* Re: [PATCH v2] kexec: Select ima_get/free_kexec_buffer() with CONFIG_HAVE_IMA_KEXEC(_OF)
2026-10-20 8:37 [PATCH v2] kexec: Select ima_get/free_kexec_buffer() with CONFIG_HAVE_IMA_KEXEC(_OF) Roberto Sassu
@ 2026-10-20 18:49 ` Mimi Zohar
2026-10-21 8:37 ` Jonathan McDowell
` (2 subsequent siblings)
3 siblings, 0 replies; 6+ messages in thread
From: Mimi Zohar @ 2026-10-20 18:49 UTC (permalink / raw)
To: Roberto Sassu, catalin.marinas, will, mark.rutland, chenhuacai,
kernel, maddy, mpe, npiggin, chleroy, pjw, palmer, aou, alex,
tglx, mingo, bp, dave.hansen, hpa, robh, saravanak
Cc: x86, linux-kernel, loongarch, linuxppc-dev, linux-riscv,
devicetree, noodles, linux-integrity, linux-security-module,
Roberto Sassu
On Tue, 2026-10-20 at 10:37 +0200, Roberto Sassu wrote:
> From: Roberto Sassu <roberto.sassu@huawei.com>
>
> On x86, if CONFIG_OF_FLATTREE is enabled, the kernel uses the device tree
> implementation of ima_get/free_kexec_buffer(). However, x86 passes the IMA
> buffer location through setup_data, not through the device tree, so the
> buffer is never found and the IMA measurement list is not carried over
> across kexec.
>
> Introduce CONFIG_HAVE_IMA_KEXEC_OF (which selects CONFIG_HAVE_IMA_KEXEC)
> and select it for the architectures that pass the IMA buffer location
> through the device tree, via of_kexec_alloc_and_setup_fdt() (arm64,
> powerpc and riscv). Build the device tree implementation of
> ima_get/free_kexec_buffer() only if the new option is enabled.
>
> Select the new option also on LoongArch, to preserve the current behavior
> and avoid a link failure. LoongArch does not pass the buffer location to
> the next kernel yet; this will be addressed separately.
>
> Finally, don't select it for x86, and use x86's own setup_data-based
> implementation regardless of CONFIG_OF_FLATTREE.
>
> Fixes: b69a2afd5afc ("x86/kexec: Carry forward IMA measurement log on kexec")
> Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
> ---
>
> v2:
> - Reworded the commit message (no code changes), suggested by Mimi
Thanks, Roberto.
The patch and now the patch description look good. Can we get some tags?
thanks,
Mimi
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH v2] kexec: Select ima_get/free_kexec_buffer() with CONFIG_HAVE_IMA_KEXEC(_OF)
2026-10-20 8:37 [PATCH v2] kexec: Select ima_get/free_kexec_buffer() with CONFIG_HAVE_IMA_KEXEC(_OF) Roberto Sassu
2026-10-20 18:49 ` Mimi Zohar
@ 2026-10-21 8:37 ` Jonathan McDowell
2026-10-22 9:59 ` Krzysztof Kozlowski
2026-10-22 13:13 ` Srish Srinivasan
2026-10-22 14:21 ` Catalin Marinas
3 siblings, 1 reply; 6+ messages in thread
From: Jonathan McDowell @ 2026-10-21 8:37 UTC (permalink / raw)
To: Roberto Sassu
Cc: catalin.marinas, will, mark.rutland, chenhuacai, kernel, maddy,
mpe, npiggin, chleroy, pjw, palmer, aou, alex, tglx, mingo, bp,
dave.hansen, hpa, robh, saravanak, x86, linux-kernel, loongarch,
linuxppc-dev, linux-riscv, devicetree, zohar, noodles,
linux-integrity, linux-security-module, Roberto Sassu
On Tue, Oct 20, 2026 at 10:37:27AM +0200, Roberto Sassu wrote:
> From: Roberto Sassu <roberto.sassu@huawei.com>
>
> On x86, if CONFIG_OF_FLATTREE is enabled, the kernel uses the device tree
> implementation of ima_get/free_kexec_buffer(). However, x86 passes the IMA
> buffer location through setup_data, not through the device tree, so the
> buffer is never found and the IMA measurement list is not carried over
> across kexec.
