[OS-BUILD PATCHv2] redhat/configs: enable KEXEC_SIG which is already enabled in RHEL8 for s390x and x86_64
From: Coiby Xu coxu@redhat.com
redhat/configs: enable KEXEC_SIG which is already enabled in RHEL8 for s390x and x86_64
Enable KEXEC_SIG for s390x and x86_64 which is already enabled in RHEL8.
Note when building .src.rpm, process_configs.sh would error on unset config options. So CONFIG_KEXEC_SIG_FORCE files are added as well.
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1976835 Signed-off-by: Coiby Xu coxu@redhat.com
diff --git a/redhat/configs/common/generic/s390x/CONFIG_KEXEC_SIG b/redhat/configs/common/generic/s390x/CONFIG_KEXEC_SIG new file mode 100644 index blahblah..blahblah 100644 --- /dev/null +++ b/redhat/configs/common/generic/s390x/CONFIG_KEXEC_SIG @@ -0,0 +1 @@ +CONFIG_KEXEC_SIG=y diff --git a/redhat/configs/common/generic/s390x/CONFIG_KEXEC_SIG_FORCE b/redhat/configs/common/generic/s390x/CONFIG_KEXEC_SIG_FORCE new file mode 100644 index blahblah..blahblah 100644 --- /dev/null +++ b/redhat/configs/common/generic/s390x/CONFIG_KEXEC_SIG_FORCE @@ -0,0 +1 @@ +# CONFIG_KEXEC_SIG_FORCE is not set diff --git a/redhat/configs/common/generic/x86/CONFIG_KEXEC_SIG b/redhat/configs/common/generic/x86/CONFIG_KEXEC_SIG new file mode 100644 index blahblah..blahblah 100644 --- /dev/null +++ b/redhat/configs/common/generic/x86/CONFIG_KEXEC_SIG @@ -0,0 +1 @@ +CONFIG_KEXEC_SIG=y diff --git a/redhat/configs/common/generic/x86/CONFIG_KEXEC_SIG_FORCE b/redhat/configs/common/generic/x86/CONFIG_KEXEC_SIG_FORCE new file mode 100644 index blahblah..blahblah 100644 --- /dev/null +++ b/redhat/configs/common/generic/x86/CONFIG_KEXEC_SIG_FORCE @@ -0,0 +1 @@ +# CONFIG_KEXEC_SIG_FORCE is not set
-- https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1227
From: Coiby Xu on gitlab.com https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1227#note_6201706...
Thanks! Pipeline has now passed.
From: Coiby Xu on gitlab.com https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1227#note_6201713...
@dzickusrh Yes, the pipeline has now passed with !1225 and new added CONFIG_KEXEC_SIG_FORCE files.
From: Bruno Meneguele on gitlab.com https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1227#note_6216955...
Acked-by: Bruno Meneguele bmeneg@redhat.com
From: Justin M. Forbes on gitlab.com https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1227#note_6216995...
Acked-by: Justin M. Forbes jforbes@fedoraproject.org (via approve button)
From: pbrobinson on gitlab.com https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1227#note_6232746...
Any reason we'd not want to enable this for arm64 for el9 too? It's been supported there since 5.4? I suspect we should just unify this to a common/generic/CONFIG_KEXEC_SIG so it's enabled on all arches where it's supported.
From: Dave Young on gitlab.com https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1227#note_6235355...
For arm64, we never tested the signature verification on arm64, maybe we can add it later separately once we have some test results on this.
From: Baoquan He on gitlab.com https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1227#note_6236684...
This looks good to me, ack the patch.
Maybe arm64 part can be addressed later separately when testing is done locally.
Thanks Baoquan
From: Coiby Xu on gitlab.com https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1227#note_6788849...
Unfortunately, enabling it in common/generic/CONFIG_KEXEC_SIG would also enable CONFIG_KEXEC_SIG for ppc64le which hasn't enabled this option in RHEL8.
kernel@lists.fedoraproject.org
-
Baoquan He (via Email Bridge) -
Bruno Meneguele (via Email Bridge)
-
Coiby Xu (via Email Bridge)
-
Dave Young (via Email Bridge)
-
Justin M. Forbes (via Email Bridge)
-
pbrobinson (via Email Bridge)