All of lore.kernel.org
 help / color / mirror / Atom feed
From: Tushar Sugandhi <tusharsu@linux.microsoft.com>
To: zohar@linux.ibm.com, noodles@fb.com, bauermann@kolabnow.com,
	kexec@lists.infradead.org, linux-integrity@vger.kernel.org
Cc: code@tyhicks.com, nramas@linux.microsoft.com, paul@paul-moore.com
Subject: [PATCH 10/10] kexec: update kexec_file_load syscall to call ima_kexec_post_load
Date: Mon,  3 Jul 2023 14:57:09 -0700	[thread overview]
Message-ID: <20230703215709.1195644-11-tusharsu@linux.microsoft.com> (raw)
In-Reply-To: <20230703215709.1195644-1-tusharsu@linux.microsoft.com>

The kexec_file_load syscall is used to load a new kernel for kexec.
The syscall needs to update its function to call ima_kexec_post_load, which
was implemented in a previous patch.  ima_kexec_post_load takes care of
mapping the measurement list for the next kernel and registering a reboot
notifier if it's not already registered.

Modify the kexec_file_load syscall to call ima_kexec_post_load after the
image has been loaded and prepared for kexec.  This ensures that the IMA
measurement list will be available to the next kernel after a kexec reboot.
This also ensures the measurements taken in the window between kexec load
and execute are captured and passed to the next kernel. 

Declare the kimage_file_post_load function in the kernel/kexec_internal.h, 
so it can be properly used in the syscall.

Signed-off-by: Tushar Sugandhi <tusharsu@linux.microsoft.com>
---
 kernel/kexec_file.c     | 7 +++++++
 kernel/kexec_internal.h | 1 +
 2 files changed, 8 insertions(+)

diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
index f989f5f1933b..efe28e77280c 100644
--- a/kernel/kexec_file.c
+++ b/kernel/kexec_file.c
@@ -184,6 +184,11 @@ kimage_validate_signature(struct kimage *image)
 }
 #endif
 
+void kimage_file_post_load(struct kimage *image)
+{
+	ima_kexec_post_load(image);
+}
+
 /*
  * In file mode list of segments is prepared by kernel. Copy relevant
  * data from user space, do error checking, prepare segment list
@@ -399,6 +404,8 @@ SYSCALL_DEFINE5(kexec_file_load, int, kernel_fd, int, initrd_fd,
 
 	kimage_terminate(image);
 
+	kimage_file_post_load(image);
+
 	ret = machine_kexec_post_load(image);
 	if (ret)
 		goto out;
diff --git a/kernel/kexec_internal.h b/kernel/kexec_internal.h
index 74da1409cd14..98dd5fcafaf0 100644
--- a/kernel/kexec_internal.h
+++ b/kernel/kexec_internal.h
@@ -30,6 +30,7 @@ static inline void kexec_unlock(void)
 
 #ifdef CONFIG_KEXEC_FILE
 #include <linux/purgatory.h>
+void kimage_file_post_load(struct kimage *image);
 void kimage_file_post_load_cleanup(struct kimage *image);
 extern char kexec_purgatory[];
 extern size_t kexec_purgatory_size;
-- 
2.25.1


WARNING: multiple messages have this Message-ID (diff)
From: Tushar Sugandhi <tusharsu@linux.microsoft.com>
To: zohar@linux.ibm.com, noodles@fb.com, bauermann@kolabnow.com,
	kexec@lists.infradead.org, linux-integrity@vger.kernel.org
Cc: code@tyhicks.com, nramas@linux.microsoft.com, paul@paul-moore.com
Subject: [PATCH 10/10] kexec: update kexec_file_load syscall to call ima_kexec_post_load
Date: Mon,  3 Jul 2023 14:57:09 -0700	[thread overview]
Message-ID: <20230703215709.1195644-11-tusharsu@linux.microsoft.com> (raw)
In-Reply-To: <20230703215709.1195644-1-tusharsu@linux.microsoft.com>

The kexec_file_load syscall is used to load a new kernel for kexec.
The syscall needs to update its function to call ima_kexec_post_load, which
was implemented in a previous patch.  ima_kexec_post_load takes care of
mapping the measurement list for the next kernel and registering a reboot
notifier if it's not already registered.

