[PATCH] kexec: Select ima_get/free_kexec_buffer() with CONFIG_HAVE_IMA_KEXEC(_OF)

[PATCH] kexec: Select ima_get/free_kexec_buffer() with CONFIG_HAVE_IMA_KEXEC(_OF)

[Roberto Sassu]

From: Roberto Sassu <roberto.sassu@huawei.com>

The ima_get/free_kexec_buffer() device tree implementation relies on the
arch code calling of_kexec_alloc_and_setup_fdt() to pass the information
about where the IMA kexec buffer is located. Only the arm64, powerpc and
riscv architectures support that. LoongArch implicitly assumes that the
device tree implementation is used, but it does not call that function.

The ima_get/free_kexec_buffer() x86 implementation instead still relies on
the setup data to pass the kexec buffer information, and is built only if
CONFIG_OF_FLATTREE is not defined.

However, if CONFIG_OF_FLATTREE is selected in x86, x86 attempts to use the
device tree implementations of ima_get/free_kexec_buffer(), which are never
going to succeed because of_kexec_alloc_and_setup_fdt() is not called for
that architecture.

Instead, define CONFIG_HAVE_IMA_KEXEC_OF (automatically selects
HAVE_IMA_KEXEC), select it for the architectures that should use the
ima_get/free_kexec_buffer() device tree implementation, and enable these
functions if the new config option is enabled. Set it also on LoongArch, to
preserve the current behavior and avoid a link failure. LoongArch does not
pass the buffer location to the next kernel yet; this will be addressed
separately.

Finally, don't select it for x86, and use x86's own setup_data-based
implementation regardless of CONFIG_OF_FLATTREE.

Fixes: b69a2afd5afc ("x86/kexec: Carry forward IMA measurement log on kexec")
Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
---
 arch/arm64/Kconfig      | 2 +-
 arch/loongarch/Kconfig  | 2 +-
 arch/powerpc/Kconfig    | 2 +-
 arch/riscv/Kconfig      | 2 +-
 arch/x86/kernel/setup.c | 2 +-
 drivers/of/kexec.c      | 4 ++--
 kernel/Kconfig.kexec    | 4 ++++
 7 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index b5a51b0ef944..4b7e248b6c91 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -1697,7 +1697,7 @@ config ARCH_SUPPORTS_KEXEC_FILE
 config ARCH_SELECTS_KEXEC_FILE
 	def_bool y
 	depends on KEXEC_FILE
-	select HAVE_IMA_KEXEC if IMA
+	select HAVE_IMA_KEXEC_OF if IMA
 
 config ARCH_SUPPORTS_KEXEC_SIG
 	def_bool y
diff --git a/arch/loongarch/Kconfig b/arch/loongarch/Kconfig
index 2067d1f2ad7a..b5420d482da4 100644
--- a/arch/loongarch/Kconfig
+++ b/arch/loongarch/Kconfig
@@ -690,7 +690,7 @@ config ARCH_SELECTS_KEXEC_FILE
 	depends on KEXEC_FILE
 	select KEXEC_ELF
 	select RELOCATABLE
-	select HAVE_IMA_KEXEC if IMA
+	select HAVE_IMA_KEXEC_OF if IMA
 
 config ARCH_SUPPORTS_CRASH_DUMP
 	def_bool 64BIT
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 2580e27e4328..096c6061893b 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -643,7 +643,7 @@ config ARCH_SELECTS_KEXEC_FILE
 	def_bool y
 	depends on KEXEC_FILE
 	select KEXEC_ELF
-	select HAVE_IMA_KEXEC if IMA
+	select HAVE_IMA_KEXEC_OF if IMA
 
 config PPC64_BIG_ENDIAN_ELF_ABI_V2
 	# Option is available to BFD, but LLD does not support ELFv1 so this is
diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig
index f8e26c4bed2b..161bf8a65beb 100644
--- a/arch/riscv/Kconfig
+++ b/arch/riscv/Kconfig
@@ -1118,7 +1118,7 @@ config ARCH_SUPPORTS_KEXEC_FILE
 config ARCH_SELECTS_KEXEC_FILE
 	def_bool y
 	depends on KEXEC_FILE
-	select HAVE_IMA_KEXEC if IMA
+	select HAVE_IMA_KEXEC_OF if IMA
 	select KEXEC_ELF
 
 config ARCH_SUPPORTS_KEXEC_PURGATORY
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index cda6adb9f69c..bc17e353c099 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -421,7 +421,7 @@ static void __init add_early_ima_buffer(u64 phys_addr)
 #endif
 }
 
