[PATCH v2] kexec: Select ima_get/free_kexec_buffer() with CONFIG_HAVE_IMA_KEXEC(_OF)
flat view
COOLING11d
From: Roberto Sassu <hidden>
Date: 2026-10-20 08:38:12
Also in:
linux-devicetree, linux-integrity, linux-riscv, linuxppc-dev, lkml, loongarch
Subsystem:
arm64 port (aarch64 architecture), linux for powerpc (32-bit and 64-bit), loongarch, open firmware and flattened device tree, risc-v architecture, the rest, x86 architecture (32-bit and 64-bit) · Maintainers:
Catalin Marinas, Will Deacon, Madhavan Srinivasan, Huacai Chen, Rob Herring, Saravana Kannan, Paul Walmsley, Palmer Dabbelt, Albert Ou, Linus Torvalds, Thomas Gleixner, Ingo Molnar, Borislav Petkov, Dave Hansen
From: Roberto Sassu <roberto.sassu@huawei.com> On x86, if CONFIG_OF_FLATTREE is enabled, the kernel uses the device tree implementation of ima_get/free_kexec_buffer(). However, x86 passes the IMA buffer location through setup_data, not through the device tree, so the buffer is never found and the IMA measurement list is not carried over across kexec. Introduce CONFIG_HAVE_IMA_KEXEC_OF (which selects CONFIG_HAVE_IMA_KEXEC) and select it for the architectures that pass the IMA buffer location through the device tree, via of_kexec_alloc_and_setup_fdt() (arm64, powerpc and riscv). Build the device tree implementation of ima_get/free_kexec_buffer() only if the new option is enabled. Select the new option also on LoongArch, to preserve the current behavior and avoid a link failure. LoongArch does not pass the buffer location to the next kernel yet; this will be addressed separately. Finally, don't select it for x86, and use x86's own setup_data-based implementation regardless of CONFIG_OF_FLATTREE. Fixes: b69a2afd5afc ("x86/kexec: Carry forward IMA measurement log on kexec") Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> --- v2: - Reworded the commit message (no code changes), suggested by Mimi arch/arm64/Kconfig | 2 +- arch/loongarch/Kconfig | 2 +- arch/powerpc/Kconfig | 2 +- arch/riscv/Kconfig | 2 +- arch/x86/kernel/setup.c | 2 +- drivers/of/kexec.c | 4 ++-- kernel/Kconfig.kexec | 4 ++++ 7 files changed, 11 insertions(+), 7 deletions(-)
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index b5a51b0ef944..4b7e248b6c91 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig@@ -1697,7 +1697,7 @@ config ARCH_SUPPORTS_KEXEC_FILE config ARCH_SELECTS_KEXEC_FILE def_bool y depends on KEXEC_FILE - select HAVE_IMA_KEXEC if IMA + select HAVE_IMA_KEXEC_OF if IMA config ARCH_SUPPORTS_KEXEC_SIG def_bool y
diff --git a/arch/loongarch/Kconfig b/arch/loongarch/Kconfig
index 2067d1f2ad7a..b5420d482da4 100644
--- a/arch/loongarch/Kconfig
+++ b/arch/loongarch/Kconfig@@ -690,7 +690,7 @@ config ARCH_SELECTS_KEXEC_FILE depends on KEXEC_FILE select KEXEC_ELF select RELOCATABLE - select HAVE_IMA_KEXEC if IMA + select HAVE_IMA_KEXEC_OF if IMA config ARCH_SUPPORTS_CRASH_DUMP def_bool 64BIT
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 2580e27e4328..096c6061893b 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig@@ -643,7 +643,7 @@ config ARCH_SELECTS_KEXEC_FILE def_bool y depends on KEXEC_FILE select KEXEC_ELF - select HAVE_IMA_KEXEC if IMA + select HAVE_IMA_KEXEC_OF if IMA config PPC64_BIG_ENDIAN_ELF_ABI_V2 # Option is available to BFD, but LLD does not support ELFv1 so this is
diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig
index f8e26c4bed2b..161bf8a65beb 100644
--- a/arch/riscv/Kconfig
+++ b/arch/riscv/Kconfig@@ -1118,7 +1118,7 @@ config ARCH_SUPPORTS_KEXEC_FILE config ARCH_SELECTS_KEXEC_FILE def_bool y depends on KEXEC_FILE - select HAVE_IMA_KEXEC if IMA + select HAVE_IMA_KEXEC_OF if IMA select KEXEC_ELF config ARCH_SUPPORTS_KEXEC_PURGATORY
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index cda6adb9f69c..bc17e353c099 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c@@ -421,7 +421,7 @@ static void __init add_early_ima_buffer(u64 phys_addr) #endif } -#if defined(CONFIG_HAVE_IMA_KEXEC) && !defined(CONFIG_OF_FLATTREE) +#ifdef CONFIG_HAVE_IMA_KEXEC int __init ima_free_kexec_buffer(void) { if (!ima_kexec_buffer_size)
diff --git a/drivers/of/kexec.c b/drivers/of/kexec.c
index 029903b986cb..724f29fef0c0 100644
--- a/drivers/of/kexec.c
+++ b/drivers/of/kexec.c@@ -116,7 +116,7 @@ static int do_get_kexec_buffer(const void *prop, int len, unsigned long *addr, return 0; } -#ifdef CONFIG_HAVE_IMA_KEXEC +#ifdef CONFIG_HAVE_IMA_KEXEC_OF /** * ima_get_kexec_buffer - get IMA buffer from the previous kernel * @addr: On successful return, set to point to the buffer contents.
@@ -196,7 +196,7 @@ static void remove_ima_buffer(void *fdt, int chosen_node) size_t size; const void *prop; - if (!IS_ENABLED(CONFIG_HAVE_IMA_KEXEC)) + if (!IS_ENABLED(CONFIG_HAVE_IMA_KEXEC_OF)) return; prop = fdt_getprop(fdt, chosen_node, "linux,ima-kexec-buffer", &len);
diff --git a/kernel/Kconfig.kexec b/kernel/Kconfig.kexec
index 15632358bcf7..c6ed60f04ea4 100644
--- a/kernel/Kconfig.kexec
+++ b/kernel/Kconfig.kexec@@ -17,6 +17,10 @@ config KEXEC_ELF config HAVE_IMA_KEXEC bool +config HAVE_IMA_KEXEC_OF + bool + select HAVE_IMA_KEXEC + config KEXEC bool "Enable kexec system call" depends on ARCH_SUPPORTS_KEXEC
--
2.43.0