Modify the kexec_file_load syscall to call ima_kexec_post_load after the
image has been loaded and prepared for kexec.  This ensures that the IMA
measurement list will be available to the next kernel after a kexec reboot.
This also ensures the measurements taken in the window between kexec load
and execute are captured and passed to the next kernel. 

Declare the kimage_file_post_load function in the kernel/kexec_internal.h, 
so it can be properly used in the syscall.

Signed-off-by: Tushar Sugandhi <tusharsu@linux.microsoft.com>
---
 kernel/kexec_file.c     | 7 +++++++
 kernel/kexec_internal.h | 1 +
 2 files changed, 8 insertions(+)

diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
index f989f5f1933b..efe28e77280c 100644
--- a/kernel/kexec_file.c
+++ b/kernel/kexec_file.c
@@ -184,6 +184,11 @@ kimage_validate_signature(struct kimage *image)
 }
 #endif
 
+void kimage_file_post_load(struct kimage *image)
+{
+	ima_kexec_post_load(image);
+}
+
 /*
  * In file mode list of segments is prepared by kernel. Copy relevant
  * data from user space, do error checking, prepare segment list
@@ -399,6 +404,8 @@ SYSCALL_DEFINE5(kexec_file_load, int, kernel_fd, int, initrd_fd,
 
 	kimage_terminate(image);
 
+	kimage_file_post_load(image);
+
 	ret = machine_kexec_post_load(image);
 	if (ret)
 		goto out;
diff --git a/kernel/kexec_internal.h b/kernel/kexec_internal.h
index 74da1409cd14..98dd5fcafaf0 100644
--- a/kernel/kexec_internal.h
+++ b/kernel/kexec_internal.h
@@ -30,6 +30,7 @@ static inline void kexec_unlock(void)
 
 #ifdef CONFIG_KEXEC_FILE
 #include <linux/purgatory.h>
+void kimage_file_post_load(struct kimage *image);
 void kimage_file_post_load_cleanup(struct kimage *image);
 extern char kexec_purgatory[];
 extern size_t kexec_purgatory_size;
-- 
2.25.1


_______________________________________________
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec

  parent reply	other threads:[~2023-07-03 21:57 UTC|newest]

Thread overview: 82+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-07-03 21:56 [PATCH 00/10] ima: measure events between kexec load and execute Tushar Sugandhi
2023-07-03 21:56 ` Tushar Sugandhi
2023-07-03 21:57 ` [PATCH 01/10] ima: implement function to allocate buffer at kexec load Tushar Sugandhi
2023-07-03 21:57   ` Tushar Sugandhi
2023-07-07 13:00   ` Mimi Zohar
2023-07-07 13:00     ` Mimi Zohar
2023-07-11 17:59     ` Tushar Sugandhi
2023-07-11 17:59       ` Tushar Sugandhi
2023-07-11 21:11       ` Mimi Zohar
2023-07-11 21:11         ` Mimi Zohar
2023-07-12 19:49         ` Tushar Sugandhi
2023-07-12 19:49           ` Tushar Sugandhi
2023-07-03 21:57 ` [PATCH 02/10] ima: implement function to populate buffer at kexec execute Tushar Sugandhi
2023-07-03 21:57   ` Tushar Sugandhi
2023-07-07 13:00   ` Mimi Zohar
2023-07-07 13:00     ` Mimi Zohar
2023-07-11 18:05     ` Tushar Sugandhi
2023-07-11 18:05       ` Tushar Sugandhi
2023-07-03 21:57 ` [PATCH 03/10] ima: allocate buffer at kexec load to hold ima measurements Tushar Sugandhi
2023-07-03 21:57   ` Tushar Sugandhi
2023-07-07 13:01   ` Mimi Zohar
2023-07-07 13:01     ` Mimi Zohar
2023-07-11 18:31     ` Tushar Sugandhi
2023-07-11 18:31       ` Tushar Sugandhi
2023-07-11 20:16   ` Stefan Berger
2023-07-11 20:16     ` Stefan Berger
2023-07-12 19:39     ` Tushar Sugandhi
2023-07-12 19:39       ` Tushar Sugandhi
2023-07-03 21:57 ` [PATCH 04/10] ima: implement functions to suspend and resume measurements Tushar Sugandhi
2023-07-03 21:57   ` Tushar Sugandhi
2023-07-03 21:57 ` [PATCH 05/10] kexec: implement functions to map and unmap segment to kimage Tushar Sugandhi
2023-07-03 21:57   ` Tushar Sugandhi
2023-07-07 12:28   ` Stefan Berger
2023-07-07 12:28     ` Stefan Berger
2023-07-11 18:41     ` Tushar Sugandhi
2023-07-11 18:41       ` Tushar Sugandhi
2023-07-11 19:19       ` Stefan Berger
2023-07-11 19:19         ` Stefan Berger
2023-07-12 19:51         ` Tushar Sugandhi
2023-07-12 19:51           ` Tushar Sugandhi
2023-07-03 21:57 ` [PATCH 06/10] ima: update buffer at kexec execute with ima measurements Tushar Sugandhi
2023-07-03 21:57   ` Tushar Sugandhi
2023-07-07 15:01   ` Mimi Zohar
2023-07-07 15:01     ` Mimi Zohar
2023-07-07 19:49     ` Mimi Zohar
2023-07-07 19:49       ` Mimi Zohar
2023-07-11 19:08       ` Tushar Sugandhi
2023-07-11 19:08         ` Tushar Sugandhi
2023-07-12 15:45         ` Mimi Zohar
2023-07-12 15:45           ` Mimi Zohar
2023-07-11 19:05     ` Tushar Sugandhi
2023-07-11 19:05       ` Tushar Sugandhi
2023-07-03 21:57 ` [PATCH 07/10] ima: remove function ima_dump_measurement_list Tushar Sugandhi
2023-07-03 21:57   ` Tushar Sugandhi
2023-07-07 13:55   ` Mimi Zohar
2023-07-07 13:55     ` Mimi Zohar
2023-07-11 19:11     ` Tushar Sugandhi
2023-07-11 19:11       ` Tushar Sugandhi
2023-07-03 21:57 ` [PATCH 08/10] ima: implement and register a reboot notifier function to update kexec buffer Tushar Sugandhi
2023-07-03 21:57   ` Tushar Sugandhi
2023-07-03 21:57 ` [PATCH 09/10] ima: suspend measurements while the kexec buffer is being copied Tushar Sugandhi
2023-07-03 21:57   ` Tushar Sugandhi
2023-07-03 21:57 ` Tushar Sugandhi [this message]
2023-07-03 21:57   ` [PATCH 10/10] kexec: update kexec_file_load syscall to call ima_kexec_post_load Tushar Sugandhi
2023-07-07  8:20   ` RuiRui Yang
2023-07-07  8:20     ` RuiRui Yang
2023-07-11 19:14     ` Tushar Sugandhi
2023-07-11 19:14       ` Tushar Sugandhi
2023-07-12  1:28       ` RuiRui Yang
2023-07-12  1:28         ` RuiRui Yang
2023-07-12 19:30         ` Tushar Sugandhi
2023-07-12 19:30           ` Tushar Sugandhi
2023-07-07  8:18 ` [PATCH 00/10] ima: measure events between kexec load and execute Dave Young
2023-07-07  8:18   ` Dave Young
2023-07-11 17:52   ` Tushar Sugandhi
2023-07-11 17:52     ` Tushar Sugandhi
2023-07-07 15:55 ` Mimi Zohar
2023-07-07 15:55   ` Mimi Zohar
2023-07-11 17:51   ` Tushar Sugandhi
2023-07-11 17:51     ` Tushar Sugandhi
2023-09-22 18:59     ` Tushar Sugandhi
2023-09-22 18:59       ` Tushar Sugandhi

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20230703215709.1195644-11-tusharsu@linux.microsoft.com \
    --to=tusharsu@linux.microsoft.com \
    --cc=bauermann@kolabnow.com \
    --cc=code@tyhicks.com \
    --cc=kexec@lists.infradead.org \
    --cc=linux-integrity@vger.kernel.org \
    --cc=noodles@fb.com \
    --cc=nramas@linux.microsoft.com \
    --cc=paul@paul-moore.com \
    --cc=zohar@linux.ibm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.