From 807b6ab712f21c5270691dce3be7a5d6f8d9875d Mon Sep 17 00:00:00 2001 From: Daniel Casota Date: Mon, 31 Aug 2026 11:55:05 +0200 Subject: [PATCH] linux, linux-esx: share the canister/.config logic via canister_config.inc linux.spec and linux-esx.spec implemented the same canister Kconfig handling in two different idioms, and they disagreed on one constellation. linux-esx.spec used %if 0%{?fips} / %else, and its %else branch cleaned the GCC_PLUGIN_{MATCH,PAD}_CANISTER_STRUCTS comments out of .config. linux.spec instead used two independent %if canister_build / %if canister_usage blocks with no %else, so when fips=0 nothing ran: the shipped .config kept the "is not set" comments, make olddefconfig dropped them, and the check_for_config_applicability.inc diff guard failed %prep. That is an x86_64 kernel built without the canister: fips is set by %global inside %ifarch, so it is 1 on x86_64 unless that line is edited to 0, and config_x86_64 carries both "is not set" comments. The aarch64 configs never carried them. Move the three conditional blocks into SPECS/linux/canister_config.inc, pulled in by both specs as Source5 + %include, the same mechanism both already use for check_for_config_applicability.inc. Divergence between the two flavours is now impossible by construction. linux-esx.spec additionally gains the derived-flag block linux.spec already had (canister_build=0, canister_usage=fips), nested inside the existing %if fips so it does not shadow -D. esx never builds a canister - it untars a prebuilt one - so fips=1 implies canister_usage=1, reproducing the old branch exactly. Tested across 112 cells: 2 specs x {x86_64, aarch64} x subrelease {91, 92} x 14 flag combinations of fips / canister_build / canister_usage / acvp_build / kat_build. All x86_64 cells are byte-identical apart from the release string. The aarch64 fips=0 cells replace PR#14's broad sed with linux-esx's narrower pair; the two forms produce byte-identical output on all five shipped config files, because no config contains a CANISTER_STRUCTS=y form - only the "is not set" comment form. The esx aarch64 reordering is likewise a no-op: the canister and jitterentropy seds touch disjoint symbols. Change-Id: If4107c14d8f15752dff0c0f25c6b4dee504e3041 Signed-off-by: Daniel Casota --- SPECS/linux/canister_config.inc | 35 +++++++++++++++++++++++++++++++++ SPECS/linux/linux-esx.spec | 26 ++++++++++++++++-------- SPECS/linux/linux.spec | 15 ++++++-------- 3 files changed, 59 insertions(+), 17 deletions(-) create mode 100644 SPECS/linux/canister_config.inc diff --git a/SPECS/linux/canister_config.inc b/SPECS/linux/canister_config.inc new file mode 100644 index 0000000000..0b2706a7ad --- /dev/null +++ b/SPECS/linux/canister_config.inc @@ -0,0 +1,35 @@ +%dnl Shared canister/.config manipulation for the Photon kernel flavours. +%dnl +%dnl Included by both SPECS/linux/linux.spec and SPECS/linux/linux-esx.spec so +%dnl that the FIPS canister Kconfig handling cannot diverge between the two +%dnl flavours again. linux.spec had no fips=0 branch at all, so an x86_64 build +%dnl with fips set to 0 left the canister "is not set" comments of config_x86_64 +%dnl in .config; "make olddefconfig" silently drops symbols that do not exist in +%dnl the tree and the check_for_config_applicability.inc diff guard then failed. +%dnl The aarch64 configs never carried those lines. +%dnl +%dnl Expects, from the including spec: +%dnl fips 1 => build a FIPS kernel carrying the crypto canister +%dnl canister_build 1 => the canister is built from source in this build +%dnl canister_usage 1 => link against a prebuilt canister object file +%dnl (derived: !canister_build when fips=1, else 0) +%dnl +%dnl Expects .config to be in place already (cp of the flavour config Source). +%dnl +%dnl The GCC_PLUGIN_MATCH_CANISTER_STRUCTS / GCC_PLUGIN_PAD_CANISTER_STRUCTS +%dnl Kconfig symbols only exist once the fips canister plugin patches have been +%dnl applied, i.e. only when fips=1. +%if 0%{?canister_build} +sed -i "s/# CONFIG_GCC_PLUGIN_PAD_CANISTER_STRUCTS is not set/CONFIG_GCC_PLUGIN_PAD_CANISTER_STRUCTS=y/" .config +sed -i "/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/d" .config +%endif + +%if 0%{?canister_usage} +sed -i "s/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS=y/" .config +%endif + +%if 0%{?fips} == 0 +# Clean up .config of FIPS related configs +sed -i "/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/d" .config +sed -i "/# CONFIG_GCC_PLUGIN_PAD_CANISTER_STRUCTS