* Re: [RESEND PATCH v1 1/1] s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n [not found] <20260209133308.118364-1-egorenar@linux.ibm.com> @ 2026-02-10 2:23 ` Baoquan He 2026-02-10 13:36 ` Heiko Carstens 0 siblings, 1 reply; 3+ messages in thread From: Baoquan He @ 2026-02-10 2:23 UTC (permalink / raw) To: Alexander Egorenkov, linux-s390; +Cc: akpm, kexec On 02/09/26 at 02:33pm, Alexander Egorenkov wrote: > The commit c8424e776b09 ("MODSIGN: Export module signature definitions") > replaced the dependency of KEXEC_SIG on SYSTEM_DATA_VERIFICATION with > the dependency on MODULE_SIG_FORMAT. This change disables KEXEC_SIG > in s390 kernels built with MODULES=n if nothing else selects > MODULE_SIG_FORMAT. > > Furthermore, the signature verification in s390 kexec does not require > MODULE_SIG_FORMAT because it requires only the struct module_signature and, > therefore, does not depend on code in kernel/module_signature.c. > > But making ARCH_SUPPORTS_KEXEC_SIG depend on SYSTEM_DATA_VERIFICATION > is also incorrect because it makes KEXEC_SIG available on s390 only > if some other arbitrary option (for instance a file system or device driver) > selects it directly or indirectly. > > To properly make KEXEC_SIG available for s390 kernels built with MODULES=y > as well as MODULES=n _and_ also not depend on arbitrary options selecting > SYSTEM_DATA_VERIFICATION, we set ARCH_SUPPORTS_KEXEC_SIG=y for s390 and > select SYSTEM_DATA_VERIFICATION when KEXEC_SIG=y. Thanks for fixing the issue. Seems the background and change is a little twisting, and selecting SYSTEM_DATA_VERIFICATION will cause a bunch of verification feature selected. While the change is only s390 related, request s390 expert to have look at this change. If no concern from s390 developer, I am also fine to it. Thanks Baoquan > > Fixes: c8424e776b09 ("MODSIGN: Export module signature definitions") > Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com> > --- > arch/s390/Kconfig | 2 +- > kernel/Kconfig.kexec | 1 + > 2 files changed, 2 insertions(+), 1 deletion(-) > > diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig > index c2c7bf974397..385c1052cf45 100644 > --- a/arch/s390/Kconfig > +++ b/arch/s390/Kconfig > @@ -313,7 +313,7 @@ config ARCH_SUPPORTS_KEXEC_FILE > def_bool y > > config ARCH_SUPPORTS_KEXEC_SIG > - def_bool MODULE_SIG_FORMAT > + def_bool y > > config ARCH_SUPPORTS_KEXEC_PURGATORY > def_bool y > diff --git a/kernel/Kconfig.kexec b/kernel/Kconfig.kexec > index 15632358bcf7..df97227cfca9 100644 > --- a/kernel/Kconfig.kexec > +++ b/kernel/Kconfig.kexec > @@ -50,6 +50,7 @@ config KEXEC_SIG > bool "Verify kernel signature during kexec_file_load() syscall" > depends on ARCH_SUPPORTS_KEXEC_SIG > depends on KEXEC_FILE > + select SYSTEM_DATA_VERIFICATION if S390 > help > This option makes the kexec_file_load() syscall check for a valid > signature of the kernel image. The image can still be loaded without > -- > 2.51.0 > ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [RESEND PATCH v1 1/1] s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n 2026-02-10 2:23 ` [RESEND PATCH v1 1/1] s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n Baoquan He @ 2026-02-10 13:36 ` Heiko Carstens 2026-02-10 14:01 ` Alexander Egorenkov 0 siblings, 1 reply; 3+ messages in thread From: Heiko Carstens @ 2026-02-10 13:36 UTC (permalink / raw) To: Baoquan He; +Cc: Alexander Egorenkov, linux-s390, akpm, kexec On Tue, Feb 10, 2026 at 10:23:01AM +0800, Baoquan He wrote: > On 02/09/26 at 02:33pm, Alexander Egorenkov wrote: > > The commit c8424e776b09 ("MODSIGN: Export module signature definitions") > > replaced the dependency of KEXEC_SIG on SYSTEM_DATA_VERIFICATION with > > the dependency on MODULE_SIG_FORMAT. This change disables KEXEC_SIG > > in s390 kernels built with MODULES=n if nothing else selects > > MODULE_SIG_FORMAT. > > > > Furthermore, the signature verification in s390 kexec does not require > > MODULE_SIG_FORMAT