Carry forward IMA measurement log on kexec on ARM64

The functions defined in "arch/powerpc/kexec/ima.c" handle setting up and freeing the resources required to carry over the IMA measurement list from the current kernel to the next kernel across kexec system call. These functions do not have architecture specific code, but are currently limited to powerpc.

Move setup_ima_buffer() call into of_kexec_setup_new_fdt() defined in "drivers/of/kexec.c".

Move the remaining architecture independent functions from "arch/powerpc/kexec/ima.c" to "drivers/of/kexec.c".
Delete "arch/powerpc/kexec/ima.c" and "arch/powerpc/include/asm/ima.h". Remove references to the deleted files in powerpc and in ima.

Co-developed-by Prakhar Srivastava <[email protected]>

Signed-off-by Prakhar Srivastava <[email protected]>

Signed-off-by Lakshmi Ramasubramanian <[email protected]>

---
 arch/powerpc/Kconfig               |   2 +-
 arch/powerpc/include/asm/ima.h     |  27 ----
 arch/powerpc/kexec/Makefile        |   7 -
 arch/powerpc/kexec/file_load.c     |   7 -
 arch/powerpc/kexec/ima.c           | 202 ------------------------
 drivers/of/kexec.c                 | 240 +++++++++++++++++++++++++++++
 include/linux/of.h                 |   2 +
 security/integrity/ima/ima.h       |   4 -
 security/integrity/ima/ima_kexec.c |   1 +
 9 files changed, 244 insertions(+), 248 deletions(-)
 delete mode 100644 arch/powerpc/include/asm/ima.h
 delete mode 100644 arch/powerpc/kexec/ima.c

arch/powerpc/kexec/file_load_64.c +1 -0

index a05c19b3cc60..3cab318aa3b9 100644
@@ -17,6 +17,7 @@
 #include <linux/kexec.h>
 #include <linux/of_fdt.h>
 #include <linux/libfdt.h>
+#include <linux/of.h>
 #include <linux/of_device.h>
 #include <linux/memblock.h>
 #include <linux/slab.h>

Hi Lakshmi,

Quoted 16 lines · Lakshmi Ramasubramanian

arch/powerpc/kexec/file_load_64.c +1 -0

index a05c19b3cc60..3cab318aa3b9 100644
@@ -17,6 +17,7 @@
  #include <linux/kexec.h>
  #include <linux/of_fdt.h>
  #include <linux/libfdt.h>
+#include <linux/of.h>
  #include <linux/of_device.h>
  #include <linux/memblock.h>
  #include <linux/slab.h>

@@ -944,7 +945,8 @@ int setup_new_fdt_ppc64(const struct kimage *image, void *fdt,
  	struct crash_mem *umem = NULL, *rmem = NULL;
  	int i, nr_ranges, ret;
 

arch/powerpc/kexec/file_load_64.c int setup_new_fdt_ppc64(const struct kimage *image, void *fdt, · line 952

Quoted 6 lines

arch/powerpc/kexec/file_load_64.c +2 -1

-	ret = setup_new_fdt(image, fdt, initrd_load_addr, initrd_len, cmdline);
+	ret = of_kexec_setup_new_fdt(image, fdt, initrd_load_addr, initrd_len,
+				     cmdline);
  	if (ret)
  		goto out;
 

The "powerpc: Move arch independent ima kexec functions to drivers/of/kexec.c" moved setup_ima_buffer() to of_kexec_setup_new_fdt(). Defering making the change from setup_new_fdt() to of_kexec_setup_new_fdt() here, is not bisect safe.

delete_fdt_mem_rsv() defined in "arch/powerpc/kexec/file_load.c" has been renamed to fdt_find_and_del_mem_rsv(), and moved to "drivers/of/kexec.c".

Remove delete_fdt_mem_rsv() in "arch/powerpc/kexec/file_load.c".

Call of_kexec_setup_new_fdt() from setup_new_fdt_ppc64() and remove setup_new_fdt() in "arch/powerpc/kexec/file_load.c".

Co-developed-by Prakhar Srivastava <[email protected]>

Signed-off-by Prakhar Srivastava <[email protected]>

Signed-off-by Lakshmi Ramasubramanian <[email protected]>

---
 arch/powerpc/include/asm/kexec.h  |  4 ---
 arch/powerpc/kexec/file_load.c    | 60 -------------------------------
 arch/powerpc/kexec/file_load_64.c |  4 ++-
 3 files changed, 3 insertions(+), 65 deletions(-)

Address and size of the buffer containing the IMA measurement log need to be passed from the current kernel to the next kernel on kexec.

