Carry forward IMA measurement log on kexec on ARM64
Subsystems (6)
v4 cover Carry forward IMA measurement log on kexec on ARM64
On kexec file load Integrgity Measurement Architecture(IMA) subsystem may verify the IMA signature of the kernel and initramfs, and measure it. The command line parameters passed to the kernel in the kexec call may also be measured by IMA. A remote attestation service can verify the measurement through the IMA log and the TPM PCR data. This can be achieved only if the IMA measurement log is carried over from the current kernel to the next kernel across the kexec call. However in the current implementation the IMA measurement logs are not carried over on ARM64 platforms. Therefore a remote attestation service cannot verify the authenticity of the running kernel on ARM64 platforms when the kernel is updated through the kexec system call.
This patch series adds support for carrying forward the IMA measurement log on kexec on ARM64. powerpc already supports carrying forward the IMA measurement log on kexec.
This series refactors the platform independent code such that it can be reused for ARM64 as well. A chosen node namely "linux,ima-kexec-buffer" is added to the DTB for ARM64 to hold the address and the size of the memory reserved to carry
the IMA measurement log.
This patch series has been tested for ARM64 platform using QEMU. I would like help from the community for testing this change on powerpc. Thanks.
This series is based on commit 18445bf405cb ("Merge tag 'spi-fix-v5.9-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi") in
https://github.com/torvalds/linux "master" branch.
Changelog:
v4:
- Submitting the patch series on behalf of the original author Prakhar Srivastava <[email protected]>
- Moved FDT_PROP_IMA_KEXEC_BUFFER ("linux,ima-kexec-buffer") to libfdt.h so that it can be shared by multiple platforms.
v3:
Breakup patches further into separate patches.
- Refactoring non architecture specific code out of powerpc
- Update powerpc related code to use fdt functions
- Update IMA buffer read related code to use of functions
- Add support to store the memory information of the IMA measurement logs to be carried forward.
- Update the property strings to align with documented nodes
https://github.com/devicetree-org/dt-schema/pull/46
v2:
Break patches into separate patches.
- Powerpc related Refactoring
- Updating the docuemntation for chosen node
- Updating arm64 to support IMA buffer pass
v1:
Refactoring carrying over IMA measuremnet logs over Kexec. This patch
moves the non-architecture specific code out of powerpc and adds to security/ima.(Suggested by Thiago)
Add Documentation regarding the ima-kexec-buffer node in the chosen
node documentation
v0:
Add a layer of abstraction to use the memory reserved by device tree
for ima buffer pass.
Add support for ima buffer pass using reserved memory for arm64 kexec.
Update the arch sepcific code path in kexec file load to store the ima buffer in the reserved memory. The same reserved memory is read on kexec or cold boot.
Lakshmi Ramasubramanian (5):
powerpc: Refactor kexec functions to move arch independent code to IMA
powerpc: Use libfdt functions to fetch IMA buffer properties
IMA: Refactor do_get_kexec_buffer() to call of_ functions directly
arm64: Store IMA log information in kimage used for kexec
arm64: Add IMA kexec buffer to DTB
arch/arm64/Kconfig | 1 + arch/arm64/include/asm/ima.h | 17 ++++ arch/arm64/include/asm/kexec.h | 3 + arch/arm64/kernel/machine_kexec_file.c | 28 ++++++ arch/powerpc/include/asm/ima.h | 3 - arch/powerpc/kexec/ima.c | 123 ++++++------------------- include/linux/libfdt.h | 3 + security/integrity/ima/ima_kexec.c | 81 ++++++++++++++++ 8 files changed, 161 insertions(+), 98 deletions(-) create mode 100644 arch/arm64/include/asm/ima.h
Signature · 1 line
2.28.0
PATCH v4 1/5 powerpc: Refactor kexec functions to move arch independent code to IMA
The functions ima_get_kexec_buffer() and ima_free_kexec_buffer() that handle carrying forward the IMA measurement logs on kexec for powerpc do not have architecture specific code, but they are currently defined for powerpc only.
Move these functions to IMA subsystem so that it can be used for other architectures as well. A later patch in this series will use these functions for carrying forward the IMA measurement log for ARM64.
Define FDT_PROP_IMA_KEXEC_BUFFER for the chosen node, namely "linux,ima-kexec-buffer", that is added to the DTB to hold the address and the size of the memory reserved to carry the IMA measurement log.
