January 2013 - openSUSE Kernel - openSUSE Mailing Lists

[opensuse-kernel] [PATCH 0/7] Backported patches for support load key of module sign from db, dbx and MokList (MODSIGN)
by Lee, Chun-Yi 16 Jan '13

16 Jan '13

Patch-mainline: Not yet, from Fedora 18 kernel Target: openSUSE 12.3 Test steps: + enable the following kernel configs: CONFIG_MODULE_SIG_FORCE=y CONFIG_MODULE_SIG_BLACKLIST=y CONFIG_MODULE_SIG_UEFI=y + build + make modules_install; make install When we do make modules_install, script will do the kernel modules sign. + copy vmlinuz binary to efi folder: # mv /boot/vmlinuz-3.0.53-default /boot/efi/vmlinuz-3.0.53-default.efi + boot kvm image with UEFI BIOS, enroll key to db, dbx + boot kvm image to SUSE, enroll key to MokList by mokutil + reboot system, go to UEFI shell + run vmlinuz-3.0.53-default.efi STUB kernel, the boot message should show: [ 0.157219] EFI: Loaded cert 'SUSE Lab: Taipei team signing key: 87a94553dfxxxxxxxxxxxxxxxxx453d07948cf93' linked to '.module_sign' [ 0.159674] EFI: Loaded cert 'SUSE Lab: Taipei team signing key: 87a94553dfxxxxxxxxxxxxxxxxx453d07948cf93' linked to '.modsign_blacklist' Backported 7 patches for load key of module sign from db, dbx and MokList (MODSIGN): 0001-modsign-Always-enforce-module-signing-in-a-Secure-Boot.patch 0002-Add-EFI-signature-data-types.patch 0003-Add-an-EFI-signature-blob-parser-and-key-loader.patch 0004-EFI-Add-in-kernel-variable-to-determine-if-Secure-Boot-is-enabled.patch 0005-MODSIGN-Add-module-certificate-blacklist-keyring.patch 0006-MODSIGN-Import-certificates-from-UEFI-Secure-Boot-v3.patch 0007-Dont-soft-lockup-on-bad-EFI-signature-lists.patch -- To unsubscribe, e-mail: opensuse-kernel+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-kernel+owner(a)opensuse.org

1 7

[opensuse-kernel] [PATCH 0/2] Backported patches for prepare KMP kernel module sign
by Lee, Chun-Yi 16 Jan '13

16 Jan '13

Patch-mainline: v3.8-rc? References: none Target: openSUSE 12.3 Backported 2 patches for for prepare KMP kernel module sign: 0001-MODSIGN-Avoid-using-.incbin-in-C-source.patch 0002-MODSIGN-Drop-ccache-hack.patch -- To unsubscribe, e-mail: opensuse-kernel+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-kernel+owner(a)opensuse.org

1 2

[opensuse-kernel] [PATCH 0/11] Backported patches to lock down functions in secure boot
by Lee, Chun-Yi 15 Jan '13

15 Jan '13

Patch-mainline: Not yet, reviewing References: none Target: openSUSE 12.3 Test steps: + build; make modules_install; make install + add 'secureboot_enable=1' kernel parameter Known issues on SLE (fixed): + xorg-x11-server need d01921ec18c21f21d377b606 patch for avoid 'xf86EnableIOPorts: failed to set IOPL for I/O (Operation not permitted)' Backported 11 patches to lock down functions in secure boot: 0001_Secure_boot:_Add_new_capability_v2.patch 0002_PCI:_Lock_down_BAR_access_in_secure_boot_environments_v2.patch 0003_x86:_Lock_down_IO_port_access_in_secure_boot_environments_v2.patch 0004_ACPI:_Limit_access_to_custom_method_v2.patch 0005_asus-wmi:_Restrict_debugfs_interface_v2.patch 0006_Restrict__dev_mem_and__dev_kmem_in_secure_boot_setups_v2.patch 0007_Secure_boot:_Add_a_dummy_kernel_parameter_that_will_switch_on_Secure_Boot_mode_v2.patch 0008_efi:_Enable_secure_boot_lockdown_automatically_when_enabled_in_firmware_v2.patch 0009_acpi:_Ignore_acpi_rsdp_kernel_parameter_in_a_secure_boot_environment_v2.patch 0010_SELinux:_define_mapping_for_new_Secure_Boot_capability_v2.patch 0011-hibernate-Disable-in-a-Secure-Boot-environment.patch -- To unsubscribe, e-mail: opensuse-kernel+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-kernel+owner(a)opensuse.org

6 19

[opensuse-kernel] [PATCH] Reenable ARMv5 config
by Dirk Müller 10 Jan '13

10 Jan '13

Hi, Please merge the patch below. TIA, Dirk

2 1

[opensuse-kernel] Kernel Panic (U)EFI System 12.2
by Günther J. Niederwimmer 07 Jan '13

07 Jan '13

Hello, i have from time to time a kernel Panic and no kdump or other log. Kernel panic - notsyncing: Watchdog detected hard LOCKUP on CPU 3 pstore dump blocked in NMI, may corrupt error record This is a Intel CPU i7-990X with 6(12) core and 24GB Ram, original last 12.2 Kernel. The message is always the same but the CPU is different. What can I do to log this, after a reset the system is booting. -- mit freundlichen Grüßen / best Regards. Günther J. Niederwimmer -- To unsubscribe, e-mail: opensuse-kernel+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-kernel+owner(a)opensuse.org

1 0