From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 27F612D7DC8 for ; Tue, 24 Mar 2026 07:10:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=170.10.133.124 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774336213; cv=pass; b=CL6L3GVUz7V4HGo1kGmKPJYhWaEqyz6lZwc8KyfX3Kk3ZJjL2OsKU+LhnCAOWWURI0mOd7ZVz7Tzp4FMWIIC2Z3dMuIkbIVa9Q3iJ1tHY3nDyPE7W331V6ZzuYLDv3kUt/4/Sv+6UoIf0l+WFB04i0Wg9p4uUbAfukbXSZJL8X4= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774336213; c=relaxed/simple; bh=B7VPMKU8S41YOV0cq+2rJWZqQOczXWbCnxUejuoOI1M=; h=MIME-Version:References:In-Reply-To:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=PQbAQ4etXUh1TbX9/ZPbh0plEjfCxz1tlLEPCjRCoeJCs/1XMZH+Dxz+G++XO+sBdy8fuJrDC4CZ0DdTKfJzPf4uRmZkQElW6mnypghTjgbQd2LaUinIeyGFpUrjMgeo+kKuc3fbSOhBezcHmGadQ51ur3+Q0vuWq8Myyv4Uisk= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=PD/Ej470; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=eou2ntcG; arc=pass smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="PD/Ej470"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="eou2ntcG" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1774336202; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=j0p7ruypCDdXXfhz5IqiaSpJ0nIoncl+MrV7FY/rAAI=; b=PD/Ej470eOb+g84OhCkfHcxaEVAW2ZaWGBRxMZ/6RlQWtlPDUE73LTb2OcLeiY5mcx5x5T mVRx4h59t4Cd+8/kGeq4nYb49CPsOOSik5h5yA5LZOaygJiXlduKycoP3wEJOtuXPP6PTw XV44ms/XCid68DShZR9v9dgbyfvVFSY= Received: from mail-dy1-f197.google.com (mail-dy1-f197.google.com [74.125.82.197]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-680-xOa9Rkv-NFCHhX_asXrZHg-1; Tue, 24 Mar 2026 03:10:00 -0400 X-MC-Unique: xOa9Rkv-NFCHhX_asXrZHg-1 X-Mimecast-MFC-AGG-ID: xOa9Rkv-NFCHhX_asXrZHg_1774336200 Received: by mail-dy1-f197.google.com with SMTP id 5a478bee46e88-2c109ba1296so8328977eec.1 for ; Tue, 24 Mar 2026 00:10:00 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1774336199; cv=none; d=google.com; s=arc-20240605; b=Bvm8FTTcP7Et5KRoN3DQawDhNRmApN+k3A1cYyTKtw3m/bP8ySe9CK+UFZXu59GNse tDv08/F4hHO0VOk39Vlm1K62301qTEpgDx0BnnTL6y5/d0bDZb7Q3SBCO/iXWuzDuYY8 s6ta1TgnxSzAmzPgBTvQ8YQLftLzCt8zwZVKMhDbrZLvIGFBtUBa/uMf82BeCk2jubBx sedLtCKMF+hXzM8n3UdnZZLBdw7YRSHlhf4bgPke/+bGObWEoUqjsb4HHgFlQnSipSar vtIUmHSjSrQOhDDkeynKws9gFeXv0i1ZnScx3Fyvf5QDAoHlxA5dtDAD0FoK4KlgV3Ty Du8w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:dkim-signature; bh=j0p7ruypCDdXXfhz5IqiaSpJ0nIoncl+MrV7FY/rAAI=; fh=pdiCdKvcwy0IgKVlcjkn5ne8/oXrw6PRNVID8bByUFU=; b=Aa1nlSDsmCxWWTrg7+90HE0wFlKwUaeqSQcSyUYaADSGb6t9P1c0R+V3WJiP/eHTet o8tXPaMFPFBqOp2cJVp8d6HCTrIsbEqcolJtGtjj6WCayZHN6mBPgmclnlt+hmimRuPf oico5iTP3D4maVWPI0bzU1HwCjXSUEm21cy8b0TgLvSvzT8gTZ8F9tLzJNi+yeX9GTU0 UYyIRzMQxHiW146YjS4yKwRFLE4Dpaz0wHCv4bT5aTSlQUGeRweWdfe0MJn+VufcM2L5 KfVbm5nb/3mucbSbrywlCFO8LkRPPKpwiXbM15lJg/778JBMYtBlFB5ynTkdObH4dPi2 PN4g==; darn=vger.kernel.org ARC-Authentication-Results: i=1; mx.google.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1774336199; x=1774940999; darn=vger.kernel.org; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=j0p7ruypCDdXXfhz5IqiaSpJ0nIoncl+MrV7FY/rAAI=; b=eou2ntcGFi+TvLGf5xsuKWWKyKj93hQ7qV0mJRcujDhMtsK6gHFI1uaIihRAeKN4Wc yiQZNm6XM2aCBGT2c4D/I6OghzBtWRXhOT5huMqsKJX5iR1OLtNLxU6E+sPdiI2THVej KQ+WAYZ9ZuLe6iHWd6XvYjhnX86oJFS+4jo9Ms7GOVyCNWWNw36MoVB0AubPi3PqtLga SN2jhEEkf1kEP/XkhUwVHjs186iwR+mB7Whk9B5Rop29WIKHCkivOCcnTluNrt0JPP7N Fgy98SnH1lyVoJkSXe747XLV1/slNvZ5/5fADvHSOs1m9M4kwZa8RIS3xeTetxajk0bT Z1VA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1774336199; x=1774940999; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=j0p7ruypCDdXXfhz5IqiaSpJ0nIoncl+MrV7FY/rAAI=; b=fFubydbBHXZ2c1JKaaL4l5Y9eXe/oN6fuDBPGK80HZ2IRX3mcy2o9SuDMKlIFeS6IB ZWMHtwoSE3o2Hn8TxY7cbXwM9MRlF3M/s9J7kUEsvbGvesA45ferAqUC+HKwv9lqQl2l s51UhfHiZslQUMH77nsN11qxb2s82E4xNvh9Gjsk7zjknqY6LIFQWHUfUZWBvLP4KCDV Vapm8PtH4ocPxSnIUECrwRSmh2b4LoHRO15ZjQYmmJ7fl0LcE3OF+koZ/X0b1xJwR5lP