Any existing "linux,ima-kexec-buffer" property in the device tree needs to be removed and its corresponding memory reservation in the currently running kernel needs to be freed. The address and size of the current kernel's IMA measurement log need to be added to the device tree's IMA kexec buffer node and memory for the buffer needs to be reserved for the log to be carried over to the next kernel on the kexec call.

Add address and size fields to "struct kimage_arch" for ARM64 platform to hold the address and size of the IMA measurement log buffer. Remove any existing "linux,ima-kexec-buffer" property in the device tree and free the corresponding memory reservation in the currently running kernel. Add "linux,ima-kexec-buffer" property to the device tree and reserve the memory for storing the IMA log that needs to be passed from the current kernel to the next one.

Update CONFIG_KEXEC_FILE to select CONFIG_HAVE_IMA_KEXEC to indicate that the IMA measurement log information is present in the device tree for ARM64.

Co-developed-by Prakhar Srivastava <[email protected]>

Signed-off-by Prakhar Srivastava <[email protected]>

Signed-off-by Lakshmi Ramasubramanian <[email protected]>

---
 arch/arm64/Kconfig             | 1 +
 arch/arm64/include/asm/kexec.h | 5 +++++
 2 files changed, 6 insertions(+)

arch/arm64/Kconfig +1 -0

index a6b5b7ef40ae..312b4d5ad232 100644
@@ -1095,6 +1095,7 @@ config KEXEC
 config KEXEC_FILE
 	bool "kexec file based system call"
 	select KEXEC_CORE
+	select HAVE_IMA_KEXEC if IMA
 	help
 	  This is new version of kexec system call. This system call is
 	  file based and takes file descriptors as system call argument

arch/arm64/include/asm/kexec.h +5 -0

index d24b527e8c00..2bd19ccb6c43 100644
@@ -100,6 +100,11 @@ struct kimage_arch {
 	void *elf_headers;
 	unsigned long elf_headers_mem;
 	unsigned long elf_headers_sz;
+
+#ifdef CONFIG_IMA_KEXEC
+	phys_addr_t ima_buffer_addr;
+	size_t ima_buffer_size;
+#endif
 };
 
 extern const struct kexec_file_ops kexec_image_ops;

Hi Lakshmi,

Quoted 19 lines · Lakshmi Ramasubramanian

Address and size of the buffer containing the IMA measurement log need to be passed from the current kernel to the next kernel on kexec.

Any existing "linux,ima-kexec-buffer" property in the device tree needs to be removed and its corresponding memory reservation in the currently running kernel needs to be freed. The address and size of the current kernel's IMA measurement log need to be added to the device tree's IMA kexec buffer node and memory for the buffer needs to be reserved for the log to be carried over to the next kernel on the kexec call.

Add address and size fields to "struct kimage_arch" for ARM64 platform to hold the address and size of the IMA measurement log buffer. Remove any existing "linux,ima-kexec-buffer" property in the device tree and free the corresponding memory reservation in the currently running kernel. Add "linux,ima-kexec-buffer" property to the device tree and reserve the memory for storing the IMA log that needs to be passed from the current kernel to the next one.

Quoted 3 lines

Update CONFIG_KEXEC_FILE to select CONFIG_HAVE_IMA_KEXEC to indicate that the IMA measurement log information is present in the device tree for ARM64.

Perhaps for some previous version of this patch set, this patch description was appropriate, but for the code below it's kind of overkill.

Quoted 36 lines

Co-developed-by Prakhar Srivastava <[email protected]>

Signed-off-by Prakhar Srivastava <[email protected]>

Signed-off-by Lakshmi Ramasubramanian <[email protected]>

---
  arch/arm64/Kconfig             | 1 +
  arch/arm64/include/asm/kexec.h | 5 +++++
  2 files changed, 6 insertions(+)

arch/arm64/Kconfig +1 -0

index a6b5b7ef40ae..312b4d5ad232 100644
@@ -1095,6 +1095,7 @@ config KEXEC
  config KEXEC_FILE
  	bool "kexec file based system call"
  	select KEXEC_CORE
+	select HAVE_IMA_KEXEC if IMA
  	help
  	  This is new version of kexec system call. This system call is
  	  file based and takes file descriptors as system call argument

arch/arm64/include/asm/kexec.h +5 -0

index d24b527e8c00..2bd19ccb6c43 100644
@@ -100,6 +100,11 @@ struct kimage_arch {
  	void *elf_headers;
  	unsigned long elf_headers_mem;
  	unsigned long elf_headers_sz;
+
+#ifdef CONFIG_IMA_KEXEC
+	phys_addr_t ima_buffer_addr;
+	size_t ima_buffer_size;
+#endif
  };
 

arch/arm64/include/asm/kexec.h struct kimage_arch { · line 110

Quoted 1 line

arch/arm64/include/asm/kexec.h +0 -0

  extern const struct kexec_file_ops kexec_image_ops;

Address and size of the buffer containing the IMA measurement log need to be passed from the current kernel to the next kernel on kexec.

