On kexec file load Integrity Measurement Architecture (IMA) subsystem
may verify the IMA signature of the kernel and initramfs, and measure
it. The command line parameters passed to the kernel in the kexec call
may also be measured by IMA. A remote attestation service can verify
a TPM quote based on the TPM event log, the IMA measurement list, and
the TPM PCR data. This can be achieved only if the IMA measurement log
is carried over from the current kernel to the next kernel across
the kexec call.
powerpc already supports carrying forward the IMA measurement log on
kexec. This patch set adds support for carrying forward the IMA
measurement log on kexec on ARM64.
This patch set moves the platform independent code defined for powerpc
such that it can be reused for other platforms as well. A chosen node
"linux,ima-kexec-buffer" is added to the DTB for ARM64 to hold
the address and the size of the memory reserved to carry
the IMA measurement log.
This patch set has been tested for ARM64 platform using QEMU.
I would like help from the community for testing this change on powerpc.
Thanks.
This patch set is based on
commit a29a64445089 ("powerpc: Use common of_kexec_setup_new_fdt()")
in https://git.kernel.org/pub/scm/linux/kernel/git/robh/linux.git
"dt/kexec" branch.
Changelog:
v14
- Select CONFIG_HAVE_IMA_KEXEC for CONFIG_KEXEC_FILE, for powerpc
and arm64, if CONFIG_IMA is enabled.
- Use IS_ENABLED() macro instead of "#ifdef" in remove_ima_buffer(),
ima_get_kexec_buffer(), and ima_free_kexec_buffer().
- Call of_kexec_setup_new_fdt() from setup_new_fdt_ppc64() and
remove setup_new_fdt() in "arch/powerpc/kexec/file_load.c".
v13
- Moved the arch independent functions to drivers/of/kexec.c
and then refactored the code.
- Moved arch_ima_add_kexec_buffer() to
security/integrity/ima/ima_kexec.c
v12
- Use fdt_appendprop_addrrange() in setup_ima_buffer()
to setup the IMA measurement list property in
the device tree.
- Moved architecture independent functions from
"arch/powerpc/kexec/ima.c" to "drivers/of/kexec."
- Deleted "arch/powerpc/kexec/ima.c" and
"arch/powerpc/include/asm/ima.h".
v11
- Rebased the changes on the kexec code refactoring done by
Rob Herring in his "dt/kexec" branch
- Removed "extern" keyword in function declarations
- Removed unnecessary header files included in C files
- Updated patch descriptions per Thiago's comments
v10
- Moved delete_fdt_mem_rsv(), remove_ima_buffer(),
get_ima_kexec_buffer, and get_root_addr_size_cells()
to drivers/of/kexec.c
- Moved arch_ima_add_kexec_buffer() to
security/integrity/ima/ima_kexec.c
- Conditionally define IMA buffer fields in struct kimage_arch
v9
- Moved delete_fdt_mem_rsv() to drivers/of/kexec_fdt.c
- Defined a new function get_ima_kexec_buffer() in
drivers/of/ima_kexec.c to replace do_get_kexec_buffer()
- Changed remove_ima_kexec_buffer() to the original function name
remove_ima_buffer()
- Moved remove_ima_buffer() to drivers/of/ima_kexec.c
- Moved ima_get_kexec_buffer() and ima_free_kexec_buffer()
to security/integrity/ima/ima_kexec.c
v8:
- Moved remove_ima_kexec_buffer(), do_get_kexec_buffer(), and
delete_fdt_mem_rsv() to drivers/of/fdt.c
- Moved ima_dump_measurement_list() and ima_add_kexec_buffer()
back to security/integrity/ima/ima_kexec.c
v7:
- Renamed remove_ima_buffer() to remove_ima_kexec_buffer() and moved
this function definition to kernel.
- Moved delete_fdt_mem_rsv() definition to kernel
- Moved ima_dump_measurement_list() and ima_add_kexec_buffer() to
a new file namely ima_kexec_fdt.c in IMA
v6:
- Remove any existing FDT_PROP_IMA_KEXEC_BUFFER property in the device
tree and also its corresponding memory reservation in the currently
running kernel.
