Skip to content

linux, linux-esx: build every 5.0 subrelease from one spec - #1680

Open
dcasota wants to merge 3 commits into
vmware:5.0from
dcasota:fix/kernel-single-source
Open

linux, linux-esx: build every 5.0 subrelease from one spec#1680
dcasota wants to merge 3 commits into
vmware:5.0from
dcasota:fix/kernel-single-source

Conversation

@dcasota

@dcasota dcasota commented Sep 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Problem

Photon 5.0 keeps three copies of each kernel spec: SPECS/90/linux/linux.spec and linux-esx.spec build kernel 6.1 for photon_subrelease 90 and below, SPECS/91/linux builds 6.12.111 for 91, and SPECS/linux builds 6.12.112 from 92. Every change that is not kernel-specific (dependencies, sections, the canister logic, the acvp/kat refusal) has to be made up to three times, and the copies drift.

Change

SPECS/linux/linux.spec and linux-esx.spec build every 5.0 subrelease, on x86_64 and aarch64. They replace SPECS/90/linux/linux.spec and linux-esx.spec and the SPECS/91/linux tree.

  • Version, Source0, the dependencies both kernels share, the acvp/kat refusal and every section are written once, with photon_subrelease conditionals where the kernels differ (Version is 6.1.183 at <= 90, 6.12.111 at 91 and 6.12.112 from 92).
  • Each kernel's preamble (Release, FIPS model, sources, patches) and changelog live in <flavour>-<kernel>.inc and <flavour>-<kernel>-changelog.inc (Source990-Source996); linux.spec also takes the subpackages whose descriptions differ from linux-<kernel>-packages.inc.
  • The 6.1 files move to SPECS/linux: included files to the top level, where SpecParser.py resolves includes, everything else under 6.1/. A file name that already exists for 6.12 with other content gets a -6.1 suffix (for example config_x86_64-6.1, fips_canister_wrapper-6.1.c), because Photon stages sources by file name; %prep copies such a source into the kernel tree under its original name. The 6.1 archives (linux-6.1.183.tar.xz, jitterentropy-3.4.1-4.tar.bz2, fips-canister-5.0.0-6.1.75-2.ph5-secure.tar.bz2) join SPECS/linux/config.yaml.
  • Subrelease 91 builds the 6.12 line at 6.12.111. SPECS/91/linux differs from SPECS/linux only in Version, Release, changelog, three CVE patches 6.12.112 drops and five patches 6.12.112 refreshes; every other file is identical. Version and Release take a subrelease conditional, the 91 changelog moves to <flavour>-6.12.111-changelog.inc, kernel_cve_patches.inc keeps the three dropped patches for 91, and the 6.12.111 form of the five refreshed patches moves under 6.12.111/ with a -6.12.111 suffix. linux-6.12.111.tar.xz joins config.yaml.
  • linux-rt stays in SPECS/90/linux with the files it uses.

Release and changelog of every kernel are unchanged (linux 6.1.183-3 / 6.12.111-4 / 6.12.112-2, linux-esx 6.1.183-1 / 6.12.111-4 / 6.12.112-2): what rpm builds is the same as with the separate specs.

Testing

  • rpm (rpmspec -P and preamble queries) and Photon's SpecParser.py read both specs as the separate specs of the base for subreleases 90, 91, 92 and 93, on x86_64 and aarch64, with and without canister_build, acvp_build and kat_build: 78 of 78 checks identical. Name-version-release per subrelease and arch matches the list above.
  • %prep applies every patch at --fuzz=0 to 6.1.183, 6.12.111 and 6.12.112.
  • check_spec.py --mainline 93 with spec-checker: check a spec as the subrelease being checked sees it #1678 exits 0 for SPECS/linux/linux.spec and linux-esx.spec at subreleases 90, 91, 92 and 93, and for SPECS/90/linux/linux-rt.spec at 90. Without spec-checker: check a spec as the subrelease being checked sees it #1678 it stops on the single specs with a TypeError in create_altered_spec while opening an included file.
  • The kernel-deps generator with spec-generator: read kernel specs as the current subrelease sees them #1679 produces the same 9 driver specs at subreleases 90, 91, 92 and 93 as from the separate specs.
  • linux and linux-esx 6.12.112-2 build from this stack. aarch64 is checked statically only.

Dependencies

🤖 Generated with Claude Code

This was referenced Sep 15, 2026
Open
Open
dcasota added a commit to dcasota/photonos-scripts that referenced this pull request Sep 15, 2026
@dcasota @claude
sharukhan: test the kernel PR stack rebased onto 5.0 3941e19c0
f06f175 
Upstream ee3c2b78b (92/linux CVE fixes) took linux and linux-esx to
6.12.109-2, the release the canister PR stack had used. The stack was
rebased: linux and linux-esx to -3, the canister_build fix to -4, and
the single-source specs regenerated on top.