Any existing "linux,ima-kexec-buffer" property in the device tree needs to be removed and its corresponding memory reservation in the currently running kernel needs to be freed. The address and size of the current kernel's IMA measurement log need to be added to the device tree's IMA kexec buffer node and memory for the buffer needs to be reserved for the log to be carried over to the next kernel on the kexec call.

Add address and size fields to "struct kimage_arch" for ARM64 platform to hold the address and size of the IMA measurement log buffer. Remove any existing "linux,ima-kexec-buffer" property in the device tree and free the corresponding memory reservation in the currently running kernel. Add "linux,ima-kexec-buffer" property to the device tree and reserve the memory for storing the IMA log that needs to be passed from the current kernel to the next one.

Update CONFIG_KEXEC_FILE to select CONFIG_HAVE_IMA_KEXEC to indicate that the IMA measurement log information is present in the device tree for ARM64.

Co-developed-by Prakhar Srivastava <[email protected]>

Signed-off-by Prakhar Srivastava <[email protected]>

Signed-off-by Lakshmi Ramasubramanian <[email protected]>

---
 arch/arm64/Kconfig             | 1 +
 arch/arm64/include/asm/kexec.h | 5 +++++
 2 files changed, 6 insertions(+)

On kexec file load Integrity Measurement Architecture (IMA) subsystem may verify the IMA signature of the kernel and initramfs, and measure it. The command line parameters passed to the kernel in the kexec call may also be measured by IMA. A remote attestation service can verify a TPM quote based on the TPM event log, the IMA measurement list, and the TPM PCR data. This can be achieved only if the IMA measurement log is carried over from the current kernel to the next kernel across the kexec call.

powerpc already supports carrying forward the IMA measurement log on kexec. This patch set adds support for carrying forward the IMA measurement log on kexec on ARM64.

This patch set moves the platform independent code defined for powerpc such that it can be reused for other platforms as well. A chosen node "linux,ima-kexec-buffer" is added to the DTB for ARM64 to hold the address and the size of the memory reserved to carry the IMA measurement log.

This patch set has been tested for ARM64 platform using QEMU. I would like help from the community for testing this change on powerpc. Thanks.

This patch set is based on
commit a29a64445089 ("powerpc: Use common of_kexec_setup_new_fdt()") in https://git.kernel.org/pub/scm/linux/kernel/git/robh/linux.git
"dt/kexec" branch.

Quoted 19 lines · Lakshmi Ramasubramanian

On kexec file load Integrity Measurement Architecture (IMA) subsystem may verify the IMA signature of the kernel and initramfs, and measure it. The command line parameters passed to the kernel in the kexec call may also be measured by IMA. A remote attestation service can verify a TPM quote based on the TPM event log, the IMA measurement list, and the TPM PCR data. This can be achieved only if the IMA measurement log is carried over from the current kernel to the next kernel across the kexec call.

powerpc already supports carrying forward the IMA measurement log on kexec. This patch set adds support for carrying forward the IMA measurement log on kexec on ARM64.

This patch set moves the platform independent code defined for powerpc such that it can be reused for other platforms as well. A chosen node "linux,ima-kexec-buffer" is added to the DTB for ARM64 to hold the address and the size of the memory reserved to carry the IMA measurement log.

Quoted 8 lines

This patch set has been tested for ARM64 platform using QEMU. I would like help from the community for testing this change on powerpc. Thanks.

This patch set is based on
commit a29a64445089 ("powerpc: Use common of_kexec_setup_new_fdt()") in https://git.kernel.org/pub/scm/linux/kernel/git/robh/linux.git
"dt/kexec" branch.

This all looks good to me. I'd suggest you send the above patches out as part of this series because I don't plan to do so.

I would like to also resolve the vmalloc vs. kmalloc difference for allocating the FDT. Then we can further consolidate the DT kexec code.

It all needs some acks from arm64 and powerpc maintainers. As far as merging, I think via the integrity tree makes the most sense.

Quoted 32 lines · Rob Herring

Quoted 19 lines · Lakshmi Ramasubramanian

On kexec file load Integrity Measurement Architecture (IMA) subsystem may verify the IMA signature of the kernel and initramfs, and measure it. The command line parameters passed to the kernel in the kexec call may also be measured by IMA. A remote attestation service can verify a TPM quote based on the TPM event log, the IMA measurement list, and the TPM PCR data. This can be achieved only if the IMA measurement log is carried over from the current kernel to the next kernel across the kexec call.

powerpc already supports carrying forward the IMA measurement log on kexec. This patch set adds support for carrying forward the IMA measurement log on kexec on ARM64.