>
> Introduce CONFIG_HAVE_IMA_KEXEC_OF (which selects CONFIG_HAVE_IMA_KEXEC)
> and select it for the architectures that pass the IMA buffer location
> through the device tree, via of_kexec_alloc_and_setup_fdt() (arm64,
> powerpc and riscv). Build the device tree implementation of
> ima_get/free_kexec_buffer() only if the new option is enabled.
>
> Select the new option also on LoongArch, to preserve the current behavior
> and avoid a link failure. LoongArch does not pass the buffer location to
> the next kernel yet; this will be addressed separately.
>
> Finally, don't select it for x86, and use x86's own setup_data-based
> implementation regardless of CONFIG_OF_FLATTREE.
>
> Fixes: b69a2afd5afc ("x86/kexec: Carry forward IMA measurement log on kexec")
> Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Reviewed-By: Jonathan McDowell <noodles@meta.com>
I think my original intent when adding the ACPI x86 passthrough was to
ensure I didn't break anything for anyone who'd been trying to use OF
with x86 and pass it through, but if it wasn't even wired up there then
that's not a concern.
> ---
>
> v2:
> - Reworded the commit message (no code changes), suggested by Mimi
>
> arch/arm64/Kconfig | 2 +-
> arch/loongarch/Kconfig | 2 +-
> arch/powerpc/Kconfig | 2 +-
> arch/riscv/Kconfig | 2 +-
> arch/x86/kernel/setup.c | 2 +-
> drivers/of/kexec.c | 4 ++--
> kernel/Kconfig.kexec | 4 ++++
> 7 files changed, 11 insertions(+), 7 deletions(-)
>
> diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
> index b5a51b0ef944..4b7e248b6c91 100644
> --- a/arch/arm64/Kconfig
> +++ b/arch/arm64/Kconfig
> @@ -1697,7 +1697,7 @@ config ARCH_SUPPORTS_KEXEC_FILE
> config ARCH_SELECTS_KEXEC_FILE
> def_bool y
> depends on KEXEC_FILE
> - select HAVE_IMA_KEXEC if IMA
> + select HAVE_IMA_KEXEC_OF if IMA
>
> config ARCH_SUPPORTS_KEXEC_SIG
> def_bool y
> diff --git a/arch/loongarch/Kconfig b/arch/loongarch/Kconfig
> index 2067d1f2ad7a..b5420d482da4 100644
> --- a/arch/loongarch/Kconfig
> +++ b/arch/loongarch/Kconfig
> @@ -690,7 +690,7 @@ config ARCH_SELECTS_KEXEC_FILE
> depends on KEXEC_FILE
> select KEXEC_ELF
> select RELOCATABLE
> - select HAVE_IMA_KEXEC if IMA
> + select HAVE_IMA_KEXEC_OF if IMA
>
> config ARCH_SUPPORTS_CRASH_DUMP
> def_bool 64BIT
> diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
> index 2580e27e4328..096c6061893b 100644
> --- a/arch/powerpc/Kconfig
> +++ b/arch/powerpc/Kconfig
> @@ -643,7 +643,7 @@ config ARCH_SELECTS_KEXEC_FILE
> def_bool y
> depends on KEXEC_FILE
> select KEXEC_ELF
> - select HAVE_IMA_KEXEC if IMA
> + select HAVE_IMA_KEXEC_OF if IMA
>
> config PPC64_BIG_ENDIAN_ELF_ABI_V2
> # Option is available to BFD, but LLD does not support ELFv1 so this is
> diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig
> index f8e26c4bed2b..161bf8a65beb 100644
> --- a/arch/riscv/Kconfig
> +++ b/arch/riscv/Kconfig
> @@ -1118,7 +1118,7 @@ config ARCH_SUPPORTS_KEXEC_FILE
> config ARCH_SELECTS_KEXEC_FILE
> def_bool y
> depends on KEXEC_FILE
