All of lore.kernel.org
 help / color / mirror / Atom feed
From: Jonathan McDowell <noodles@fb.com>
To: Mimi Zohar <zohar@linux.ibm.com>
Cc: Thomas Gleixner <tglx@linutronix.de>,
	Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>,
	Dave Hansen <dave.hansen@linux.intel.com>,
	"x86@kernel.org" <x86@kernel.org>,
	"H. Peter Anvin" <hpa@zytor.com>,
	Dmitry Kasatkin <dmitry.kasatkin@gmail.com>,
	James Morris <jmorris@namei.org>,
	"Serge E. Hallyn" <serge@hallyn.com>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
	"linux-integrity@vger.kernel.org"
	<linux-integrity@vger.kernel.org>,
	"linux-security-module@vger.kernel.org" 
	<linux-security-module@vger.kernel.org>
Subject: Re: [PATCH v2] Carry forward IMA measurement log on kexec on x86_64
Date: Tue, 3 May 2022 12:02:06 +0000	[thread overview]
Message-ID: <YnEZtisrvO0AhrAz@noodles-fedora.dhcp.thefacebook.com> (raw)
In-Reply-To: <7d7fa18d396439d98e26890f647fffdc9e7d8b20.camel@linux.ibm.com>

On Fri, Apr 29, 2022 at 05:30:10PM -0400, Mimi Zohar wrote:
> > diff --git a/security/integrity/ima/ima_kexec.c b/security/integrity/ima/ima_kexec.c
> > index 13753136f03f..419c50cfe6b9 100644
> > --- a/security/integrity/ima/ima_kexec.c
> > +++ b/security/integrity/ima/ima_kexec.c
> > @@ -10,6 +10,7 @@
> >  #include <linux/seq_file.h>
> >  #include <linux/vmalloc.h>
> >  #include <linux/kexec.h>
> > +#include <linux/memblock.h>
> >  #include <linux/of.h>
> >  #include <linux/ima.h>
> >  #include "ima.h"
> > @@ -134,10 +135,66 @@ void ima_add_kexec_buffer(struct kimage *image)
> >  }
> >  #endif /* IMA_KEXEC */
> >  
> > +#ifndef CONFIG_OF
> > +static phys_addr_t ima_early_kexec_buffer_phys;
> > +static size_t ima_early_kexec_buffer_size;
> > +
> > +void __init ima_set_kexec_buffer(phys_addr_t phys_addr, size_t size)
> > +{
> > +	if (size == 0)
> > +		return;
> > +
> > +	ima_early_kexec_buffer_phys = phys_addr;
> > +	ima_early_kexec_buffer_size = size;
> > +}
> > +
> > +int __init ima_free_kexec_buffer(void)
> > +{
> > +	int rc;
> > +
> > +	if (!IS_ENABLED(CONFIG_HAVE_IMA_KEXEC))
> > +		return -ENOTSUPP;
> > +
> > +	if (ima_early_kexec_buffer_size == 0)
> > +		return -ENOENT;
> > +
> > +	rc = memblock_phys_free(ima_early_kexec_buffer_phys,
> > +				ima_early_kexec_buffer_size);
> > +	if (rc)
> > +		return rc;
> > +
> > +	ima_early_kexec_buffer_phys = 0;
> > +	ima_early_kexec_buffer_size = 0;
> > +
> > +	return 0;
> > +}
> > +
> > +int __init ima_get_kexec_buffer(void **addr, size_t *size)
> > +{
> > +	if (!IS_ENABLED(CONFIG_HAVE_IMA_KEXEC))
> > +		return -ENOTSUPP;
> > +
> > +	if (ima_early_kexec_buffer_size == 0)
> > +		return -ENOENT;
> > +
> > +	*addr = __va(ima_early_kexec_buffer_phys);
> > +	*size = ima_early_kexec_buffer_size;
> > +
> > +	return 0;
> > +}
> > +
> 
> Originally both ima_get_kexec_buffer() and ima_free_kexec_buffer() were
> architecture specific.  Refer to commit 467d27824920 ("powerpc: ima:
> get the kexec buffer passed by the previous kernel").  Is there any
> need for defining them here behind an "#ifndef CONFIG_OF"?

Commit fee3ff99bc67 (powerpc: Move arch independent ima kexec functions
to drivers/of/kexec.c) moved those functions to drivers/of/kexec.c as a
more generic implementation so that ARM64 could use them too.

I think for platforms that use device tree that's the way to go, but the
functions to generically set + get the IMA buffer for non device tree
systems were useful enough to put in the IMA code rather than being x86
specific. If you disagree I can move them under arch/x86/ (assuming the
x86 folk agree using setup_data is the right way to go, I haven't seen
any of them comment on this approach yet).

