kernel: enable CONFIG_CRYPTO_DH in aarch64

[tobiasb-ms]

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

• The toolchain has been rebuilt successfully (or no changes were made to it)
• The toolchain/worker package manifests are up-to-date
• Any updated packages successfully build (or no packages were changed)
• Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
• Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
• All package sources are available
• cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
• LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
• All source files have up-to-date hashes in the *.signatures.json files
• sudo make go-tidy-all and sudo make go-test-coverage pass
• Documentation has been updated to match any changes to the build system
• Ready to merge

---

Summary

Add the dh kernel module (CONFIG_CRYPTO_DH) to the aarch64 kernel configuration. This is required for fips images, and is already present in the amd64 config, and has never been present in arm64.

KConfig for CONFIG_CRYPTO_DH is present in many distros.

See "validation" section of PR notes for validations I've done.

Change Log

• Enabled CONFIG_CRYPTO_DH in module mode in the aarch64 kernel configuration in both kernel and kernel-64k.
• Bumped version of various kernel-related packages.

Does this affect the toolchain?

NO

Associated Issues

• https://microsoft.visualstudio.com/OS/_workitems/edit/55493874

Test Methodology

• Ran "big build" -- root: https://dev.azure.com/mariner-org/mariner/_build/results?buildId=707384&view=results
• Upgraded kernel on azure arm64 and amd64 vms and confirmed they boot.
• Network is clearly working, since they're in the cloud and I had to ssh into them.
• Put both in FIPS mode and confirmed they boot and FIPS checks are performed.

Various pieces of information (only from arm64 vm):
BEFORE upgrading kernel:

$ lsmod | grep dh
<no output>

$ modinfo dh
modinfo: ERROR: Module dh not found.

$ systemd-analyze
Startup finished in 994ms (kernel) + 1.508s (initrd) + 35.822s (userspace) = 38.324s 
graphical.target reached after 35.264s in userspace.

$ sudo ls -l /boot/ | grep vmlinuz
-rw------- 1 root root 48661352 Dec  5 20:57 vmlinuz-6.6.57.1-5.azl3
$ sudo ls -lh /boot/ | grep vmlinuz
-rw------- 1 root root  47M Dec  5 20:57 vmlinuz-6.6.57.1-5.azl3

AFTER upgrading kernel and rebooting:

$ lsmod | grep dh
<no output>

$ modinfo dh
filename:       /lib/modules/6.6.57.1-8.azl3/kernel/crypto/dh_generic.ko.xz
description:    DH generic algorithm
license:        GPL
alias:          crypto-dh
alias:          dh
depends:
intree:         Y
name:           dh_generic
vermagic:       6.6.57.1-8.azl3 SMP mod_unload modversions aarch64
sig_id:         PKCS#7
signer:
sig_key:
sig_hashalgo:   unknown
signature:

$ systemd-analyze
Startup finished in 942ms (kernel) + 1.524s (initrd) + 7.807s (userspace) = 10.274s
graphical.target reached after 7.397s in userspace.

$ sudo ls -l /boot/ | grep vmlinuz
-rw------- 1 root root 48661352 Dec  5 20:57 vmlinuz-6.6.57.1-5.azl3
-rw------- 1 root root 48650752 Jan  8 16:05 vmlinuz-6.6.57.1-8.azl3
$ sudo ls -lh /boot/ | grep vmlinuz
-rw------- 1 root root  47M Dec  5 20:57 vmlinuz-6.6.57.1-5.azl3
-rw------- 1 root root  47M Jan  8 16:05 vmlinuz-6.6.57.1-8.azl3