| Message ID | 20201204195149.611-7-nramas@linux.microsoft.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | Carry forward IMA measurement log on kexec on ARM64 | expand |
Lakshmi Ramasubramanian <nramas@linux.microsoft.com> writes: > ima_get_kexec_buffer() retrieves the address and size of the buffer > used for carrying forward the IMA measurement logs on kexec from > the device tree. > > ima_free_kexec_buffer() removes the chosen node > "linux,ima-kexec-buffer" from the device tree, and frees the buffer > used for carrying forward the IMA measurement logs on kexec. > > These functions do not have architecture specific code, but are > currently limited to powerpc. Move ima_get_kexec_buffer() and > ima_free_kexec_buffer() to ima_kexec.c in IMA so that they are > accessible for other architectures as well. > > With the above change the functions in arch/powerpc/kexec/ima.c are > defined only when the kernel config CONFIG_IMA_KEXEC is enabled. > Update the Makefile to build arch/powerpc/kexec/ima.c only when > CONFIG_IMA_KEXEC is enabled and remove "#ifdef CONFIG_IMA_KEXEC" > in arch/powerpc/kexec/ima.c. Nice. > Co-developed-by: Prakhar Srivastava <prsriva@linux.microsoft.com> > Signed-off-by: Prakhar Srivastava <prsriva@linux.microsoft.com> > Signed-off-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com> > Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Reviewed-by: Thiago Jung Bauermann <bauerman@linux.ibm.com> Just a small nit below: > --- > arch/powerpc/include/asm/ima.h | 3 -- > arch/powerpc/kexec/Makefile | 7 +--- > arch/powerpc/kexec/ima.c | 50 ----------------------------- > security/integrity/ima/ima_kexec.c | 51 ++++++++++++++++++++++++++++++ > 4 files changed, 52 insertions(+), 59 deletions(-) > > diff --git a/arch/powerpc/include/asm/ima.h b/arch/powerpc/include/asm/ima.h > index a2fc71bc3b23..d8444d27f0d8 100644 > --- a/arch/powerpc/include/asm/ima.h > +++ b/arch/powerpc/include/asm/ima.h > @@ -6,9 +6,6 @@ > > struct kimage; > > -int ima_get_kexec_buffer(void **addr, size_t *size); > -int ima_free_kexec_buffer(void); > - > #ifdef CONFIG_IMA_KEXEC > int arch_ima_add_kexec_buffer(struct kimage *image, unsigned long load_addr, > size_t size); > diff --git a/arch/powerpc/kexec/Makefile b/arch/powerpc/kexec/Makefile > index 4aff6846c772..f54a9dbff4c8 100644 > --- a/arch/powerpc/kexec/Makefile > +++ b/arch/powerpc/kexec/Makefile > @@ -9,12 +9,7 @@ obj-$(CONFIG_PPC32) += relocate_32.o > > obj-$(CONFIG_KEXEC_FILE) += file_load.o ranges.o file_load_$(BITS).o elf_$(BITS).o > > -ifdef CONFIG_HAVE_IMA_KEXEC > -ifdef CONFIG_IMA > -obj-y += ima.o > -endif > -endif > - > +obj-$(CONFIG_IMA_KEXEC) += ima.o > > # Disable GCOV, KCOV & sanitizers in odd or sensitive code > GCOV_PROFILE_core_$(BITS).o := n > diff --git a/arch/powerpc/kexec/ima.c b/arch/powerpc/kexec/ima.c > index 68017123b07d..bf7084c0c4da 100644 > --- a/arch/powerpc/kexec/ima.c > +++ b/arch/powerpc/kexec/ima.c > @@ -13,55 +13,6 @@ > #include <linux/libfdt.h> > #include <asm/ima.h> With this patch, the following includes become unnecessary and can be removed from this file: #include <linux/of.h> #include <linux/memblock.h> > -/** > - * ima_get_kexec_buffer - get IMA buffer from the previous kernel > - * @addr: On successful return, set to point to the buffer