* [PATCH 0/2] module: Split modules_install compression and in-kernel decompression
@ 2024-07-22 9:06 Petr Pavlu
2024-07-22 9:06 ` [PATCH 1/2] " Petr Pavlu
` (2 more replies)
0 siblings, 3 replies; 7+ messages in thread
From: Petr Pavlu @ 2024-07-22 9:06 UTC (permalink / raw)
To: Luis Chamberlain
Cc: Masahiro Yamada, Nathan Chancellor, Nicolas Schier,
linux-modules, linux-kbuild, linux-kernel, Petr Pavlu
Allow enabling the in-kernel module decompression support separately,
without requiring to enable also the automatic compression during
'make modules_install'.
Petr Pavlu (2):
module: Split modules_install compression and in-kernel decompression
module: Clean up the description of MODULE_SIG_<type>
kernel/module/Kconfig | 77 ++++++++++++++++++++--------------------
scripts/Makefile.modinst | 2 ++
2 files changed, 41 insertions(+), 38 deletions(-)
base-commit: 933069701c1b507825b514317d4edd5d3fd9d417
--
2.35.3
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH 1/2] module: Split modules_install compression and in-kernel decompression
2024-07-22 9:06 [PATCH 0/2] module: Split modules_install compression and in-kernel decompression Petr Pavlu
@ 2024-07-22 9:06 ` Petr Pavlu
2024-07-22 10:23 ` Masahiro Yamada
2024-07-22 9:06 ` [PATCH 2/2] module: Clean up the description of MODULE_SIG_<type> Petr Pavlu
2024-08-19 22:14 ` [PATCH 0/2] module: Split modules_install compression and in-kernel decompression Luis Chamberlain
2 siblings, 1 reply; 7+ messages in thread
From: Petr Pavlu @ 2024-07-22 9:06 UTC (permalink / raw)
To: Luis Chamberlain
Cc: Masahiro Yamada, Nathan Chancellor, Nicolas Schier,
linux-modules, linux-kbuild, linux-kernel, Petr Pavlu
The kernel configuration allows specifying a module compression mode. If
one is selected then each module gets compressed during
'make modules_install' and additionally one can also enable support for
a respective direct in-kernel decompression support. This means that the
decompression support cannot be enabled without the automatic compression.
Some distributions, such as the (open)SUSE family, use a signer service for
modules. A build runs on a worker machine but signing is done by a separate
locked-down server that is in possession of the signing key. The build
invokes 'make modules_install' to create a modules tree, collects
information about the modules, asks the signer service for their signature,
appends each signature to the respective module and compresses all modules.
When using this arrangment, the 'make modules_install' step produces
unsigned+uncompressed modules and the distribution's own build recipe takes
care of signing and compression later.
The signing support can be currently enabled without automatically signing
modules during 'make modules_install'. However, the in-kernel decompression
support can be selected only after first enabling automatic compression
during this step.
To allow only enabling the in-kernel decompression support without the
automatic compression during 'make modules_install', separate the
compression options similarly to the signing options, as follows:
> Enable loadable module support
[*] Module compression
Module compression type (GZIP) --->
[*] Automatically compress all modules
[ ] Support in-kernel module decompression
* "Module compression" (MODULE_COMPRESS) is a new main switch for the
compression/decompression support. It replaces MODULE_COMPRESS_NONE.
* "Module compression type" (MODULE_COMPRESS_<type>) chooses the
compression type, one of GZ, XZ, ZSTD.
* "Automatically compress all modules" (MODULE_COMPRESS_ALL) is a new
option to enable module compression during 'make modules_install'. It
defaults to Y.
* "Support in-kernel module decompression" (MODULE_DECOMPRESS) enables
in-kernel decompression.
Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
---
kernel/module/Kconfig | 61 ++++++++++++++++++++--------------------
scripts/Makefile.modinst | 2 ++
2 files changed, 33 insertions(+), 30 deletions(-)
diff --git a/kernel/module/Kconfig b/kernel/module/Kconfig
index 4047b6d48255..bb7f7930fef6 100644
--- a/kernel/module/Kconfig
+++ b/kernel/module/Kconfig
@@ -278,64 +278,65 @@ config MODULE_SIG_HASH
default "sha3-384" if MODULE_SIG_SHA3_384
default "sha3-512" if MODULE_SIG_SHA3_512
-choice
- prompt "Module compression mode"
+config MODULE_COMPRESS
+ bool "Module compression"
help
- This option allows you to choose the algorithm which will be used to
- compress modules when 'make modules_install' is run. (or, you can
- choose to not compress modules at all.)
-
- External modules will also be compressed in the same way during the
- installation.
-
- For modules inside an initrd or initramfs, it's more efficient to
- compress the whole initrd or initramfs instead.
-
+ Enable module compression to reduce on-disk size of module binaries.
This is fully compatible with signed modules.
- Please note that the tool used to load modules needs to support the
- corresponding algorithm. module-init-tools MAY support gzip, and kmod
- MAY support gzip, xz and zstd.
+ The tool used to work with modules needs to support the selected
+ compression type. kmod MAY support gzip, xz and zstd. Other tools
+ might have a limited selection of the supported types.
- Your build system needs to provide the appropriate compression tool
- to compress the modules.
+ Note that for modules inside an initrd or initramfs, it's more
+ efficient to compress the whole ramdisk instead.
- If in doubt, select 'None'.
+ If unsure, say N.
-config MODULE_COMPRESS_NONE
- bool "None"
+choice
+ prompt "Module compression type"
+ depends on MODULE_COMPRESS
help
- Do not compress modules. The installed modules are suffixed
- with .ko.
+ Choose the supported algorithm for module compression.
config MODULE_COMPRESS_GZIP
bool "GZIP"
help
- Compress modules with GZIP. The installed modules are suffixed
- with .ko.gz.
+ Support modules compressed with GZIP. The installed modules are
+ suffixed with .ko.gz.
config MODULE_COMPRESS_XZ
bool "XZ"
help
- Compress modules with XZ. The installed modules are suffixed
- with .ko.xz.
+ Support modules compressed with XZ. The installed modules are
+ suffixed with .ko.xz.
config MODULE_COMPRESS_ZSTD
bool "ZSTD"
help
- Compress modules with ZSTD. The installed modules are suffixed
- with .ko.zst.
+ Support modules compressed with ZSTD. The installed modules are
+ suffixed with .ko.zst.
endchoice
+config MODULE_COMPRESS_ALL
+ bool "Automatically compress all modules"
+ default y
+ depends on MODULE_COMPRESS
+ help
+ Compress all modules during 'make modules_install'.
+
+ Your build system needs to provide the appropriate compression tool
+ for the selected compression type. External modules will also be
+ compressed in the same way during the installation.
+
config MODULE_DECOMPRESS
bool "Support in-kernel module decompression"
- depends on MODULE_COMPRESS_GZIP || MODULE_COMPRESS_XZ || MODULE_COMPRESS_ZSTD
+ depends on MODULE_COMPRESS
select ZLIB_INFLATE if MODULE_COMPRESS_GZIP
select XZ_DEC if MODULE_COMPRESS_XZ
select ZSTD_DECOMPRESS if MODULE_COMPRESS_ZSTD
help
-
Support for decompressing kernel modules by the kernel itself
instead of relying on userspace to perform this task. Useful when
load pinning security policy is enabled.
diff --git a/scripts/Makefile.modinst b/scripts/Makefile.modinst
index 0afd75472679..bce4a9adb893 100644
--- a/scripts/Makefile.modinst
+++ b/scripts/Makefile.modinst
@@ -51,9 +51,11 @@ $(foreach x, % :, $(if $(findstring $x, $(dst)), \
$(error module installation path cannot contain '$x')))
suffix-y :=
+ifdef CONFIG_MODULE_COMPRESS_ALL
suffix-$(CONFIG_MODULE_COMPRESS_GZIP) := .gz
suffix-$(CONFIG_MODULE_COMPRESS_XZ) := .xz
suffix-$(CONFIG_MODULE_COMPRESS_ZSTD) := .zst
+endif
modules := $(patsubst $(extmod_prefix)%.o, $(dst)/%.ko$(suffix-y), $(modules))
install-$(CONFIG_MODULES) += $(modules)
--
2.35.3
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH 2/2] module: Clean up the description of MODULE_SIG_<type>
2024-07-22 9:06 [PATCH 0/2] module: Split modules_install compression and in-kernel decompression Petr Pavlu
2024-07-22 9:06 ` [PATCH 1/2] " Petr Pavlu
@ 2024-07-22 9:06 ` Petr Pavlu
2024-08-19 22:14 ` [PATCH 0/2] module: Split modules_install compression and in-kernel decompression Luis Chamberlain
2 siblings, 0 replies; 7+ messages in thread
From: Petr Pavlu @ 2024-07-22 9:06 UTC (permalink / raw)
To: Luis Chamberlain
Cc: Masahiro Yamada, Nathan Chancellor, Nicolas Schier,
linux-modules, linux-kbuild, linux-kernel, Petr Pavlu
The MODULE_SIG_<type> config choice has an inconsistent prompt styled as
a question and lengthy option names.
Simplify the prompt and option names to be consistent with other module
options.
Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
---
kernel/module/Kconfig | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/kernel/module/Kconfig b/kernel/module/Kconfig
index bb7f7930fef6..ccdbd1bc12aa 100644
--- a/kernel/module/Kconfig
+++ b/kernel/module/Kconfig
@@ -228,7 +228,7 @@ comment "Do not forget to sign required modules with scripts/sign-file"
depends on MODULE_SIG_FORCE && !MODULE_SIG_ALL
choice
- prompt "Which hash algorithm should modules be signed with?"
+ prompt "Hash algorithm to sign modules"
depends on MODULE_SIG || IMA_APPRAISE_MODSIG
help
This determines which sort of hashing algorithm will be used during
@@ -238,31 +238,31 @@ choice
the signature on that module.
config MODULE_SIG_SHA1
- bool "Sign modules with SHA-1"
+ bool "SHA-1"
select CRYPTO_SHA1
config MODULE_SIG_SHA256
- bool "Sign modules with SHA-256"
+ bool "SHA-256"
select CRYPTO_SHA256
config MODULE_SIG_SHA384
- bool "Sign modules with SHA-384"
+ bool "SHA-384"
select CRYPTO_SHA512
config MODULE_SIG_SHA512
- bool "Sign modules with SHA-512"
+ bool "SHA-512"
select CRYPTO_SHA512
config MODULE_SIG_SHA3_256
- bool "Sign modules with SHA3-256"
+ bool "SHA3-256"
select CRYPTO_SHA3
config MODULE_SIG_SHA3_384
- bool "Sign modules with SHA3-384"
+ bool "SHA3-384"
select CRYPTO_SHA3
config MODULE_SIG_SHA3_512
- bool "Sign modules with SHA3-512"
+ bool "SHA3-512"
select CRYPTO_SHA3
endchoice
--
2.35.3
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH 1/2] module: Split modules_install compression and in-kernel decompression
2024-07-22 9:06 ` [PATCH 1/2] " Petr Pavlu
@ 2024-07-22 10:23 ` Masahiro Yamada
2024-07-25 12:59 ` Petr Pavlu
0 siblings, 1 reply; 7+ messages in thread
From: Masahiro Yamada @ 2024-07-22 10:23 UTC (permalink / raw)
To: Petr Pavlu
Cc: Luis Chamberlain, Nathan Chancellor, Nicolas Schier,
linux-modules, linux-kbuild, linux-kernel
On Mon, Jul 22, 2024 at 6:07 PM Petr Pavlu <petr.pavlu@suse.com> wrote:
>
> The kernel configuration allows specifying a module compression mode. If
> one is selected then each module gets compressed during
> 'make modules_install' and additionally one can also enable support for
> a respective direct in-kernel decompression support. This means that the
> decompression support cannot be enabled without the automatic compression.
>
> Some distributions, such as the (open)SUSE family, use a signer service for
> modules. A build runs on a worker machine but signing is done by a separate
> locked-down server that is in possession of the signing key. The build
> invokes 'make modules_install' to create a modules tree, collects
> information about the modules, asks the signer service for their signature,
> appends each signature to the respective module and compresses all modules.
>
> When using this arrangment, the 'make modules_install' step produces
> unsigned+uncompressed modules and the distribution's own build recipe takes
> care of signing and compression later.
>
> The signing support can be currently enabled without automatically signing
> modules during 'make modules_install'. However, the in-kernel decompression
> support can be selected only after first enabling automatic compression
> during this step.
>
> To allow only enabling the in-kernel decompression support without the
> automatic compression during 'make modules_install', separate the
> compression options similarly to the signing options, as follows:
>
> > Enable loadable module support
> [*] Module compression
> Module compression type (GZIP) --->
> [*] Automatically compress all modules
> [ ] Support in-kernel module decompression
>
> * "Module compression" (MODULE_COMPRESS) is a new main switch for the
> compression/decompression support. It replaces MODULE_COMPRESS_NONE.
> * "Module compression type" (MODULE_COMPRESS_<type>) chooses the
> compression type, one of GZ, XZ, ZSTD.
> * "Automatically compress all modules" (MODULE_COMPRESS_ALL) is a new
> option to enable module compression during 'make modules_install'. It
> defaults to Y.
> * "Support in-kernel module decompression" (MODULE_DECOMPRESS) enables
> in-kernel decompression.
>
> Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
> ---
My preference is to add
CONFIG_MODULE_DECOMPRESS_GZIP
CONFIG_MODULE_DECOMPRESS_XZ
CONFIG_MODULE_DECOMPRESS_ZSTD
instead of
CONFIG_MODULE_COMPRESS_ALL.
For example,
if MODULE_DECOMPRESS
config MODULE_DECOMPRESS_GZIP
bool "Support in-kernel GZIP decompression for module"
default MODULE_COMPRESS_GZIP
config MODULE_DECOMPRESS_XZ
bool "Support in-kernel XZ decompression for module"
default MODULE_COMPRESS_XZ
config MODULE_DECOMPRESS_ZSTD
bool "Support in-kernel ZSTD decompression for module"
default MODULE_COMPRESS_ZSTD
endif
OR, maybe
config MODULE_DECOMPRESS_GZIP
bool "Support in-kernel GZIP decompression for module"
select MODULE_DECOMPRESS
config MODULE_DECOMPRESS_XZ
bool "Support in-kernel XZ decompression for module"
select MODULE_DECOMPRESS
config MODULE_DECOMPRESS_ZSTD
bool "Support in-kernel ZSTD decompression for module"
select MODULE_DECOMPRESS
config MODULE_DECOMPRESS
bool
You can toggle MODULE_COMPRESS_GZIP and
MODULE_DECOMPRESS_GZIP independently
Of course, the current kernel/module/decompress.c does not
work when multiple (or zero) CONFIG_MODULE_DECOMPRESS_* is
enabled. It needs a little modification.
I will wait for Lius's comment.
> kernel/module/Kconfig | 61 ++++++++++++++++++++--------------------
> scripts/Makefile.modinst | 2 ++
> 2 files changed, 33 insertions(+), 30 deletions(-)
>
> diff --git a/kernel/module/Kconfig b/kernel/module/Kconfig
> index 4047b6d48255..bb7f7930fef6 100644
> --- a/kernel/module/Kconfig
> +++ b/kernel/module/Kconfig
> @@ -278,64 +278,65 @@ config MODULE_SIG_HASH
> default "sha3-384" if MODULE_SIG_SHA3_384
> default "sha3-512" if MODULE_SIG_SHA3_512
>
> -choice
> - prompt "Module compression mode"
> +config MODULE_COMPRESS
> + bool "Module compression"
> help
> - This option allows you to choose the algorithm which will be used to
> - compress modules when 'make modules_install' is run. (or, you can
> - choose to not compress modules at all.)
