| Message ID | 20200819172134.11243-6-nramas@linux.microsoft.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | Carry forward IMA measurement log on kexec on ARM64 | expand |
Lakshmi Ramasubramanian <nramas@linux.microsoft.com> writes: > The address and size of the current kernel's IMA measurement log > need to be added to the device tree's IMA kexec buffer node for > the log to be carried over to the next kernel on the kexec call. > > Add the IMA measurement log buffer properties to the device tree for > ARM64. Update CONFIG_KEXEC_FILE to select CONFIG_HAVE_IMA_KEXEC to > indicate that the IMA measurement log information is present in > the device tree. > > Co-developed-by: Prakhar Srivastava <prsriva@linux.microsoft.com> > Signed-off-by: Prakhar Srivastava <prsriva@linux.microsoft.com> > Signed-off-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com> > --- > arch/arm64/Kconfig | 1 + > arch/arm64/kernel/machine_kexec_file.c | 11 +++++++++++ > 2 files changed, 12 insertions(+) > > diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig > index 6d232837cbee..9f03c8245e5b 100644 > --- a/arch/arm64/Kconfig > +++ b/arch/arm64/Kconfig > @@ -1077,6 +1077,7 @@ config KEXEC > config KEXEC_FILE > bool "kexec file based system call" > select KEXEC_CORE > + select HAVE_IMA_KEXEC > help > This is new version of kexec system call. This system call is > file based and takes file descriptors as system call argument > diff --git a/arch/arm64/kernel/machine_kexec_file.c b/arch/arm64/kernel/machine_kexec_file.c > index 4c54723e7a04..8488f8e87d1a 100644 > --- a/arch/arm64/kernel/machine_kexec_file.c > +++ b/arch/arm64/kernel/machine_kexec_file.c > @@ -153,6 +153,17 @@ static int setup_dtb(struct kimage *image, > FDT_PROP_KASLR_SEED); > } > > + /* add ima-kexec-buffer */ > + if (image->arch.ima_buffer_size > 0) { > + > + ret = fdt_appendprop_addrrange(dtb, 0, off, > + FDT_PROP_IMA_KEXEC_BUFFER, > + image->arch.ima_buffer_addr, > + image->arch.ima_buffer_size); > + if (ret) > + return (ret == -FDT_ERR_NOSPACE ? -ENOMEM : -EINVAL); > + } > + > /* add rng-seed */ > if (rng_is_initialized()) { > void *rng_seed; I believe you need to add a memory reservation to the dtb covering the IMA kexec buffer, otherwise nothing stops the new kernel from stomping over it. E.g., powerpc does: ret = fdt_add_mem_rsv(fdt, image->arch.ima_buffer_addr, image->arch.ima_buffer_size);
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index 6d232837cbee..9f03c8245e5b 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -1077,6 +1077,7 @@ config KEXEC config KEXEC_FILE bool "kexec file based system call" select KEXEC_CORE + select HAVE_IMA_KEXEC help This is new version of kexec system call. This system call is file based and takes file descriptors as system call argument diff --git a/arch/arm64/kernel/machine_kexec_file.c b/arch/arm64/kernel/machine_kexec_file.c index 4c54723e7a04..8488f8e87d1a 100644 --- a/arch/arm64/kernel/machine_kexec_file.c +++ b/arch/arm64/kernel/machine_kexec_file.c @@ -153,6 +153,17 @@ static int setup_dtb(struct kimage *image, FDT_PROP_KASLR_SEED); } + /* add ima-kexec-buffer */ + if (image->arch.ima_buffer_size > 0) { + + ret = fdt_appendprop_addrrange(dtb, 0, off, + FDT_PROP_IMA_KEXEC_BUFFER, + image->arch.ima_buffer_addr, + image->arch.ima_buffer_size); + if (ret) + return (ret == -FDT_ERR_NOSPACE ? -ENOMEM : -EINVAL); + } + /* add rng-seed */ if (rng_is_initialized()) { void *rng_seed;