- Moved the function remove_ima_buffer() defined for powerpc to IMA
and renamed the function to ima_remove_kexec_buffer(). Also, moved
delete_fdt_mem_rsv() from powerpc to IMA.
v5:
- Merged get_addr_size_cells() and do_get_kexec_buffer() into a single
function when moving the arch independent code from powerpc to IMA
- Reverted the change to use FDT functions in powerpc code and added
back the original code in get_addr_size_cells() and
do_get_kexec_buffer() for powerpc.
- Added fdt_add_mem_rsv() for ARM64 to reserve the memory for
the IMA log buffer during kexec.
- Fixed the warning reported by kernel test bot for ARM64
arch_ima_add_kexec_buffer() - moved this function to a new file
namely arch/arm64/kernel/ima_kexec.c
v4:
- Submitting the patch series on behalf of the original author
Prakhar Srivastava <[email protected]>
- Moved FDT_PROP_IMA_KEXEC_BUFFER ("linux,ima-kexec-buffer") to
libfdt.h so that it can be shared by multiple platforms.
v3:
Breakup patches further into separate patches.
- Refactoring non architecture specific code out of powerpc
- Update powerpc related code to use fdt functions
- Update IMA buffer read related code to use of functions
- Add support to store the memory information of the IMA
measurement logs to be carried forward.
- Update the property strings to align with documented nodes
https://github.com/devicetree-org/dt-schema/pull/46
v2:
Break patches into separate patches.
- Powerpc related Refactoring
- Updating the docuemntation for chosen node
- Updating arm64 to support IMA buffer pass
v1:
Refactoring carrying over IMA measuremnet logs over Kexec. This patch
moves the non-architecture specific code out of powerpc and adds to
security/ima.(Suggested by Thiago)
Add Documentation regarding the ima-kexec-buffer node in the chosen
node documentation
v0:
Add a layer of abstraction to use the memory reserved by device tree
for ima buffer pass.
Add support for ima buffer pass using reserved memory for arm64 kexec.
Update the arch sepcific code path in kexec file load to store the
ima buffer in the reserved memory. The same reserved memory is read
on kexec or cold boot.
Lakshmi Ramasubramanian (6):
ima: Move arch_ima_add_kexec_buffer() to ima
powerpc: Move arch independent ima kexec functions to
drivers/of/kexec.c
kexec: Use fdt_appendprop_addrrange() to add ima buffer to FDT
powerpc: Delete unused functions
arm64: Free DTB buffer if fdt_open_into() fails
arm64: Add IMA log information in kimage used for kexec
arch/arm64/Kconfig | 1 +
arch/arm64/include/asm/kexec.h | 5 +
arch/arm64/kernel/machine_kexec_file.c | 4 +-
arch/powerpc/Kconfig | 2 +-
arch/powerpc/include/asm/ima.h | 30 ----
arch/powerpc/include/asm/kexec.h | 4 -
arch/powerpc/kexec/Makefile | 7 -
arch/powerpc/kexec/file_load.c | 67 --------
arch/powerpc/kexec/file_load_64.c | 4 +-
arch/powerpc/kexec/ima.c | 219 -------------------------
drivers/of/kexec.c | 193 ++++++++++++++++++++++
include/linux/of.h | 2 +
security/integrity/ima/ima.h | 4 -
security/integrity/ima/ima_kexec.c | 22 +++
14 files changed, 230 insertions(+), 334 deletions(-)
delete mode 100644 arch/powerpc/include/asm/ima.h
delete mode 100644 arch/powerpc/kexec/ima.c
--
2.29.2
create_dtb() function allocates memory for the device tree blob (DTB)
and calls fdt_open_into(). If this call fails the memory allocated
for the DTB is not freed before returning from create_dtb() thereby
leaking memory.
Call vfree() to free the memory allocated for the DTB if fdt_open_into()
fails.
Co-developed-by: Prakhar Srivastava <[email protected]>
Signed-off-by: Prakhar Srivastava <[email protected]>
Signed-off-by: Lakshmi Ramasubramanian <[email protected]>
Reviewed-by: Thiago Jung Bauermann <[email protected]>
---
arch/arm64/kernel/machine_kexec_file.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/kernel/machine_kexec_file.c b/arch/arm64/kernel/machine_kexec_file.c
index 7da22bb7b9d5..2664b63bb118 100644
--- a/arch/arm64/kernel/machine_kexec_file.c
+++ b/arch/arm64/kernel/machine_kexec_file.c
@@ -65,8 +65,10 @@ static int create_dtb(struct kimage *image,
/* duplicate a device tree blob */
ret = fdt_open_into(initial_boot_params, buf, buf_size);
- if (ret)
+ if (ret) {
+ vfree(buf);
return -EINVAL;
+ }
ret = of_kexec_setup_new_fdt(image, buf, initrd_load_addr,
initrd_len, cmdline);
--
2.29.2
Address and size of the buffer containing the IMA measurement log need
to be passed from the current kernel to the next kernel on kexec.
