[Rachel Menge (rlmenge)]

Summary

Build the hardware-accelerated AES and GHASH crypto implementations (and the cryptd helper they depend on) into the kernel instead of shipping them as modules. This makes them available before /init, so FIPS self-tests run against the accelerated implementations at boot.

Fixes AB#24795

Changes

Kernel config (base/comps/kernel/6.18-{x86_64,aarch64}-azl.config)

Arch	Options changed m -> y
x86_64	CRYPTO_AES_NI_INTEL, CRYPTO_GHASH_CLMUL_NI_INTEL, CRYPTO_CRYPTD
arm64	CRYPTO_AES_ARM64, CRYPTO_AES_ARM64_CE, CRYPTO_AES_ARM64_CE_BLK, CRYPTO_AES_ARM64_NEON_BLK, CRYPTO_AES_ARM64_BS, CRYPTO_AES_ARM64_CE_CCM, CRYPTO_GHASH_ARM64_CE, CRYPTO_CRYPTD

CRYPTO_CRYPTD is built in on both arches for consistency.

Config checker (azl4-os-required-kernel-configs.json)

Enforce the new values so they can't silently regress to modules:

• CONFIG_CRYPTO_AES_NI_INTEL, CONFIG_CRYPTO_GHASH_CLMUL_NI_INTEL (x86_64)
• CONFIG_CRYPTO_AES_ARM64_CE_BLK, CONFIG_CRYPTO_GHASH_ARM64_CE (arm64)
• CONFIG_CRYPTO_CRYPTD (both)

Packaging

kernel.spec release bumped to 1.3 with a changelog entry. Rendered spec and lock are regenerated.

Testing

• Config checker passes on both arches (260 configs on x86_64, 223 on arm64); pytest passes.
• azldev comp build -p kernel succeeds on x86_64.
• Built kernel-core config has CONFIG_CRYPTO_AES_NI_INTEL=y, CONFIG_CRYPTO_GHASH_CLMUL_NI_INTEL=y and CONFIG_CRYPTO_CRYPTD=y.
• aesni-intel, ghash-clmulni-intel and cryptd appear in modules.builtin.
• None of those three .ko files is shipped in any kernel-modules* RPM.

[Rachel Menge (rlmenge)]

/azp run

[azure-pipelines]

Azure Pipelines:
2 pipeline(s) were filtered out due to trigger conditions.

[Copilot]

🔵 Needs a closer look

The early-boot FIPS changes affect both architectures, but reported validation lacks ARM64 build results and FIPS-enabled boot/self-test evidence needed to establish runtime correctness.

No open issues 🎉

What changed in this PR

This PR makes accelerated AES and GHASH implementations available before /init for early FIPS self-tests in Azure Linux.

Changes:

• Builds the selected crypto implementations and cryptd into the x86_64 and ARM64 kernels.
• Adds config-checker requirements to prevent key settings from reverting to modules.
• Bumps the kernel package release to 1.3 and updates rendered files and the lock fingerprint.

File	Description
specs/​k/​kernel/​kernel.spec	Reflects the release bump and changelog entry.
specs/​k/​kernel/​6.18-x86_64-azl.config	Renders the x86_64 built-in crypto settings.
specs/​k/​kernel/​6.18-aarch64-azl.config	Renders the ARM64 built-in crypto settings.
scripts/​ci/​kernel/​kernel-config-checker/​kernel_config_checker/​kernel_configs_json/​azl4-os-required-kernel-configs.json	Enforces required built-in crypto settings by architecture.
locks/​kernel.lock	Updates the component input fingerprint.
base/​comps/​kernel/​kernel.spec	Increments the package release and documents the change.
base/​comps/​kernel/​6.18-x86_64-azl.config	Enables built-in AES-NI, GHASH, and cryptd.
base/​comps/​kernel/​6.18-aarch64-azl.config	Enables built-in ARM64 AES variants, GHASH, and cryptd.

_{Review effort: Balanced}