From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.ozlabs.org (lists.ozlabs.org [112.213.38.117]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 4847AC07E9D for ; Mon, 26 Sep 2022 06:49:58 +0000 (UTC) Received: from boromir.ozlabs.org (localhost [IPv6:::1]) by lists.ozlabs.org (Postfix) with ESMTP id 4MbYKJ64j5z3fDd for ; Mon, 26 Sep 2022 16:49:56 +1000 (AEST) Authentication-Results: lists.ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=R01HPFGg; dkim-atps=neutral Authentication-Results: lists.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=linuxfoundation.org (client-ip=139.178.84.217; helo=dfw.source.kernel.org; envelope-from=gregkh@linuxfoundation.org; receiver=) Authentication-Results: lists.ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=R01HPFGg; dkim-atps=neutral Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by lists.ozlabs.org (Postfix) with ESMTPS id 4MbYGf2BPPz3f3B for ; Mon, 26 Sep 2022 16:47:38 +1000 (AEST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4BB136111B; Mon, 26 Sep 2022 06:47:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2D481C433D6; Mon, 26 Sep 2022 06:47:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1664174854; bh=Y2sNyycpz3WfUGxxxwkrxUxDfizPmjY1zyzAphv6PIM=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=R01HPFGgQkDQRVV6X/B85xXIWfuTBp4FYgiRlfvicfMadW+sS9Aa4uveH3JqL9r23 Ff6Sw3/AUKjIe4eR/Md3V2qY3UjWduTwexkEjHI2Udigby3+gkYfFqPtAt3lvzZ5yX uFPWzkAzYRCDL1i9yqqNN14LCX5p+qNGKO1nNU1M= Date: Mon, 26 Sep 2022 08:47:32 +0200 From: Greg Kroah-Hartman To: Michal =?iso-8859-1?Q?Such=E1nek?= Subject: Re: [PATCH 5.15 0/6] arm64: kexec_file: use more system keyrings to verify kernel image signature + dependencies Message-ID: References: <20220924094521.GY28810@kitsune.suse.cz> <20220924115523.GZ28810@kitsune.suse.cz> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <20220924115523.GZ28810@kitsune.suse.cz> X-BeenThere: linuxppc-dev@lists.ozlabs.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Linux on PowerPC Developers Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Dave Hansen , Alexander Egorenkov , keyrings@vger.kernel.org, Paul Mackerras , "H. Peter Anvin" , Alexander Gordeev , Will Deacon , Sasha Levin , "open list:S390" , Coiby Xu , Baoquan He , AKASHI Takahiro , "maintainer:X86 ARCHITECTURE \(32-BIT AND 64-BIT\)" , Christian Borntraeger , Ingo Molnar , Catalin Marinas , "Naveen N. Rao" , Eric Biederman , Vasily Gorbik , Heiko Carstens , Borislav Petkov , Mimi Zohar , Thomas Gleixner , "moderated list:ARM64 PORT \(AARCH64 ARCHITECTURE\)" , Philipp Rudo , "open list:KEXEC" , linux-kernel@vger.kernel.org, stable@vger.kernel.org, linux-security-module@vger.kernel.org, James Morse , Sven Schnelle , Andrew Morton , "open list:LINUX FOR POWERPC \(32-BIT AND 64-BIT\)" Errors-To: linuxppc-dev-bounces+linuxppc-dev=archiver.kernel.org@lists.ozlabs.org Sender: "Linuxppc-dev" On Sat, Sep 24, 2022 at 01:55:23PM +0200, Michal Suchánek wrote: > On Sat, Sep 24, 2022 at 12:13:34PM +0200, Greg Kroah-Hartman wrote: > > On Sat, Sep 24, 2022 at 11:45:21AM +0200, Michal Suchánek wrote: > > > On Sat, Sep 24, 2022 at 11:19:19AM +0200, Greg Kroah-Hartman wrote: > > > > On Fri, Sep 23, 2022 at 07:10:28PM +0200, Michal Suchanek wrote: > > > > > Hello, > > > > > > > > > > this is backport of commit 0d519cadf751 > > > > > ("arm64: kexec_file: use more system keyrings to verify kernel image signature") > > > > > to table 5.15 tree including the preparatory patches. > > > > > > > > This feels to me like a new feature for arm64, one that has never worked > > > > before and you are just making it feature-parity with x86, right? > > > > > > > > Or is this a regression fix somewhere? Why is this needed in 5.15.y and > > > > why can't people who need this new feature just use a newer kernel > > > > version (5.19?) > > > > > > It's half-broken implementation of the kexec kernel verification. At the time > > > it was implemented for arm64 we had the platform and secondary keyrings > > > and x86 was using them but on arm64 the initial implementation ignores > > > them. > > > > Ok, so it's something that never worked. Adding support to get it to > > work doesn't really fall into the stable kernel rules, right? > > Not sure. It was defective, not using the facilities available at the > time correctly. Which translates to kernels that can be kexec'd on x86 > failing to kexec on arm64 without any explanation (signed with same key, > built for the appropriate arch). Feature parity across architectures is not a "regression", but rather a "this feature is not implemented for this architecture yet" type of thing. > > Again, what's wrong with 5.19 for anyone who wants this? Who does want > > this? > > Not sure, really. > > The final patch was repeatedly backported to stable and failed to build > because the prerequisites were missing. That's because it was tagged, but now that you show the full set of requirements, it's pretty obvious to me that this is not relevant for going this far back. thanks, greg k-h