contents. > - * @size: On successful return, set to the buffer size. > - * > - * Return: 0 on success, negative errno on error. > - */ > -int ima_get_kexec_buffer(void **addr, size_t *size) > -{ > - int ret; > - unsigned long tmp_addr; > - size_t tmp_size; > - > - ret = get_ima_kexec_buffer(NULL, 0, &tmp_addr, &tmp_size); > - if (ret) > - return ret; > - > - *addr = __va(tmp_addr); > - *size = tmp_size; > - > - return 0; > -} > - > -/** > - * ima_free_kexec_buffer - free memory used by the IMA buffer > - */ > -int ima_free_kexec_buffer(void) > -{ > - int ret; > - unsigned long addr; > - size_t size; > - struct property *prop; > - > - prop = of_find_property(of_chosen, "linux,ima-kexec-buffer", NULL); > - if (!prop) > - return -ENOENT; > - > - ret = get_ima_kexec_buffer(NULL, 0, &addr, &size); > - if (ret) > - return ret; > - > - ret = of_remove_property(of_chosen, prop); > - if (ret) > - return ret; > - > - return memblock_free(addr, size); > -} > - > -#ifdef CONFIG_IMA_KEXEC > /** > * arch_ima_add_kexec_buffer - do arch-specific steps to add the IMA buffer > * > @@ -154,4 +105,3 @@ int setup_ima_buffer(const struct kimage *image, void *fdt, int chosen_node) > > return 0; > } > -#endif /* CONFIG_IMA_KEXEC */
On 12/5/20 1:02 PM, Thiago Jung Bauermann wrote: > > Lakshmi Ramasubramanian <nramas@linux.microsoft.com> writes: > >> ima_get_kexec_buffer() retrieves the address and size of the buffer >> used for carrying forward the IMA measurement logs on kexec from >> the device tree. >> >> ima_free_kexec_buffer() removes the chosen node >> "linux,ima-kexec-buffer" from the device tree, and frees the buffer >> used for carrying forward the IMA measurement logs on kexec. >> >> These functions do not have architecture specific code, but are >> currently limited to powerpc. Move ima_get_kexec_buffer() and >> ima_free_kexec_buffer() to ima_kexec.c in IMA so that they are >> accessible for other architectures as well. >> >> With the above change the functions in arch/powerpc/kexec/ima.c are >> defined only when the kernel config CONFIG_IMA_KEXEC is enabled. >> Update the Makefile to build arch/powerpc/kexec/ima.c only when >> CONFIG_IMA_KEXEC is enabled and remove "#ifdef CONFIG_IMA_KEXEC" >> in arch/powerpc/kexec/ima.c. > > Nice. > >> Co-developed-by: Prakhar Srivastava <prsriva@linux.microsoft.com> >> Signed-off-by: Prakhar Srivastava <prsriva@linux.microsoft.com> >> Signed-off-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com> >> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> > > Reviewed-by: Thiago Jung Bauermann <bauerman@linux.ibm.com> > > Just a small nit below: > >> --- >> arch/powerpc/include/asm/ima.h | 3 -- >> arch/powerpc/kexec/Makefile | 7 +--- >> arch/powerpc/kexec/ima.c | 50 ----------------------------- >> security/integrity/ima/ima_kexec.c | 51 ++++++++++++++++++++++++++++++ >> 4 files changed, 52 insertions(+), 59 deletions(-) >> >> diff --git a/arch/powerpc/include/asm/ima.h b/arch/powerpc/include/asm/ima.h >> index a2fc71bc3b23..d8444d27f0d8 100644 >> --- a/arch/powerpc/include/asm/ima.h >> +++ b/arch/powerpc/include/asm/ima.h >> @@ -6,9 +6,6 @@ >> >> struct kimage; >> >> -int ima_get_kexec_buffer(void **addr, size_t *size); >> -int ima_free_kexec_buffer(void); >> - >> #ifdef CONFIG_IMA_KEXEC >> int