Any existing "linux,ima-kexec-buffer" property in the device tree
needs to be removed and its corresponding memory reservation in
the currently running kernel needs to be freed. The address and
size of the current kernel's IMA measurement log need to be added
to the device tree's IMA kexec buffer node and memory for the buffer
needs to be reserved for the log to be carried over to the next kernel
on the kexec call.
Add address and size fields to "struct kimage_arch" for ARM64 platform
to hold the address and size of the IMA measurement log buffer. Remove
any existing "linux,ima-kexec-buffer" property in the device tree and
free the corresponding memory reservation in the currently running
kernel. Add "linux,ima-kexec-buffer" property to the device tree and
reserve the memory for storing the IMA log that needs to be passed from
the current kernel to the next one.
Update CONFIG_KEXEC_FILE to select CONFIG_HAVE_IMA_KEXEC to indicate
that the IMA measurement log information is present in the device tree
for ARM64.
Co-developed-by: Prakhar Srivastava <[email protected]>
Signed-off-by: Prakhar Srivastava <[email protected]>
Signed-off-by: Lakshmi Ramasubramanian <[email protected]>
---
arch/arm64/Kconfig | 1 +
arch/arm64/include/asm/kexec.h | 5 +++++
2 files changed, 6 insertions(+)
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index a6b5b7ef40ae..312b4d5ad232 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -1095,6 +1095,7 @@ config KEXEC
config KEXEC_FILE
bool "kexec file based system call"
select KEXEC_CORE
+ select HAVE_IMA_KEXEC if IMA
help
This is new version of kexec system call. This system call is
file based and takes file descriptors as system call argument
diff --git a/arch/arm64/include/asm/kexec.h b/arch/arm64/include/asm/kexec.h
index d24b527e8c00..2bd19ccb6c43 100644
--- a/arch/arm64/include/asm/kexec.h
+++ b/arch/arm64/include/asm/kexec.h
@@ -100,6 +100,11 @@ struct kimage_arch {
void *elf_headers;
unsigned long elf_headers_mem;
unsigned long elf_headers_sz;
+
+#ifdef CONFIG_IMA_KEXEC
+ phys_addr_t ima_buffer_addr;
+ size_t ima_buffer_size;
+#endif
};
extern const struct kexec_file_ops kexec_image_ops;
--
2.29.2
On Mon, Jan 04, 2021 at 11:25:56AM -0800, Lakshmi Ramasubramanian wrote:
> On kexec file load Integrity Measurement Architecture (IMA) subsystem
> may verify the IMA signature of the kernel and initramfs, and measure
> it. The command line parameters passed to the kernel in the kexec call
> may also be measured by IMA. A remote attestation service can verify
> a TPM quote based on the TPM event log, the IMA measurement list, and
> the TPM PCR data. This can be achieved only if the IMA measurement log
> is carried over from the current kernel to the next kernel across
> the kexec call.
>
> powerpc already supports carrying forward the IMA measurement log on
> kexec. This patch set adds support for carrying forward the IMA
> measurement log on kexec on ARM64.
>
> This patch set moves the platform independent code defined for powerpc
> such that it can be reused for other platforms as well. A chosen node
> "linux,ima-kexec-buffer" is added to the DTB for ARM64 to hold
> the address and the size of the memory reserved to carry
> the IMA measurement log.
>
> This patch set has been tested for ARM64 platform using QEMU.
> I would like help from the community for testing this change on powerpc.
> Thanks.
>
> This patch set is based on
> commit a29a64445089 ("powerpc: Use common of_kexec_setup_new_fdt()")
> in https://git.kernel.org/pub/scm/linux/kernel/git/robh/linux.git
> "dt/kexec" branch.
