On Fri, 22 Nov 2013, Geert Uytterhoeven wrote: > >> Only arm, i386, ppc, ppc64, sh, and x86_64 support zImage. > >> It's not clear to me what alpha supports (if it supports anything at all?). > > > > Motiviation behind this patchset is secureboot. That is x86 specific > > only and bzImage is most commonly used format on that platform. So it > > makes sense to implement bzImage loader first, IMO. > > While secureboot(TM) may be x86-centric And ARM, right? > IIRC actually loading signed kernels and modules didn't originate on > x86. Anything can have a bootloader that accepts signed kernel images > only. Yes, but if you don't have the whole secure boot security model (i.e. root is implicitly untrusted), it's all just a game really. If you are playing this "signed kernel and modules" game, but have trusted root, he's free to replace the bootloader by one that wouldn't be verifying the kernel signature, and reboot into arbitrary kernel. -- Jiri Kosina SUSE Labs
