Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:18 as permitted sender) client-ip=2620:137:e000::1:18;
From:   Jonathan McDowell <noodles@fb.com>
To:     Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
CC:     Thomas Gleixner <tglx@linutronix.de>,
        Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>,
        Dave Hansen <dave.hansen@linux.intel.com>,
        "x86@kernel.org" <x86@kernel.org>,
        "H. Peter Anvin" <hpa@zytor.com>, Mimi Zohar <zohar@linux.ibm.com>,
        Dmitry Kasatkin <dmitry.kasatkin@gmail.com>,
        James Morris <jmorris@namei.org>,
        "Serge E. Hallyn" <serge@hallyn.com>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "linux-integrity@vger.kernel.org" <linux-integrity@vger.kernel.org>,
        "linux-security-module@vger.kernel.org" 
        <linux-security-module@vger.kernel.org>
Subject: Re: [PATCH v4] x86/kexec: Carry forward IMA measurement log on kexec
Thread-Topic: [PATCH v4] x86/kexec: Carry forward IMA measurement log on kexec
Thread-Index: AQHYZhzxVqT3nOkmWUWyxVUnnMcrja0dDuyAgASUV4CAAbUegIABInwA
Date:   Wed, 18 May 2022 10:42:03 +0000
Message-ID: <YoTM3jU6PcfEsNkL@noodles-fedora.dhcp.thefacebook.com>
References: <YmKyvlF3my1yWTvK@noodles-fedora-PC23Y6EG>
 <YmgjXZphkmDKgaOA@noodles-fedora-PC23Y6EG>
 <YnuJCH75GrhVm0Tp@noodles-fedora.dhcp.thefacebook.com>
 <Yn01Cfb3Divf49g7@noodles-fedora.dhcp.thefacebook.com>
 <8bffb420-46d9-eb57-a944-b2389570f88d@linux.microsoft.com>
 <YoJqg/MUkQS4pDMh@noodles-fedora.dhcp.thefacebook.com>
 <08651a15-14d8-236e-7e13-a22d50f17f4e@linux.microsoft.com>
In-Reply-To: <08651a15-14d8-236e-7e13-a22d50f17f4e@linux.microsoft.com>
Accept-Language: en-GB, en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?ZX/HvPP3ZgGVXV7ujtxsoHeCVSWPkI/7JMes3k3smoeGWLyibITYrAfDRPpy?=
 =?us-ascii?Q?kUdPjzHk6X3T+kQDpP9UixaikO4cRxjRfz+qDApT3Bf3U+uOa+e13F7/7BzD?=
 =?us-ascii?Q?E/+SSBVhMQMk3bs3DdgJe6exWFN0C7UAjJ3knPlmNjTQgWf0CQpiQ+O+LHz7?=
 =?us-ascii?Q?OeYSIzxsDhLPeyOX5xmkH/I6RdSndtuV1Q3ztKr7m4FJVNNUHcw9jP3sSZOs?=
 =?us-ascii?Q?V2OlBW83xmq7wzWe+/snSZTw1sj0/rtFgEKqHoSqtr+kX8TSKy9sKgtzIB91?=
 =?us-ascii?Q?EHclPeGrClnILYTDe3rxHv5EIgVSImUdjHxaE5kwOZSMQlFl/7Nq3PBvzj1L?=
 =?us-ascii?Q?Qtp19yh3hfe4LUkUsWhxrcS8WPKLT1KAkPhkiqsWzjSEGBOwPoAOaz7kS0+L?=
 =?us-ascii?Q?Q7EhNyzVuoutIPQjF77PZsDx9cx99/LXipUSMsS6+uSv0So7eClrKVqzI2a+?=
 =?us-ascii?Q?VSziYGVcoQw88Hq4QJ56kHit5PlyYc/DFVKhDurP+gMe9u/B46KWhi1FI1Kn?=
 =?us-ascii?Q?FHHnnDkgwaBUZwNYqySGp3S3qlLXk/Dbu8nyL8pCyPyhGgi4A+/YLwXx7FGp?=
 =?us-ascii?Q?xLxBnuafrOlcc3WQb7IpjwX/qv9ifMW7Bp4OzodeAYgNs+gUxXpKOhvdvxH/?=
 =?us-ascii?Q?3e7SGUDyYsojAP+cUrxmRGEx9qB1fgB1QoLtK94NsuqUTI9vGTYI5UiPt95f?=
 =?us-ascii?Q?P7aRoYKcuYR+nXXnA8s3vptZdoDkes03phVdo79/7wPVti61zfEeu/E5ZJK/?=
 =?us-ascii?Q?72c0nn2bxvl5ABX1/oBsmTi6rYPUgbOU0jmoeJDcU6IDwELLex8AvfSXwwIJ?=
 =?us-ascii?Q?nfeMhzCaOiv3UEv06Srw0yft+5zUBZDOqs5HgFyU2P5Dw6VHO/vuIv5Uki2X?=
 =?us-ascii?Q?o3KvFKOek9pz74/grire9pYX4r4wk24Mh8e3Fid6UWcK6WDbr1XjwaHYyHnY?=
 =?us-ascii?Q?SRTWOaiLMtVHxTCInPSe8/E82zEnRp/t6HkLPLtlAOvIroFbJDoyQRsEPmMC?=
 =?us-ascii?Q?b/GMHM2g1JYfbpuTSlyHIP0ziQDaR/obJ0pymBO6lCdsBML5yR7HCZ9OCZ8i?=
 =?us-ascii?Q?/as0aUaFlajzYd3JpEHhT1nsVMvBRMrVMp6zii1tCWfvqBZMMlXJ7zmGKSPj?=
 =?us-ascii?Q?iCLSi2IKpkmhzzZCOthizDIVbvA4Wy3nxk2zlqkjg03tTT7hhLXYMpF7+OYo?=
 =?us-ascii?Q?jP3s//nOGJ0i84MJlXWhmT6C8jXFomWp9m9/zBSutoXjcsU/uLcL0FOGo3fn?=
 =?us-ascii?Q?GqBpLTnIpuOQLpdwTUb96EVBeNcMa69DUrwhtfVoZRR/OqGn6l7uY8bZ2r+f?=
 =?us-ascii?Q?VNWsAEvovhcPTVVPO3vvuMUGbZt82KdFPZbnCTcagHbwui+ouxRfXDOWdudF?=
 =?us-ascii?Q?krWpEbEWBkupyN4T42bDCTiKuo8d+m4SVnEg9sVPRnegw1CaMKzApqJbTdaB?=
 =?us-ascii?Q?vtp96kxxNmW8U/bQXkl9zaETmJOKPKWtVfwqnpNl0dBIxGfhB8ivTL7AfyA4?=
 =?us-ascii?Q?GjrhKlf2aJLYb12caRmVH2EjQRbEDH/n//55cWVm0uO0RQY0dPM5YkJ+eIiR?=
