Carry forward IMA measurement log on kexec on ARM64

arch/powerpc/kexec/ima.c +1 -89

index 720e50e490b6..467647886064 100644
@@ -9,6 +9,7 @@
 #include <linux/slab.h>
 #include <linux/kexec.h>
 #include <linux/of.h>
+#include <linux/ima.h>
 #include <linux/memblock.h>
 #include <linux/libfdt.h>
 

@@ -28,105 +29,6 @@ static int get_addr_size_cells(int *addr_cells, int *size_cells)
 	return 0;
 }
 
-static int do_get_kexec_buffer(const void *prop, int len, unsigned long *addr,
-			       size_t *size)
-{
-	int ret, addr_cells, size_cells;
-
-	ret = get_addr_size_cells(&addr_cells, &size_cells);
-	if (ret)
-		return ret;
-
-	if (len < 4 * (addr_cells + size_cells))
-		return -ENOENT;
-
-	*addr = of_read_number(prop, addr_cells);
-	*size = of_read_number(prop + 4 * addr_cells, size_cells);
-
-	return 0;
-}
-
-/**
- * ima_get_kexec_buffer - get IMA buffer from the previous kernel
- * @addr:	On successful return, set to point to the buffer contents.
- * @size:	On successful return, set to the buffer size.
- *
- * Return: 0 on success, negative errno on error.
- */
-int ima_get_kexec_buffer(void **addr, size_t *size)
-{
-	int ret, len;
-	unsigned long tmp_addr;
-	size_t tmp_size;
-	const void *prop;
-
-	prop = of_get_property(of_chosen, "linux,ima-kexec-buffer", &len);
-	if (!prop)
-		return -ENOENT;
-
-	ret = do_get_kexec_buffer(prop, len, &tmp_addr, &tmp_size);
-	if (ret)
-		return ret;
-
-	*addr = __va(tmp_addr);
-	*size = tmp_size;
-
-	return 0;
-}
-
-/**
- * ima_free_kexec_buffer - free memory used by the IMA buffer
- */
-int ima_free_kexec_buffer(void)
-{
-	int ret;
-	unsigned long addr;
-	size_t size;
-	struct property *prop;
-
-	prop = of_find_property(of_chosen, "linux,ima-kexec-buffer", NULL);
-	if (!prop)
-		return -ENOENT;
-
-	ret = do_get_kexec_buffer(prop->value, prop->length, &addr, &size);
-	if (ret)
-		return ret;
-
-	ret = of_remove_property(of_chosen, prop);
-	if (ret)
-		return ret;
-
-	return memblock_free(addr, size);
-
-}
-
-/**
- * remove_ima_buffer - remove the IMA buffer property and reservation from @fdt
- *
- * The IMA measurement buffer is of no use to a subsequent kernel, so we always
- * remove it from the device tree.
- */
-void remove_ima_buffer(void *fdt, int chosen_node)
-{
-	int ret, len;
-	unsigned long addr;
-	size_t size;
-	const void *prop;
-
-	prop = fdt_getprop(fdt, chosen_node, "linux,ima-kexec-buffer", &len);
-	if (!prop)
-		return;
-

arch/powerpc/kexec/ima.c +2 -2

 #ifdef CONFIG_IMA_KEXEC
 /**
  * arch_ima_add_kexec_buffer - do arch-specific steps to add the IMA buffer

@@ -179,7 +81,7 @@ int setup_ima_buffer(const struct kimage *image, void *fdt, int chosen_node)
 	int ret, addr_cells, size_cells, entry_size;
 	u8 value[16];
 
-	remove_ima_buffer(fdt, chosen_node);
+	ima_remove_kexec_buffer(fdt, chosen_node);
 	if (!image->arch.ima_buffer_size)
 		return 0;
 

@@ -201,7 +103,7 @@ int setup_ima_buffer(const struct kimage *image, void *fdt, int chosen_node)
 	if (ret)
 		return ret;
 
-	ret = fdt_setprop(fdt, chosen_node, "linux,ima-kexec-buffer", value,
+	ret = fdt_setprop(fdt, chosen_node, FDT_PROP_IMA_KEXEC_BUFFER, value,
 			  entry_size);
 	if (ret < 0)
 		return -EINVAL;

include/linux/kexec.h +0 -0

index 9e93bef52968..00a60dcc7075 100644

include/linux/kexec.h +7 -0

+static inline int delete_fdt_mem_rsv(void *fdt, unsigned long start,
+				     unsigned long size)
+{
+	return 0;
+}
+#endif /* ifndef CONFIG_KEXEC_FILE */
+
 #ifdef CONFIG_KEXEC_ELF
 struct kexec_elf_info {
 	/*

include/linux/libfdt.h +3 -0

index 90ed4ebfa692..75fb40aa013b 100644
@@ -5,4 +5,7 @@
 #include <linux/libfdt_env.h>
 #include "../../scripts/dtc/libfdt/libfdt.h"
 