Until the permutation rows pass, the variants cherry-pick the rebased
stack from the fork-only branch test/kernel-single-source-rebase-20260915
instead of fix/kernel-single-source, which still backs vmware/photon#1680.
The embedded canister-equivalent patch is regenerated against it and now
takes linux to 6.12.109-5 and linux-esx to -4.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JW73JTCUGRcaNTUEQcAMtf
@dcasota
dcasota force-pushed the fix/kernel-single-source branch 5 times, most recently from c8ccbbb to a5448d8 Compare September 19, 2026 11:44
@dcasota
dcasota force-pushed the fix/kernel-single-source branch from a5448d8 to 7569770 Compare September 27, 2026 07:30
dcasota added a commit to dcasota/photonos-scripts that referenced this pull request Sep 29, 2026
@dcasota @claude
sharukhan branch-check: compare a moved changelog against its package
5be890d 
branch-check compared each changed spec file with the same path on the
target. fix/kernel-single-source keeps the kernel changelogs in includes
(linux-6.12-changelog.inc) that 5.0 does not have, so its 6.12.111-2 passed
against vmware/5.0 although 5.0 had just published 6.12.111-2 in
SPECS/linux/linux.spec (vmware/photon#1680). When a path is absent on a side,
the check now reads every .spec and *changelog*.inc %changelog of the same
package directory name there (SPECS/<pkg>/ and SPECS/<subrelease>/<pkg>/).
Verified: old #1680 head fails as it should, the rebased branches and every
other open PR pass against dcasota and vmware 5.0. Test covers a changelog
moved into an include.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JW73JTCUGRcaNTUEQcAMtf
@dcasota
dcasota force-pushed the fix/kernel-single-source branch 2 times, most recently from d2a02c3 to 0427868 Compare September 30, 2026 11:49
@dcasota
dcasota force-pushed the fix/kernel-single-source branch from 0427868 to 3e91f03 Compare October 7, 2026 11:07
dcasota and others added 3 commits October 8, 2026 11:52
@dcasota @claude
linux, linux-esx: share the canister/.config logic via canister_confi…
77b921b 
…g.inc

linux.spec and linux-esx.spec implemented the same canister Kconfig handling
in two different idioms, and they disagreed on one constellation.

linux-esx.spec used %if 0%{?fips} / %else, and its %else branch cleaned the
GCC_PLUGIN_{MATCH,PAD}_CANISTER_STRUCTS comments out of .config. linux.spec
instead used two independent %if canister_build / %if canister_usage blocks
with no %else, so when fips=0 nothing ran: the shipped .config kept the
"is not set" comments, make olddefconfig dropped them, and the
check_for_config_applicability.inc diff guard failed %prep. That is an
x86_64 kernel built without the canister: fips is set by %global inside
%ifarch, so it is 1 on x86_64 unless that line is edited to 0, and
config_x86_64 carries both "is not set" comments. The aarch64 configs
never carried them.

Move the three conditional blocks into SPECS/linux/canister_config.inc,
pulled in by both specs as Source5 + %include, the same mechanism both
already use for check_for_config_applicability.inc. Divergence between the
two flavours is now impossible by construction.

SPECS/91/linux, which builds subrelease 91 from its own copy of the 6.12.111
specs, carries the same defect and gets the same change.

linux-esx.spec additionally gains the derived-flag block linux.spec already
had (canister_build=0, canister_usage=fips), nested inside the existing
%if fips so it does not shadow -D. esx never builds a canister - it untars a
prebuilt one - so fips=1 implies canister_usage=1, reproducing the old
branch exactly.

Tested across 168 cells: SPECS/91/linux at subrelease 91 and SPECS/linux at
92 and 93 x 2 specs x {x86_64, aarch64} x 14 flag combinations of fips /
canister_build / canister_usage / acvp_build / kat_build. All x86_64 cells are byte-identical apart from the release string.
The aarch64 fips=0 cells gain the two deletions, which are no-ops there: no
aarch64 config carries the "is not set" comments. The esx aarch64
reordering is likewise a no-op: the canister and jitterentropy seds touch
disjoint symbols.

Change-Id: If4107c14d8f15752dff0c0f25c6b4dee504e3041
Signed-off-by: Daniel Casota <dcasota@gmail.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@dcasota @claude
linux: make canister_build work against the current kernel
2b139b8 
Two defects keep canister_build=1 from producing a usable canister, and a
third lets the FIPS build modes run where they cannot work.

1. The patch series no longer applies. Upstream dropped the WARN_ON()
wrapper around !digest_size in pkcs1pad_verify(), and that single line is
shared context for canister-creation patches 1004 and 1010, so %prep
fails at --fuzz=0 with

	1 out of 2 hunks FAILED -- crypto/rsa-pkcs1pad.c.rej

Rebase both onto the 6.12 series. In 1004 the WARN_ON -> fcw_warn_on
conversion is load-bearing rather than cosmetic: WARN_ON emits a
__bug_table entry, and keeping __bug_table out of the canister is what
that patch exists to do.