--- arch/powerpc/include/asm/ima.h | 3 - arch/powerpc/kexec/ima.c | 60 +------------------- include/linux/libfdt.h | 3 + security/integrity/ima/ima_kexec.c | 91 ++++++++++++++++++++++++++++++ 4 files changed, 97 insertions(+), 60 deletions(-)
arch/powerpc/include/asm/ima.h +0 -3
@@ -4,9 +4,6 @@struct kimage ; -int ima_get_kexec_buffer (void **addr,size_t *size); -int ima_free_kexec_buffer (void ); -#ifdef CONFIG_IMA void remove_ima_buffer (void *fdt,int chosen_node);#else
arch/powerpc/kexec/ima.c +3 -57
82 lines not on this page · raw message
include/linux/libfdt.h +3 -0
@@ -5,4 +5,7 @@#include <linux/libfdt_env.h> #include "../../scripts/dtc/libfdt/libfdt.h" +/* Common device tree properties */ +#define FDT_PROP_IMA_KEXEC_BUFFER "linux,ima-kexec-buffer" +#endif /* _INCLUDE_LIBFDT_H_ */
security/integrity/ima/ima_kexec.c +91 -0
99 lines not on this page · raw message
Signature · 1 line
2.28.0
Re: [PATCH v4 1/5] powerpc: Refactor kexec functions to move arch independent code to IMA
Quoted 9 lines · Lakshmi Ramasubramanian
The functions
ima_get_kexec_buffer()andima_free_kexec_buffer()that handle carrying forward the IMA measurement logs on kexec for powerpc do not have architecture specific code, but they are currently defined for powerpc only.Move these functions to IMA subsystem so that it can be used for other architectures as well. A later patch in this series will use these functions for carrying forward the IMA measurement log for ARM64.
Quoted 8 lines
Define
FDT_PROP_IMA_KEXEC_BUFFERfor the chosen node, namely "linux,ima-kexec-buffer", that is added to the DTB to hold the address and the size of the memory reserved to carry the IMA measurement log.Co-developed-by Prakhar Srivastava <[email protected]>Signed-off-by Prakhar Srivastava <[email protected]>Signed-off-by Lakshmi Ramasubramanian <[email protected]>
This patch removes two functions from arch/powerpc/kexec/ima.c, but adds four to security/integrity/ima/ima_kexec.c. The extra ones are get_addr_size_cells() and do_get_kexec_buffer(), which are being copied from the powerpc code but can't be removed yet because they're still used there by remove_ima_buffer() and setup_ima_buffer().
On the next patch you remove the need for these functions in powerpc code and therefore delete them. This confused me at first, so I think it would be cleared if you put patch 2 first in the series and then on this patch you can simply move the four functions and delete them from arch/powerpc/kexec/ima.c.
If you prefer to keep the current order, it's worth mentioning on the commit log where get_addr_size_cells() and do_get_kexec_buffer() are coming from.
Regardless:
Signature · 2 lines
Thiago Jung Bauermann IBM Linux Technology Center
Re: [PATCH v4 1/5] powerpc: Refactor kexec functions to move arch independent code to IMA
Quoted 33 lines · Thiago Jung Bauermann
Quoted 9 lines · Lakshmi Ramasubramanian
The functions
ima_get_kexec_buffer()andima_free_kexec_buffer()that handle carrying forward the IMA measurement logs on kexec for powerpc do not have architecture specific code, but they are currently defined for powerpc only.Move these functions to IMA subsystem so that it can be used for other architectures as well. A later patch in this series will use these functions for carrying forward the IMA measurement log for ARM64.
Quoted 8 lines
Define
FDT_PROP_IMA_KEXEC_BUFFERfor the chosen node, namely "linux,ima-kexec-buffer", that is added to the DTB to hold the address and the size of the memory reserved to carry the IMA measurement log.Co-developed-by Prakhar Srivastava <[email protected]>Signed-off-by Prakhar Srivastava <[email protected]>Signed-off-by Lakshmi Ramasubramanian <[email protected]>This patch removes two functions from
arch/powerpc/kexec/ima.c, but adds four tosecurity/integrity/ima/ima_kexec.c. The extra ones areget_addr_size_cells()anddo_get_kexec_buffer(), which are being copied from the powerpc code but can't be removed yet because they're still used there byremove_ima_buffer()andsetup_ima_buffer().On the next patch you remove the need for these functions in powerpc code and therefore delete them. This confused me at first, so I think it would be cleared if you put patch 2 first in the series and then on this patch you can simply move the four functions and delete them from
arch/powerpc/kexec/ima.c.
Quoted 8 lines
If you prefer to keep the current order, it's worth mentioning on the commit log where
get_addr_size_cells()anddo_get_kexec_buffer()are coming from.Regardless:
Reviewed-by Thiago Jung Bauermann <[email protected]>
Thanks for reviewing the changes Thiago.