-#if defined(CONFIG_HAVE_IMA_KEXEC) && !defined(CONFIG_OF_FLATTREE)
+#ifdef CONFIG_HAVE_IMA_KEXEC
 int __init ima_free_kexec_buffer(void)
 {
 	if (!ima_kexec_buffer_size)
diff --git a/drivers/of/kexec.c b/drivers/of/kexec.c
index 029903b986cb..724f29fef0c0 100644
--- a/drivers/of/kexec.c
+++ b/drivers/of/kexec.c
@@ -116,7 +116,7 @@ static int do_get_kexec_buffer(const void *prop, int len, unsigned long *addr,
 	return 0;
 }
 
-#ifdef CONFIG_HAVE_IMA_KEXEC
+#ifdef CONFIG_HAVE_IMA_KEXEC_OF
 /**
  * ima_get_kexec_buffer - get IMA buffer from the previous kernel
  * @addr:	On successful return, set to point to the buffer contents.
@@ -196,7 +196,7 @@ static void remove_ima_buffer(void *fdt, int chosen_node)
 	size_t size;
 	const void *prop;
 
-	if (!IS_ENABLED(CONFIG_HAVE_IMA_KEXEC))
+	if (!IS_ENABLED(CONFIG_HAVE_IMA_KEXEC_OF))
 		return;
 
 	prop = fdt_getprop(fdt, chosen_node, "linux,ima-kexec-buffer", &len);
diff --git a/kernel/Kconfig.kexec b/kernel/Kconfig.kexec
index 15632358bcf7..c6ed60f04ea4 100644
--- a/kernel/Kconfig.kexec
+++ b/kernel/Kconfig.kexec
@@ -17,6 +17,10 @@ config KEXEC_ELF
 config HAVE_IMA_KEXEC
 	bool
 
+config HAVE_IMA_KEXEC_OF
+	bool
+	select HAVE_IMA_KEXEC
+
 config KEXEC
 	bool "Enable kexec system call"
 	depends on ARCH_SUPPORTS_KEXEC
-- 
2.43.0

Re: [PATCH] kexec: Select ima_get/free_kexec_buffer() with CONFIG_HAVE_IMA_KEXEC(_OF)

[Mimi Zohar]

Hi Roberto,

On Wed, 2026-10-14 at 17:00 +0200, Roberto Sassu wrote:
> From: Roberto Sassu <roberto.sassu@huawei.com>

The first paragraph should explain the problem from a high level: the user-
visible impact and cause. For example, something like:

“On x86, if CONFIG_OF_FLATTREE is enabled, the kernel uses the device tree
implementation of ima_get/free_kexec_buffer(). However, x86 doesn’t pass the IMA
buffer through the device tree, so the buffer is never found and the IMA
measurement log is not carried over across kexec.”

Then continue with the fix: defining CONFIG_HAVE_IMA_KEXEC_OF and selecting it
only on the architectures that use the device tree implementation.

thanks,

Mimi

> 
> The ima_get/free_kexec_buffer() device tree implementation relies on the
> arch code calling of_kexec_alloc_and_setup_fdt() to pass the information
> about where the IMA kexec buffer is located. Only the arm64, powerpc and
> riscv architectures support that. LoongArch implicitly assumes that the
> device tree implementation is used, but it does not call that function.

> 
> The ima_get/free_kexec_buffer() x86 implementation instead still relies on
> the setup data to pass the kexec buffer information, and is built only if
> CONFIG_OF_FLATTREE is not defined.
> 
> However, if CONFIG_OF_FLATTREE is selected in x86, x86 attempts to use the
> device tree implementations of ima_get/free_kexec_buffer(), which are never
> going to succeed because of_kexec_alloc_and_setup_fdt() is not called for
> that architecture.
> 
> Instead, define CONFIG_HAVE_IMA_KEXEC_OF (automatically selects
> HAVE_IMA_KEXEC), select it for the architectures that should use the
> ima_get/free_kexec_buffer() device tree implementation, and enable these
> functions if the new config option is enabled. Set it also on LoongArch, to
> preserve the current behavior and avoid a link failure. LoongArch does not
> pass the buffer location to the next kernel yet; this will be addressed
> separately.
> 
> Finally, don't select it for x86, and use x86's own setup_data-based
> implementation regardless of CONFIG_OF_FLATTREE.
> 
> Fixes: b69a2afd5afc ("x86/kexec: Carry forward IMA measurement log on kexec")
> Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>