Re: [PATCH] kexec: Select ima_get/free_kexec_buffer() with CONFIG_HAVE_IMA_KEXEC(_OF)

[Mimi Zohar <zohar@linux.ibm.com>]

Hi Roberto,

On Wed, 2026-10-14 at 17:00 +0200, Roberto Sassu wrote:
> From: Roberto Sassu <roberto.sassu@huawei.com>

The first paragraph should explain the problem from a high level: the user-
visible impact and cause. For example, something like:

“On x86, if CONFIG_OF_FLATTREE is enabled, the kernel uses the device tree
implementation of ima_get/free_kexec_buffer(). However, x86 doesn’t pass the IMA
buffer through the device tree, so the buffer is never found and the IMA
measurement log is not carried over across kexec.”

Then continue with the fix: defining CONFIG_HAVE_IMA_KEXEC_OF and selecting it
only on the architectures that use the device tree implementation.

thanks,

Mimi

> 
> The ima_get/free_kexec_buffer() device tree implementation relies on the
> arch code calling of_kexec_alloc_and_setup_fdt() to pass the information
> about where the IMA kexec buffer is located. Only the arm64, powerpc and
> riscv architectures support that. LoongArch implicitly assumes that the
> device tree implementation is used, but it does not call that function.

> 
> The ima_get/free_kexec_buffer() x86 implementation instead still relies on
> the setup data to pass the kexec buffer information, and is built only if
> CONFIG_OF_FLATTREE is not defined.
> 
> However, if CONFIG_OF_FLATTREE is selected in x86, x86 attempts to use the
> device tree implementations of ima_get/free_kexec_buffer(), which are never
> going to succeed because of_kexec_alloc_and_setup_fdt() is not called for
> that architecture.
> 
> Instead, define CONFIG_HAVE_IMA_KEXEC_OF (automatically selects
> HAVE_IMA_KEXEC), select it for the architectures that should use the
> ima_get/free_kexec_buffer() device tree implementation, and enable these
> functions if the new config option is enabled. Set it also on LoongArch, to
> preserve the current behavior and avoid a link failure. LoongArch does not
> pass the buffer location to the next kernel yet; this will be addressed
> separately.
> 
> Finally, don't select it for x86, and use x86's own setup_data-based
> implementation regardless of CONFIG_OF_FLATTREE.
> 
> Fixes: b69a2afd5afc ("x86/kexec: Carry forward IMA measurement log on kexec")
> Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>