This patch set moves the platform independent code defined for powerpc such that it can be reused for other platforms as well. A chosen node "linux,ima-kexec-buffer" is added to the DTB for ARM64 to hold the address and the size of the memory reserved to carry the IMA measurement log.

Quoted 8 lines

This patch set has been tested for ARM64 platform using QEMU. I would like help from the community for testing this change on powerpc. Thanks.

This patch set is based on
commit a29a64445089 ("powerpc: Use common of_kexec_setup_new_fdt()") in https://git.kernel.org/pub/scm/linux/kernel/git/robh/linux.git
"dt/kexec" branch.

This all looks good to me. I'd suggest you send the above patches out as part of this series because I don't plan to do so.

Quoted 5 lines

I would like to also resolve the vmalloc vs. kmalloc difference for allocating the FDT. Then we can further consolidate the DT kexec code.

It all needs some acks from arm64 and powerpc maintainers. As far as merging, I think via the integrity tree makes the most sense.

Thanks, Rob. Lakshmi, please update Rob's patches to include patch descriptions before re-posting.

Quoted 32 lines · Rob Herring

Quoted 19 lines · Lakshmi Ramasubramanian

On kexec file load Integrity Measurement Architecture (IMA) subsystem may verify the IMA signature of the kernel and initramfs, and measure it. The command line parameters passed to the kernel in the kexec call may also be measured by IMA. A remote attestation service can verify a TPM quote based on the TPM event log, the IMA measurement list, and the TPM PCR data. This can be achieved only if the IMA measurement log is carried over from the current kernel to the next kernel across the kexec call.

powerpc already supports carrying forward the IMA measurement log on kexec. This patch set adds support for carrying forward the IMA measurement log on kexec on ARM64.

This patch set moves the platform independent code defined for powerpc such that it can be reused for other platforms as well. A chosen node "linux,ima-kexec-buffer" is added to the DTB for ARM64 to hold the address and the size of the memory reserved to carry the IMA measurement log.

Quoted 8 lines

This patch set has been tested for ARM64 platform using QEMU. I would like help from the community for testing this change on powerpc. Thanks.

This patch set is based on
commit a29a64445089 ("powerpc: Use common of_kexec_setup_new_fdt()") in https://git.kernel.org/pub/scm/linux/kernel/git/robh/linux.git
"dt/kexec" branch.

This all looks good to me. I'd suggest you send the above patches out as part of this series because I don't plan to do so.

Quoted 5 lines

I would like to also resolve the vmalloc vs. kmalloc difference for allocating the FDT. Then we can further consolidate the DT kexec code.

It all needs some acks from arm64 and powerpc maintainers. As far as merging, I think via the integrity tree makes the most sense.

Thanks, Rob. Lakshmi, please update Rob's patches to include patch descriptions before re-posting.

Quoted 23 lines · Lakshmi Ramasubramanian

On kexec file load Integrity Measurement Architecture (IMA) subsystem may verify the IMA signature of the kernel and initramfs, and measure it. The command line parameters passed to the kernel in the kexec call may also be measured by IMA. A remote attestation service can verify a TPM quote based on the TPM event log, the IMA measurement list, and the TPM PCR data. This can be achieved only if the IMA measurement log is carried over from the current kernel to the next kernel across the kexec call.

powerpc already supports carrying forward the IMA measurement log on kexec. This patch set adds support for carrying forward the IMA measurement log on kexec on ARM64.

This patch set moves the platform independent code defined for powerpc such that it can be reused for other platforms as well. A chosen node "linux,ima-kexec-buffer" is added to the DTB for ARM64 to hold the address and the size of the memory reserved to carry the IMA measurement log.

This patch set has been tested for ARM64 platform using QEMU. I would like help from the community for testing this change on powerpc. Thanks.

Quoted 4 lines

This patch set is based on
commit a29a64445089 ("powerpc: Use common of_kexec_setup_new_fdt()") in https://git.kernel.org/pub/scm/linux/kernel/git/robh/linux.git
"dt/kexec" branch.

This all looks good to me. I'd suggest you send the above patches out as part of this series because I don't plan to do so.

I would like to also resolve the vmalloc vs. kmalloc difference for allocating the FDT. Then we can further consolidate the DT kexec code.

It all needs some acks from arm64 and powerpc maintainers. As far as merging, I think via the integrity tree makes the most sense.