2019-10-07 19:04:15

by Prakhar Srivastava

[permalink] [raw]
Subject: [PATCH v2 0/2] Add support to carry ima measurement log in kexec_file_load

Add support to carry ima measurement log
to the next kexec'ed session triggered via kexec_file_load.
- Top of Linux 5.3-rc6

Currently during kexec the kernel file signatures are/can be validated
prior to actual load, the information(PE/ima signature) is not carried
to the next session. This lead to loss of information.

Carrying forward the ima measurement log to the next kexec'ed session
allows a verifying party to get the entire runtime event log since the
last full reboot, since that is when PCRs were last reset.

Tested for arm64 qemu and real hardware.

I have not been unable to test the patch for powerpc 64bit. Any testing
is greatly appretiated.

TODO: Add support for 32 bit in the of_ima.c

Changelog:

v2:
- move common code to drivers/of/of_ima.c.
- point arm64 to use of_ima implementation.
- point powerpc to use of_ima implementation

v1:
- add new fdt porperties to mark start and end for ima measurement
log.
- use fdt_* functions to add/remove fdt properties and memory
allocations.
- remove additional check for endian-ness as they are checked
in fdt_* functions.

v0:
- Add support to carry ima measurement log in arm64,
uses same code as powerpc.
Prakhar Srivastava (2):
Add support for arm64 to carry ima measurement log in kexec_file_load
update powerpc implementation to call into of_ima*

arch/Kconfig | 6 +-
arch/arm64/include/asm/ima.h | 24 +++
arch/arm64/include/asm/kexec.h | 5 +
arch/arm64/kernel/Makefile | 3 +-
arch/arm64/kernel/ima_kexec.c | 78 ++++++++++
arch/arm64/kernel/machine_kexec_file.c | 6 +
arch/powerpc/include/asm/ima.h | 6 -
arch/powerpc/kernel/Makefile | 8 +-
arch/powerpc/kernel/ima_kexec.c | 170 ++-------------------
drivers/of/Kconfig | 6 +
drivers/of/Makefile | 1 +
drivers/of/of_ima.c | 204 +++++++++++++++++++++++++
include/linux/of.h | 31 ++++
13 files changed, 378 insertions(+), 170 deletions(-)
create mode 100644 arch/arm64/include/asm/ima.h
create mode 100644 arch/arm64/kernel/ima_kexec.c
create mode 100644 drivers/of/of_ima.c

--
2.17.1