because it requires only the struct module_signature and, > > therefore, does not depend on code in kernel/module_signature.c. > > > > But making ARCH_SUPPORTS_KEXEC_SIG depend on SYSTEM_DATA_VERIFICATION > > is also incorrect because it makes KEXEC_SIG available on s390 only > > if some other arbitrary option (for instance a file system or device driver) > > selects it directly or indirectly. > > > > To properly make KEXEC_SIG available for s390 kernels built with MODULES=y > > as well as MODULES=n _and_ also not depend on arbitrary options selecting > > SYSTEM_DATA_VERIFICATION, we set ARCH_SUPPORTS_KEXEC_SIG=y for s390 and > > select SYSTEM_DATA_VERIFICATION when KEXEC_SIG=y. > > Thanks for fixing the issue. > > Seems the background and change is a little twisting, and selecting > SYSTEM_DATA_VERIFICATION will cause a bunch of verification feature > selected. While the change is only s390 related, request s390 expert to > have look at this change. If no concern from s390 developer, I am also > fine to it. ... > > diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig > > index c2c7bf974397..385c1052cf45 100644 > > --- a/arch/s390/Kconfig > > +++ b/arch/s390/Kconfig > > @@ -313,7 +313,7 @@ config ARCH_SUPPORTS_KEXEC_FILE > > def_bool y > > > > config ARCH_SUPPORTS_KEXEC_SIG > > - def_bool MODULE_SIG_FORMAT > > + def_bool y > > > > config ARCH_SUPPORTS_KEXEC_PURGATORY > > def_bool y > > diff --git a/kernel/Kconfig.kexec b/kernel/Kconfig.kexec > > index 15632358bcf7..df97227cfca9 100644 > > --- a/kernel/Kconfig.kexec > > +++ b/kernel/Kconfig.kexec > > @@ -50,6 +50,7 @@ config KEXEC_SIG > > bool "Verify kernel signature during kexec_file_load() syscall" > > depends on ARCH_SUPPORTS_KEXEC_SIG > > depends on KEXEC_FILE > > + select SYSTEM_DATA_VERIFICATION if S390 Alexander, would it make sense to move this to arch/s390/Kconfig and add something like select SYSTEM_DATA_VERIFICATION if KEXEC_SIG instead? This would have the slight advantage to keep arch specifics out of common code Kconfig. ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [RESEND PATCH v1 1/1] s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n 2026-02-10 13:36 ` Heiko Carstens @ 2026-02-10 14:01 ` Alexander Egorenkov 0 siblings, 0 replies; 3+ messages in thread From: Alexander Egorenkov @ 2026-02-10 14:01 UTC (permalink / raw) To: Heiko Carstens, Baoquan He; +Cc: linux-s390, akpm, kexec >> > diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig >> > index c2c7bf974397..385c1052cf45 100644 >> > --- a/arch/s390/Kconfig >> > +++ b/arch/s390/Kconfig >> > @@ -313,7 +313,7 @@ config ARCH_SUPPORTS_KEXEC_FILE >> > def_bool y >> > >> > config ARCH_SUPPORTS_KEXEC_SIG >> > - def_bool MODULE_SIG_FORMAT >> > + def_bool y >> > >> > config ARCH_SUPPORTS_KEXEC_PURGATORY >> > def_bool y >> > diff --git a/kernel/Kconfig.kexec b/kernel/Kconfig.kexec >> > index 15632358bcf7..df97227cfca9 100644 >> > --- a/kernel/Kconfig.kexec >> > +++ b/kernel/Kconfig.kexec >> > @@ -50,6 +50,7 @@ config KEXEC_SIG >> > bool "Verify kernel signature during kexec_file_load() syscall" >> > depends on ARCH_SUPPORTS_KEXEC_SIG >> > depends on KEXEC_FILE >> > + select SYSTEM_DATA_VERIFICATION if S390 > > Alexander, would it make sense to move this to arch/s390/Kconfig and > add something like > > select SYSTEM_DATA_VERIFICATION if KEXEC_SIG > > instead? This would have the slight advantage to keep arch specifics > out of common code Kconfig. That's even better, what i was actually looking for. And works as expected too. Thanks, Heiko. ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-02-10 14:01 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20260209133308.118364-1-egorenar@linux.ibm.com>
2026-02-10 2:23 ` [RESEND PATCH v1 1/1] s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n Baoquan He
2026-02-10 13:36 ` Heiko Carstens
2026-02-10 14:01 ` Alexander Egorenkov
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox