From 37bd5e3c9d080830b84e63dfd47a33148250a39c Mon Sep 17 00:00:00 2001
From: Zvonko Kaiser <zkaiser@nvidia.com>
Date: Fri, 10 Oct 2025 16:01:53 +0000
Subject: [PATCH] gpu: Add kernel CONFIG check

We need to make sure that the kernel we're using has the
correct configs set, otherwise the module signing will not work.

Signed-off-by: Zvonko Kaiser <zkaiser@nvidia.com>
---
 .../rootfs-builder/nvidia/nvidia_chroot.sh    | 23 +++++++++++++++++++
 .../rootfs-builder/nvidia/nvidia_rootfs.sh    |  9 ++++++++
 2 files changed, 32 insertions(+)

diff --git a/tools/osbuilder/rootfs-builder/nvidia/nvidia_chroot.sh b/tools/osbuilder/rootfs-builder/nvidia/nvidia_chroot.sh
index 80da5e83a0..23ecbbe8b8 100644
--- a/tools/osbuilder/rootfs-builder/nvidia/nvidia_chroot.sh
+++ b/tools/osbuilder/rootfs-builder/nvidia/nvidia_chroot.sh
@@ -6,10 +6,19 @@
 
 #!/bin/bash
 set -euo pipefail
+[[ -n "${DEBUG}" ]] && set -x
 
 shopt -s nullglob
 shopt -s extglob
 
+# Error helpers
+trap 'echo "chroot: ERROR at line ${LINENO}: ${BASH_COMMAND}" >&2' ERR
+die() {
+  local msg="${*:-fatal error}"
+  echo "chroot: ${msg}" >&2
+  exit 1
+}
+
 run_file_name=$2
 run_fm_file_name=$3
 arch_target=$4
@@ -97,6 +106,19 @@ install_nvidia_fabricmanager_from_distribution() {
 	apt-mark hold nvidia-fabricmanager-"${driver_version}"  libnvidia-nscq-"${driver_version}"
 }
 
+check_kernel_sig_config() {
+	[[ -n ${kernel_version} ]] || die "kernel_version is not set"
+	[[ -e /lib/modules/"${kernel_version}"/build/scripts/config ]] || die  "Cannot find /lib/modules/${kernel_version}/build/scripts/config"
+	# make sure the used kernel has the proper CONFIG(s) set
+	readonly scripts_config=/lib/modules/"${kernel_version}"/build/scripts/config
+	[[ "$("${scripts_config}" --file "/boot/config-${kernel_version}" --state CONFIG_MODULE_SIG)" == "y" ]] || die  "Kernel config CONFIG_MODULE_SIG must be =Y"
+	[[ "$("${scripts_config}" --file "/boot/config-${kernel_version}" --state CONFIG_MODULE_SIG_FORCE)" == "y" ]] || die  "Kernel config CONFIG_MODULE_SIG_FORCE must be =Y"
+	[[ "$("${scripts_config}" --file "/boot/config-${kernel_version}" --state CONFIG_MODULE_SIG_ALL)" == "y" ]] || die  "Kernel config CONFIG_MODULE_SIG_ALL must be =Y"
+	[[ "$("${scripts_config}" --file "/boot/config-${kernel_version}" --state CONFIG_MODULE_SIG_SHA512)" == "y" ]] || die  "Kernel config CONFIG_MODULE_SIG_SHA512 must be =Y"
+	[[ "$("${scripts_config}" --file "/boot/config-${kernel_version}" --state CONFIG_SYSTEM_TRUSTED_KEYS)" == "" ]] || die  "Kernel config CONFIG_SYSTEM_TRUSTED_KEYS must be =\"\""
+	[[ "$("${scripts_config}" --file "/boot/config-${kernel_version}" --state CONFIG_SYSTEM_TRUSTED_KEYRING)" == "y" ]] || die  "Kernel config CONFIG_SYSTEM_TRUSTED_KEYRING must be =Y"
+}
+
 build_nvidia_drivers() {
 	is_feature_enabled "compute" || {
 		echo "chroot: Skipping NVIDIA drivers build"
@@ -133,6 +155,7 @@ build_nvidia_drivers() {
 
 		if [[ -n "${KBUILD_SIGN_PIN}" ]]; then
 			mkdir -p "${certs_dir}" && mv /signing_key.* "${certs_dir}"/.
+			check_kernel_sig_config
 		fi
 
 		make INSTALL_MOD_STRIP=1 -j "$(nproc)" CC=gcc SYSSRC=/lib/modules/"${kernel_version}"/build modules_install
diff --git a/tools/osbuilder/rootfs-builder/nvidia/nvidia_rootfs.sh b/tools/osbuilder/rootfs-builder/nvidia/nvidia_rootfs.sh
index 0ece0f06fb..7fbfdb782a 100644
--- a/tools/osbuilder/rootfs-builder/nvidia/nvidia_rootfs.sh
+++ b/tools/osbuilder/rootfs-builder/nvidia/nvidia_rootfs.sh
@@ -7,6 +7,15 @@
 set -euo pipefail
 [[ -n "${DEBUG}" ]] && set -x
 
+# Error helpers
+trap 'echo "rootfs: ERROR at line ${LINENO}: ${BASH_COMMAND}" >&2' ERR
+die() {
+  local msg="${*:-fatal error}"
+  echo "rootfs: ${msg}" >&2
+  exit 1
+}
+
+
 readonly BUILD_DIR="/kata-containers/tools/packaging/kata-deploy/local-build/build/"
 # catch errors and then assign
 script_dir="$(dirname "$(readlink -f "$0")")"