverity_descriptor is declared */
++#undef HAVE_FSVERITY_DESCRIPTOR
++
++/* Define to 1 if struct fsverity_read_metadata_arg is declared */
++#undef HAVE_FSVERITY_READ_METADATA_ARG
++
+ /* Define to 1 if you have the `fsync' function. */
+ #undef HAVE_FSYNC
+ 
+-- 
+2.51.2
+
diff --git a/package/e2fsprogs/e2fsprogs.mk b/package/e2fsprogs/e2fsprogs.mk
index ad3d1dbe75b3..276b84c75a00 100644
--- a/package/e2fsprogs/e2fsprogs.mk
+++ b/package/e2fsprogs/e2fsprogs.mk
@@ -18,8 +18,8 @@ E2FSPROGS_INSTALL_STAGING = YES
 E2FSPROGS_DEPENDENCIES = host-pkgconf util-linux
 HOST_E2FSPROGS_DEPENDENCIES = host-pkgconf host-util-linux
 
-# 0001-configure.ac-check-for-FS_IOC_READ_VERITY_METADATA-a.patch
-# the additional dependencies are only needed for autoreconf
+# We have patches that require us to run autoreconf. The additional dependencies
+# are only needed for that.
 E2FSPROGS_AUTORECONF = YES
 E2FSPROGS_AUTORECONF_OPTS = --include=$(HOST_DIR)/share/autoconf-archive
 E2FSPROGS_DEPENDENCIES += host-gettext host-autoconf-archive
-- 
2.51.2

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] package/e2fsprogs: fix fsverity build error slightly differently

[Thomas Petazzoni via buildroot]

Hello Markus,

On Thu, Dec 04, 2025 at 04:30:04PM -0800, Markus Mayer via buildroot wrote:
> Turns out Thomas and I were working concurrently on two different ways
> to fix the e2fsprogs 1.47.3 build error with regards to fsverity not
> being present in older kernels.
> 
> Thomas' patch disables the fsverity functionality in e2fsprogs based on
> the kernel headers used for compilation while my patch aims to provide
> the missing definitions if the kernel doesn't.
> 
> By providing the missing definitions whenever the kernel headers don't,
> fsverity related features can be compiled in even if the kernel headers
> are too old. This allows binaries to run on newer kernels with full
> functionality, but it relies on e2fsprogs to properly handle -ENOTSUPP
> errors at runtime if the kernel doesn't support the ioctl.[1]
> 
> We both submitted our respective patches to Ted T'so but haven't heard
> back as of yet. After a brief discussion on the Buildroot mailing list,
> we are trying my approach for now.
> 
> [1]: Compiling binaries against older kernel headers, but exclusively
> running them on newer kernels, can happen if one's toolchain comes with
> older kernel headers in the sysroot for increased compatibility across
> multiple kernel versions (e.g. the same toolchain & sysroot are used to
> build root file systems with Linux 5.4 and 6.12).
> 
> Signed-off-by: Markus Mayer <mmayer@broadcom.com>

Since then, my patch has been accepted and merged by Ted Tso:

  https://github.com/tytso/e2fsprogs/commit/4aba12dc19a95626eb7fa1df2d19c5235c2bc848

And it was integrated into Buildroot as well. Since we no longer have
any build failure in Buildroot, I think to be convinced that another
approach is needed, you should first convince upstream first that your
approach is better. Therefore, I will mark your Buildroot patch as
Rejected, but if you get your patches merged upstream, we will
obviously be happy to backport them in Buildroot (until a new
e2fsprogs release contains them, of course).

Best regards,

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot