Re: [PATCH 2/3] mseal sysmap: Allow with CHECKPOINT_RESTORE, default off

[Lorenzo Stoakes (ARM)]

On Tue, Oct 27, 2026 at 07:43:17PM +0800, Chris Down wrote:
> MSEAL_SYSTEM_MAPPINGS depends on !CHECKPOINT_RESTORE because CRIU moves
> system mappings when restoring a process. Now that sealing can be chosen
> at boot we should instead use this to determine defaults.
>
> Let's add MSEAL_SYSTEM_MAPPINGS_DEFAULT_ON and move the dependency
> there. Existing configurations retain their behaviour. Kernels built
> with CHECKPOINT_RESTORE can build sealing in, but will only seal
> mappings when explicitly requested with mseal_system_mappings=1.
>
> Hosts can also share a kernel built with MSEAL_SYSTEM_MAPPINGS=y and
> MSEAL_SYSTEM_MAPPINGS_DEFAULT_ON=n, enabling sealing only where needed.
> This lets hosts which need sealing share the kernel image with hosts
> which need their system mappings to remain movable, which simplifies
> deployment.
>
> Signed-off-by: Chris Down <chris@xxxxxxxxxxxxxx>

Sorry, NAK to this patch. It's adding far too much complexity.

The honest version of this is removing the CRIU dependency, and since it's well
documented that many things break if you use it, and the config option is
default-no, then it's kinda your own fault if you insist on doing the broken
thing.

So I don't think I'd mind that, and it'd make the change simpler, as you could
fold it into patch 1 also ;)

--
Cheers, Lorenzo