This all looks good to me. I'd suggest you send the above patches out as
part of this series because I don't plan to do so.
I would like to also resolve the vmalloc vs. kmalloc difference for
allocating the FDT. Then we can further consolidate the DT kexec code.
It all needs some acks from arm64 and powerpc maintainers. As far as
merging, I think via the integrity tree makes the most sense.
Rob
On Tue, 2021-01-12 at 08:42 -0600, Rob Herring wrote:
> On Mon, Jan 04, 2021 at 11:25:56AM -0800, Lakshmi Ramasubramanian wrote:
> > On kexec file load Integrity Measurement Architecture (IMA) subsystem
> > may verify the IMA signature of the kernel and initramfs, and measure
> > it. The command line parameters passed to the kernel in the kexec call
> > may also be measured by IMA. A remote attestation service can verify
> > a TPM quote based on the TPM event log, the IMA measurement list, and
> > the TPM PCR data. This can be achieved only if the IMA measurement log
> > is carried over from the current kernel to the next kernel across
> > the kexec call.
> >
> > powerpc already supports carrying forward the IMA measurement log on
> > kexec. This patch set adds support for carrying forward the IMA
> > measurement log on kexec on ARM64.
> >
> > This patch set moves the platform independent code defined for powerpc
> > such that it can be reused for other platforms as well. A chosen node
> > "linux,ima-kexec-buffer" is added to the DTB for ARM64 to hold
> > the address and the size of the memory reserved to carry
> > the IMA measurement log.
> >
> > This patch set has been tested for ARM64 platform using QEMU.
> > I would like help from the community for testing this change on powerpc.
> > Thanks.
> >
> > This patch set is based on
> > commit a29a64445089 ("powerpc: Use common of_kexec_setup_new_fdt()")
> > in https://git.kernel.org/pub/scm/linux/kernel/git/robh/linux.git
> > "dt/kexec" branch.
>
> This all looks good to me. I'd suggest you send the above patches out as
> part of this series because I don't plan to do so.
>
> I would like to also resolve the vmalloc vs. kmalloc difference for
> allocating the FDT. Then we can further consolidate the DT kexec code.
>
> It all needs some acks from arm64 and powerpc maintainers. As far as
> merging, I think via the integrity tree makes the most sense.
Thanks, Rob. Lakshmi, please update Rob's patches to include patch
descriptions before re-posting.
Mimi
On 1/12/21 6:42 AM, Rob Herring wrote:
> On Mon, Jan 04, 2021 at 11:25:56AM -0800, Lakshmi Ramasubramanian wrote:
>> On kexec file load Integrity Measurement Architecture (IMA) subsystem
>> may verify the IMA signature of the kernel and initramfs, and measure
>> it. The command line parameters passed to the kernel in the kexec call
>> may also be measured by IMA. A remote attestation service can verify
>> a TPM quote based on the TPM event log, the IMA measurement list, and
>> the TPM PCR data. This can be achieved only if the IMA measurement log
>> is carried over from the current kernel to the next kernel across
>> the kexec call.
>>
>> powerpc already supports carrying forward the IMA measurement log on
>> kexec. This patch set adds support for carrying forward the IMA
>> measurement log on kexec on ARM64.
>>
>> This patch set moves the platform independent code defined for powerpc
>> such that it can be reused for other platforms as well. A chosen node
>> "linux,ima-kexec-buffer" is added to the DTB for ARM64 to hold
>> the address and the size of the memory reserved to carry
>> the IMA measurement log.
>>
>> This patch set has been tested for ARM64 platform using QEMU.
>> I would like help from the community for testing this change on powerpc.
>> Thanks.
>>
>> This patch set is based on
>> commit a29a64445089 ("powerpc: Use common of_kexec_setup_new_fdt()")
>> in https://git.kernel.org/pub/scm/linux/kernel/git/robh/linux.git
>> "dt/kexec" branch.
>
> This all looks good to me. I'd suggest you send the above patches out as
> part of this series because I don't plan to do so.
Thanks for reviewing the patches Rob.
Sure - I'll add your patches to this series.
> I would like to also resolve the vmalloc vs. kmalloc difference for
> allocating the FDT. Then we can further consolidate the DT kexec code.
I think FDT allocation using vmalloc for ARM64 can be changed to
kmalloc. What are the other changes you'd like me to do in arm64/powerpc
DT kexec code in this patch series?
