Re: [PATCH v1 0/8] kho: add read-only Kexec Handover mode

[Mike Rapoport <rppt@kernel.org>]

Hi Pasha,

Some brief comments before digging in.

On Sun, Oct 18, 2026 at 10:11:03PM -0400, Pasha Tatashin wrote:
> This series introduces a read-only Kexec Handover mode, enabled at boot
> via 'kho_ro=<pa>' pointing to the physical address of the KHO FDT.
> 
> In standard KHO, the target kernel takes ownership of preserved memory
> during early boot, initializes struct pages for preserved folios, and
> reclaims KHO metadata and preserved pages back into the page allocator
> as they are restored.
> 
> In some scenarios (such as a caretaker, inspection kernel, firmware), a
> kernel needs to inspect and consume preserved KHO subtrees, radix trees,
> and serialized metadata without taking ownership of or modifying the KHO
> state, leaving the preserved KHO tree intact for a subsequent kernel.
> In this mode, the KHO physical memory lies outside the kernel's direct
> map.
> 
> To support this cleanly without duplicating KHO traversal logic:
> - Patch 1 exposes the physical address of the outgoing KHO FDT via
>   /sys/kernel/debug/kho/out/fdt_phys so userspace tooling can pass it
>   to a 'kho_ro=<pa>' kernel.

We already pass the physical address, why adding a boolean kho_ro is not
enough?

> - Patch 2 moves the shared radix-tree key encoding and indexing,
>   vmalloc flag conversion, and FDT validation and subtree lookup helpers
>   to kernel/liveupdate/kexec_handover_internal.h so they can be shared
>   between standard and read-only KHO.
> - Patch 3 hardens kho_restore_vmalloc() by introducing
>   kho_vmalloc_validate() in kernel/liveupdate/kexec_handover_internal.h
>   to validate the preservation metadata header and flags before
>   restoring the vmalloc area.

The diff for kexec_handover_internal.h 

>  kernel/liveupdate/kexec_handover_internal.h   | 171 +++++++-

seems a wee too large. Maybe some of this should move to a .c file?

> - Patch 4 avoids modifying ser->next and bs->head_pa in kho_block_add()
>   and kho_block_set_shrink_one() when operating on an incoming block
>   set, as the chain is already linked and incoming blocks must not be
>   modified in KHO read-only mode.
> - Patch 5 adds CONFIG_KEXEC_HANDOVER_READONLY and
>   kernel/liveupdate/kexec_handover_ro.c. When booted with
>   'kho_ro=<pa>', preserved KHO metadata is mapped read-only
>   (PAGE_KERNEL_RO), with the FDT and radix-tree nodes mapped lazily on
>   first visit and kept cached, providing read-only implementations of
>   kho_retrieve_subtree(), kho_restore_vmalloc(),
>   kho_ro_lookup_folio_order(), kho_ro_map_folio(), and kho_ro_unmap().

What are the expected users of these APIs?

> - Patch 6 updates kho_block to map incoming serialized blocks read-only
>   via kho_ro_map_folio() and unmap them via kho_ro_unmap() in read-only
>   KHO mode.
> - Patches 7 and 8 extend test_kho and tools/testing/selftests/kho/vmtest.sh
>   to test read-only KHO handover when preserved memory lies outside
>   the boot kernel's initial memory range on both x86_64 and arm64.
> 
> Pasha Tatashin (8):
>   kho: expose physical address of outgoing FDT
>   kho: move radix tree, vmalloc, and FDT helpers to internal header
>   kho: validate preservation metadata in kho_restore_vmalloc()
>   kho: do not modify incoming serialized blocks
>   kho: add read-only Kexec Handover mode
>   kho: support read-only KHO mode in kho_block
>   kho: test: support read-only KHO mode in test_kho
>   selftests: kho: add read-only KHO test to vmtest.sh
> 
>  .../admin-guide/kernel-parameters.txt         |   6 +
>  Documentation/admin-guide/mm/kho.rst          |   3 +
>  include/linux/kexec_handover.h                |  53 ++-
>  kernel/liveupdate/Kconfig                     |  16 +
>  kernel/liveupdate/Makefile                    |   4 +-
>  kernel/liveupdate/kexec_handover.c            | 142 +------
>  kernel/liveupdate/kexec_handover_debugfs.c    |  22 +-
>  kernel/liveupdate/kexec_handover_internal.h   | 171 +++++++-
>  kernel/liveupdate/kexec_handover_ro.c         | 378 ++++++++++++++++++
>  kernel/liveupdate/kho_block.c                 |  92 +++--
>  lib/Kconfig.debug                             |   2 +-
>  lib/test_kho.c                                |  68 +++-
>  tools/testing/selftests/kho/arm64.conf        |   3 +
>  tools/testing/selftests/kho/init.c            |  38 +-
>  tools/testing/selftests/kho/vmtest.sh         | 103 +++--
>  tools/testing/selftests/kho/x86.conf          |   1 +
>  16 files changed, 881 insertions(+), 221 deletions(-)
>  create mode 100644 kernel/liveupdate/kexec_handover_ro.c
> 
> 
> base-commit: 27be83a12b246b6b3783e7d3ac5c378ff7520f25
> -- 
> 2.56.0.176.g3575e65682-goog
> 

-- 
Sincerely yours,
Mike.