+/* Common device tree properties */
+#define FDT_PROP_IMA_KEXEC_BUFFER	"linux,ima-kexec-buffer"
+
 #endif /* _INCLUDE_LIBFDT_H_ */

security/integrity/ima/Makefile +0 -0

index 67dabca670e2..05719fd28aec 100644
@@ -7,10 +7,11 @@
 obj-$(CONFIG_IMA) += ima.o
 

security/integrity/ima/Makefile +10 -0

+/**
+ * ima_remove_kexec_buffer - remove the IMA buffer property and
+ *			     reservation from @fdt
+ *
+ * @fdt: Flattened Device Tree to update
+ * @chosen_node: Offset to the chosen node in the device tree
+ *
+ * The IMA measurement buffer is of no use to a subsequent kernel,
+ * so we always remove it from the device tree.
+ */

security/integrity/ima/Makefile +1 -0

+}

security/integrity/ima/ima_kexec.c +48 -0

index 121de3e04af2..ed70f99aeedc 100644
@@ -10,8 +10,66 @@
 #include <linux/seq_file.h>
 #include <linux/vmalloc.h>
 #include <linux/kexec.h>
+#include <linux/of.h>
+#include <linux/memblock.h>
+#include <linux/libfdt.h>
+#include <linux/ima.h>
 #include "ima.h"
 
+/**
+ * ima_get_kexec_buffer - get IMA buffer from the previous kernel
+ * @addr:	On successful return, set to point to the buffer contents.
+ * @size:	On successful return, set to the buffer size.
+ *
+ * Return: 0 on success, negative errno on error.
+ */
+static int ima_get_kexec_buffer(void **addr, size_t *size)
+{
+	int ret, len;
+	unsigned long tmp_addr;
+	size_t tmp_size;
+	const void *prop;
+
+	prop = of_get_property(of_chosen, FDT_PROP_IMA_KEXEC_BUFFER, &len);
+	if (!prop)
+		return -ENOENT;
+
+	ret = do_get_kexec_buffer(prop, len, &tmp_addr, &tmp_size);
+	if (ret)
+		return ret;
+
+	*addr = __va(tmp_addr);
+	*size = tmp_size;
+
+	return 0;
+}
+
+/**
+ * ima_free_kexec_buffer - free memory used by the IMA buffer
+ */
+static int ima_free_kexec_buffer(void)
+{
+	int ret;
+	unsigned long addr;
+	size_t size;
+	struct property *prop;
+
+	prop = of_find_property(of_chosen, FDT_PROP_IMA_KEXEC_BUFFER, NULL);
+	if (!prop)
+		return -ENOENT;
+
+	ret = do_get_kexec_buffer(prop->value, prop->length, &addr, &size);
+	if (ret)

security/integrity/ima/ima_kexec.c +0 -0

 #ifdef CONFIG_IMA_KEXEC
 static int ima_dump_measurement_list(unsigned long *buffer_size, void **buffer,
 				     unsigned long segment_size)

security/integrity/ima/ima_kexec_file.c new file +9 -0

new file mode 100644
index 000000000000..225e913e6ef2
@@ -0,0 +1,51 @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ * Copyright (C) 2020 Microsoft Corporation
+ *
+ * Author: Lakshmi Ramasubramanian ([email protected])
+ *
+ * ima_kexec_file.c
+ *	Implements functions to handle device tree operations
+ */

security/integrity/ima/ima_kexec_file.c new file +11 -0

+{
+	int i, ret, num_rsvs = fdt_num_mem_rsv(fdt);
+
+	for (i = 0; i < num_rsvs; i++) {
+		uint64_t rsv_start, rsv_size;
+
+		ret = fdt_get_mem_rsv(fdt, i, &rsv_start, &rsv_size);
+		if (ret) {
+			pr_err("Malformed device tree.\n");
+			return -EINVAL;
+		}

security/integrity/ima/ima_kexec_file.c new file +6 -0

+			return 0;
+		}
+	}
+
+	return -ENOENT;
+}

Any existing FDT_PROP_IMA_KEXEC_BUFFER property in the device tree needs to be removed and its corresponding memory reservation in the currently running kernel needs to be freed.

The address and size of the current kernel's IMA measurement log need to be added to the device tree's IMA kexec buffer node and memory for the buffer needs to be reserved for the log to be carried over to the next kernel on the kexec call.

Remove any existing FDT_PROP_IMA_KEXEC_BUFFER property in the device tree and free the corresponding memory reservation in the currently running kernel. Add FDT_PROP_IMA_KEXEC_BUFFER property to the device tree and reserve the memory for storing the IMA log.
Update CONFIG_KEXEC_FILE to select CONFIG_HAVE_IMA_KEXEC to indicate that the IMA measurement log information is present in the device tree for ARM64.