I'll update the commit log to describe the changes related to get_addr_size_cells() and do_get_kexec_buffer().
-lakshmi
Re: [PATCH v4 1/5] powerpc: Refactor kexec functions to move arch independent code to IMA
In reply to Lakshmi Ramasubramaniansecurity/integrity/ima/ima_kexec.c line 59
Quoted 8 lines · Lakshmi Ramasubramanian
security/integrity/ima/ima_kexec.c +8
-0+/** +* ima_get_kexec_buffer - get IMA buffer from the previous kernel +* @addr: On successful return, set to point to the buffer contents. +* @size: On successful return, set to the buffer size. +* +* Return: 0 on success, negative errno on error. +*/ +int ima_get_kexec_buffer (void **addr,size_t *size)
I just noticed that this function is only called from within ima_kexec.c, so it can be made static.
Quoted 14 lines
security/integrity/ima/ima_kexec.c +14
-0+{ +int ret, len; +unsigned long tmp_addr; +size_t tmp_size; +const void *prop; + + prop =of_get_property (of_chosen,FDT_PROP_IMA_KEXEC_BUFFER , &len); +if (!prop) +return -ENOENT ; + + ret =do_get_kexec_buffer (prop, len, &tmp_addr, &tmp_size); +if (ret) +return ret; +
security/integrity/ima/ima_kexec.c line 83
Quoted 10 lines
security/integrity/ima/ima_kexec.c +10
-0+ *addr =__va (tmp_addr); + *size = tmp_size; + +return 0 ; +} + +/** +* ima_free_kexec_buffer - free memory used by the IMA buffer +*/ +int ima_free_kexec_buffer (void )
This one can be static as well.
Quoted 25 lines
security/integrity/ima/ima_kexec.c +22
-0+{ +int ret; +unsigned long addr; +size_t size; +struct property *prop; + + prop =of_find_property (of_chosen,FDT_PROP_IMA_KEXEC_BUFFER ,NULL ); +if (!prop) +return -ENOENT ; + + ret =do_get_kexec_buffer (prop->value, prop->length, &addr, &size); +if (ret) +return ret; + + ret =of_remove_property (of_chosen, prop); +if (ret) +return ret; + +return memblock_free (addr, size); + +} +#ifdef CONFIG_IMA_KEXEC static int ima_dump_measurement_list (unsigned long *buffer_size,void **buffer,unsigned long segment_size)
Signature · 2 lines
Thiago Jung Bauermann IBM Linux Technology Center
Re: [PATCH v4 1/5] powerpc: Refactor kexec functions to move arch independent code to IMA
Quoted 14 lines · Thiago Jung Bauermann
security/integrity/ima/ima_kexec.c line 59
Quoted 8 lines · Lakshmi Ramasubramanian
security/integrity/ima/ima_kexec.c +8
-0+/** +* ima_get_kexec_buffer - get IMA buffer from the previous kernel +* @addr: On successful return, set to point to the buffer contents. +* @size: On successful return, set to the buffer size. +* +* Return: 0 on success, negative errno on error. +*/ +int ima_get_kexec_buffer (void **addr,size_t *size)I just noticed that this function is only called from within
ima_kexec.c, so it can be made static.
Will do.
Quoted 19 lines
Quoted 19 lines
security/integrity/ima/ima_kexec.c +18
-0+{ +int ret, len; +unsigned long tmp_addr; +size_t tmp_size; +const void *prop; + + prop =of_get_property (of_chosen,FDT_PROP_IMA_KEXEC_BUFFER , &len); +if (!prop) +return -ENOENT ; + + ret =do_get_kexec_buffer (prop, len, &tmp_addr, &tmp_size); +if (ret) +return ret; + + *addr =__va (tmp_addr); + *size = tmp_size; + +return 0 ;
Quoted 8 lines
security/integrity/ima/ima_kexec.c line 83
Quoted 6 lines
security/integrity/ima/ima_kexec.c +6
-0+} + +/** +* ima_free_kexec_buffer - free memory used by the IMA buffer +*/ +int ima_free_kexec_buffer (void )This one can be static as well.
Will do.
