[PATCH v2 00/13] kho: simplify state machine and enable dynamic updates

Pasha Tatashin
2025-11-14T19:00:08Z

Andrew: This series applies against mm-nonmm-unstable, but should
go right before LUOv5, i.e. on top of:
"liveupdate: kho: use %pe format specifier for error pointer printing"

Changelog v2:
- Addressed comments from Mike and Pratyush
- Added Review-bys.

It also replaces the following patches, that once applied should be
dropped from mm-nonmm-unstable:
"liveupdate: kho: when live update add KHO image during kexec load"
"liveupdate: Kconfig: make debugfs optional"
"kho: enable KHO by default"

This patch series refactors the Kexec Handover subsystem to transition
from a rigid, state-locked model to a dynamic, re-entrant architecture.
It also introduces usability improvements.

Motivation
Currently, KHO relies on a strict state machine where memory
preservation is locked upon finalization. If a change is required, the
user must explicitly "abort" to reset the state. Additionally, the kexec
image cannot be loaded until KHO is finalized, and the FDT is rebuilt
from scratch on every finalization.

This series simplifies this workflow to support "load early, finalize
late" scenarios.

Key Changes

State Machine Simplification:
- Removed kho_abort(). kho_finalize() is now re-entrant; calling it a
second time automatically flushes the previous serialized state and
generates a fresh one.

- Removed kho_out.finalized checks from preservation APIs, allowing
drivers to add/remove pages even after an initial finalization.

- Decoupled kexec_file_load from KHO finalization. The KHO FDT physical
address is now stable from boot, allowing the kexec image to be loaded
before the handover metadata is finalized.

FDT Management:
- The FDT is now updated in-place dynamically when subtrees are added or
removed, removing the need for complex reconstruction logic.

- The output FDT is always exposed in debugfs (initialized and zeroed at
boot), improving visibility and debugging capabilities throughout the
system lifecycle.

- Removed the redundant global preserved_mem_map pointer, establishing
the FDT property as the single source of truth.

New Features & API Enhancements:
- High-Level Allocators: Introduced kho_alloc_preserve() and friends to
reduce boilerplate for drivers that need to allocate, preserve, and
eventually restore simple memory buffers.

- Configuration: Added CONFIG_KEXEC_HANDOVER_ENABLE_DEFAULT to allow KHO
to be active by default without requiring the kho=on command line
parameter.

Fixes:
- Fixed potential alignment faults when accessing 64-bit FDT properties.

- Fixed the lifecycle of the FDT folio preservation (now preserved once
at init).

Pasha Tatashin (13):
kho: Fix misleading log message in kho_populate()
kho: Convert __kho_abort() to return void
kho: Introduce high-level memory allocation API
kho: Preserve FDT folio only once during initialization
kho: Verify deserialization status and fix FDT alignment access
kho: Always expose output FDT in debugfs
kho: Simplify serialization and remove __kho_abort
kho: Remove global preserved_mem_map and store state in FDT
kho: Remove abort functionality and support state refresh
kho: Update FDT dynamically for subtree addition/removal
kho: Allow kexec load before KHO finalization
kho: Allow memory preservation state updates after finalization
kho: Add Kconfig option to enable KHO by default

include/linux/kexec_handover.h | 39 +-
kernel/liveupdate/Kconfig | 14 +
kernel/liveupdate/kexec_handover.c | 378 +++++++++++---------
kernel/liveupdate/kexec_handover_debugfs.c | 2 +-
kernel/liveupdate/kexec_handover_internal.h | 1 -
5 files changed, 239 insertions(+), 195 deletions(-)

--
2.52.0.rc1.455.g30608eb744-goog