> - select HAVE_IMA_KEXEC if IMA
> + select HAVE_IMA_KEXEC_OF if IMA
> select KEXEC_ELF
>
> config ARCH_SUPPORTS_KEXEC_PURGATORY
> diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
> index cda6adb9f69c..bc17e353c099 100644
> --- a/arch/x86/kernel/setup.c
> +++ b/arch/x86/kernel/setup.c
> @@ -421,7 +421,7 @@ static void __init add_early_ima_buffer(u64 phys_addr)
> #endif
> }
>
> -#if defined(CONFIG_HAVE_IMA_KEXEC) && !defined(CONFIG_OF_FLATTREE)
> +#ifdef CONFIG_HAVE_IMA_KEXEC
> int __init ima_free_kexec_buffer(void)
> {
> if (!ima_kexec_buffer_size)
> diff --git a/drivers/of/kexec.c b/drivers/of/kexec.c
> index 029903b986cb..724f29fef0c0 100644
> --- a/drivers/of/kexec.c
> +++ b/drivers/of/kexec.c
> @@ -116,7 +116,7 @@ static int do_get_kexec_buffer(const void *prop, int len, unsigned long *addr,
> return 0;
> }
>
> -#ifdef CONFIG_HAVE_IMA_KEXEC
> +#ifdef CONFIG_HAVE_IMA_KEXEC_OF
> /**
> * ima_get_kexec_buffer - get IMA buffer from the previous kernel
> * @addr: On successful return, set to point to the buffer contents.
> @@ -196,7 +196,7 @@ static void remove_ima_buffer(void *fdt, int chosen_node)
> size_t size;
> const void *prop;
>
> - if (!IS_ENABLED(CONFIG_HAVE_IMA_KEXEC))
> + if (!IS_ENABLED(CONFIG_HAVE_IMA_KEXEC_OF))
> return;
>
> prop = fdt_getprop(fdt, chosen_node, "linux,ima-kexec-buffer", &len);
> diff --git a/kernel/Kconfig.kexec b/kernel/Kconfig.kexec
> index 15632358bcf7..c6ed60f04ea4 100644
> --- a/kernel/Kconfig.kexec
> +++ b/kernel/Kconfig.kexec
> @@ -17,6 +17,10 @@ config KEXEC_ELF
> config HAVE_IMA_KEXEC
> bool
>
> +config HAVE_IMA_KEXEC_OF
> + bool
> + select HAVE_IMA_KEXEC
> +
> config KEXEC
> bool "Enable kexec system call"
> depends on ARCH_SUPPORTS_KEXEC
> --
> 2.43.0
J.
--
... "You are in a twisty little maze of lookup tables, all different." --
Joe Zeff, The Scary Devil Monastery
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH v2] kexec: Select ima_get/free_kexec_buffer() with CONFIG_HAVE_IMA_KEXEC(_OF)
2026-10-21 8:37 ` Jonathan McDowell
@ 2026-10-22 9:59 ` Krzysztof Kozlowski
0 siblings, 0 replies; 6+ messages in thread
From: Krzysztof Kozlowski @ 2026-10-22 9:59 UTC (permalink / raw)
To: Jonathan McDowell
Cc: Roberto Sassu, catalin.marinas, will, mark.rutland, chenhuacai,
kernel, maddy, mpe, npiggin, chleroy, pjw, palmer, aou, alex,
tglx, mingo, bp, dave.hansen, hpa, robh, saravanak, x86,
linux-kernel, loongarch, linuxppc-dev, linux-riscv, devicetree,
zohar, noodles, linux-integrity, linux-security-module,
Roberto Sassu
On Wed, Oct 21, 2026 at 09:37:51AM +0100, Jonathan McDowell wrote:
> On Tue, Oct 20, 2026 at 10:37:27AM +0200, Roberto Sassu wrote:
> > From: Roberto Sassu <roberto.sassu@huawei.com>
> >
> > On x86, if CONFIG_OF_FLATTREE is enabled, the kernel uses the device tree
> > implementation of ima_get/free_kexec_buffer(). However, x86 passes the IMA
> > buffer location through setup_data, not through the device tree, so the
> > buffer is never found and the IMA measurement list is not carried over
> > across kexec.