-lakshmi
Quoted 28 lines
Quoted 26 lines
security/integrity/ima/ima_kexec.c +22
-0+{ +int ret; +unsigned long addr; +size_t size; +struct property *prop; + + prop =of_find_property (of_chosen,FDT_PROP_IMA_KEXEC_BUFFER ,NULL ); +if (!prop) +return -ENOENT ; + + ret =do_get_kexec_buffer (prop->value, prop->length, &addr, &size); +if (ret) +return ret; + + ret =of_remove_property (of_chosen, prop); +if (ret) +return ret; + +return memblock_free (addr, size); + +} +#ifdef CONFIG_IMA_KEXEC static int ima_dump_measurement_list (unsigned long *buffer_size,void **buffer,unsigned long segment_size)
PATCH v4 2/5 powerpc: Use libfdt functions to fetch IMA buffer properties
In reply to Lakshmi Ramasubramanianremove_ima_buffer() uses custom code to handle properties of the IMA buffer, such as the buffer's address, size, etc., in the device tree. Flat Device Tree (FDT) library (libfdt) provides helper functions for handling device tree node properties and they should be used instead.
Use libfdt functions for handling IMA buffer properties in the device tree node for powerpc.
--- arch/powerpc/kexec/ima.c | 63 ++++++++++++++++------------------------ 1 file changed, 25 insertions(+), 38 deletions(-)
arch/powerpc/kexec/ima.c +25 -38
@@ -12,40 +12,6 @@#include <linux/memblock.h> #include <linux/libfdt.h> -static int get_addr_size_cells (int *addr_cells,int *size_cells) -{ -struct device_node *root; - - root =of_find_node_by_path ("/" ); -if (!root) -return -EINVAL ; - - *addr_cells =of_n_addr_cells (root); - *size_cells =of_n_size_cells (root); - -of_node_put (root); - -return 0 ; -} - -static int do_get_kexec_buffer (const void *prop,int len,unsigned long *addr, -size_t *size) -{ -int ret, addr_cells, size_cells; - - ret =get_addr_size_cells (&addr_cells, &size_cells); -if (ret) -return ret; - -if (len <4 * (addr_cells + size_cells)) -return -ENOENT ; - - *addr =of_read_number (prop, addr_cells); - *size =of_read_number (prop +4 * addr_cells, size_cells); - -return 0 ; -} -/** * remove_ima_buffer - remove the IMA buffer property and reservation from @fdt *
@@ -54,7 +20,7 @@ static int do_get_kexec_buffer(const void *prop, int len, unsigned long *addr,*/ void remove_ima_buffer (void *fdt,int chosen_node) { -int ret, len; +int ret, len, addr_cells, size_cells;unsigned long addr;size_t size;const void *prop;
@@ -63,7 +29,22 @@ void remove_ima_buffer(void *fdt, int chosen_node)if (!prop)return ; - ret =do_get_kexec_buffer (prop, len, &addr, &size); + ret =fdt_address_cells (fdt, chosen_node); +if (ret <0 ) +return ; + addr_cells = ret; + + ret =fdt_size_cells (fdt, chosen_node); +if (ret <0 ) +return ; + size_cells = ret; + +if (len <4 * (addr_cells + size_cells)) +return ; + + addr =of_read_number (prop, addr_cells); + size =of_read_number (prop +4 * addr_cells, size_cells); +fdt_delprop (fdt, chosen_node,FDT_PROP_IMA_KEXEC_BUFFER );if (ret)return ;
@@ -129,9 +110,15 @@ int setup_ima_buffer(const struct kimage *image, void *fdt, int chosen_node)if (!image->arch.ima_buffer_size)return 0 ; - ret =get_addr_size_cells (&addr_cells, &size_cells); -if (ret) + ret =fdt_address_cells (fdt, chosen_node); +if (ret <0 ) +return ret; + addr_cells = ret; + + ret =fdt_size_cells (fdt, chosen_node); +if (ret <0 )return ret; + size_cells = ret; entry_size =4 * (addr_cells + size_cells);
Signature · 1 line
2.28.0
Re: [PATCH v4 2/5] powerpc: Use libfdt functions to fetch IMA buffer properties
arch/powerpc/kexec/ima.c void remove_ima_buffer(void *fdt, int chosen_node) · line 32
Quoted 6 lines · Lakshmi Ramasubramanian
arch/powerpc/kexec/ima.c +1
-1@@ -63,7 +29,22 @@ void remove_ima_buffer(void *fdt, int chosen_node)if (!prop)return ; - ret =do_get_kexec_buffer (prop, len, &addr, &size); + ret =fdt_address_cells (fdt, chosen_node);
This change was already present in the previous version of the patch but it was just today that I noticed a problem: there's no #address-cells property in /chosen. This code will still work though because if there's no property this function returns 2 which is the correct value for ppc64. But it's conceptually wrong. You need to pass the node offset for / so that it gets the #address-cells property from there.
arch/powerpc/kexec/ima.c void remove_ima_buffer(void *fdt, int chosen_node) · line 37
Quoted 5 lines
arch/powerpc/kexec/ima.c +5
-0+if (ret <0 ) +return ; + addr_cells = ret; + + ret =fdt_size_cells (fdt, chosen_node);
Here we're not so lucky. The default value returned when no #size-cells property is present is 1, which is wrong for ppc64 so this change introduces a bug. You also need to pass the node offset for / here.