> -
> - External modules will also be compressed in the same way during the
> - installation.
> -
> - For modules inside an initrd or initramfs, it's more efficient to
> - compress the whole initrd or initramfs instead.
> -
> + Enable module compression to reduce on-disk size of module binaries.
> This is fully compatible with signed modules.
>
> - Please note that the tool used to load modules needs to support the
> - corresponding algorithm. module-init-tools MAY support gzip, and kmod
> - MAY support gzip, xz and zstd.
> + The tool used to work with modules needs to support the selected
> + compression type. kmod MAY support gzip, xz and zstd. Other tools
> + might have a limited selection of the supported types.
>
> - Your build system needs to provide the appropriate compression tool
> - to compress the modules.
> + Note that for modules inside an initrd or initramfs, it's more
> + efficient to compress the whole ramdisk instead.
>
> - If in doubt, select 'None'.
> + If unsure, say N.
>
> -config MODULE_COMPRESS_NONE
> - bool "None"
> +choice
> + prompt "Module compression type"
> + depends on MODULE_COMPRESS
> help
> - Do not compress modules. The installed modules are suffixed
> - with .ko.
> + Choose the supported algorithm for module compression.
>
> config MODULE_COMPRESS_GZIP
> bool "GZIP"
> help
> - Compress modules with GZIP. The installed modules are suffixed
> - with .ko.gz.
> + Support modules compressed with GZIP. The installed modules are
> + suffixed with .ko.gz.
>
> config MODULE_COMPRESS_XZ
> bool "XZ"
> help
> - Compress modules with XZ. The installed modules are suffixed
> - with .ko.xz.
> + Support modules compressed with XZ. The installed modules are
> + suffixed with .ko.xz.
>
> config MODULE_COMPRESS_ZSTD
> bool "ZSTD"
> help
> - Compress modules with ZSTD. The installed modules are suffixed
> - with .ko.zst.
> + Support modules compressed with ZSTD. The installed modules are
> + suffixed with .ko.zst.
>
> endchoice
>
> +config MODULE_COMPRESS_ALL
> + bool "Automatically compress all modules"
> + default y
> + depends on MODULE_COMPRESS
> + help
> + Compress all modules during 'make modules_install'.
> +
> + Your build system needs to provide the appropriate compression tool
> + for the selected compression type. External modules will also be
> + compressed in the same way during the installation.
> +
> config MODULE_DECOMPRESS
> bool "Support in-kernel module decompression"
> - depends on MODULE_COMPRESS_GZIP || MODULE_COMPRESS_XZ || MODULE_COMPRESS_ZSTD
> + depends on MODULE_COMPRESS
> select ZLIB_INFLATE if MODULE_COMPRESS_GZIP
> select XZ_DEC if MODULE_COMPRESS_XZ
> select ZSTD_DECOMPRESS if MODULE_COMPRESS_ZSTD
> help
> -
> Support for decompressing kernel modules by the kernel itself
> instead of relying on userspace to perform this task. Useful when
> load pinning security policy is enabled.