> >
> > Introduce CONFIG_HAVE_IMA_KEXEC_OF (which selects CONFIG_HAVE_IMA_KEXEC)
> > and select it for the architectures that pass the IMA buffer location
> > through the device tree, via of_kexec_alloc_and_setup_fdt() (arm64,
> > powerpc and riscv). Build the device tree implementation of
> > ima_get/free_kexec_buffer() only if the new option is enabled.
> >
> > Select the new option also on LoongArch, to preserve the current behavior
> > and avoid a link failure. LoongArch does not pass the buffer location to
> > the next kernel yet; this will be addressed separately.
> >
> > Finally, don't select it for x86, and use x86's own setup_data-based
> > implementation regardless of CONFIG_OF_FLATTREE.
> >
> > Fixes: b69a2afd5afc ("x86/kexec: Carry forward IMA measurement log on kexec")
> > Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
>
> Reviewed-By: Jonathan McDowell <noodles@meta.com>
Please use kernel style tags, so Reviewed-by.
Best regards,
Krzysztof
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2] kexec: Select ima_get/free_kexec_buffer() with CONFIG_HAVE_IMA_KEXEC(_OF)
2026-10-20 8:37 [PATCH v2] kexec: Select ima_get/free_kexec_buffer() with CONFIG_HAVE_IMA_KEXEC(_OF) Roberto Sassu
2026-10-20 18:49 ` Mimi Zohar
2026-10-21 8:37 ` Jonathan McDowell
@ 2026-10-22 13:13 ` Srish Srinivasan
2026-10-22 14:21 ` Catalin Marinas
3 siblings, 0 replies; 6+ messages in thread
From: Srish Srinivasan @ 2026-10-22 13:13 UTC (permalink / raw)
To: Roberto Sassu, catalin.marinas, will, mark.rutland, chenhuacai,
kernel, maddy, mpe, npiggin, chleroy, pjw, palmer, aou, alex,
tglx, mingo, bp, dave.hansen, hpa, robh, saravanak
Cc: x86, linux-kernel, loongarch, linuxppc-dev, linux-riscv,
devicetree, zohar, noodles, linux-integrity,
linux-security-module, Roberto Sassu
On 10/20/26 2:07 PM, Roberto Sassu wrote:
> From: Roberto Sassu <roberto.sassu@huawei.com>
>
> On x86, if CONFIG_OF_FLATTREE is enabled, the kernel uses the device tree
> implementation of ima_get/free_kexec_buffer(). However, x86 passes the IMA
> buffer location through setup_data, not through the device tree, so the
> buffer is never found and the IMA measurement list is not carried over
> across kexec.
>
> Introduce CONFIG_HAVE_IMA_KEXEC_OF (which selects CONFIG_HAVE_IMA_KEXEC)
> and select it for the architectures that pass the IMA buffer location
> through the device tree, via of_kexec_alloc_and_setup_fdt() (arm64,
> powerpc and riscv). Build the device tree implementation of
> ima_get/free_kexec_buffer() only if the new option is enabled.
>
> Select the new option also on LoongArch, to preserve the current behavior
> and avoid a link failure. LoongArch does not pass the buffer location to
> the next kernel yet; this will be addressed separately.
>
> Finally, don't select it for x86, and use x86's own setup_data-based
> implementation regardless of CONFIG_OF_FLATTREE.
