| Message ID | 20201204195149.611-9-nramas@linux.microsoft.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | Carry forward IMA measurement log on kexec on ARM64 | expand |
Lakshmi Ramasubramanian <nramas@linux.microsoft.com> writes: > Address and size of the buffer containing the IMA measurement log need > to be passed from the current kernel to the next kernel on kexec. > > Any existing "linux,ima-kexec-buffer" property in the device tree > needs to be removed and its corresponding memory reservation in > the currently running kernel needs to be freed. The address and > size of the current kernel's IMA measurement log need to be added > to the device tree's IMA kexec buffer node and memory for the buffer > needs to be reserved for the log to be carried over to the next kernel > on the kexec call. > > Add address and size fields to "struct kimage_arch" for ARM64 platform > to hold the address and size of the IMA measurement log buffer. Remove > any existing "linux,ima-kexec-buffer" property in the device tree and > free the corresponding memory reservation in the currently running > kernel. Add "linux,ima-kexec-buffer" property to the device tree and > reserve the memory for storing the IMA log that needs to be passed from > the current kernel to the next one. > > Update CONFIG_KEXEC_FILE to select CONFIG_HAVE_IMA_KEXEC to indicate > that the IMA measurement log information is present in the device tree > for ARM64. > > Co-developed-by: Prakhar Srivastava <prsriva@linux.microsoft.com> > Signed-off-by: Prakhar Srivastava <prsriva@linux.microsoft.com> > Signed-off-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com> Reviewed-by: Thiago Jung Bauermann <bauerman@linux.ibm.com> > --- > arch/arm64/Kconfig | 1 + > arch/arm64/include/asm/ima.h | 22 ++++++++++++++ > arch/arm64/include/asm/kexec.h | 5 ++++ > arch/arm64/kernel/Makefile | 1 + > arch/arm64/kernel/ima.c | 41 ++++++++++++++++++++++++++ > arch/arm64/kernel/machine_kexec_file.c | 8 +++++ > 6 files changed, 78 insertions(+) > create mode 100644 arch/arm64/include/asm/ima.h > create mode 100644 arch/arm64/kernel/ima.c > > diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig > index 1515f6f153a0..bcca4a467eda 100644 > --- a/arch/arm64/Kconfig > +++ b/arch/arm64/Kconfig > @@ -1094,6 +1094,7 @@ config KEXEC > config KEXEC_FILE > bool "kexec file based system call" > select KEXEC_CORE > + select HAVE_IMA_KEXEC > help > This is new version of kexec system call. This system call is > file based and takes file descriptors as system call argument > diff --git a/arch/arm64/include/asm/ima.h b/arch/arm64/include/asm/ima.h > new file mode 100644 > index 000000000000..354adc8b444c > --- /dev/null > +++ b/arch/arm64/include/asm/ima.h > @@ -0,0 +1,22 @@ > +/* SPDX-License-Identifier: GPL-2.0-or-later */ > +/* > + * Copyright (C) 2019 Microsoft Corporation Shouldn't the year here be 2020? > + * > + * Author: Prakhar Srivastava <prsriva@linux.microsoft.com> > + * > + */ > +#ifndef _ASM_ARCH_IMA_H > +#define _ASM_ARCH_IMA_H > + > +struct kimage; > + > +#ifdef CONFIG_IMA_KEXEC > +extern int setup_ima_buffer(struct kimage *image, void *dtb, int off); > +#else > +static inline int setup_ima_buffer(struct kimage *image, void *dtb, int off) > +{ > + return 0; > +} > +#endif /* CONFIG_IMA_KEXEC */ > + > +#endif /* _ASM_ARCH_IMA_H */ <snip> > diff --git a/arch/arm64/kernel/ima.c