Quoted 20 lines
arch/powerpc/kexec/ima.c +11
-2+if (ret <0 ) +return ; + size_cells = ret; + +if (len <4 * (addr_cells + size_cells)) +return ; + + addr =of_read_number (prop, addr_cells); + size =of_read_number (prop +4 * addr_cells, size_cells); +fdt_delprop (fdt, chosen_node,FDT_PROP_IMA_KEXEC_BUFFER );if (ret)return ;@@ -129,9 +110,15 @@ int setup_ima_buffer(const struct kimage *image, void *fdt, int chosen_node)if (!image->arch.ima_buffer_size)return 0 ; - ret =get_addr_size_cells (&addr_cells, &size_cells); -if (ret) + ret =fdt_address_cells (fdt, chosen_node);
arch/powerpc/kexec/ima.c int setup_ima_buffer(const struct kimage *image, void *fdt, int chosen_node) · line 123
Quoted 10 lines
arch/powerpc/kexec/ima.c +7
-0+if (ret <0 ) +return ret; + addr_cells = ret; + + ret =fdt_size_cells (fdt, chosen_node); +if (ret <0 )return ret; + size_cells = ret; entry_size =4 * (addr_cells + size_cells);
Ditto here.
Signature · 2 lines
Thiago Jung Bauermann IBM Linux Technology Center
Re: [PATCH v4 2/5] powerpc: Use libfdt functions to fetch IMA buffer properties
Quoted 7 lines · Thiago Jung Bauermann
Quoted 4 lines · Lakshmi Ramasubramanian
arch/powerpc/kexec/ima.c +0
-0@@ -63,7 +29,22 @@ void remove_ima_buffer(void *fdt, int chosen_node)if (!prop)return ;
Quoted 9 lines
arch/powerpc/kexec/ima.c void remove_ima_buffer(void *fdt, int chosen_node) · line 32
Quoted 2 lines
arch/powerpc/kexec/ima.c +1
-1- ret =do_get_kexec_buffer (prop, len, &addr, &size); + ret =fdt_address_cells (fdt, chosen_node);This change was already present in the previous version of the patch but it was just today that I noticed a problem: there's no #address-cells property in /chosen. This code will still work though because if there's no property this function returns 2 which is the correct value for ppc64. But it's conceptually wrong. You need to pass the node offset for / so that it gets the #address-cells property from there.
Thanks for the info.
Will fix this.
Quoted 10 lines
arch/powerpc/kexec/ima.c void remove_ima_buffer(void *fdt, int chosen_node) · line 37
Quoted 6 lines
arch/powerpc/kexec/ima.c +5
-0+if (ret <0 ) +return ; + addr_cells = ret; + + ret =fdt_size_cells (fdt, chosen_node);Here we're not so lucky. The default value returned when no #size-cells property is present is 1, which is wrong for ppc64 so this change introduces a bug. You also need to pass the node offset for / here.
Will fix this.
Quoted 30 lines
Quoted 30 lines
arch/powerpc/kexec/ima.c +18
-2+if (ret <0 ) +return ; + size_cells = ret; + +if (len <4 * (addr_cells + size_cells)) +return ; + + addr =of_read_number (prop, addr_cells); + size =of_read_number (prop +4 * addr_cells, size_cells); +fdt_delprop (fdt, chosen_node,FDT_PROP_IMA_KEXEC_BUFFER );if (ret)return ;@@ -129,9 +110,15 @@ int setup_ima_buffer(const struct kimage *image, void *fdt, int chosen_node)if (!image->arch.ima_buffer_size)return 0 ; - ret =get_addr_size_cells (&addr_cells, &size_cells); -if (ret) + ret =fdt_address_cells (fdt, chosen_node); +if (ret <0 ) +return ret; + addr_cells = ret; + + ret =fdt_size_cells (fdt, chosen_node); +if (ret <0 )return ret; + size_cells = ret;
Quoted 4 lines
arch/powerpc/kexec/ima.c int setup_ima_buffer(const struct kimage *image, void *fdt, int chosen_node) · line 123
Quoted 1 line
arch/powerpc/kexec/ima.c +0
-0entry_size =4 * (addr_cells + size_cells);Ditto here.
Will fix this.
thanks,
-lakshmi
PATCH v4 3/5 IMA: Refactor do_get_kexec_buffer() to call of_ functions directly
In reply to Lakshmi Ramasubramaniando_get_kexec_buffer() calls another local function get_addr_size_cells() to get the address and size of the IMA measurement log buffer stored in the device tree. get_addr_size_cells() is small enough that it can be merged into do_get_kexec_buffer() and a function call can be avoided.
