kernel: enable CONFIG_KEXEC_SIG*

[pprindeville]

Failing to build because of missing symbols related to provisioning
CONFIG_KEXEC.

Signed-off-by: Philip Prindeville philipp@redfish-solutions.com

[pprindeville]

Requesting reviews from @aparcar @rsalvaterra @bobafetthotmail

[mans0n]

The commit title should be something like x86: enable CONFIG_KEXEC_SIG*.

[pprindeville]

The commit title should be something like x86: enable CONFIG_KEXEC_SIG*.

Done.

[mans0n]

Er, I mean the prefix should be x86:...

[aparcar]

Er, I mean the prefix should be x86:...

It's already renamed, just the commit kept the old name

[pprindeville]

Er, I mean the prefix should be x86:...

It's already renamed, just the commit kept the old name

So... good to go?

[aparcar]

How is this failing? I'm trying to build x86/64 and it works just fine?

[chunkeey]

CONFIG_KEXEC_SIG symbols showed up in 5.4. But from what I know, openwrt doesn't sign kernel modules (CONFIG_MODULE_SIG is disabled in the generic/config-5.10) or kernels yet. So, If this gets enabled and if the KConfig help text for CONFIG_KEXEC_SIG holds true: "If configured, any attempt of loading a image without valid signature will fail." this would just break?

I would suggest to put # CONFIG_KEXEC_SIG is not set into the target/generic/config-5.10 for now.

[pprindeville]

x86 has EFI. EFI potentially supports secure boot, which would require signed images.

[chunkeey]

Do you want to add support for grub+kernel+module signing on x86 (and possibly arm) for this?

EDIT: (just remembered about grub, it needs to be signed too.)

[pprindeville]

Do you want to add support for grub+kernel+module signing on x86 (and possibly arm) for this?

EDIT: (just remembered about grub, it needs to be signed too.)

I don't plan on doing it any time soon, but don't want to add any obstacles to someone taking it on, either.

[pprindeville]

I would suggest to put # CONFIG_KEXEC_SIG is not set into the target/generic/config-5.10 for now.

Done.

[pprindeville]

@aparcar @chunkeey Can someone assign reviewers please?

[ynezz]

Failing to build because of missing symbols related to provisioning CONFIG_KEXEC and signed images.

Can you please make it clear (in the commit message) for us mere mortals what is failing now? What needs to be done in order to see the failure?

[pprindeville]

Failing to build because of missing symbols related to provisioning CONFIG_KEXEC and signed images.

Can you please make it clear (in the commit message) for us mere mortals what is failing now? What needs to be done in order to see the failure?

I'm building x86_64/generic with CONFIG_KERNEL_KEXEC=y set, and I'm seeing the target/linux build hang with:

kexec system call (KEXEC) [Y/n/?] y
kexec file based system call (KEXEC_FILE) [Y/n/?] y
Verify kernel signature during kexec_file_load() syscall (KEXEC_SIG) [N/y/?] (NEW) 

So in short, if CONFIG_KEXEC is set, then 5.10 requires settings for CONFIG_KEXEC_SIG.

[ynezz]

Thanks! Pulled into my staging tree at https://git.openwrt.org/openwrt/staging/ynezz.git