kexec: Provide an option to use new kexec system call
Hi, This is v2 of the patch. Since v1, I moved syscall implemented check littler earlier in the function as per the feedback. Now a new kexec syscall (kexec_file_load()) has been merged in upstream kernel. This system call takes file descriptors of kernel and initramfs as input (as opposed to list of segments to be loaded). This new system call allows for signature verification of the kernel being loaded. One use of signature verification of kernel is secureboot systems where we want to allow kexec into a kernel only if it is validly signed by a key system trusts. This patch provides and option --kexec-file-syscall (-s), to force use of new system call for kexec. Default is to continue to use old syscall. Currently only bzImage64 on x86_64 can be loaded using this system call. As kernel adds support for more arches and for more image types, kexec-tools can be modified accordingly. Signed-off-by:Vivek Goyal <vgoyal@redhat.com> Acked-by:
Baoquan He <bhe@redhat.com> Signed-off-by:
Simon Horman <horms@verge.net.au>
Loading
Please sign in to comment