>
> Fixes: b69a2afd5afc ("x86/kexec: Carry forward IMA measurement log on kexec")
> Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Tested-by: Srish Srinivasan <ssrish@linux.ibm.com> # PowerVM
> ---
>
> v2:
> - Reworded the commit message (no code changes), suggested by Mimi
>
> arch/arm64/Kconfig | 2 +-
> arch/loongarch/Kconfig | 2 +-
> arch/powerpc/Kconfig | 2 +-
> arch/riscv/Kconfig | 2 +-
> arch/x86/kernel/setup.c | 2 +-
> drivers/of/kexec.c | 4 ++--
> kernel/Kconfig.kexec | 4 ++++
> 7 files changed, 11 insertions(+), 7 deletions(-)
>
> diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
> index b5a51b0ef944..4b7e248b6c91 100644
> --- a/arch/arm64/Kconfig
> +++ b/arch/arm64/Kconfig
> @@ -1697,7 +1697,7 @@ config ARCH_SUPPORTS_KEXEC_FILE
> config ARCH_SELECTS_KEXEC_FILE
> def_bool y
> depends on KEXEC_FILE
> - select HAVE_IMA_KEXEC if IMA
> + select HAVE_IMA_KEXEC_OF if IMA
>
> config ARCH_SUPPORTS_KEXEC_SIG
> def_bool y
> diff --git a/arch/loongarch/Kconfig b/arch/loongarch/Kconfig
> index 2067d1f2ad7a..b5420d482da4 100644
> --- a/arch/loongarch/Kconfig
> +++ b/arch/loongarch/Kconfig
> @@ -690,7 +690,7 @@ config ARCH_SELECTS_KEXEC_FILE
> depends on KEXEC_FILE
> select KEXEC_ELF
> select RELOCATABLE
> - select HAVE_IMA_KEXEC if IMA
> + select HAVE_IMA_KEXEC_OF if IMA
>
> config ARCH_SUPPORTS_CRASH_DUMP
> def_bool 64BIT
> diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
> index 2580e27e4328..096c6061893b 100644
> --- a/arch/powerpc/Kconfig
> +++ b/arch/powerpc/Kconfig
> @@ -643,7 +643,7 @@ config ARCH_SELECTS_KEXEC_FILE
> def_bool y
> depends on KEXEC_FILE
> select KEXEC_ELF
> - select HAVE_IMA_KEXEC if IMA
> + select HAVE_IMA_KEXEC_OF if IMA
>
> config PPC64_BIG_ENDIAN_ELF_ABI_V2
> # Option is available to BFD, but LLD does not support ELFv1 so this is
> diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig
> index f8e26c4bed2b..161bf8a65beb 100644
> --- a/arch/riscv/Kconfig
> +++ b/arch/riscv/Kconfig
> @@ -1118,7 +1118,7 @@ config ARCH_SUPPORTS_KEXEC_FILE
> config ARCH_SELECTS_KEXEC_FILE
> def_bool y
> depends on KEXEC_FILE
> - select HAVE_IMA_KEXEC if IMA
> + select HAVE_IMA_KEXEC_OF if IMA
> select KEXEC_ELF
>
> config ARCH_SUPPORTS_KEXEC_PURGATORY
> diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
> index cda6adb9f69c..bc17e353c099 100644
> --- a/arch/x86/kernel/setup.c
> +++ b/arch/x86/kernel/setup.c
> @@ -421,7 +421,7 @@ static void __init add_early_ima_buffer(u64 phys_addr)
> #endif
> }
>
> -#if defined(CONFIG_HAVE_IMA_KEXEC) && !defined(CONFIG_OF_FLATTREE)
> +#ifdef CONFIG_HAVE_IMA_KEXEC
> int __init ima_free_kexec_buffer(void)
> {
> if (!ima_kexec_buffer_size)
> diff --git a/drivers/of/kexec.c b/drivers/of/kexec.c
> index 029903b986cb..724f29fef0c0 100644
> --- a/drivers/of/kexec.c
> +++ b/drivers/of/kexec.c
> @@ -116,7 +116,7 @@ static int do_get_kexec_buffer(const void *prop, int len, unsigned long *addr,
> return 0;
> }
>
> -#ifdef CONFIG_HAVE_IMA_KEXEC
> +#ifdef CONFIG_HAVE_IMA_KEXEC_OF
> /**
> * ima_get_kexec_buffer - get IMA buffer from the previous kernel
> * @addr: On successful return, set to point to the buffer contents.
