From: Prakhar Srivastava <prsriva@linux.microsoft.com>
To: linux-arm-kernel@lists.infradead.org,
linux-kernel@vger.kernel.org, linuxppc-dev@lists.ozlabs.org,
devicetree@vger.kernel.org, linux-integrity@vger.kernel.org,
linux-security-module@vger.kernel.org
Cc: catalin.marinas@arm.com, will@kernel.org, mpe@ellerman.id.au,
benh@kernel.crashing.org, paulus@samba.org, robh+dt@kernel.org,
frowand.list@gmail.com, zohar@linux.ibm.com,
dmitry.kasatkin@gmail.com, jmorris@namei.org, serge@hallyn.com,
pasha.tatashin@soleen.com, allison@lohutok.net,
kstewart@linuxfoundation.org, takahiro.akashi@linaro.org,
tglx@linutronix.de, vincenzo.frascino@arm.com,
mark.rutland@arm.com, masahiroy@kernel.org, james.morse@arm.com,
bhsharma@redhat.com, mbrugger@suse.com, hsinyi@chromium.org,
tao.li@vivo.com, christophe.leroy@c-s.fr,
gregkh@linuxfoundation.org, nramas@linux.microsoft.com,
prsriva@linux.microsoft.com, tusharsu@linux.microsoft.com,
balajib@linux.microsoft.com
Subject: [RFC][PATCH 0/2] Add support for using reserved memory for ima buffer pass
Date: Mon, 4 May 2020 13:38:27 -0700 [thread overview]
Message-ID: <20200504203829.6330-1-prsriva@linux.microsoft.com> (raw)
IMA during kexec(kexec file load) verifies the kernel signature and measures
the signature of the kernel. The signature in the logs can be used to verfiy the
authenticity of the kernel. The logs don not get carried over kexec and thus
remote attesation cannot verify the signature of the running kernel.
Introduce an ABI to carry forward the ima logs over kexec.
Memory reserved via device tree reservation can be used to store and read
via the of_* functions.
Reserved memory stores the size(sizeof(size_t)) of the buffer in the starting
address, followed by the IMA log contents.
Tested on:
arm64 with Uboot
Prakhar Srivastava (2):
Add a layer of abstraction to use the memory reserved by device tree
for ima buffer pass.
Add support for ima buffer pass using reserved memory for arm64 kexec.
Update the arch sepcific code path in kexec file load to store the
ima buffer in the reserved memory. The same reserved memory is read
on kexec or cold boot.
arch/arm64/Kconfig | 1 +
arch/arm64/include/asm/ima.h | 22 ++++
arch/arm64/include/asm/kexec.h | 5 +
arch/arm64/kernel/Makefile | 1 +
arch/arm64/kernel/ima_kexec.c | 64 ++++++++++
arch/arm64/kernel/machine_kexec_file.c | 1 +
arch/powerpc/include/asm/ima.h | 3 +-
arch/powerpc/kexec/ima.c | 14 ++-
drivers/of/Kconfig | 6 +
drivers/of/Makefile | 1 +
drivers/of/of_ima.c | 165 +++++++++++++++++++++++++
include/linux/of.h | 34 +++++
security/integrity/ima/ima_kexec.c | 15 ++-
13 files changed, 325 insertions(+), 7 deletions(-)
create mode 100644 arch/arm64/include/asm/ima.h
create mode 100644 arch/arm64/kernel/ima_kexec.c
create mode 100644 drivers/of/of_ima.c
--
2.25.1
next reply other threads:[~2020-05-04 20:38 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-04 20:38 Prakhar Srivastava [this message]
2020-05-04 20:38 ` [RFC][PATCH 1/2] Add a layer of abstraction to use the memory reserved by device tree for ima buffer pass Prakhar Srivastava
2020-05-12 23:09 ` Rob Herring
2020-05-18 20:34 ` Prakhar Srivastava
2020-05-04 20:38 ` [RFC][PATCH 2/2] Add support for ima buffer pass using reserved memory arm64 Prakhar Srivastava
2020-05-05 9:59 ` [RFC][PATCH 0/2] Add support for using reserved memory for ima buffer pass Mark Rutland
2020-05-07 5:50 ` Prakhar Srivastava
2020-05-12 23:05 ` Rob Herring
2020-05-18 20:16 ` Prakhar Srivastava
2020-05-23 4:08 ` Thiago Jung Bauermann
2020-06-01 4:05 ` Prakhar Srivastava
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200504203829.6330-1-prsriva@linux.microsoft.com \
--to=prsriva@linux.microsoft.com \
--cc=allison@lohutok.net \
--cc=balajib@linux.microsoft.com \
--cc=benh@kernel.crashing.org \
--cc=bhsharma@redhat.com \
--cc=catalin.marinas@arm.com \
--cc=christophe.leroy@c-s.fr \
--cc=devicetree@vger.kernel.org \
--cc=dmitry.kasatkin@gmail.com \
--cc=frowand.list@gmail.com \
--cc=gregkh@linuxfoundation.org \
--cc=hsinyi@chromium.org \
--cc=james.morse@arm.com \
--cc=jmorris@namei.org \
--cc=kstewart@linuxfoundation.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=linuxppc-dev@lists.ozlabs.org \
--cc=mark.rutland@arm.com \
--cc=masahiroy@kernel.org \
--cc=mbrugger@suse.com \
--cc=mpe@ellerman.id.au \
--cc=nramas@linux.microsoft.com \
--cc=pasha.tatashin@soleen.com \
--cc=paulus@samba.org \
--cc=robh+dt@kernel.org \
--cc=serge@hallyn.com \
--cc=takahiro.akashi@linaro.org \
--cc=tao.li@vivo.com \
--cc=tglx@linutronix.de \
--cc=tusharsu@linux.microsoft.com \
--cc=vincenzo.frascino@arm.com \
--cc=will@kernel.org \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).