@AKASHI Takahiro - could you please let me know if the above sounds right?
>
> It all needs some acks from arm64 and powerpc maintainers. As far as
> merging, I think via the integrity tree makes the most sense.
I'll create the patch series in "next-integrity" branch.
Thiago/Mimi have acked some of the patches. Please review the remaining
patches in this version.
Could arm64 maintainers please review the patches and respond?
thanks,
-lakshmi
On 1/12/21 10:05 AM, Mimi Zohar wrote:
> On Tue, 2021-01-12 at 08:42 -0600, Rob Herring wrote:
>> On Mon, Jan 04, 2021 at 11:25:56AM -0800, Lakshmi Ramasubramanian wrote:
>>> On kexec file load Integrity Measurement Architecture (IMA) subsystem
>>> may verify the IMA signature of the kernel and initramfs, and measure
>>> it. The command line parameters passed to the kernel in the kexec call
>>> may also be measured by IMA. A remote attestation service can verify
>>> a TPM quote based on the TPM event log, the IMA measurement list, and
>>> the TPM PCR data. This can be achieved only if the IMA measurement log
>>> is carried over from the current kernel to the next kernel across
>>> the kexec call.
>>>
>>> powerpc already supports carrying forward the IMA measurement log on
>>> kexec. This patch set adds support for carrying forward the IMA
>>> measurement log on kexec on ARM64.
>>>
>>> This patch set moves the platform independent code defined for powerpc
>>> such that it can be reused for other platforms as well. A chosen node
>>> "linux,ima-kexec-buffer" is added to the DTB for ARM64 to hold
>>> the address and the size of the memory reserved to carry
>>> the IMA measurement log.
>>>
>>> This patch set has been tested for ARM64 platform using QEMU.
>>> I would like help from the community for testing this change on powerpc.
>>> Thanks.
>>>
>>> This patch set is based on
>>> commit a29a64445089 ("powerpc: Use common of_kexec_setup_new_fdt()")
>>> in https://git.kernel.org/pub/scm/linux/kernel/git/robh/linux.git
>>> "dt/kexec" branch.
>>
>> This all looks good to me. I'd suggest you send the above patches out as
>> part of this series because I don't plan to do so.
>>
>> I would like to also resolve the vmalloc vs. kmalloc difference for
>> allocating the FDT. Then we can further consolidate the DT kexec code.
>>
>> It all needs some acks from arm64 and powerpc maintainers. As far as
>> merging, I think via the integrity tree makes the most sense.
>
> Thanks, Rob. Lakshmi, please update Rob's patches to include patch
> descriptions before re-posting.
>
Will do Mimi.
thanks,
-lakshmi
Mimi Zohar <[email protected]> writes:
> On Tue, 2021-01-12 at 08:42 -0600, Rob Herring wrote:
>> On Mon, Jan 04, 2021 at 11:25:56AM -0800, Lakshmi Ramasubramanian wrote:
>> > On kexec file load Integrity Measurement Architecture (IMA) subsystem
>> > may verify the IMA signature of the kernel and initramfs, and measure
>> > it. The command line parameters passed to the kernel in the kexec call
>> > may also be measured by IMA. A remote attestation service can verify
>> > a TPM quote based on the TPM event log, the IMA measurement list, and
>> > the TPM PCR data. This can be achieved only if the IMA measurement log
>> > is carried over from the current kernel to the next kernel across
>> > the kexec call.
>> >
>> > powerpc already supports carrying forward the IMA measurement log on
>> > kexec. This patch set adds support for carrying forward the IMA
>> > measurement log on kexec on ARM64.
>> >
>> > This patch set moves the platform independent code defined for powerpc
>> > such that it can be reused for other platforms as well. A chosen node
>> > "linux,ima-kexec-buffer" is added to the DTB for ARM64 to hold
>> > the address and the size of the memory reserved to carry
>> > the IMA measurement log.
>> >
>> > This patch set has been tested for ARM64 platform using QEMU.
>> > I would like help from the community for testing this change on powerpc.
>> > Thanks.
>> >
>> > This patch set is based on
>> > commit a29a64445089 ("powerpc: Use common of_kexec_setup_new_fdt()")
>> > in https://git.kernel.org/pub/scm/linux/kernel/git/robh/linux.git
>> > "dt/kexec" branch.