> diff --git a/scripts/Makefile.modinst b/scripts/Makefile.modinst
> index 0afd75472679..bce4a9adb893 100644
> --- a/scripts/Makefile.modinst
> +++ b/scripts/Makefile.modinst
> @@ -51,9 +51,11 @@ $(foreach x, % :, $(if $(findstring $x, $(dst)), \
> $(error module installation path cannot contain '$x')))
>
> suffix-y :=
> +ifdef CONFIG_MODULE_COMPRESS_ALL
> suffix-$(CONFIG_MODULE_COMPRESS_GZIP) := .gz
> suffix-$(CONFIG_MODULE_COMPRESS_XZ) := .xz
> suffix-$(CONFIG_MODULE_COMPRESS_ZSTD) := .zst
> +endif
>
> modules := $(patsubst $(extmod_prefix)%.o, $(dst)/%.ko$(suffix-y), $(modules))
> install-$(CONFIG_MODULES) += $(modules)
> --
> 2.35.3
>
--
Best Regards
Masahiro Yamada
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH 1/2] module: Split modules_install compression and in-kernel decompression
2024-07-22 10:23 ` Masahiro Yamada
@ 2024-07-25 12:59 ` Petr Pavlu
2024-07-28 9:03 ` Masahiro Yamada
0 siblings, 1 reply; 7+ messages in thread
From: Petr Pavlu @ 2024-07-25 12:59 UTC (permalink / raw)
To: Masahiro Yamada
Cc: Luis Chamberlain, Nathan Chancellor, Nicolas Schier,
linux-modules, linux-kbuild, linux-kernel
On 7/22/24 12:23, Masahiro Yamada wrote:
> On Mon, Jul 22, 2024 at 6:07 PM Petr Pavlu <petr.pavlu@suse.com> wrote:
>>
>> The kernel configuration allows specifying a module compression mode. If
>> one is selected then each module gets compressed during
>> 'make modules_install' and additionally one can also enable support for
>> a respective direct in-kernel decompression support. This means that the
>> decompression support cannot be enabled without the automatic compression.
>>
>> Some distributions, such as the (open)SUSE family, use a signer service for
>> modules. A build runs on a worker machine but signing is done by a separate
>> locked-down server that is in possession of the signing key. The build
>> invokes 'make modules_install' to create a modules tree, collects
>> information about the modules, asks the signer service for their signature,
>> appends each signature to the respective module and compresses all modules.
>>
>> When using this arrangment, the 'make modules_install' step produces
>> unsigned+uncompressed modules and the distribution's own build recipe takes
>> care of signing and compression later.
>>
>> The signing support can be currently enabled without automatically signing
>> modules during 'make modules_install'. However, the in-kernel decompression
>> support can be selected only after first enabling automatic compression
>> during this step.
>>
>> To allow only enabling the in-kernel decompression support without the
>> automatic compression during 'make modules_install', separate the
>> compression options similarly to the signing options, as follows:
>>
>>> Enable loadable module support
>> [*] Module compression
>> Module compression type (GZIP) --->
>> [*] Automatically compress all modules
>> [ ] Support in-kernel module decompression
>>
>> * "Module compression" (MODULE_COMPRESS) is a new main switch for the
>> compression/decompression support. It replaces MODULE_COMPRESS_NONE.
>> * "Module compression type" (MODULE_COMPRESS_<type>) chooses the
>> compression type, one of GZ, XZ, ZSTD.
>> * "Automatically compress all modules" (MODULE_COMPRESS_ALL) is a new
>> option to enable module compression during 'make modules_install'. It
>> defaults to Y.
>> * "Support in-kernel module decompression" (MODULE_DECOMPRESS) enables
>> in-kernel decompression.
>>
>> Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
>> ---
>
>
>
> My preference is to add
> CONFIG_MODULE_DECOMPRESS_GZIP
> CONFIG_MODULE_DECOMPRESS_XZ
> CONFIG_MODULE_DECOMPRESS_ZSTD
> instead of
> CONFIG_MODULE_COMPRESS_ALL.
>
>
>
>
> For example,
>
>
> if MODULE_DECOMPRESS
>
> config MODULE_DECOMPRESS_GZIP
> bool "Support in-kernel GZIP decompression for module"
> default MODULE_COMPRESS_GZIP
>
> config MODULE_DECOMPRESS_XZ
> bool "Support in-kernel XZ decompression for module"
> default MODULE_COMPRESS_XZ
>
> config MODULE_DECOMPRESS_ZSTD
> bool "Support in-kernel ZSTD decompression for module"
> default MODULE_COMPRESS_ZSTD
>
> endif
>
>
>
>
>
> OR, maybe
>
>
>
> config MODULE_DECOMPRESS_GZIP
> bool "Support in-kernel GZIP decompression for module"
> select MODULE_DECOMPRESS
>
> config MODULE_DECOMPRESS_XZ
> bool "Support in-kernel XZ decompression for module"
> select MODULE_DECOMPRESS
>
> config MODULE_DECOMPRESS_ZSTD
> bool "Support in-kernel ZSTD decompression for module"
> select MODULE_DECOMPRESS
>
> config MODULE_DECOMPRESS
> bool
>
>
>
>
> You can toggle MODULE_COMPRESS_GZIP and
> MODULE_DECOMPRESS_GZIP independently
I can implement this, but what would be a use case to enable multiple module
decompression types in the kernel?
