Re: [PATCH] integrity: Eliminate weak definition of arch_get_secureboot()

[Mimi Zohar <zohar@linux.ibm.com>]

On Thu, 2026-03-12 at 16:03 +0100, Arnd Bergmann wrote:
> On Mon, Mar 9, 2026, at 21:37, Nathan Chancellor wrote:
> > security/integrity/secure_boot.c contains a single __weak function,
> > which breaks recordmcount when building with clang:
> > 
> >   $ make -skj"$(nproc)" ARCH=powerpc LLVM=1 ppc64_defconfig 
> > security/integrity/secure_boot.o
> >   Cannot find symbol for section 2: .text.
> >   security/integrity/secure_boot.o: failed
> > 
> > Introduce a Kconfig symbol, CONFIG_HAVE_ARCH_GET_SECUREBOOT, to indicate
> > that an architecture provides a definition of arch_get_secureboot().
> > Provide a static inline stub when this symbol is not defined to achieve
> > the same effect as the __weak function, allowing secure_boot.c to be
> > removed altogether. Move the s390 definition of arch_get_secureboot()
> > out of the CONFIG_KEXEC_FILE block to ensure it is always available, as
> > it does not actually depend on KEXEC_FILE.
> > 
> > Fixes: 31a6a07eefeb ("integrity: Make arch_ima_get_secureboot integrity-wide")
> > Signed-off-by: Nathan Chancellor <nathan@kernel.org>
> 
> Acked-by: Arnd Bergmann <arnd@arndb.de>

I pushed out the patch to next-integrity, but am a bit concerned about the
definition:

+config HAVE_ARCH_GET_SECUREBOOT
+       def_bool EFI
+

Has anyone actually tested this patch on s390, not just compiled it?  If so, I'd
appreciate a tested-by tag.

thanks,

Mimi