* [RESEND PATCH v1 1/1] s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n
@ 2026-02-09 13:33 Alexander Egorenkov
2026-02-10 2:23 ` Baoquan He
0 siblings, 1 reply; 4+ messages in thread
From: Alexander Egorenkov @ 2026-02-09 13:33 UTC (permalink / raw)
To: akpm, bhe; +Cc: kexec
The commit c8424e776b09 ("MODSIGN: Export module signature definitions")
replaced the dependency of KEXEC_SIG on SYSTEM_DATA_VERIFICATION with
the dependency on MODULE_SIG_FORMAT. This change disables KEXEC_SIG
in s390 kernels built with MODULES=n if nothing else selects
MODULE_SIG_FORMAT.
Furthermore, the signature verification in s390 kexec does not require
MODULE_SIG_FORMAT because it requires only the struct module_signature and,
therefore, does not depend on code in kernel/module_signature.c.
But making ARCH_SUPPORTS_KEXEC_SIG depend on SYSTEM_DATA_VERIFICATION
is also incorrect because it makes KEXEC_SIG available on s390 only
if some other arbitrary option (for instance a file system or device driver)
selects it directly or indirectly.
To properly make KEXEC_SIG available for s390 kernels built with MODULES=y
as well as MODULES=n _and_ also not depend on arbitrary options selecting
SYSTEM_DATA_VERIFICATION, we set ARCH_SUPPORTS_KEXEC_SIG=y for s390 and
select SYSTEM_DATA_VERIFICATION when KEXEC_SIG=y.
Fixes: c8424e776b09 ("MODSIGN: Export module signature definitions")
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
---
arch/s390/Kconfig | 2 +-
kernel/Kconfig.kexec | 1 +
2 files changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index c2c7bf974397..385c1052cf45 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -313,7 +313,7 @@ config ARCH_SUPPORTS_KEXEC_FILE
def_bool y
config ARCH_SUPPORTS_KEXEC_SIG
- def_bool MODULE_SIG_FORMAT
+ def_bool y
config ARCH_SUPPORTS_KEXEC_PURGATORY
def_bool y
diff --git a/kernel/Kconfig.kexec b/kernel/Kconfig.kexec
index 15632358bcf7..df97227cfca9 100644
--- a/kernel/Kconfig.kexec
+++ b/kernel/Kconfig.kexec
@@ -50,6 +50,7 @@ config KEXEC_SIG
bool "Verify kernel signature during kexec_file_load() syscall"
depends on ARCH_SUPPORTS_KEXEC_SIG
depends on KEXEC_FILE
+ select SYSTEM_DATA_VERIFICATION if S390
help
This option makes the kexec_file_load() syscall check for a valid
signature of the kernel image. The image can still be loaded without
--
2.51.0
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [RESEND PATCH v1 1/1] s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n
2026-02-09 13:33 [RESEND PATCH v1 1/1] s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n Alexander Egorenkov
@ 2026-02-10 2:23 ` Baoquan He
2026-02-10 13:36 ` Heiko Carstens
0 siblings, 1 reply; 4+ messages in thread
From: Baoquan He @ 2026-02-10 2:23 UTC (permalink / raw)
To: Alexander Egorenkov, linux-s390; +Cc: akpm, kexec
On 02/09/26 at 02:33pm, Alexander Egorenkov wrote:
> The commit c8424e776b09 ("MODSIGN: Export module signature definitions")
> replaced the dependency of KEXEC_SIG on SYSTEM_DATA_VERIFICATION with
> the dependency on MODULE_SIG_FORMAT. This change disables KEXEC_SIG
> in s390 kernels built with MODULES=n if nothing else selects
> MODULE_SIG_FORMAT.
>
> Furthermore, the signature verification in s390 kexec does not require
> MODULE_SIG_FORMAT because it requires only the struct module_signature and,
> therefore, does not depend on code in kernel/module_signature.c.
>
> But making ARCH_SUPPORTS_KEXEC_SIG depend on SYSTEM_DATA_VERIFICATION
> is also incorrect because it makes KEXEC_SIG available on s390 only
> if some other arbitrary option (for instance a file system or device driver)
> selects it directly or indirectly.
>
> To properly make KEXEC_SIG available for s390 kernels built with MODULES=y
> as well as MODULES=n _and_ also not depend on arbitrary options selecting
> SYSTEM_DATA_VERIFICATION, we set ARCH_SUPPORTS_KEXEC_SIG=y for s390 and
> select SYSTEM_DATA_VERIFICATION when KEXEC_SIG=y.
Thanks for fixing the issue.
Seems the background and change is a little twisting, and selecting
SYSTEM_DATA_VERIFICATION will cause a bunch of verification feature
selected. While the change is only s390 related, request s390 expert to
have look at this change. If no concern from s390 developer, I am also
fine to it.
Thanks
Baoquan
>
> Fixes: c8424e776b09 ("MODSIGN: Export module signature definitions")
> Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
> ---
> arch/s390/Kconfig | 2 +-
> kernel/Kconfig.kexec | 1 +
> 2 files changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
> index c2c7bf974397..385c1052cf45 100644
> --- a/arch/s390/Kconfig
> +++ b/arch/s390/Kconfig
> @@ -313,7 +313,7 @@ config ARCH_SUPPORTS_KEXEC_FILE
> def_bool y
>
> config ARCH_SUPPORTS_KEXEC_SIG
> - def_bool MODULE_SIG_FORMAT
> + def_bool y
>
> config ARCH_SUPPORTS_KEXEC_PURGATORY
> def_bool y
> diff --git a/kernel/Kconfig.kexec b/kernel/Kconfig.kexec
> index 15632358bcf7..df97227cfca9 100644
> --- a/kernel/Kconfig.kexec
> +++ b/kernel/Kconfig.kexec
> @@ -50,6 +50,7 @@ config KEXEC_SIG
> bool "Verify kernel signature during kexec_file_load() syscall"
> depends on ARCH_SUPPORTS_KEXEC_SIG
> depends on KEXEC_FILE
> + select SYSTEM_DATA_VERIFICATION if S390
> help
> This option makes the kexec_file_load() syscall check for a valid
> signature of the kernel image. The image can still be loaded without
> --
> 2.51.0
>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [RESEND PATCH v1 1/1] s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n
2026-02-10 2:23 ` Baoquan He
@ 2026-02-10 13:36 ` Heiko Carstens
2026-02-10 14:01 ` Alexander Egorenkov
0 siblings, 1 reply; 4+ messages in thread
From: Heiko Carstens @ 2026-02-10 13:36 UTC (permalink / raw)
To: Baoquan He; +Cc: Alexander Egorenkov, linux-s390, akpm, kexec
On Tue, Feb 10, 2026 at 10:23:01AM +0800, Baoquan He wrote:
> On 02/09/26 at 02:33pm, Alexander Egorenkov wrote:
> > The commit c8424e776b09 ("MODSIGN: Export module signature definitions")
> > replaced the dependency of KEXEC_SIG on SYSTEM_DATA_VERIFICATION with
> > the dependency on MODULE_SIG_FORMAT. This change disables KEXEC_SIG
> > in s390 kernels built with MODULES=n if nothing else selects
> > MODULE_SIG_FORMAT.
> >
> > Furthermore, the signature verification in s390 kexec does not require
> > MODULE_SIG_FORMAT because it requires only the struct module_signature and,
> > therefore, does not depend on code in kernel/module_signature.c.
> >
> > But making ARCH_SUPPORTS_KEXEC_SIG depend on SYSTEM_DATA_VERIFICATION
> > is also incorrect because it makes KEXEC_SIG available on s390 only
> > if some other arbitrary option (for instance a file system or device driver)
> > selects it directly or indirectly.
> >
> > To properly make KEXEC_SIG available for s390 kernels built with MODULES=y
> > as well as MODULES=n _and_ also not depend on arbitrary options selecting
> > SYSTEM_DATA_VERIFICATION, we set ARCH_SUPPORTS_KEXEC_SIG=y for s390 and
> > select SYSTEM_DATA_VERIFICATION when KEXEC_SIG=y.