 =?us-ascii?Q?Q+c/b983L7AOxYSK002y//5TPY2B3GG1A1a6AJRUZ2mFngjBG2QY1xEna37X?=
 =?us-ascii?Q?1ZHtZNMcjsE/giY1VHEZngwE2tq4hxWKJ2JId+hoqs1aJulNOc2azBhW8P4e?=
 =?us-ascii?Q?uSQzQwMAXYHYCRp1wiepDHUd/k+MaDxzkmDG59V+4EokCHrDN2SuA9cStRnr?=
 =?us-ascii?Q?uIqB+daDbg=3D=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-ID: <5534527EE5F18C448076658D7489F8D5@namprd15.prod.outlook.com>
MIME-Version: 1.0
X-OriginatorOrg: fb.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: SJ0PR15MB4552.namprd15.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: d1a747dc-c6f4-4fd3-b0df-08da38bb0bcf
X-MS-Exchange-CrossTenant-originalarrivaltime: 18 May 2022 10:42:03.4390
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 8ae927fe-1255-47a7-a2af-5f3a069daaa2
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: fPg/zEPgmcjz2cFQt7MHTArxu2/YWDQkxC/138HZoD9VNpsdfNhs67+k64wp4XMD
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN8PR15MB2676
X-Proofpoint-GUID: c3ITtEyajwm8r_lra6BQgTALR372PsgW
X-Proofpoint-ORIG-GUID: c3ITtEyajwm8r_lra6BQgTALR372PsgW
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.874,Hydra:6.0.486,FMLib:17.11.64.514
 definitions=2022-05-18_03,2022-05-17_02,2022-02-23_01
X-Spam-Status: No, score=-2.3 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,
	DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,
	MAILING_LIST_MULTI,RDNS_NONE,SPF_HELO_NONE,T_SCC_BODY_TEXT_LINE
	autolearn=no autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
	lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Tue, May 17, 2022 at 10:19:45AM -0700, Lakshmi Ramasubramanian wrote:
> 
> > > > diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
> > > > index 170d0fd68b1f..54bd4ce5f908 100644
> > > > --- a/arch/x86/kernel/kexec-bzimage64.c
> > > > +++ b/arch/x86/kernel/kexec-bzimage64.c
> > > > @@ -186,6 +186,33 @@ setup_efi_state(struct boot_params *params, unsigned long params_load_addr,
> > > >    }
> > > >    #endif /* CONFIG_EFI */
> > > > +static void
> > > > +setup_ima_state(const struct kimage *image, struct boot_params *params,
> > > > +		unsigned long params_load_addr,
> > > > +		unsigned int ima_setup_data_offset)
> > > > +{
> > > > +#ifdef CONFIG_IMA_KEXEC
> > > > +	struct setup_data *sd = (void *)params + ima_setup_data_offset;
> > > > +	unsigned long setup_data_phys;
> > > > +	struct ima_setup_data *ima;
> > > > +
> > > > +	if (!image->ima_buffer_size)
> > > > +		return;
> > > > +
> > > > +	sd->type = SETUP_IMA;
> > > > +	sd->len = sizeof(*ima);
> > > > +
> > > > +	ima = (void *)sd + sizeof(struct setup_data);
> > > > +	ima->addr = image->ima_buffer_addr;
> > > > +	ima->size = image->ima_buffer_size;
> > > > +
> > > > +	/* Add setup data */
> > > > +	setup_data_phys = params_load_addr + ima_setup_data_offset;
> > > > +	sd->next = params->hdr.setup_data;
> > > > +	params->hdr.setup_data = setup_data_phys;
> > > > +#endif /* CONFIG_IMA_KEXEC */
> > > > +}
> > > > +
> > > >    static int
> > > >    setup_boot_parameters(struct kimage *image, struct boot_params *params,
> > > >    		      unsigned long params_load_addr,
> > > > @@ -247,6 +274,13 @@ setup_boot_parameters(struct kimage *image, struct boot_params *params,
> > > >    	setup_efi_state(params, params_load_addr, efi_map_offset, efi_map_sz,
> > > >    			efi_setup_data_offset);
> > > >    #endif
> > > > +
> > > > +	/* Setup IMA log buffer state */
> > > > +	setup_ima_state(image, params, params_load_addr,
> > > > +			efi_setup_data_offset +
> > > > +			sizeof(struct setup_data) +
> > > > +			sizeof(struct efi_setup_data));
> > > Here you could check image->ima_buffer_size and call setup_ima_state() only
> > > if it is non-zero.