>
>
> Of course, the current kernel/module/decompress.c does not
> work when multiple (or zero) CONFIG_MODULE_DECOMPRESS_* is
> enabled. It needs a little modification.
One issue is with the file /sys/module/compression which shows the module
decompression type supported by the kernel. If multiple types are allowed then
I think they should all get listed there. This could however create some
compatibility problems. For instance, kmod reads this file and currently
expects to find exactly one type, so it would need updating as well.
Thanks,
Petr
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH 1/2] module: Split modules_install compression and in-kernel decompression
2024-07-25 12:59 ` Petr Pavlu
@ 2024-07-28 9:03 ` Masahiro Yamada
0 siblings, 0 replies; 7+ messages in thread
From: Masahiro Yamada @ 2024-07-28 9:03 UTC (permalink / raw)
To: Petr Pavlu
Cc: Luis Chamberlain, Nathan Chancellor, Nicolas Schier,
linux-modules, linux-kbuild, linux-kernel
On Thu, Jul 25, 2024 at 9:59 PM Petr Pavlu <petr.pavlu@suse.com> wrote:
>
> On 7/22/24 12:23, Masahiro Yamada wrote:
> > On Mon, Jul 22, 2024 at 6:07 PM Petr Pavlu <petr.pavlu@suse.com> wrote:
> >>
> >> The kernel configuration allows specifying a module compression mode. If
> >> one is selected then each module gets compressed during
> >> 'make modules_install' and additionally one can also enable support for
> >> a respective direct in-kernel decompression support. This means that the
> >> decompression support cannot be enabled without the automatic compression.
> >>
> >> Some distributions, such as the (open)SUSE family, use a signer service for
> >> modules. A build runs on a worker machine but signing is done by a separate
> >> locked-down server that is in possession of the signing key. The build
> >> invokes 'make modules_install' to create a modules tree, collects
> >> information about the modules, asks the signer service for their signature,
> >> appends each signature to the respective module and compresses all modules.
> >>
> >> When using this arrangment, the 'make modules_install' step produces
> >> unsigned+uncompressed modules and the distribution's own build recipe takes
> >> care of signing and compression later.
> >>
> >> The signing support can be currently enabled without automatically signing
> >> modules during 'make modules_install'. However, the in-kernel decompression
> >> support can be selected only after first enabling automatic compression
> >> during this step.
> >>
> >> To allow only enabling the in-kernel decompression support without the
> >> automatic compression during 'make modules_install', separate the
> >> compression options similarly to the signing options, as follows:
> >>
> >>> Enable loadable module support
> >> [*] Module compression
> >> Module compression type (GZIP) --->
> >> [*] Automatically compress all modules
> >> [ ] Support in-kernel module decompression
> >>
> >> * "Module compression" (MODULE_COMPRESS) is a new main switch for the
> >> compression/decompression support. It replaces MODULE_COMPRESS_NONE.
> >> * "Module compression type" (MODULE_COMPRESS_<type>) chooses the
> >> compression type, one of GZ, XZ, ZSTD.
> >> * "Automatically compress all modules" (MODULE_COMPRESS_ALL) is a new
> >> option to enable module compression during 'make modules_install'. It
> >> defaults to Y.
> >> * "Support in-kernel module decompression" (MODULE_DECOMPRESS) enables
> >> in-kernel decompression.
> >>
> >> Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
> >> ---
> >
> >
> >
> > My preference is to add
> > CONFIG_MODULE_DECOMPRESS_GZIP
> > CONFIG_MODULE_DECOMPRESS_XZ
> > CONFIG_MODULE_DECOMPRESS_ZSTD
> > instead of
> > CONFIG_MODULE_COMPRESS_ALL.