tojOqMTE3ihXi1ve+eV7OV4EtOPDTr5/gb51F9SIOAc7bld/fJaiC022OdnzNn4VWlrC S6DQ== X-Forwarded-Encrypted: i=1; AJvYcCUdWezI50GKu/4/LnQHwoirRltSr6D6ZTQL0c1T1ID/ImH26j3KEX4o+c0VvQWfCI2Cg8Qlutk73r8/wQQ=@vger.kernel.org X-Gm-Message-State: AOJu0YzWUT+qYZhNqPQu167ZyrdPY/NOFr8L+Sz09fU3NONVVRDqq8yS G8clDhoqPJE8rSuHnrF2H0rYRBHzhz+FiFJH8wOVsfxMc62e939+aTiJdYjm4/JdGYUpzH77utz ZyzWBMobbYGT8B85ONXf5ofhTKvwzGVIv2cC5jdaDyQQPW4t4AEU+CvV/MvKNR+KatIjvmyrONd LihD9eJf/DinktmZj2/QZSbW0V3k6F7RFe5jsWdEYE X-Gm-Gg: ATEYQzylPOEDoy0NGBeXhJ9xMMai4HESJRg+9W0G5u6f9hFAd2mHeKMhmxzfYhDnZl+ n1itoYZe9vJRghfpRRBrye7KFUzbIgcvai4HWd+LqVZwaS/F7hc+mxV0DF9jWJ7A3D/zb6Jyozl 1bwu5TagL0hjPCVHX6gYNPhvl98Oi16NrYhTEHKtASF4YUem97gFi8tkbykIWaOHygC7pTOc2He PQpyGU= X-Received: by 2002:a05:7300:a145:b0:2be:617:2ddf with SMTP id 5a478bee46e88-2c10970ed0fmr7262375eec.16.1774336199473; Tue, 24 Mar 2026 00:09:59 -0700 (PDT) X-Received: by 2002:a05:7300:a145:b0:2be:617:2ddf with SMTP id 5a478bee46e88-2c10970ed0fmr7262363eec.16.1774336199034; Tue, 24 Mar 2026 00:09:59 -0700 (PDT) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 References: <20260322014402.8815-1-piliu@redhat.com> <20260323120202.e662110de3ca696086f9e1f9@linux-foundation.org> In-Reply-To: <20260323120202.e662110de3ca696086f9e1f9@linux-foundation.org> From: Pingfan Liu Date: Tue, 24 Mar 2026 15:09:48 +0800 X-Gm-Features: AQROBzArO1s8UFiUXdDfYP1zd5xobyzeix-spM303OTU0oAnUprxLEsDtBalr70 Message-ID: Subject: Re: [PATCHv7 00/13] kexec: Use BPF lskel to enable kexec to load PE format boot image To: Andrew Morton Cc: "David S. Miller" , Alexei Starovoitov , Daniel Borkmann , John Fastabend , Andrii Nakryiko , Martin KaFai Lau , Eduard Zingerman , Song Liu , Yonghong Song , Jeremy Linton , Catalin Marinas , Will Deacon , Ard Biesheuvel , Simon Horman , Gerd Hoffmann , Vitaly Kuznetsov , Philipp Rudo , Viktor Malik , Jan Hendrik Farr , Baoquan He , Dave Young , kexec@lists.infradead.org, bpf@vger.kernel.org, systemd-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, Mar 24, 2026 at 3:02=E2=80=AFAM Andrew Morton wrote: > > On Sun, 22 Mar 2026 09:43:49 +0800 Pingfan Liu wrote: > > > Nowadays, UEFI PE bootable images are becoming increasingly popular > > among distributions. Currently, we have several kinds of image format > > parsers in user space (kexec-tools). However, this approach breaks the > > integrity protection of the images. To address this integrity protectio= n > > concern, several approaches have been proposed to resolve this issue, > > but none of them have been accepted upstream yet. > > > > The summary of those approaches: > > -1. UEFI service emulator for UEFI stub > > -2. PE format parser in kernel > > -3. Signing the arm64/boot/Image > > > > > > For the first approach, I tried a purgatory-style emulator [1], but it > > encounters hardware scaling issues. For the second approach, both > > zboot-format [2] and UKI-format [3] parsers were rejected due to > > concerns that variant format parsers would bloat the kernel code. > > Additionally, for example in arm64, both UKI and zboot format parsers > > would need to be introduced and chained together to handle image > > loading. For the third approach, I attempted [4], but since zboot or UK= I > > images already have signatures, upstream maintainers dislike the > > additional signature on the Image. Moreover, for secure boot UKI, this > > method cannot use signatures to protect the initramfs. > > > > > > *** The approach in this series *** > > > > This series introduces an approach that allows image formats to be > > parsed by BPF programs. > > AI review has a ton of questions: > https://sashiko.dev/#/patchset/20260322014402.8815-1-piliu@redhat= .com > > Coverage is partial because some patches didn't apply. Probably some > of these questions are legitimate, others will be false positives - > we're still figuring this out. > Thank you, I will check them too. Best Regards, Pingfan