> > 
> > setup_ima_state() has this check already.
> 
> Yes - I noticed that.
> I was just suggesting a minor optimization - avoid making this function call
> if IMA buffer is not present.
> 
> > 
> > > > +
> > > >    	/* Setup EDD info */
> > > >    	memcpy(params->eddbuf, boot_params.eddbuf,
> > > >    				EDDMAXNR * sizeof(struct edd_info));
> > > > @@ -403,6 +437,10 @@ static void *bzImage64_load(struct kimage *image, char *kernel,
> > > >    				sizeof(struct setup_data) +
> > > >    				sizeof(struct efi_setup_data);
> > > > +	if (IS_ENABLED(CONFIG_IMA_KEXEC))
> > > > +		kbuf.bufsz += sizeof(struct setup_data) +
> > > > +			      sizeof(struct ima_setup_data);
> > > > +
> > > >    	params = kzalloc(kbuf.bufsz, GFP_KERNEL);
> > > >    	if (!params)
> > > >    		return ERR_PTR(-ENOMEM);
> > > > diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
> > > > index 249981bf3d8a..ab5e7a351845 100644
> > > > --- a/arch/x86/kernel/setup.c
> > > > +++ b/arch/x86/kernel/setup.c
> > > > @@ -11,6 +11,7 @@
> > > >    #include <linux/dma-map-ops.h>
> > > >    #include <linux/dmi.h>
> > > >    #include <linux/efi.h>
> > > > +#include <linux/ima.h>
> > > >    #include <linux/init_ohci1394_dma.h>
> > > >    #include <linux/initrd.h>
> > > >    #include <linux/iscsi_ibft.h>
> > > > @@ -145,6 +146,11 @@ __visible unsigned long mmu_cr4_features __ro_after_init;
> > > >    __visible unsigned long mmu_cr4_features __ro_after_init = X86_CR4_PAE;
> > > >    #endif
> > > > +#ifdef CONFIG_IMA
> > > > +static phys_addr_t ima_kexec_buffer_phys;
> > > > +static size_t ima_kexec_buffer_size;
> > > > +#endif
> > > > +
> > > >    /* Boot loader ID and version as integers, for the benefit of proc_dointvec */
> > > >    int bootloader_type, bootloader_version;
> > > > @@ -335,6 +341,59 @@ static void __init reserve_initrd(void)
> > > >    }
> > > >    #endif /* CONFIG_BLK_DEV_INITRD */
> > > > +static void __init add_early_ima_buffer(u64 phys_addr)
> > > > +{
> > > > +#ifdef CONFIG_IMA
> > > > +	struct ima_setup_data *data;
> > > > +
> > > > +	data = early_memremap(phys_addr + sizeof(struct setup_data),
> > > > +			      sizeof(*data));
> > > > +	if (!data) {
> > > > +		pr_warn("setup: failed to memremap ima_setup_data entry\n");
> > > > +		return;
> > > > +	}
> > > Here if memory allocation fails, would kexec system call fail or would it
> > > only not add IMA buffer, but continue with the system call?
> > 
> > This is run in the context of the *new* kernel. Boot will continue, but
> > the IMA buffer will not be successfully passed across. Effectively that
> > puts us in the same situation as now; things like TPM PCRs will have
> > been updated, but we won't have the log showing us how we got to the
> > current state.
> I think it is better to treat this error as a critical failure.

That's going to crash the entire system, because it's after we've
started execution of the new kernel. Given that the failure mode will
result in the lack of the logs, but not incorrect TPM PCRs, that seems a
bit extreme.

J.