| Message ID | 20200908230856.9799-4-nramas@linux.microsoft.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | Carry forward IMA measurement log on kexec on ARM64 | expand |
Lakshmi Ramasubramanian <nramas@linux.microsoft.com> writes: > Any existing FDT_PROP_IMA_KEXEC_BUFFER property in the device tree > needs to be removed and its corresponding memory reservation in > the currently running kernel needs to be freed. > > The address and size of the current kernel's IMA measurement log need > to be added to the device tree's IMA kexec buffer node and memory for > the buffer needs to be reserved for the log to be carried over to > the next kernel on the kexec call. > > Remove any existing FDT_PROP_IMA_KEXEC_BUFFER property in the device > tree and free the corresponding memory reservation in the currently > running kernel. Add FDT_PROP_IMA_KEXEC_BUFFER property to the device > tree and reserve the memory for storing the IMA log. > Update CONFIG_KEXEC_FILE to select CONFIG_HAVE_IMA_KEXEC to indicate > that the IMA measurement log information is present in the device tree > for ARM64. > > Co-developed-by: Prakhar Srivastava <prsriva@linux.microsoft.com> > Signed-off-by: Prakhar Srivastava <prsriva@linux.microsoft.com> > Signed-off-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com> Reviewed-by: Thiago Jung Bauermann <bauerman@linux.ibm.com>
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index 6d232837cbee..9f03c8245e5b 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -1077,6 +1077,7 @@ config KEXEC config KEXEC_FILE bool "kexec file based system call" select KEXEC_CORE + select HAVE_IMA_KEXEC help This is new version of kexec system call. This system call is file based and takes file descriptors as system call argument diff --git a/arch/arm64/kernel/machine_kexec_file.c b/arch/arm64/kernel/machine_kexec_file.c index 361a1143e09e..66909505d959 100644 --- a/arch/arm64/kernel/machine_kexec_file.c +++ b/arch/arm64/kernel/machine_kexec_file.c @@ -21,6 +21,7 @@ #include <linux/string.h> #include <linux/types.h> #include <linux/vmalloc.h> +#include <linux/ima.h> #include <asm/byteorder.h> /* relevant device tree properties */ @@ -62,6 +63,8 @@ static int setup_dtb(struct kimage *image, off = ret; + ima_remove_kexec_buffer(dtb, ret); + ret = fdt_delprop(dtb, off, FDT_PROP_KEXEC_ELFHDR); if (ret && ret != -FDT_ERR_NOTFOUND) goto out; @@ -136,6 +139,21 @@ static int setup_dtb(struct kimage *image, FDT_PROP_KASLR_SEED); } + /* add ima-kexec-buffer */ + if (image->arch.ima_buffer_size > 0) { + ret = fdt_appendprop_addrrange(dtb, 0, off, + FDT_PROP_IMA_KEXEC_BUFFER, + image->arch.ima_buffer_addr, + image->arch.ima_buffer_size); + if (ret) + return (ret == -FDT_ERR_NOSPACE ? -ENOMEM : -EINVAL); + + ret = fdt_add_mem_rsv(dtb, image->arch.ima_buffer_addr, + image->arch.ima_buffer_size); + if (ret) + goto out; + } + /* add rng-seed */ if (rng_is_initialized()) { void *rng_seed;