is not set/d" .config +%endif diff --git a/SPECS/linux/linux-esx.spec b/SPECS/linux/linux-esx.spec index 70ef16afa5..d9e2ceb59a 100644 --- a/SPECS/linux/linux-esx.spec +++ b/SPECS/linux/linux-esx.spec @@ -26,10 +26,21 @@ %global fips 0 %endif +# The esx flavour never builds the canister itself, it always links against the +# prebuilt canister object file. Mirror linux.spec's derived flag model so the +# shared canister_config.inc behaves identically for both flavours. +%if 0%{?fips} +%global canister_build 0 +%global canister_usage 1 +%else +%global canister_build 0 +%global canister_usage 0 +%endif + Summary: Kernel Name: linux-esx Version: 6.12.109 -Release: 4%{?dist} +Release: 5%{?dist} URL: http://www.kernel.org Group: System Environment/Kernel Vendor: VMware, Inc. @@ -44,6 +55,8 @@ Source2: initramfs.trigger # contains pre, postun, filetriggerun tasks Source3: scriptlets.inc Source4: check_for_config_applicability.inc +# shared canister/.config handling, also included by linux.spec +Source5: canister_config.inc Source19: spec_install_post.inc @@ -436,20 +449,15 @@ tar -xvf /usr/lib/fips-canister/fips-canister-%{fips_canister_version}.tar.bz2 # corresponding .cmd file. Empty content is ok, since we are not going # to rebuild it. touch crypto/.fips_canister.o.cmd - -sed -i "s/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS=y/" .config %else -# Clean up .config of FIPS related configs -sed -i "/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/d" .config -sed -i "/# CONFIG_GCC_PLUGIN_PAD_CANISTER_STRUCTS is not set/d" .config - sed -i "s/# CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_2 is not set/CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_2=y/" .config sed -i "s/CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_32=y/# CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_32 is not set/" .config sed -i "s/CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKS=128/CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKS=64/" .config sed -i "s/CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKSIZE=256/CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKSIZE=32/" .config %endif - +%dnl canister/.config handling, shared with linux.spec +%include %{SOURCE5} %ifarch x86_64 sed -e "s,@@NAME@@,%{name},g" \ -e "s,@@VERSION_RELEASE@@,%{version}-%{release},g" \ @@ -579,6 +587,8 @@ ln -sf linux-%{uname_r}.cfg /boot/photon.cfg %{_usrsrc}/linux-headers-%{uname_r} %changelog +* Wed Sep 16 2026 Daniel Casota 6.12.109-5 +- Share canister/.config handling via canister_config.inc * Wed Sep 16 2026 Shreenidhi Shedi 6.12.109-4 - Use rpm macros while building - Fix rpm build warnings diff --git a/SPECS/linux/linux.spec b/SPECS/linux/linux.spec index 5f104bedea..2ebc6949cd 100644 --- a/SPECS/linux/linux.spec +++ b/SPECS/linux/linux.spec @@ -80,7 +80,7 @@ Summary: Kernel Name: linux Version: 6.12.109 -Release: 4%{?acvp_build:.acvp}%{?kat_build:.kat}%{?dist} +Release: 5%{?acvp_build:.acvp}%{?kat_build:.kat}%{?dist} URL: http://www.kernel.org/ Group: System Environment/Kernel Vendor: VMware, Inc. @@ -99,6 +99,8 @@ Source3: https://github.com/amzn/amzn-drivers/archive/refs/tags/ena_linux %define efa_version 3.1.0 Source4: https://github.com/amzn/amzn-drivers/archive/refs/tags/efa_linux_%{efa_version}.tar.gz +# shared canister/.config handling, also included by linux-esx.spec +Source5: canister_config.inc # contains pre, postun, filetriggerun tasks Source6: scriptlets.inc Source7: check_for_config_applicability.inc @@ -702,14 +704,7 @@ sed -i 's/CONFIG_LD_VERSION=23900/CONFIG_LD_VERSION=24601/' .config sed -i 's/CONFIG_GCC_ASM_GOTO_OUTPUT_BROKEN=y/CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y\nCONFIG_CC_HAS_ASM_GOTO_TIED_OUTPUT=y/' .config %endif -%if 0%{?canister_build} -sed -i "s/# CONFIG_GCC_PLUGIN_PAD_CANISTER_STRUCTS is not set/CONFIG_GCC_PLUGIN_PAD_CANISTER_STRUCTS=y/" .config -sed -i "/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/d" .config -%endif - -%if 0%{?canister_usage} -sed -i "s/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS=y/" .config -%endif +%include %{SOURCE5} %ifarch x86_64 sed -e "s,@@NAME@@,%{name},g" \ @@ -1023,6 +1018,8 @@ ln -sf linux-%{uname_r}.cfg /boot/photon.cfg %endif %changelog +* Wed Sep 16 2026 Daniel Casota 6.12.109-5 +- Share canister/.config handling via canister_config.inc; fixes the fips=0 path * Wed Sep 16 2026 Shreenidhi Shedi 6.12.109-4 - Fix rpm build warnings - Exclude bpf_jit_disasm binary to avoid binutils-libs dependency