b/arch/arm64/kernel/ima.c > new file mode 100644 > index 000000000000..d65bdbe1adf6 > --- /dev/null > +++ b/arch/arm64/kernel/ima.c > @@ -0,0 +1,41 @@ > +// SPDX-License-Identifier: GPL-2.0-or-later > +/* > + * Copyright (C) 2016 IBM Corporation Same question: shouldn't the year here be 2020? > + * > + * Authors: > + * Lakshmi Ramasubramanian <nramas@linux.microsoft.com> > + */ > + > +#include <linux/kexec.h> > +#include <linux/of.h> > +#include <linux/libfdt.h> > +#include <asm/ima.h> > + > +/** > + * setup_ima_buffer - add IMA buffer information to the fdt > + * > + * @image: kexec image being loaded. > + * @dtb: Flattened device tree for the next kernel. > + * @off: Offset to the chosen node. > + * > + * Return: 0 on success, or negative errno on error. > + */ > +int setup_ima_buffer(struct kimage *image, void *dtb, int off) > +{ > + int ret = 0; > + > + /* add ima-kexec-buffer */ > + if (image->arch.ima_buffer_size > 0) { > + ret = fdt_appendprop_addrrange(dtb, 0, off, > + "linux,ima-kexec-buffer", > + image->arch.ima_buffer_addr, > + image->arch.ima_buffer_size); > + if (ret) > + return (ret == -FDT_ERR_NOSPACE ? -ENOMEM : -EINVAL); > + > + ret = fdt_add_mem_rsv(dtb, image->arch.ima_buffer_addr, > + image->arch.ima_buffer_size); > + } > + > + return ret; > +}
On 12/5/20 1:44 PM, Thiago Jung Bauermann wrote: > > Lakshmi Ramasubramanian <nramas@linux.microsoft.com> writes: > >> Address and size of the buffer containing the IMA measurement log need >> to be passed from the current kernel to the next kernel on kexec. >> >> Any existing "linux,ima-kexec-buffer" property in the device tree >> needs to be removed and its corresponding memory reservation in >> the currently running kernel needs to be freed. The address and >> size of the current kernel's IMA measurement log need to be added >> to the device tree's IMA kexec buffer node and memory for the buffer >> needs to be reserved for the log to be carried over to the next kernel >> on the kexec call. >> >> Add address and size fields to "struct kimage_arch" for ARM64 platform >> to hold the address and size of the IMA measurement log buffer. Remove >> any existing "linux,ima-kexec-buffer" property in the device tree and >> free the corresponding memory reservation in the currently running >> kernel. Add "linux,ima-kexec-buffer" property to the device tree and >> reserve the memory for storing the IMA log that needs to be passed from >> the current kernel to the next one. >> >> Update CONFIG_KEXEC_FILE to select CONFIG_HAVE_IMA_KEXEC to indicate >> that the IMA measurement log information is present in the device tree >> for ARM64. >> >> Co-developed-by: Prakhar Srivastava <prsriva@linux.microsoft.com> >> Signed-off-by: Prakhar Srivastava <prsriva@linux.microsoft.com> >> Signed-off-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com> > > Reviewed-by: Thiago Jung Bauermann <bauerman@linux.ibm.com> > >> --- >> arch/arm64/Kconfig | 1 + >> arch/arm64/include/asm/ima.h | 22 ++++++++++++++ >> arch/arm64/include/asm/kexec.h | 5 ++++ >> arch/arm64/kernel/Makefile | 1 + >> arch/arm64/kernel/ima.c | 41 ++++++++++++++++++++++++++ >> arch/arm64/kernel/machine_kexec_file.c | 8 +++++ >> 6 files changed, 78 insertions(+) >> create mode 100644 arch/arm64/include/asm/ima.h >> create mode 100644 arch/arm64/kernel/ima.c >> >> diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig >> index 