> > +#else
> > +
> > +void __init ima_set_kexec_buffer(phys_addr_t phys_addr, size_t size)
> > +{
> > +	pr_warn("CONFIG_OF enabled, ignoring call to set buffer details.\n");
> > +}
> > +#endif /* CONFIG_OF */
> > +
> 
> Only when "HAVE_IMA_KEXEC" is defined is this file included.  Why is
> this warning needed?

x86 *can* have device tree enabled, but the only platform I'm aware that
did it was OLPC and I haven't seen any of the distros enable it. I put
this in so there's a warning if we have CONFIG_OF enabled on x86 and
tried to pass the IMA log via setup_data. Can remove (or fold into the
x86 code if we go that way).

> >  /*
> >   * Restore the measurement list from the previous kernel.
> >   */
> > -void ima_load_kexec_buffer(void)
> > +void __init ima_load_kexec_buffer(void)
> >  {
> >  	void *kexec_buffer = NULL;
> >  	size_t kexec_buffer_size = 0;

J.

  reply	other threads:[~2022-05-03 12:02 UTC|newest]

Thread overview: 58+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-04-22 13:50 [PATCH] Carry forward IMA measurement log on kexec on x86_64 Jonathan McDowell
2022-04-25 16:29 ` Mimi Zohar
2022-04-26 12:08   ` Jonathan McDowell
2022-04-26 13:49     ` Mimi Zohar
2022-04-26 16:48       ` Jonathan McDowell
2022-04-26 18:10         ` Mimi Zohar
2022-04-28 10:40           ` Jonathan McDowell
2022-04-28 12:25             ` Mimi Zohar
2022-04-26 16:52 ` [PATCH v2] " Jonathan McDowell
2022-04-29 21:30   ` Mimi Zohar
2022-05-03 12:02     ` Jonathan McDowell [this message]
2022-05-04 13:49       ` Mimi Zohar
2022-05-09 10:40   ` Jonathan McDowell
2022-05-09 11:25     ` Boris Petkov
2022-05-09 17:46       ` Jonathan McDowell
2022-05-09 18:09         ` Borislav Petkov
2022-05-09 18:41           ` Jonathan McDowell
2022-05-09 19:40             ` Borislav Petkov
2022-05-10  8:02               ` Jonathan McDowell
2022-05-10 10:46   ` Borislav Petkov
2022-05-11  9:59   ` [PATCH v3] x86/kexec: Carry forward IMA measurement log on kexec Jonathan McDowell
2022-05-11 17:53     ` Mimi Zohar
2022-05-11 17:56       ` Borislav Petkov
2022-05-11 19:12         ` Mimi Zohar
2022-05-12  1:34       ` Mimi Zohar
2022-05-12 16:25     ` [PATCH v4] " Jonathan McDowell
2022-05-13 17:19       ` Lakshmi Ramasubramanian
2022-05-16 15:15         ` Jonathan McDowell
2022-05-17 17:19           ` Lakshmi Ramasubramanian
2022-05-18 10:42             ` Jonathan McDowell
2022-05-18 14:43       ` Mimi Zohar
2022-05-30  8:40         ` Jonathan McDowell
2022-06-03 15:55           ` Dave Hansen
2022-06-03 15:55             ` Dave Hansen
2022-06-06  3:54             ` Baoquan He
2022-06-06  3:54               ` Baoquan He
2022-06-06  4:06       ` Baoquan He
2022-06-10  9:52         ` Jonathan McDowell
2022-06-10  9:52           ` Jonathan McDowell
2022-06-13 10:30       ` [PATCH v5] " Jonathan McDowell
2022-06-13 10:30         ` Jonathan McDowell
2022-06-13 21:01         ` Mimi Zohar
2022-06-13 21:01           ` Mimi Zohar
2022-06-16  2:59           ` Baoquan He
2022-06-16  2:59             ` Baoquan He
2022-06-16 15:30         ` [PATCH v6] " Jonathan McDowell
2022-06-16 15:30           ` Jonathan McDowell
2022-06-30  8:36           ` [PATCH v7] " Jonathan McDowell
2022-06-30  8:36             ` Jonathan McDowell
2022-06-30 11:54             ` Mimi Zohar
2022-06-30 11:54               ` Mimi Zohar
2022-07-04  2:36             ` Baoquan He
2022-07-04  2:36               ` Baoquan He
2022-06-27 11:56 ` [tip: x86/kdump] " tip-bot2 for Jonathan McDowell
2022-07-01 14:37 ` tip-bot2 for Jonathan McDowell
2022-07-07 16:52 ` [tip: x86/boot] " tip-bot2 for Jonathan McDowell
2022-07-07 17:37   ` Jonathan McDowell
2022-07-07 17:50     ` Dave Hansen

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=YnEZtisrvO0AhrAz@noodles-fedora.dhcp.thefacebook.com \
    --to=noodles@fb.com \
    --cc=bp@alien8.de \
    --cc=dave.hansen@linux.intel.com \
    --cc=dmitry.kasatkin@gmail.com \
    --cc=hpa@zytor.com \
    --cc=jmorris@namei.org \
    --cc=linux-integrity@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=mingo@redhat.com \
    --cc=serge@hallyn.com \
    --cc=tglx@linutronix.de \
    --cc=x86@kernel.org \
    --cc=zohar@linux.ibm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.