>>
>> This all looks good to me. I'd suggest you send the above patches out as
>> part of this series because I don't plan to do so.
>>
>> I would like to also resolve the vmalloc vs. kmalloc difference for
>> allocating the FDT. Then we can further consolidate the DT kexec code.
>>
>> It all needs some acks from arm64 and powerpc maintainers. As far as
>> merging, I think via the integrity tree makes the most sense.
>
> Thanks, Rob. Lakshmi, please update Rob's patches to include patch
> descriptions before re-posting.
Also please update the powerpc mailing list address to
[email protected]
--
Thiago Jung Bauermann
IBM Linux Technology Center
Hi Lakshmi,
On Mon, 2021-01-04 at 11:26 -0800, Lakshmi Ramasubramanian wrote:
> Address and size of the buffer containing the IMA measurement log need
> to be passed from the current kernel to the next kernel on kexec.
>
> Any existing "linux,ima-kexec-buffer" property in the device tree
> needs to be removed and its corresponding memory reservation in
> the currently running kernel needs to be freed. The address and
> size of the current kernel's IMA measurement log need to be added
> to the device tree's IMA kexec buffer node and memory for the buffer
> needs to be reserved for the log to be carried over to the next kernel
> on the kexec call.
>
> Add address and size fields to "struct kimage_arch" for ARM64 platform
> to hold the address and size of the IMA measurement log buffer. Remove
> any existing "linux,ima-kexec-buffer" property in the device tree and
> free the corresponding memory reservation in the currently running
> kernel. Add "linux,ima-kexec-buffer" property to the device tree and
> reserve the memory for storing the IMA log that needs to be passed from
> the current kernel to the next one.
>
> Update CONFIG_KEXEC_FILE to select CONFIG_HAVE_IMA_KEXEC to indicate
> that the IMA measurement log information is present in the device tree
> for ARM64.
Perhaps for some previous version of this patch set, this patch
description was appropriate, but for the code below it's kind of
overkill.
Mimi
>
> Co-developed-by: Prakhar Srivastava <[email protected]>
> Signed-off-by: Prakhar Srivastava <[email protected]>
> Signed-off-by: Lakshmi Ramasubramanian <[email protected]>
> ---
> arch/arm64/Kconfig | 1 +
> arch/arm64/include/asm/kexec.h | 5 +++++
> 2 files changed, 6 insertions(+)
>
> diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
> index a6b5b7ef40ae..312b4d5ad232 100644
> --- a/arch/arm64/Kconfig
> +++ b/arch/arm64/Kconfig
> @@ -1095,6 +1095,7 @@ config KEXEC
> config KEXEC_FILE
> bool "kexec file based system call"
> select KEXEC_CORE
> + select HAVE_IMA_KEXEC if IMA
> help
> This is new version of kexec system call. This system call is
> file based and takes file descriptors as system call argument
> diff --git a/arch/arm64/include/asm/kexec.h b/arch/arm64/include/asm/kexec.h
> index d24b527e8c00..2bd19ccb6c43 100644
> --- a/arch/arm64/include/asm/kexec.h
> +++ b/arch/arm64/include/asm/kexec.h
> @@ -100,6 +100,11 @@ struct kimage_arch {
> void *elf_headers;
> unsigned long elf_headers_mem;
> unsigned long elf_headers_sz;
> +
> +#ifdef CONFIG_IMA_KEXEC
> + phys_addr_t ima_buffer_addr;
> + size_t ima_buffer_size;
> +#endif
> };
>
> extern const struct kexec_file_ops kexec_image_ops;
On 1/12/21 3:28 PM, Mimi Zohar wrote:
> Hi Lakshmi,
>
> On Mon, 2021-01-04 at 11:26 -0800, Lakshmi Ramasubramanian wrote:
>> Address and size of the buffer containing the IMA measurement log need
>> to be passed from the current kernel to the next kernel on kexec.
>>
>> Any existing "linux,ima-kexec-buffer" property in the device tree
>> needs to be removed and its corresponding memory reservation in
>> the currently running kernel needs to be freed. The address and
>> size of the current kernel's IMA measurement log need to be added
>> to the device tree's IMA kexec buffer node and memory for the buffer
>> needs to be reserved for the log to be carried over to the next kernel
>> on the kexec call.