>
> Thanks for fixing the issue.
>
> Seems the background and change is a little twisting, and selecting
> SYSTEM_DATA_VERIFICATION will cause a bunch of verification feature
> selected. While the change is only s390 related, request s390 expert to
> have look at this change. If no concern from s390 developer, I am also
> fine to it.
...
> > diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
> > index c2c7bf974397..385c1052cf45 100644
> > --- a/arch/s390/Kconfig
> > +++ b/arch/s390/Kconfig
> > @@ -313,7 +313,7 @@ config ARCH_SUPPORTS_KEXEC_FILE
> > def_bool y
> >
> > config ARCH_SUPPORTS_KEXEC_SIG
> > - def_bool MODULE_SIG_FORMAT
> > + def_bool y
> >
> > config ARCH_SUPPORTS_KEXEC_PURGATORY
> > def_bool y
> > diff --git a/kernel/Kconfig.kexec b/kernel/Kconfig.kexec
> > index 15632358bcf7..df97227cfca9 100644
> > --- a/kernel/Kconfig.kexec
> > +++ b/kernel/Kconfig.kexec
> > @@ -50,6 +50,7 @@ config KEXEC_SIG
> > bool "Verify kernel signature during kexec_file_load() syscall"
> > depends on ARCH_SUPPORTS_KEXEC_SIG
> > depends on KEXEC_FILE
> > + select SYSTEM_DATA_VERIFICATION if S390
Alexander, would it make sense to move this to arch/s390/Kconfig and
add something like
select SYSTEM_DATA_VERIFICATION if KEXEC_SIG
instead? This would have the slight advantage to keep arch specifics
out of common code Kconfig.
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [RESEND PATCH v1 1/1] s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n
2026-02-10 13:36 ` Heiko Carstens
@ 2026-02-10 14:01 ` Alexander Egorenkov
0 siblings, 0 replies; 4+ messages in thread
From: Alexander Egorenkov @ 2026-02-10 14:01 UTC (permalink / raw)
To: Heiko Carstens, Baoquan He; +Cc: linux-s390, akpm, kexec
>> > diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
>> > index c2c7bf974397..385c1052cf45 100644
>> > --- a/arch/s390/Kconfig
>> > +++ b/arch/s390/Kconfig
>> > @@ -313,7 +313,7 @@ config ARCH_SUPPORTS_KEXEC_FILE
>> > def_bool y
>> >
>> > config ARCH_SUPPORTS_KEXEC_SIG
>> > - def_bool MODULE_SIG_FORMAT
>> > + def_bool y
>> >
>> > config ARCH_SUPPORTS_KEXEC_PURGATORY
>> > def_bool y
>> > diff --git a/kernel/Kconfig.kexec b/kernel/Kconfig.kexec
>> > index 15632358bcf7..df97227cfca9 100644
>> > --- a/kernel/Kconfig.kexec
>> > +++ b/kernel/Kconfig.kexec
>> > @@ -50,6 +50,7 @@ config KEXEC_SIG
>> > bool "Verify kernel signature during kexec_file_load() syscall"
>> > depends on ARCH_SUPPORTS_KEXEC_SIG
>> > depends on KEXEC_FILE
>> > + select SYSTEM_DATA_VERIFICATION if S390
>
> Alexander, would it make sense to move this to arch/s390/Kconfig and
> add something like
>
> select SYSTEM_DATA_VERIFICATION if KEXEC_SIG
>
> instead? This would have the slight advantage to keep arch specifics
> out of common code Kconfig.
That's even better, what i was actually looking for.
And works as expected too.
Thanks, Heiko.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-02-10 14:01 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-02-09 13:33 [RESEND PATCH v1 1/1] s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n Alexander Egorenkov
2026-02-10 2:23 ` Baoquan He
2026-02-10 13:36 ` Heiko Carstens
2026-02-10 14:01 ` Alexander Egorenkov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox