On Thu, 2026-03-12 at 16:03 +0100, Arnd Bergmann wrote:
> On Mon, Mar 9, 2026, at 21:37, Nathan Chancellor wrote:
> > security/integrity/secure_boot.c contains a single __weak function,
> > which breaks recordmcount when building with clang:
> >
> > $ make -skj"$(nproc)" ARCH=powerpc LLVM=1 ppc64_defconfig
> > security/integrity/secure_boot.o
> > Cannot find symbol for section 2: .text.
> > security/integrity/secure_boot.o: failed
> >
> > Introduce a Kconfig symbol, CONFIG_HAVE_ARCH_GET_SECUREBOOT, to indicate
> > that an architecture provides a definition of arch_get_secureboot().
> > Provide a static inline stub when this symbol is not defined to achieve
> > the same effect as the __weak function, allowing secure_boot.c to be
> > removed altogether. Move the s390 definition of arch_get_secureboot()
> > out of the CONFIG_KEXEC_FILE block to ensure it is always available, as
> > it does not actually depend on KEXEC_FILE.
> >
> > Fixes: 31a6a07eefeb ("integrity: Make arch_ima_get_secureboot
> > integrity-wide")
> > Signed-off-by: Nathan Chancellor <[email protected]>
>
> Acked-by: Arnd Bergmann <[email protected]>
I pushed out the patch to next-integrity, but am a bit concerned about the
definition:
+config HAVE_ARCH_GET_SECUREBOOT
+ def_bool EFI
+
Has anyone actually tested this patch on s390, not just compiled it? If so, I'd
appreciate a tested-by tag.
thanks,
Mimi