>>
>> Add address and size fields to "struct kimage_arch" for ARM64 platform
>> to hold the address and size of the IMA measurement log buffer. Remove
>> any existing "linux,ima-kexec-buffer" property in the device tree and
>> free the corresponding memory reservation in the currently running
>> kernel. Add "linux,ima-kexec-buffer" property to the device tree and
>> reserve the memory for storing the IMA log that needs to be passed from
>> the current kernel to the next one.
>>
>> Update CONFIG_KEXEC_FILE to select CONFIG_HAVE_IMA_KEXEC to indicate
>> that the IMA measurement log information is present in the device tree
>> for ARM64.
>
> Perhaps for some previous version of this patch set, this patch
> description was appropriate, but for the code below it's kind of
> overkill.
>
I agree Mimi. Will edit the patch description.
thanks,
-lakshmi
>>
>> Co-developed-by: Prakhar Srivastava <[email protected]>
>> Signed-off-by: Prakhar Srivastava <[email protected]>
>> Signed-off-by: Lakshmi Ramasubramanian <[email protected]>
>> ---
>> arch/arm64/Kconfig | 1 +
>> arch/arm64/include/asm/kexec.h | 5 +++++
>> 2 files changed, 6 insertions(+)
>>
>> diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
>> index a6b5b7ef40ae..312b4d5ad232 100644
>> --- a/arch/arm64/Kconfig
>> +++ b/arch/arm64/Kconfig
>> @@ -1095,6 +1095,7 @@ config KEXEC
>> config KEXEC_FILE
>> bool "kexec file based system call"
>> select KEXEC_CORE
>> + select HAVE_IMA_KEXEC if IMA
>> help
>> This is new version of kexec system call. This system call is
>> file based and takes file descriptors as system call argument
>> diff --git a/arch/arm64/include/asm/kexec.h b/arch/arm64/include/asm/kexec.h
>> index d24b527e8c00..2bd19ccb6c43 100644
>> --- a/arch/arm64/include/asm/kexec.h
>> +++ b/arch/arm64/include/asm/kexec.h
>> @@ -100,6 +100,11 @@ struct kimage_arch {
>> void *elf_headers;
>> unsigned long elf_headers_mem;
>> unsigned long elf_headers_sz;
>> +
>> +#ifdef CONFIG_IMA_KEXEC
>> + phys_addr_t ima_buffer_addr;
>> + size_t ima_buffer_size;
>> +#endif
>> };
>>
>> extern const struct kexec_file_ops kexec_image_ops;
>
Lakshmi Ramasubramanian <[email protected]> writes:
> Address and size of the buffer containing the IMA measurement log need
> to be passed from the current kernel to the next kernel on kexec.
>
> Any existing "linux,ima-kexec-buffer" property in the device tree
> needs to be removed and its corresponding memory reservation in
> the currently running kernel needs to be freed. The address and
> size of the current kernel's IMA measurement log need to be added
> to the device tree's IMA kexec buffer node and memory for the buffer
> needs to be reserved for the log to be carried over to the next kernel
> on the kexec call.
>
> Add address and size fields to "struct kimage_arch" for ARM64 platform
> to hold the address and size of the IMA measurement log buffer. Remove
> any existing "linux,ima-kexec-buffer" property in the device tree and
> free the corresponding memory reservation in the currently running
> kernel. Add "linux,ima-kexec-buffer" property to the device tree and
> reserve the memory for storing the IMA log that needs to be passed from
> the current kernel to the next one.
>
> Update CONFIG_KEXEC_FILE to select CONFIG_HAVE_IMA_KEXEC to indicate
> that the IMA measurement log information is present in the device tree
> for ARM64.
>
> Co-developed-by: Prakhar Srivastava <[email protected]>
> Signed-off-by: Prakhar Srivastava <[email protected]>
> Signed-off-by: Lakshmi Ramasubramanian <[email protected]>
> ---
> arch/arm64/Kconfig | 1 +
> arch/arm64/include/asm/kexec.h | 5 +++++
> 2 files changed, 6 insertions(+)
Reviewed-by: Thiago Jung Bauermann <[email protected]>
--
Thiago Jung Bauermann
IBM Linux Technology Center