Refactor do_get_kexec_buffer() to call of_ functions directly instead of calling get_addr_size_cells() and remove get_addr_size_cells().
--- security/integrity/ima/ima_kexec.c | 20 +++++--------------- 1 file changed, 5 insertions(+), 15 deletions(-)
security/integrity/ima/ima_kexec.c +5 -15
@@ -15,31 +15,21 @@#include <linux/libfdt.h> #include "ima.h" -static int get_addr_size_cells (int *addr_cells,int *size_cells) +static int do_get_kexec_buffer (const void *prop,int len,unsigned long *addr, +size_t *size) { +int addr_cells, size_cells;struct device_node *root; root =of_find_node_by_path ("/" );if (!root)return -EINVAL ; - *addr_cells =of_n_addr_cells (root); - *size_cells =of_n_size_cells (root); + addr_cells =of_n_addr_cells (root); + size_cells =of_n_size_cells (root);of_node_put (root); -return 0 ; -} - -static int do_get_kexec_buffer (const void *prop,int len,unsigned long *addr, -size_t *size) -{ -int ret, addr_cells, size_cells; - - ret =get_addr_size_cells (&addr_cells, &size_cells); -if (ret) -return ret; -if (len <4 * (addr_cells + size_cells))return -ENOENT ;
Signature · 1 line
2.28.0
Re: [PATCH v4 3/5] IMA: Refactor do_get_kexec_buffer() to call of_ functions directly
Quoted 11 lines · Lakshmi Ramasubramanian
do_get_kexec_buffer()calls another local functionget_addr_size_cells()to get the address and size of the IMA measurement log buffer stored in the device tree.get_addr_size_cells()is small enough that it can be merged intodo_get_kexec_buffer()and a function call can be avoided.Refactor
do_get_kexec_buffer()to callof_functions directly instead of callingget_addr_size_cells()and removeget_addr_size_cells().Co-developed-by Prakhar Srivastava <[email protected]>Signed-off-by Prakhar Srivastava <[email protected]>Signed-off-by Lakshmi Ramasubramanian <[email protected]>
Signature · 2 lines
Thiago Jung Bauermann IBM Linux Technology Center
PATCH v4 4/5 arm64: Store IMA log information in kimage used for kexec
In reply to Lakshmi RamasubramanianAddress and size of the buffer containing the IMA measurement log need to be passed from the current kernel to the next kernel on kexec.
Add address and size fields to "struct kimage_arch" for ARM64 platform to hold the address and size of the IMA measurement log buffer. Define an architecture specific function for ARM64 namely arch_ima_add_kexec_buffer() that will set the address and size of the current kernel's IMA buffer to be passed to the next kernel on kexec.
--- arch/arm64/include/asm/ima.h | 17 +++++++++++++++++ arch/arm64/include/asm/kexec.h | 3 +++ arch/arm64/kernel/machine_kexec_file.c | 17 +++++++++++++++++ 3 files changed, 37 insertions(+) create mode 100644 arch/arm64/include/asm/ima.h
arch/arm64/include/asm/ima.h new file +17 -0
@@ -0,0 +1,17 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef _ASM_ARCH_IMA_H +#define _ASM_ARCH_IMA_H + +struct kimage ; + +#ifdef CONFIG_IMA_KEXEC +int arch_ima_add_kexec_buffer (struct kimage *image,unsigned long load_addr, +size_t size); +#else +static inline int arch_ima_add_kexec_buffer (struct kimage *image, +unsigned long load_addr,size_t size) +{ +return 0 ; +} +#endif /* CONFIG_IMA_KEXEC */ +#endif /* _ASM_ARCH_IMA_H */
arch/arm64/include/asm/kexec.h +3 -0
@@ -100,6 +100,9 @@ struct kimage_arch {void *elf_headers;unsigned long elf_headers_mem;unsigned long elf_headers_sz; + +phys_addr_t ima_buffer_addr; +size_t ima_buffer_size; };extern const struct kexec_file_ops kexec_image_ops;
arch/arm64/kernel/machine_kexec_file.c +17 -0
@@ -38,6 +38,23 @@ const struct kexec_file_ops * const kexec_file_loaders[] = { NULL }; +/** +* arch_ima_add_kexec_buffer - do arch-specific steps to add the IMA buffer +* +* Architectures should use this function to pass on the IMA buffer +* information to the next kernel. +* +* Return: 0 on success, negative errno on error. +*/ +int arch_ima_add_kexec_buffer (struct kimage *image,unsigned long load_addr, +size_t size) +{ + image->arch.ima_buffer_addr = load_addr; + image->arch.ima_buffer_size = size; +return 0 ; +} + +int arch_kimage_file_post_load_cleanup (struct kimage *image) {vfree (image->arch.dtb);
