Hi Pasha, Some brief comments before digging in.
On Sun, Oct 18, 2026 at 10:11:03PM -0400, Pasha Tatashin wrote: > This series introduces a read-only Kexec Handover mode, enabled at boot > via 'kho_ro=<pa>' pointing to the physical address of the KHO FDT. > > In standard KHO, the target kernel takes ownership of preserved memory > during early boot, initializes struct pages for preserved folios, and > reclaims KHO metadata and preserved pages back into the page allocator > as they are restored. > > In some scenarios (such as a caretaker, inspection kernel, firmware), a > kernel needs to inspect and consume preserved KHO subtrees, radix trees, > and serialized metadata without taking ownership of or modifying the KHO > state, leaving the preserved KHO tree intact for a subsequent kernel. > In this mode, the KHO physical memory lies outside the kernel's direct > map. > > To support this cleanly without duplicating KHO traversal logic: > - Patch 1 exposes the physical address of the outgoing KHO FDT via > /sys/kernel/debug/kho/out/fdt_phys so userspace tooling can pass it > to a 'kho_ro=<pa>' kernel. We already pass the physical address, why adding a boolean kho_ro is not enough? > - Patch 2 moves the shared radix-tree key encoding and indexing, > vmalloc flag conversion, and FDT validation and subtree lookup helpers > to kernel/liveupdate/kexec_handover_internal.h so they can be shared > between standard and read-only KHO. > - Patch 3 hardens kho_restore_vmalloc() by introducing > kho_vmalloc_validate() in kernel/liveupdate/kexec_handover_internal.h > to validate the preservation metadata header and flags before > restoring the vmalloc area. The diff for kexec_handover_internal.h > kernel/liveupdate/kexec_handover_internal.h | 171 +++++++- seems a wee too large. Maybe some of this should move to a .c file? > - Patch 4 avoids modifying ser->next and bs->head_pa in kho_block_add() > and kho_block_set_shrink_one() when operating on an incoming block > set, as the chain is already linked and incoming blocks must not be > modified in KHO read-only mode. > - Patch 5 adds CONFIG_KEXEC_HANDOVER_READONLY and > kernel/liveupdate/kexec_handover_ro.c. When booted with > 'kho_ro=<pa>', preserved KHO metadata is mapped read-only > (PAGE_KERNEL_RO), with the FDT and radix-tree nodes mapped lazily on > first visit and kept cached, providing read-only implementations of > kho_retrieve_subtree(), kho_restore_vmalloc(), > kho_ro_lookup_folio_order(), kho_ro_map_folio(), and kho_ro_unmap(). What are the expected users of these APIs? > - Patch 6 updates kho_block to map incoming serialized blocks read-only > via kho_ro_map_folio() and unmap them via kho_ro_unmap() in read-only > KHO mode. > - Patches 7 and 8 extend test_kho and tools/testing/selftests/kho/vmtest.sh > to test read-only KHO handover when preserved memory lies outside > the boot kernel's initial memory range on both x86_64 and arm64. > > Pasha Tatashin (8): > kho: expose physical address of outgoing FDT > kho: move radix tree, vmalloc, and FDT helpers to internal header > kho: validate preservation metadata in kho_restore_vmalloc() > kho: do not modify incoming serialized blocks > kho: add read-only Kexec Handover mode > kho: support read-only KHO mode in kho_block > kho: test: support read-only KHO mode in test_kho > selftests: kho: add read-only KHO test to vmtest.sh > > .../admin-guide/kernel-parameters.txt | 6 + > Documentation/admin-guide/mm/kho.rst | 3 + > include/linux/kexec_handover.h | 53 ++- > kernel/liveupdate/Kconfig | 16 + > kernel/liveupdate/Makefile | 4 +- > kernel/liveupdate/kexec_handover.c | 142 +------ > kernel/liveupdate/kexec_handover_debugfs.c | 22 +- > kernel/liveupdate/kexec_handover_internal.h | 171 +++++++- > kernel/liveupdate/kexec_handover_ro.c | 378 ++++++++++++++++++ > kernel/liveupdate/kho_block.c | 92 +++-- > lib/Kconfig.debug | 2 +- > lib/test_kho.c | 68 +++- > tools/testing/selftests/kho/arm64.conf | 3 + > tools/testing/selftests/kho/init.c | 38 +- > tools/testing/selftests/kho/vmtest.sh | 103 +++-- > tools/testing/selftests/kho/x86.conf | 1 + > 16 files changed, 881 insertions(+), 221 deletions(-) > create mode 100644 kernel/liveupdate/kexec_handover_ro.c > > > base-commit: 27be83a12b246b6b3783e7d3ac5c378ff7520f25 > -- > 2.56.0.176.g3575e65682-goog > -- Sincerely yours, Mike.
