[Starlingx-discuss] CentOS 7.5 upgrade status update

[McKenna, Jason]

Hi folks,

I do not think the kernel signature item is a real issue, but an artifact of how we built the test image.

The warning reported is basically saying that the driver was compiled against a different build of the kernel than is currently running.  This is typical for intermediate builds where a kernel was compiled, the driver was compiled, and the kernel compiled again (which was the case when I was attempting to get the CentOS 7.5 test load built as the contents in the repos were changing).  I will clean the kernel driver packages the next time I perform a build and we can verify that the error disappears.

-J

For anyone interested in technical details, the kernel regenerates a key pair every time it is built, and compiles one half into the kernel and puts the other half in the kernel-devel package.  Packages (like kernel drivers) building against the kernel-devel package will sign themselves with the key from the package.  Upon loading a driver, the kernel will validate that the signature on the driver matches the half of the key which the kernel has access to.  A mismatched key indicates that the kernel running and kernel-devel package which the driver was built against came from 2 different builds of the kernel, and marks the kernel tainted as a warning.

> -----Original Message-----
> From: Rasa, Nimalini
> Sent: September 18, 2018 9:50 AM
> To: Lin, Shuicheng <shuicheng.lin at intel.com>; Xie, Cindy
> <cindy.xie at intel.com>; McKenna, Jason <Jason.McKenna at windriver.com>;
> Martinez Monroy, Elio <elio.martinez.monroy at intel.com>; Waheed, Numan
> <Numan.Waheed at windriver.com>; starlingx-discuss at lists.starlingx.io
> Cc: Khalil, Ghada <Ghada.Khalil at windriver.com>
> Subject: RE: [Starlingx-discuss] CentOS 7.5 upgrade status update
> 
> Hi Shuicheng,
> It does have the correct version:
> controller-0:~$ uname -a
> Linux controller-0 3.10.0-862.11.6.el7.36.tis.x86_64 #1 SMP PREEMPT Thu Sep
> 13 10:48:38 EDT 2018 x86_64 x86_64 x86_64 GNU/Linux
> 
> Thanks,
> Nimalini
> 
> -----Original Message-----
> From: Lin, Shuicheng [mailto:shuicheng.lin at intel.com]
> Sent: Monday, September 17, 2018 9:16 PM
> To: Rasa, Nimalini; Xie, Cindy; McKenna, Jason; Martinez Monroy, Elio;
> Waheed, Numan; starlingx-discuss at lists.starlingx.io
> Cc: Khalil, Ghada
> Subject: RE: [Starlingx-discuss] CentOS 7.5 upgrade status update
> 
> Hi Nimalini,
> For the kernel signature issue, could you help confirm whether the kernel
> version is 3.10.0-862.11.6 or not?
> You could check it with "uname -a" or search it in the kern.log file.
> Thanks.
> 
> Best Regards
> Shuicheng
> 
> 
> -----Original Message-----
> From: Rasa, Nimalini [mailto:Nimalini.Rasa at windriver.com]
> Sent: Tuesday, September 18, 2018 12:21 AM
> To: Lin, Shuicheng <shuicheng.lin at intel.com>; Xie, Cindy
> <cindy.xie at intel.com>; McKenna, Jason <Jason.McKenna at windriver.com>;
> Martinez Monroy, Elio <elio.martinez.monroy at intel.com>; Waheed, Numan
> <Numan.Waheed at windriver.com>; starlingx-discuss at lists.starlingx.io
> Cc: Khalil, Ghada <Ghada.Khalil at windriver.com>
> Subject: RE: [Starlingx-discuss] CentOS 7.5 upgrade status update
> 
> Hi Shuicheng,
> In this test case, basically trying to allocate double the amount of 2M pages.
> 
> For the kernel signature, I tried it on 3 different hardware labs and got the
> following:
> controller-0:~$ cat /proc/sys/kernel/tainted
> 12288
> controller-0:~$ grep --color=never -i "module verification failed"
> /var/log/kern.log
> 2018-09-14T19:55:12.495 localhost kernel: notice [    8.016748] e1000e:
> module verification failed: signature and/or required key missing - tainting
> kernel
> 2018-09-14T20:49:52.937 controller-0 kernel: notice [    9.517476] e1000e:
> module verification failed: signature and/or required key missing - tainting
> kernel
> 
> 
> Thanks,
> Nimalini
> 
> -----Original Message-----
> From: Lin, Shuicheng [mailto:shuicheng.lin at intel.com]
> Sent: Friday, September 14, 2018 9:13 PM
> To: Rasa, Nimalini; Xie, Cindy; McKenna, Jason; Martinez Monroy, Elio;
> Waheed, Numan; starlingx-discuss at lists.starlingx.io
> Cc: Khalil, Ghada
> Subject: RE: [Starlingx-discuss] CentOS 7.5 upgrade status update
> 
> Hi Nimalini,
> Could you share me the detail reproduce step for "
> test_schedule_vm_mempage_config"?
> 
> For the 2nd failure, I tried "'cat /proc/sys/kernel/tainted'" both in my virtual
> and bare metal environment, and both of them show 4096. Then what
> should I do next?
> "
> controller-0:~$ cat /proc/sys/kernel/tainted
> 4096
> controller-0:~$ grep --color=never -i "module verification failed"
> /var/log/kern.log controller-0:~$ "
> 
> Best Regards
> Shuicheng
> 
> -----Original Message-----
> From: Rasa, Nimalini [mailto:Nimalini.Rasa at windriver.com]
> Sent: Saturday, September 15, 2018 3:02 AM
> To: Xie, Cindy <cindy.xie at intel.com>; McKenna, Jason
> <Jason.McKenna at windriver.com>; Martinez Monroy, Elio
> <elio.martinez.monroy at intel.com>; Waheed, Numan
> <Numan.Waheed at windriver.com>; starlingx-discuss at lists.starlingx.io
> Cc: Khalil, Ghada <Ghada.Khalil at windriver.com>; Lin, Shuicheng
> <shuicheng.lin at intel.com>
> Subject: RE: [Starlingx-discuss] CentOS 7.5 upgrade status update
> 
> Hi Cindy,
> Adding more clarification of the test cases that are failed:
> 
> FAIL       20180914 06:54:06
> test_schedule_vm_mempage_config[1048576]
>   Test case is trying to over allocate 2M pages, expected to reject the cli, in
> this case it's accepted.
> 
> FAIL       20180914 07:57:34            test_kernel_module_signatures
> Test case is doing the following:
>         - 'cat /proc/sys/kernel/tainted', ensure value is 4096. If not, do following
> steps:
>         - 'grep --color=never -i "module verification failed" /var/log/kern.log' to
> find out failed modules
>         - 'modinfo <failed_module> | grep --color=never -E "sig|filename" to
> display signing info for each module
> 
> 
> Hope it clarifies bit more as to what the test cases it trying to do. If you have
> any questions please let me know.
> 
> Thanks,
> Nimalini