arch_ima_add_kexec_buffer(struct kimage *image, unsigned long load_addr, >> size_t size); >> diff --git a/arch/powerpc/kexec/Makefile b/arch/powerpc/kexec/Makefile >> index 4aff6846c772..f54a9dbff4c8 100644 >> --- a/arch/powerpc/kexec/Makefile >> +++ b/arch/powerpc/kexec/Makefile >> @@ -9,12 +9,7 @@ obj-$(CONFIG_PPC32) += relocate_32.o >> >> obj-$(CONFIG_KEXEC_FILE) += file_load.o ranges.o file_load_$(BITS).o elf_$(BITS).o >> >> -ifdef CONFIG_HAVE_IMA_KEXEC >> -ifdef CONFIG_IMA >> -obj-y += ima.o >> -endif >> -endif >> - >> +obj-$(CONFIG_IMA_KEXEC) += ima.o >> >> # Disable GCOV, KCOV & sanitizers in odd or sensitive code >> GCOV_PROFILE_core_$(BITS).o := n >> diff --git a/arch/powerpc/kexec/ima.c b/arch/powerpc/kexec/ima.c >> index 68017123b07d..bf7084c0c4da 100644 >> --- a/arch/powerpc/kexec/ima.c >> +++ b/arch/powerpc/kexec/ima.c >> @@ -13,55 +13,6 @@ >> #include <linux/libfdt.h> >> #include <asm/ima.h> > > With this patch, the following includes become unnecessary and can be > removed from this file: > > #include <linux/of.h> > #include <linux/memblock.h> > Sure - will make this change. thanks, -lakshmi >> -/** >> - * ima_get_kexec_buffer - get IMA buffer from the previous kernel >> - * @addr: On successful return, set to point to the buffer contents. >> - * @size: On successful return, set to the buffer size. >> - * >> - * Return: 0 on success, negative errno on error. >> - */ >> -int ima_get_kexec_buffer(void **addr, size_t *size) >> -{ >> - int ret; >> - unsigned long tmp_addr; >> - size_t tmp_size; >> - >> - ret = get_ima_kexec_buffer(NULL, 0, &tmp_addr, &tmp_size); >> - if (ret) >> - return ret; >> - >> - *addr = __va(tmp_addr); >> - *size = tmp_size; >> - >> - return 0; >> -} >> - >> -/** >> - * ima_free_kexec_buffer - free memory used by the IMA buffer >> - */ >> -int ima_free_kexec_buffer(void) >> -{ >> - int ret; >> - unsigned long addr; >> - size_t size; >> - struct property *prop; >> - >> - prop = of_find_property(of_chosen, "linux,ima-kexec-buffer", NULL); >> - if (!prop) >> - return -ENOENT; >> - >> - ret = get_ima_kexec_buffer(NULL, 0, &addr, &size); >> - if (ret) >> - return ret; >> - >> - ret = of_remove_property(of_chosen, prop); >> - if (ret) >> - return ret; >> - >> - return memblock_free(addr, size); >> -} >> - >> -#ifdef CONFIG_IMA_KEXEC >> /** >> * arch_ima_add_kexec_buffer - do arch-specific steps to add the IMA buffer >> * >> @@ -154,4 +105,3 @@ int setup_ima_buffer(const struct kimage *image, void *fdt, int chosen_node) >> >> return 0; >> } >> -#endif /* CONFIG_IMA_KEXEC */ >
diff --git a/arch/powerpc/include/asm/ima.h b/arch/powerpc/include/asm/ima.h index a2fc71bc3b23..d8444d27f0d8 100644 --- a/arch/powerpc/include/asm/ima.h +++ b/arch/powerpc/include/asm/ima.h @@ -6,9 +6,6 @@ struct kimage; -int ima_get_kexec_buffer(void **addr, size_t *size); -int ima_free_kexec_buffer(void); - #ifdef CONFIG_IMA_KEXEC int arch_ima_add_kexec_buffer(struct kimage *image, unsigned long load_addr, size_t size); diff --git a/arch/powerpc/kexec/Makefile b/arch/powerpc/kexec/Makefile index 4aff6846c772..f54a9dbff4c8 100644 --- a/arch/powerpc/kexec/Makefile +++ b/arch/powerpc/kexec/Makefile @@ -9,12 +9,7 @@ obj-$(CONFIG_PPC32) += relocate_32.o obj-$(CONFIG_KEXEC_FILE) += file_load.o ranges.o file_load_$(BITS).o elf_$(BITS).o -ifdef CONFIG_HAVE_IMA_KEXEC -ifdef CONFIG_IMA -obj-y += ima.o -endif -endif - +obj-$(CONFIG_IMA_KEXEC) += ima.o # Disable GCOV, KCOV & sanitizers in odd or sensitive code GCOV_PROFILE_core_$(BITS).o := n diff --git a/arch/powerpc/kexec/ima.c b/arch/powerpc/kexec/ima.c index 68017123b07d..bf7084c0c4da 100644 --- a/arch/powerpc/kexec/ima.c +++ b/arch/powerpc/kexec/ima.c @@ -13,55 +13,6 @@ #include <linux/libfdt.h> #include <asm/ima.h> -/** - * ima_get_kexec_buffer - get IMA buffer from the previous kernel - * @addr: On successful return, set to point to the buffer contents. - * @size: On successful return, set to the buffer size. - * - * Return: 0 on success, negative errno on error. - */ -int ima_get_kexec_buffer(void **addr, size_t *size) -{ - int ret; - unsigned long tmp_addr; - size_t tmp_size; - - ret = get_ima_kexec_buffer(NULL, 0, &tmp_addr, &tmp_size); - if (ret) - return ret; - - *addr = __va(tmp_addr); - *size = tmp_size; - - return 0; -} - -/** - * ima_free_kexec_buffer - free memory used by the IMA buffer - */ -int ima_free_kexec_buffer(void) -{ - int ret; - unsigned long addr; - size_t size; - struct property *prop; - - prop = of_find_property(of_chosen, "linux,ima-kexec-buffer", NULL); - if (!prop) - return -ENOENT; - - ret = get_ima_kexec_buffer(NULL, 0, &addr, &size); - if (ret) - return ret; - - ret = of_remove_property(of_chosen, prop); - if (ret) - return ret; - - return memblock_free(addr, size); -} - -#ifdef CONFIG_IMA_KEXEC /** * arch_ima_add_kexec_buffer - do arch-specific steps to add the IMA buffer * @@ -154,4 +105,3 @@ int setup_ima_buffer(const struct kimage *image, void *fdt, int chosen_node) return 0; } -#endif /* CONFIG_IMA_KEXEC */ diff --git a/security/integrity/ima/ima_kexec.c b/security/integrity/ima/ima_kexec.c index 121de3e04af2..4d354593aecf 100644 --- a/security/integrity/ima/ima_kexec.c +++ b/security/integrity/ima/ima_kexec.c @@ -9,7 +9,10 @@ #include <linux/seq_file.h> #include <linux/vmalloc.h> +#include <linux/memblock.h> +#include <linux/of.h> #include <linux/kexec.h> +#include <linux/ima.h> #include "ima.h" #ifdef CONFIG_IMA_KEXEC @@ -133,6 +136,54 @@ void ima_add_kexec_buffer(struct kimage *image) } #endif /* IMA_KEXEC */ +/** + * ima_get_kexec_buffer - get IMA buffer from the previous kernel + * @addr: On successful return, set to point to the buffer contents. + * @size: On successful return, set to the buffer size. + * + * Return: 0 on success, negative errno on error. + */ +static int ima_get_kexec_buffer(void **addr, size_t *size) +{ + int ret; + unsigned long tmp_addr; + size_t tmp_size; + + ret = get_ima_kexec_buffer(NULL, 0, &tmp_addr, &tmp_size); + if (ret) + return ret; + + *addr = __va(tmp_addr); + *size = tmp_size; + + return 0; +} + +/** + * ima_free_kexec_buffer - free memory used by the IMA buffer + */ +static int ima_free_kexec_buffer(void) +{ + int ret; + unsigned long addr; + size_t size; + struct property *prop; + + prop = of_find_property(of_chosen, "linux,ima-kexec-buffer", NULL); + if (!prop) + return -ENOENT; + + ret = get_ima_kexec_buffer(NULL, 0, &addr, &size); + if (ret) + return ret; + + ret = of_remove_property(of_chosen, prop); + if (ret) + return ret; + + return memblock_free(addr, size); +} + /* * Restore the measurement list from the previous kernel. */