Co-developed-by Prakhar Srivastava <[email protected]>

Signed-off-by Prakhar Srivastava <[email protected]>

Signed-off-by Lakshmi Ramasubramanian <[email protected]>

On kexec file load Integrity Measurement Architecture(IMA) subsystem may verify the IMA signature of the kernel and initramfs, and measure it. The command line parameters passed to the kernel in the kexec call may also be measured by IMA. A remote attestation service can verify the measurement through the IMA log and the TPM PCR data. This can be achieved only if the IMA measurement log is carried over from the current kernel to the next kernel across the kexec call. However in the current implementation the IMA measurement logs are not carried over on ARM64 platforms. Therefore a remote attestation service cannot verify the authenticity of the running kernel on ARM64 platforms when the kernel is updated through the kexec system call.

This patch series adds support for carrying forward the IMA measurement log on kexec on ARM64. powerpc already supports carrying forward the IMA measurement log on kexec.

This series refactors the platform independent code defined for powerpc such that it can be reused for ARM64 as well. A chosen node namely "linux,ima-kexec-buffer" is added to the DTB for ARM64 to hold the address and the size of the memory reserved to carry
the IMA measurement log.

This patch series has been tested for ARM64 platform using QEMU. I would like help from the community for testing this change on powerpc. Thanks.

This series is based on commit f4d51dffc6c0 ("Linux 5.9-rc4") in
https://github.com/torvalds/linux "master" branch.

Changelog:

v6:
- Remove any existing FDT_PROP_IMA_KEXEC_BUFFER property in the device tree and also its corresponding memory reservation in the currently running kernel.
- Moved the function remove_ima_buffer() defined for powerpc to IMA and renamed the function to ima_remove_kexec_buffer(). Also, moved delete_fdt_mem_rsv() from powerpc to IMA.

v5:
- Merged get_addr_size_cells() and do_get_kexec_buffer() into a single function when moving the arch independent code from powerpc to IMA
- Reverted the change to use FDT functions in powerpc code and added back the original code in get_addr_size_cells() and do_get_kexec_buffer() for powerpc.
- Added fdt_add_mem_rsv() for ARM64 to reserve the memory for the IMA log buffer during kexec.
- Fixed the warning reported by kernel test bot for ARM64 arch_ima_add_kexec_buffer() - moved this function to a new file namely arch/arm64/kernel/ima_kexec.c

v4:
- Submitting the patch series on behalf of the original author Prakhar Srivastava <[email protected]>
- Moved FDT_PROP_IMA_KEXEC_BUFFER ("linux,ima-kexec-buffer") to libfdt.h so that it can be shared by multiple platforms.

v3:
Breakup patches further into separate patches.
- Refactoring non architecture specific code out of powerpc
- Update powerpc related code to use fdt functions
- Update IMA buffer read related code to use of functions
- Add support to store the memory information of the IMA measurement logs to be carried forward.
- Update the property strings to align with documented nodes
https://github.com/devicetree-org/dt-schema/pull/46

v2:
Break patches into separate patches.
- Powerpc related Refactoring
- Updating the docuemntation for chosen node
- Updating arm64 to support IMA buffer pass

v1:
Refactoring carrying over IMA measuremnet logs over Kexec. This patch
moves the non-architecture specific code out of powerpc and adds to security/ima.(Suggested by Thiago)
Add Documentation regarding the ima-kexec-buffer node in the chosen
node documentation

v0:
Add a layer of abstraction to use the memory reserved by device tree
for ima buffer pass.
Add support for ima buffer pass using reserved memory for arm64 kexec.
Update the arch sepcific code path in kexec file load to store the ima buffer in the reserved memory. The same reserved memory is read on kexec or cold boot.

Lakshmi Ramasubramanian (3):
powerpc: Refactor kexec functions to move arch independent code to IMA
arm64: Store IMA log information in kimage used for kexec
arm64: Add IMA kexec buffer to DTB

 arch/arm64/Kconfig                      |   1 +
 arch/arm64/include/asm/ima.h            |  18 ++++
 arch/arm64/include/asm/kexec.h          |   3 +
 arch/arm64/kernel/Makefile              |   1 +
 arch/arm64/kernel/ima_kexec.c           |  34 ++++++++
 arch/arm64/kernel/machine_kexec_file.c  |  18 ++++
 arch/powerpc/include/asm/ima.h          |  11 +--
 arch/powerpc/include/asm/kexec.h        |   1 -
 arch/powerpc/kexec/file_load.c          |  33 +-------
 arch/powerpc/kexec/ima.c                | 104 +-----------------------
 include/linux/ima.h                     |   2 +
 include/linux/kexec.h                   |  11 +++
 include/linux/libfdt.h                  |   3 +
 security/integrity/ima/Makefile         |   3 +-
 security/integrity/ima/ima.h            |   2 +
 security/integrity/ima/ima_fdt.c        |  80 ++++++++++++++++++
 security/integrity/ima/ima_kexec.c      |  58 +++++++++++++
 security/integrity/ima/ima_kexec_file.c |  51 ++++++++++++
 18 files changed, 289 insertions(+), 145 deletions(-)
 create mode 100644 arch/arm64/include/asm/ima.h
 create mode 100644 arch/arm64/kernel/ima_kexec.c
 create mode 100644 security/integrity/ima/ima_fdt.c
 create mode 100644 security/integrity/ima/ima_kexec_file.c