On Tue, Jun 16, 2015 at 04:27:57PM -0400, Vivek Goyal wrote: > > So looks like you are looking for a system/option where you just want to > always make use of kexec_file_load() and disable kexec_load(). This sounds > like you want a kernel where kexec_load() is compiled out and you want > only kexec_file_load() in. Either compiled out or disabled via some flag (similar to how signed moduled verification can be required via a flag that can be set, but not unset once it is set), yes. > Right now one can't do that becase kexec_file_load() depends on > CONFIG_KEXEC option. > > I am wondering that how about making CONFIG_KEXEC_FILE_LOAD independent > of CONFIG_KEXEC. That way one can set CONFIG_KEXEC_VERIFY_SIG=y, and > only signed kernel can be kexeced on that system. That would certianly also be a workable strategy. > This should gel well with long term strategy of deprecating kexec_load() > at some point of time when kexec_file_load() is ready to completely > replace it. Well, note that Debian and Ubuntu are still using kexec-tools 2.0.7 (even in their latest development/unstable releases), which doesn't have support for kexec_file_load(). So we need to get Debian to upgrade its kexec-tools as part of this. I'll try to file a nag-o-gram to the Debian BTS. - Ted