1515f6f153a0..bcca4a467eda 100644 >> --- a/arch/arm64/Kconfig >> +++ b/arch/arm64/Kconfig >> @@ -1094,6 +1094,7 @@ config KEXEC >> config KEXEC_FILE >> bool "kexec file based system call" >> select KEXEC_CORE >> + select HAVE_IMA_KEXEC >> help >> This is new version of kexec system call. This system call is >> file based and takes file descriptors as system call argument >> diff --git a/arch/arm64/include/asm/ima.h b/arch/arm64/include/asm/ima.h >> new file mode 100644 >> index 000000000000..354adc8b444c >> --- /dev/null >> +++ b/arch/arm64/include/asm/ima.h >> @@ -0,0 +1,22 @@ >> +/* SPDX-License-Identifier: GPL-2.0-or-later */ >> +/* >> + * Copyright (C) 2019 Microsoft Corporation > > Shouldn't the year here be 2020? Yes - will update. >> + * >> + * Author: Prakhar Srivastava <prsriva@linux.microsoft.com> >> + * >> + */ >> +#ifndef _ASM_ARCH_IMA_H >> +#define _ASM_ARCH_IMA_H >> + >> +struct kimage; >> + >> +#ifdef CONFIG_IMA_KEXEC >> +extern int setup_ima_buffer(struct kimage *image, void *dtb, int off); >> +#else >> +static inline int setup_ima_buffer(struct kimage *image, void *dtb, int off) >> +{ >> + return 0; >> +} >> +#endif /* CONFIG_IMA_KEXEC */ >> + >> +#endif /* _ASM_ARCH_IMA_H */ > > <snip> > >> diff --git a/arch/arm64/kernel/ima.c b/arch/arm64/kernel/ima.c >> new file mode 100644 >> index 000000000000..d65bdbe1adf6 >> --- /dev/null >> +++ b/arch/arm64/kernel/ima.c >> @@ -0,0 +1,41 @@ >> +// SPDX-License-Identifier: GPL-2.0-or-later >> +/* >> + * Copyright (C) 2016 IBM Corporation > > Same question: shouldn't the year here be 2020? Yes. Also, should be "Copyright (C) 2020 Microsoft Corporation" Will make these changes. thanks, -lakshmi > >> + * >> + * Authors: >> + * Lakshmi Ramasubramanian <nramas@linux.microsoft.com> >> + */ >> + >> +#include <linux/kexec.h> >> +#include <linux/of.h> >> +#include <linux/libfdt.h> >> +#include <asm/ima.h> >> + >> +/** >> + * setup_ima_buffer - add IMA buffer information to the fdt >> + * >> + * @image: kexec image being loaded. >> + * @dtb: Flattened device tree for the next kernel. >> + * @off: Offset to the chosen node. >> + * >> + * Return: 0 on success, or negative errno on error. >> + */ >> +int setup_ima_buffer(struct kimage *image, void *dtb, int off) >> +{ >> + int ret = 0; >> + >> + /* add ima-kexec-buffer */ >> + if (image->arch.ima_buffer_size > 0) { >> + ret = fdt_appendprop_addrrange(dtb, 0, off, >> + "linux,ima-kexec-buffer", >> + image->arch.ima_buffer_addr, >> + image->arch.ima_buffer_size); >> + if (ret) >> + return (ret == -FDT_ERR_NOSPACE ? -ENOMEM : -EINVAL); >> + >> + ret = fdt_add_mem_rsv(dtb, image->arch.ima_buffer_addr, >> + image->arch.ima_buffer_size); >> + } >> + >> + return ret; >> +} >
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index 1515f6f153a0..bcca4a467eda 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -1094,6 +1094,7 @@ config KEXEC config KEXEC_FILE bool "kexec file based system call" select KEXEC_CORE + select HAVE_IMA_KEXEC help This is new version of kexec system call. This system call is file based and takes file descriptors as system call argument diff --git a/arch/arm64/include/asm/ima.h b/arch/arm64/include/asm/ima.h new file mode 100644 index 000000000000..354adc8b444c --- /dev/null +++ b/arch/arm64/include/asm/ima.h @@ -0,0 +1,22 @@ +/* SPDX-License-Identifier: GPL-2.0-or-later */ +/* + * Copyright (C) 2019 Microsoft Corporation + * + * Author: Prakhar Srivastava <prsriva@linux.microsoft.com> + * + */ +#ifndef _ASM_ARCH_IMA_H +#define _ASM_ARCH_IMA_H + +struct kimage; + +#ifdef CONFIG_IMA_KEXEC +extern int setup_ima_buffer(struct kimage *image, void *dtb, int off); +#else +static inline int setup_ima_buffer(struct kimage *image, void *dtb, int off) +{ + return 0; +} +#endif /* CONFIG_IMA_KEXEC */ + +#endif /* _ASM_ARCH_IMA_H */ diff --git a/arch/arm64/include/asm/kexec.h b/arch/arm64/include/asm/kexec.h index d24b527e8c00..2bd19ccb6c43 100644 --- a/arch/arm64/include/asm/kexec.h +++ b/arch/arm64/include/asm/kexec.h @@ -100,6 +100,11 @@ struct kimage_arch { void *elf_headers; unsigned long elf_headers_mem; unsigned long elf_headers_sz; + +#ifdef CONFIG_IMA_KEXEC + phys_addr_t ima_buffer_addr; + size_t ima_buffer_size; +#endif }; extern const struct kexec_file_ops kexec_image_ops; diff --git a/arch/arm64/kernel/Makefile b/arch/arm64/kernel/Makefile index bbaf0bc4ad60..da83f1b3367e 100644 --- a/arch/arm64/kernel/Makefile +++ b/arch/arm64/kernel/Makefile @@ -60,6 +60,7 @@ obj-$(CONFIG_ARM_SDE_INTERFACE) += sdei.o obj-$(CONFIG_ARM64_PTR_AUTH) += pointer_auth.o obj-$(CONFIG_SHADOW_CALL_STACK) += scs.o obj-$(CONFIG_ARM64_MTE) += mte.o +obj-$(CONFIG_IMA_KEXEC) += ima.o obj-y += vdso/ probes/ obj-$(CONFIG_COMPAT_VDSO) += vdso32/ diff --git a/arch/arm64/kernel/ima.c b/arch/arm64/kernel/ima.c new file mode 100644 index 000000000000..d65bdbe1adf6 --- /dev/null +++ b/arch/arm64/kernel/ima.c @@ -0,0 +1,41 @@ +// SPDX-License-Identifier: GPL-2.0-or-later +/* + * Copyright (C) 2016 IBM Corporation + * + * Authors: + * Lakshmi Ramasubramanian <nramas@linux.microsoft.com> + */ + +#include <linux/kexec.h> +#include <linux/of.h> +#include <linux/libfdt.h> +#include <asm/ima.h> + +/** + * setup_ima_buffer - add IMA buffer information to the fdt + * + * @image: kexec image being loaded. + * @dtb: Flattened device tree for the next kernel. + * @off: Offset to the chosen node. + * + * Return: 0 on success, or negative errno on error. + */ +int setup_ima_buffer(struct kimage *image, void *dtb, int off) +{ + int ret = 0; + + /* add ima-kexec-buffer */ + if (image->arch.ima_buffer_size > 0) { + ret = fdt_appendprop_addrrange(dtb, 0, off, + "linux,ima-kexec-buffer", + image->arch.ima_buffer_addr, + image->arch.ima_buffer_size); + if (ret) + return (ret == -FDT_ERR_NOSPACE ? -ENOMEM : -EINVAL); + + ret = fdt_add_mem_rsv(dtb, image->arch.ima_buffer_addr, + image->arch.ima_buffer_size); + } + + return ret; +} diff --git a/arch/arm64/kernel/machine_kexec_file.c b/arch/arm64/kernel/machine_kexec_file.c index 03210f644790..ca7ae1cf3c1d 100644 --- a/arch/arm64/kernel/machine_kexec_file.c +++ b/arch/arm64/kernel/machine_kexec_file.c @@ -21,7 +21,9 @@ #include <linux/string.h> #include <linux/types.h> #include <linux/vmalloc.h> +#include <linux/ima.h> #include <asm/byteorder.h> +#include <asm/ima.h> /* relevant device tree properties */ #define FDT_PROP_KEXEC_ELFHDR "linux,elfcorehdr" @@ -62,6 +64,8 @@ static int setup_dtb(struct kimage *image, off = ret; + remove_ima_buffer(dtb, ret); + ret = fdt_delprop(dtb, off, FDT_PROP_KEXEC_ELFHDR); if (ret && ret != -FDT_ERR_NOTFOUND) goto out; @@ -136,6 +140,10 @@ static int setup_dtb(struct kimage *image, FDT_PROP_KASLR_SEED); } + ret = setup_ima_buffer(image, dtb, off); + if (ret) + goto out; + /* add rng-seed */ if (rng_is_initialized()) { void *rng_seed;