Signature · 1 line
2.28.0
kernel test robot
build botRe: [PATCH v4 4/5] arm64: Store IMA log information in kimage used for kexec
Thank you for the patch! Perhaps something to improve:
Hi Lakshmi,
Thank you for the patch! Perhaps something to improve:
[auto build test WARNING on arm64/for-next/core]
[also build test WARNING on powerpc/next integrity/next-integrity v5.9-rc1 next-20200819] [If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]
url: https://github.com/0day-ci/linux/commits/Lakshmi-Ramasubramanian/Carry-forward-IMA-measurement-log-on-kexec-on-ARM64/20200820-012312 base: https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-next/core config: arm64-defconfig (attached as .config) compiler: aarch64-linux-gcc (GCC) 9.3.0
reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross
# save the attached .config to linux build tree
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-9.3.0 make.cross ARCH=arm64
If you fix the issue, kindly add following tag as appropriate
All warnings (new ones prefixed by >>):
>> arch/arm64/kernel/machine_kexec_file.c:49:5: warning: no previous prototype for 'arch_ima_add_kexec_buffer' [-Wmissing-prototypes]
49 | int arch_ima_add_kexec_buffer(struct kimage *image, unsigned long load_addr,
| ^~~~~~~~~~~~~~~~~~~~~~~~~
# https://github.com/0day-ci/linux/commit/35dba82b07df4391b0b88724808a43c9a11395e8
git remote add linux-review https://github.com/0day-ci/linux
git fetch --no-tags linux-review Lakshmi-Ramasubramanian/Carry-forward-IMA-measurement-log-on-kexec-on-ARM64/20200820-012312 git checkout 35dba82b07df4391b0b88724808a43c9a11395e8
vim +/arch_ima_add_kexec_buffer +49 arch/arm64/kernel/machine_kexec_file.c
40
41 /**
42 * arch_ima_add_kexec_buffer - do arch-specific steps to add the IMA buffer
43 *
44 * Architectures should use this function to pass on the IMA buffer
45 * information to the next kernel.
46 *
47 * Return: 0 on success, negative errno on error.
48 */
> 49 int arch_ima_add_kexec_buffer(struct kimage *image, unsigned long load_addr,
50 size_t size)
51 {
52 image->arch.ima_buffer_addr = load_addr;
53 image->arch.ima_buffer_size = size;
54 return 0;
55 }
56 ---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org
Re: [PATCH v4 4/5] arm64: Store IMA log information in kimage used for kexec
In reply to Lakshmi RamasubramanianQuoted 9 lines · Lakshmi Ramasubramanian
Address and size of the buffer containing the IMA measurement log need to be passed from the current kernel to the next kernel on kexec.
Add address and size fields to "struct
kimage_arch" for ARM64 platform to hold the address and size of the IMA measurement log buffer. Define an architecture specific function for ARM64 namelyarch_ima_add_kexec_buffer()that will set the address and size of the current kernel's IMA buffer to be passed to the next kernel on kexec.
Quoted 3 lines
Co-developed-by Prakhar Srivastava <[email protected]>Signed-off-by Prakhar Srivastava <[email protected]>Signed-off-by Lakshmi Ramasubramanian <[email protected]>
IMHO this patch and the next one can be squashed together. Also, a minor comment below.
Quoted 18 lines
--- arch/arm64/include/asm/ima.h | 17 +++++++++++++++++ arch/arm64/include/asm/kexec.h | 3 +++ arch/arm64/kernel/machine_kexec_file.c | 17 +++++++++++++++++ 3 files changed, 37 insertions(+) create mode 100644 arch/arm64/include/asm/ima.harch/arm64/include/asm/ima.h new file +5
-0@@ -0,0 +1,17 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef _ASM_ARCH_IMA_H +#define _ASM_ARCH_IMA_H + +struct kimage ;
arch/arm64/include/asm/ima.h line 15
Quoted 10 lines
arch/arm64/include/asm/ima.h new file +10
-0+ +#ifdef CONFIG_IMA_KEXEC +int arch_ima_add_kexec_buffer (struct kimage *image,unsigned long load_addr, +size_t size); +#else +static inline int arch_ima_add_kexec_buffer (struct kimage *image, +unsigned long load_addr,size_t size) +{ +return 0 ; +}
There's no need to define arch_ima_add_kexec_buffer() if CONFIG_IMA_KEXEC isn't set because in that case, the code which calls this function in ima_add_kexec_buffer() won't be part of the build.