> >
> >
> >
> >
> > For example,
> >
> >
> > if MODULE_DECOMPRESS
> >
> > config MODULE_DECOMPRESS_GZIP
> > bool "Support in-kernel GZIP decompression for module"
> > default MODULE_COMPRESS_GZIP
> >
> > config MODULE_DECOMPRESS_XZ
> > bool "Support in-kernel XZ decompression for module"
> > default MODULE_COMPRESS_XZ
> >
> > config MODULE_DECOMPRESS_ZSTD
> > bool "Support in-kernel ZSTD decompression for module"
> > default MODULE_COMPRESS_ZSTD
> >
> > endif
> >
> >
> >
> >
> >
> > OR, maybe
> >
> >
> >
> > config MODULE_DECOMPRESS_GZIP
> > bool "Support in-kernel GZIP decompression for module"
> > select MODULE_DECOMPRESS
> >
> > config MODULE_DECOMPRESS_XZ
> > bool "Support in-kernel XZ decompression for module"
> > select MODULE_DECOMPRESS
> >
> > config MODULE_DECOMPRESS_ZSTD
> > bool "Support in-kernel ZSTD decompression for module"
> > select MODULE_DECOMPRESS
> >
> > config MODULE_DECOMPRESS
> > bool
> >
> >
> >
> >
> > You can toggle MODULE_COMPRESS_GZIP and
> > MODULE_DECOMPRESS_GZIP independently
>
> I can implement this, but what would be a use case to enable multiple module
> decompression types in the kernel?
I just thought there is a possibility where the singer service A
compresses modules in GZIP, and the singer service B in XZ, etc.
If the compression type is predictable at the Kbuild time,
it is fine.
>
> >
> >
> > Of course, the current kernel/module/decompress.c does not
> > work when multiple (or zero) CONFIG_MODULE_DECOMPRESS_* is
> > enabled. It needs a little modification.
>
> One issue is with the file /sys/module/compression which shows the module
> decompression type supported by the kernel. If multiple types are allowed then
> I think they should all get listed there. This could however create some
> compatibility problems. For instance, kmod reads this file and currently
> expects to find exactly one type, so it would need updating as well.
OK, understood. Then,
Acked-by: Masahiro Yamada <masahiroy@kernel.org>
--
Best Regards
Masahiro Yamada
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH 0/2] module: Split modules_install compression and in-kernel decompression
2024-07-22 9:06 [PATCH 0/2] module: Split modules_install compression and in-kernel decompression Petr Pavlu
2024-07-22 9:06 ` [PATCH 1/2] " Petr Pavlu
2024-07-22 9:06 ` [PATCH 2/2] module: Clean up the description of MODULE_SIG_<type> Petr Pavlu
@ 2024-08-19 22:14 ` Luis Chamberlain
2 siblings, 0 replies; 7+ messages in thread
From: Luis Chamberlain @ 2024-08-19 22:14 UTC (permalink / raw)
To: Petr Pavlu
Cc: Masahiro Yamada, Nathan Chancellor, Nicolas Schier,
linux-modules, linux-kbuild, linux-kernel
On Mon, Jul 22, 2024 at 11:06:20AM +0200, Petr Pavlu wrote:
> Allow enabling the in-kernel module decompression support separately,
> without requiring to enable also the automatic compression during
> 'make modules_install'.
Applied and pushed, thanks!
Luis
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2024-08-19 22:14 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-07-22 9:06 [PATCH 0/2] module: Split modules_install compression and in-kernel decompression Petr Pavlu
2024-07-22 9:06 ` [PATCH 1/2] " Petr Pavlu
2024-07-22 10:23 ` Masahiro Yamada
2024-07-25 12:59 ` Petr Pavlu
2024-07-28 9:03 ` Masahiro Yamada
2024-07-22 9:06 ` [PATCH 2/2] module: Clean up the description of MODULE_SIG_<type> Petr Pavlu
2024-08-19 22:14 ` [PATCH 0/2] module: Split modules_install compression and in-kernel decompression Luis Chamberlain
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®