This series introduces a read-only Kexec Handover mode, enabled at boot via 'kho_ro=<pa>' pointing to the physical address of the KHO FDT.
In standard KHO, the target kernel takes ownership of preserved memory during early boot, initializes struct pages for preserved folios, and reclaims KHO metadata and preserved pages back into the page allocator as they are restored. In some scenarios (such as a caretaker, inspection kernel, firmware), a kernel needs to inspect and consume preserved KHO subtrees, radix trees, and serialized metadata without taking ownership of or modifying the KHO state, leaving the preserved KHO tree intact for a subsequent kernel. In this mode, the KHO physical memory lies outside the kernel's direct map. To support this cleanly without duplicating KHO traversal logic: - Patch 1 exposes the physical address of the outgoing KHO FDT via /sys/kernel/debug/kho/out/fdt_phys so userspace tooling can pass it to a 'kho_ro=<pa>' kernel. - Patch 2 moves the shared radix-tree key encoding and indexing, vmalloc flag conversion, and FDT validation and subtree lookup helpers to kernel/liveupdate/kexec_handover_internal.h so they can be shared between standard and read-only KHO. - Patch 3 hardens kho_restore_vmalloc() by introducing kho_vmalloc_validate() in kernel/liveupdate/kexec_handover_internal.h to validate the preservation metadata header and flags before restoring the vmalloc area. - Patch 4 avoids modifying ser->next and bs->head_pa in kho_block_add() and kho_block_set_shrink_one() when operating on an incoming block set, as the chain is already linked and incoming blocks must not be modified in KHO read-only mode. - Patch 5 adds CONFIG_KEXEC_HANDOVER_READONLY and kernel/liveupdate/kexec_handover_ro.c. When booted with 'kho_ro=<pa>', preserved KHO metadata is mapped read-only (PAGE_KERNEL_RO), with the FDT and radix-tree nodes mapped lazily on first visit and kept cached, providing read-only implementations of kho_retrieve_subtree(), kho_restore_vmalloc(), kho_ro_lookup_folio_order(), kho_ro_map_folio(), and kho_ro_unmap(). - Patch 6 updates kho_block to map incoming serialized blocks read-only via kho_ro_map_folio() and unmap them via kho_ro_unmap() in read-only KHO mode. - Patches 7 and 8 extend test_kho and tools/testing/selftests/kho/vmtest.sh to test read-only KHO handover when preserved memory lies outside the boot kernel's initial memory range on both x86_64 and arm64. Pasha Tatashin (8): kho: expose physical address of outgoing FDT kho: move radix tree, vmalloc, and FDT helpers to internal header kho: validate preservation metadata in kho_restore_vmalloc() kho: do not modify incoming serialized blocks kho: add read-only Kexec Handover mode kho: support read-only KHO mode in kho_block kho: test: support read-only KHO mode in test_kho selftests: kho: add read-only KHO test to vmtest.sh .../admin-guide/kernel-parameters.txt | 6 + Documentation/admin-guide/mm/kho.rst | 3 + include/linux/kexec_handover.h | 53 ++- kernel/liveupdate/Kconfig | 16 + kernel/liveupdate/Makefile | 4 +- kernel/liveupdate/kexec_handover.c | 142 +------ kernel/liveupdate/kexec_handover_debugfs.c | 22 +- kernel/liveupdate/kexec_handover_internal.h | 171 +++++++- kernel/liveupdate/kexec_handover_ro.c | 378 ++++++++++++++++++ kernel/liveupdate/kho_block.c | 92 +++-- lib/Kconfig.debug | 2 +- lib/test_kho.c | 68 +++- tools/testing/selftests/kho/arm64.conf | 3 + tools/testing/selftests/kho/init.c | 38 +- tools/testing/selftests/kho/vmtest.sh | 103 +++-- tools/testing/selftests/kho/x86.conf | 1 + 16 files changed, 881 insertions(+), 221 deletions(-) create mode 100644 kernel/liveupdate/kexec_handover_ro.c base-commit: 27be83a12b246b6b3783e7d3ac5c378ff7520f25 -- 2.56.0.176.g3575e65682-goog