6.12.111 then inserted a gcc workaround (CFLAGS_ecc.o, under CONFIG_ARM,
CONFIG_KASAN_STACK and GCC) between the curve25519 and ecdh_generic lines
of crypto/Makefile, which is the context of the last hunk of 1000:

	1 out of 9 hunks FAILED -- saving rejects to file crypto/Makefile.rej

Rebase 1000 onto it as well. The lines it adds there are unchanged -
canister += ecc.o, drbg.o and $(ecdh_generic-y) - only context and
offsets move, and every other file in the patch is byte-identical.

2. A canister that does build is rejected at boot:

	FIPS(fips_integrity_init): processing 8 sections, 687696 bytes
	Kernel panic - not syncing: FIPS canister verification failed!

gen_canister_relocs gives each section an "ondx", the number
fips_integrity_init() uses to index its si[] array when reversing a
relocation. si[] is built from canister_sections[], which holds only the
sections carrying both markers. .bss carries a begin marker only - it is
not measured, it is listed so relocations can resolve against it - yet it
still consumed an ondx, so every section laid out after .bss was numbered
one too high and its relocations were reversed against the wrong section.
Let only a measured section consume an index. .bss is NOBITS and cannot
hold relocations, so the sentinel is never dereferenced; should a
relocation ever target a section without a valid index (the sentinel, or
one beyond the unsigned char the interpreter reads), the generator now
stops with the section name instead of emitting a wrapped index. The
measured set, the generated linker script and the canister HMAC are
unchanged.

3. acvp_build and kat_build build x86_64 inputs on other architectures.
The build system injects both toggles for every architecture. On aarch64,
SPECS/linux/linux.spec re-enabled fips after its architecture block and
pulled in canister machinery that cannot work there: the canister is
arch/x86 crypto and its tooling handles only R_X86_64_* relocations.
Independently, in SPECS/linux/linux.spec and SPECS/90/linux/linux.spec
alike, acvp_build selects config_x86_64_acvp, the only ACVP config, for an
arm64 kernel, and the build fails late for a reason that names neither
toggle.

Confine the fips override to x86_64, and refuse acvp_build and kat_build
on any other architecture with the same block in both specs, so the build
stops at once and says why. They are refused rather than undefined because
Photon's SpecParser.py cannot undefine an injected macro, and would still
compute a .acvp Release that rpm no longer builds. canister_build stays
allowed on aarch64, where it is already ignored.

SPECS/91/linux, which builds subrelease 91 from its own copy of the 6.12.111
specs, carries the same patch series, generator and fips override, and gets
the identical change. With it, %prep applies every patch at --fuzz=0 to
6.12.111 (subrelease 91) and 6.12.112 (92), for linux and linux-esx, by
default and with canister_build and kat_build.

Change-Id: Ib5878beeec1dd79e2bcdfefc33639d2b40d69d14
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@dcasota @claude
linux, linux-esx: build every 5.0 subrelease from one spec
1d6e318 
SPECS/linux/linux.spec and linux-esx.spec now build kernel 6.1 for
photon_subrelease 90 and below, kernel 6.12.111 for 91 and kernel 6.12
from 92, on x86_64 and aarch64, replacing SPECS/90/linux/linux.spec and
linux-esx.spec and the SPECS/91/linux tree.

Each kernel's preamble (Release, FIPS model, sources, patches) and
changelog live in <flavour>-<kernel>.inc and <flavour>-<kernel>-changelog.inc;
linux.spec also takes the subpackages whose descriptions differ from
linux-<kernel>-packages.inc. Version, Source0, the dependencies both
kernels share, the acvp/kat refusal and every section are written once,
with photon_subrelease conditionals where the kernels differ.

The 6.1 files move to SPECS/linux: included files to the top level,
where SpecParser resolves includes, everything else under 6.1/. A name
that exists for 6.12 with other content gets a -6.1 suffix, because
Photon stages sources by file name; %prep copies such a source into the
kernel tree under its original name. The 6.1 archives join config.yaml.
linux-rt stays in SPECS/90/linux with the files it uses.

Subrelease 91 builds the 6.12 line at 6.12.111. SPECS/91/linux differed
from SPECS/linux only in Version, Release, changelog, three CVE patches
6.12.112 dropped and five patches 6.12.112 refreshed. Version and Release
take a subrelease conditional, the 91 changelog moves to
<flavour>-6.12.111-changelog.inc, kernel_cve_patches.inc keeps the
dropped patches for 91, and the 6.12.111 form of the refreshed patches
moves under 6.12.111/ with a -6.12.111 suffix. The 6.12.111 archive
joins config.yaml.

rpm and Photon's SpecParser read both specs exactly as before for
subreleases 90, 91, 92 and 93, on x86_64 and aarch64, with and without
canister_build, acvp_build and kat_build, and every file %prep copies
lands under the same name. %prep applies every patch at --fuzz=0 to
6.1.183, 6.12.111 and 6.12.112. check_spec needs
fix/check-spec-subrelease-aware on the common branch to read a spec that
serves several subreleases.

Change-Id: Iee86a86f800b0bb70b83b96c673078a4bc6e1512
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@dcasota
dcasota force-pushed the fix/kernel-single-source branch from 3e91f03 to 1d6e318 Compare October 9, 2026 07:24

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@dcasota