Quoted 2 lines
arch/arm64/include/asm/ima.h new file +2
-0+#endif /* CONFIG_IMA_KEXEC */ +#endif /* _ASM_ARCH_IMA_H */
Signature · 2 lines
Thiago Jung Bauermann IBM Linux Technology Center
PATCH v4 5/5 arm64: Add IMA kexec buffer to DTB
In reply to Lakshmi RamasubramanianThe address and size of the current kernel's IMA measurement log need to be added to the device tree's IMA kexec buffer node for the log to be carried over to the next kernel on the kexec call.
Add the IMA measurement log buffer properties to the device tree for ARM64. Update CONFIG_KEXEC_FILE to select CONFIG_HAVE_IMA_KEXEC to indicate that the IMA measurement log information is present in the device tree.
--- arch/arm64/Kconfig | 1 + arch/arm64/kernel/machine_kexec_file.c | 11 +++++++++++ 2 files changed, 12 insertions(+)
arch/arm64/Kconfig +1 -0
@@ -1077,6 +1077,7 @@ config KEXEC config KEXEC_FILE bool "kexec file based system call" select KEXEC_CORE + select HAVE_IMA_KEXEC help This is new version of kexec system call. This system call is file based and takes file descriptors as system call argument
arch/arm64/kernel/machine_kexec_file.c +11 -0
@@ -153,6 +153,17 @@ static int setup_dtb(struct kimage *image, FDT_PROP_KASLR_SEED); } +/* add ima-kexec-buffer */ +if (image->arch.ima_buffer_size >0 ) { + + ret =fdt_appendprop_addrrange (dtb,0 , off, +FDT_PROP_IMA_KEXEC_BUFFER , + image->arch.ima_buffer_addr, + image->arch.ima_buffer_size); +if (ret) +return (ret == -FDT_ERR_NOSPACE ? -ENOMEM : -EINVAL ); + } +/* add rng-seed */ if (rng_is_initialized ()) {void *rng_seed;
Signature · 1 line
2.28.0
Re: [PATCH v4 5/5] arm64: Add IMA kexec buffer to DTB
Quoted 41 lines · Lakshmi Ramasubramanian
The address and size of the current kernel's IMA measurement log need to be added to the device tree's IMA kexec buffer node for the log to be carried over to the next kernel on the kexec call.
Add the IMA measurement log buffer properties to the device tree for ARM64. Update
CONFIG_KEXEC_FILEto selectCONFIG_HAVE_IMA_KEXECto indicate that the IMA measurement log information is present in the device tree.Co-developed-by Prakhar Srivastava <[email protected]>Signed-off-by Prakhar Srivastava <[email protected]>Signed-off-by Lakshmi Ramasubramanian <[email protected]>--- arch/arm64/Kconfig | 1 + arch/arm64/kernel/machine_kexec_file.c | 11 +++++++++++ 2 files changed, 12 insertions(+)arch/arm64/Kconfig +1
-0@@ -1077,6 +1077,7 @@ config KEXEC config KEXEC_FILE bool "kexec file based system call" select KEXEC_CORE + select HAVE_IMA_KEXEC help This is new version of kexec system call. This system call is file based and takes file descriptors as system call argumentarch/arm64/kernel/machine_kexec_file.c +4
-0@@ -153,6 +153,17 @@ static int setup_dtb(struct kimage *image, FDT_PROP_KASLR_SEED); } +/* add ima-kexec-buffer */ +if (image->arch.ima_buffer_size >0 ) { + + ret = fdt_appendprop_addrrange(dtb, 0, off,
arch/arm64/kernel/machine_kexec_file.c static int setup_dtb(struct kimage *image, · line 169
Quoted 10 lines
arch/arm64/kernel/machine_kexec_file.c +7
-0+FDT_PROP_IMA_KEXEC_BUFFER , + image->arch.ima_buffer_addr, + image->arch.ima_buffer_size); +if (ret) +return (ret == -FDT_ERR_NOSPACE ? -ENOMEM : -EINVAL ); + } +/* add rng-seed */ if (rng_is_initialized ()) {void *rng_seed;
I believe you need to add a memory reservation to the dtb covering the IMA kexec buffer, otherwise nothing stops the new kernel from stomping over it. E.g., powerpc does:
ret = fdt_add_mem_rsv(fdt, image->arch.ima_buffer_addr, image->arch.ima_buffer_size);
Signature · 2 lines
Thiago Jung Bauermann IBM Linux Technology Center