> @@ -196,7 +196,7 @@ static void remove_ima_buffer(void *fdt, int chosen_node)
> size_t size;
> const void *prop;
>
> - if (!IS_ENABLED(CONFIG_HAVE_IMA_KEXEC))
> + if (!IS_ENABLED(CONFIG_HAVE_IMA_KEXEC_OF))
> return;
>
> prop = fdt_getprop(fdt, chosen_node, "linux,ima-kexec-buffer", &len);
> diff --git a/kernel/Kconfig.kexec b/kernel/Kconfig.kexec
> index 15632358bcf7..c6ed60f04ea4 100644
> --- a/kernel/Kconfig.kexec
> +++ b/kernel/Kconfig.kexec
> @@ -17,6 +17,10 @@ config KEXEC_ELF
> config HAVE_IMA_KEXEC
> bool
>
> +config HAVE_IMA_KEXEC_OF
> + bool
> + select HAVE_IMA_KEXEC
> +
> config KEXEC
> bool "Enable kexec system call"
> depends on ARCH_SUPPORTS_KEXEC
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH v2] kexec: Select ima_get/free_kexec_buffer() with CONFIG_HAVE_IMA_KEXEC(_OF)
2026-10-20 8:37 [PATCH v2] kexec: Select ima_get/free_kexec_buffer() with CONFIG_HAVE_IMA_KEXEC(_OF) Roberto Sassu
` (2 preceding siblings ...)
2026-10-22 13:13 ` Srish Srinivasan
@ 2026-10-22 14:21 ` Catalin Marinas
3 siblings, 0 replies; 6+ messages in thread
From: Catalin Marinas @ 2026-10-22 14:21 UTC (permalink / raw)
To: Roberto Sassu
Cc: will, mark.rutland, chenhuacai, kernel, maddy, mpe, npiggin,
chleroy, pjw, palmer, aou, alex, tglx, mingo, bp, dave.hansen,
hpa, robh, saravanak, x86, linux-kernel, loongarch, linuxppc-dev,
linux-riscv, devicetree, zohar, noodles, linux-integrity,
linux-security-module, Roberto Sassu
On Tue, Oct 20, 2026 at 10:37:27AM +0200, Roberto Sassu wrote:
> From: Roberto Sassu <roberto.sassu@huawei.com>
>
> On x86, if CONFIG_OF_FLATTREE is enabled, the kernel uses the device tree
> implementation of ima_get/free_kexec_buffer(). However, x86 passes the IMA
> buffer location through setup_data, not through the device tree, so the
> buffer is never found and the IMA measurement list is not carried over
> across kexec.
>
> Introduce CONFIG_HAVE_IMA_KEXEC_OF (which selects CONFIG_HAVE_IMA_KEXEC)
> and select it for the architectures that pass the IMA buffer location
> through the device tree, via of_kexec_alloc_and_setup_fdt() (arm64,
> powerpc and riscv). Build the device tree implementation of
> ima_get/free_kexec_buffer() only if the new option is enabled.
>
> Select the new option also on LoongArch, to preserve the current behavior
> and avoid a link failure. LoongArch does not pass the buffer location to
> the next kernel yet; this will be addressed separately.
>
> Finally, don't select it for x86, and use x86's own setup_data-based
> implementation regardless of CONFIG_OF_FLATTREE.
>
> Fixes: b69a2afd5afc ("x86/kexec: Carry forward IMA measurement log on kexec")
> Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
For arm64:
Acked-by: Catalin Marinas <catalin.marinas@arm.com>
^ permalink raw reply [flat|nested] 6+ messages in thread