From: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
To: zohar@linux.ibm.com, bauerman@linux.ibm.com, robh@kernel.org,
gregkh@linuxfoundation.org, james.morse@arm.com,
catalin.marinas@arm.com, sashal@kernel.org, will@kernel.org,
mpe@ellerman.id.au, benh@kernel.crashing.org, paulus@samba.org,
robh+dt@kernel.org, frowand.list@gmail.com,
vincenzo.frascino@arm.com, mark.rutland@arm.com,
dmitry.kasatkin@gmail.com, jmorris@namei.org, serge@hallyn.com,
pasha.tatashin@soleen.com, allison@lohutok.net,
kstewart@linuxfoundation.org, takahiro.akashi@linaro.org,
tglx@linutronix.de, masahiroy@kernel.org, bhsharma@redhat.com,
mbrugger@suse.com, hsinyi@chromium.org, tao.li@vivo.com,
christophe.leroy@c-s.fr
Cc: linux-integrity@vger.kernel.org, linux-kernel@vger.kernel.org,
devicetree@vger.kernel.org, prsriva@linux.microsoft.com,
balajib@linux.microsoft.com
Subject: [PATCH v6 3/3] arm64: Add IMA kexec buffer to DTB
Date: Tue, 8 Sep 2020 16:08:56 -0700 [thread overview]
Message-ID: <20200908230856.9799-4-nramas@linux.microsoft.com> (raw)
In-Reply-To: <20200908230856.9799-1-nramas@linux.microsoft.com>
Any existing FDT_PROP_IMA_KEXEC_BUFFER property in the device tree
needs to be removed and its corresponding memory reservation in
the currently running kernel needs to be freed.
The address and size of the current kernel's IMA measurement log need
to be added to the device tree's IMA kexec buffer node and memory for
the buffer needs to be reserved for the log to be carried over to
the next kernel on the kexec call.
Remove any existing FDT_PROP_IMA_KEXEC_BUFFER property in the device
tree and free the corresponding memory reservation in the currently
running kernel. Add FDT_PROP_IMA_KEXEC_BUFFER property to the device
tree and reserve the memory for storing the IMA log.
Update CONFIG_KEXEC_FILE to select CONFIG_HAVE_IMA_KEXEC to indicate
that the IMA measurement log information is present in the device tree
for ARM64.
Co-developed-by: Prakhar Srivastava <prsriva@linux.microsoft.com>
Signed-off-by: Prakhar Srivastava <prsriva@linux.microsoft.com>
Signed-off-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
---
arch/arm64/Kconfig | 1 +
arch/arm64/kernel/machine_kexec_file.c | 18 ++++++++++++++++++
2 files changed, 19 insertions(+)
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index 6d232837cbee..9f03c8245e5b 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -1077,6 +1077,7 @@ config KEXEC
config KEXEC_FILE
bool "kexec file based system call"
select KEXEC_CORE
+ select HAVE_IMA_KEXEC
help
This is new version of kexec system call. This system call is
file based and takes file descriptors as system call argument
diff --git a/arch/arm64/kernel/machine_kexec_file.c b/arch/arm64/kernel/machine_kexec_file.c
index 361a1143e09e..66909505d959 100644
--- a/arch/arm64/kernel/machine_kexec_file.c
+++ b/arch/arm64/kernel/machine_kexec_file.c
@@ -21,6 +21,7 @@
#include <linux/string.h>
#include <linux/types.h>
#include <linux/vmalloc.h>
+#include <linux/ima.h>
#include <asm/byteorder.h>
/* relevant device tree properties */
@@ -62,6 +63,8 @@ static int setup_dtb(struct kimage *image,
off = ret;
+ ima_remove_kexec_buffer(dtb, ret);
+
ret = fdt_delprop(dtb, off, FDT_PROP_KEXEC_ELFHDR);
if (ret && ret != -FDT_ERR_NOTFOUND)
goto out;
@@ -136,6 +139,21 @@ static int setup_dtb(struct kimage *image,
FDT_PROP_KASLR_SEED);
}
+ /* add ima-kexec-buffer */
+ if (image->arch.ima_buffer_size > 0) {
+ ret = fdt_appendprop_addrrange(dtb, 0, off,
+ FDT_PROP_IMA_KEXEC_BUFFER,
+ image->arch.ima_buffer_addr,
+ image->arch.ima_buffer_size);
+ if (ret)
+ return (ret == -FDT_ERR_NOSPACE ? -ENOMEM : -EINVAL);
+
+ ret = fdt_add_mem_rsv(dtb, image->arch.ima_buffer_addr,
+ image->arch.ima_buffer_size);
+ if (ret)
+ goto out;
+ }
+
/* add rng-seed */
if (rng_is_initialized()) {
void *rng_seed;
--
2.28.0
next prev parent reply other threads:[~2020-09-08 23:09 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-09-08 23:08 [PATCH v6 0/3] Carry forward IMA measurement log on kexec on ARM64 Lakshmi Ramasubramanian
2020-09-08 23:08 ` [PATCH v6 1/3] powerpc: Refactor kexec functions to move arch independent code to IMA Lakshmi Ramasubramanian
2020-09-09 5:48 ` kernel test robot
2020-09-09 7:09 ` kernel test robot
2020-09-09 7:31 ` kernel test robot
2020-09-12 3:18 ` Thiago Jung Bauermann
2020-09-08 23:08 ` [PATCH v6 2/3] arm64: Store IMA log information in kimage used for kexec Lakshmi Ramasubramanian
2020-09-08 23:08 ` Lakshmi Ramasubramanian [this message]
2020-09-12 3:23 ` [PATCH v6 3/3] arm64: Add IMA kexec buffer to DTB Thiago Jung Bauermann
2020-09-23 20:03 ` [PATCH v6 0/3] Carry forward IMA measurement log on kexec on ARM64 Mimi Zohar
2020-09-23 20:03 ` Mimi Zohar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200908230856.9799-4-nramas@linux.microsoft.com \
--to=nramas@linux.microsoft.com \
--cc=allison@lohutok.net \
--cc=balajib@linux.microsoft.com \
--cc=bauerman@linux.ibm.com \
--cc=benh@kernel.crashing.org \
--cc=bhsharma@redhat.com \
--cc=catalin.marinas@arm.com \
--cc=christophe.leroy@c-s.fr \
--cc=devicetree@vger.kernel.org \
--cc=dmitry.kasatkin@gmail.com \
--cc=frowand.list@gmail.com \
--cc=gregkh@linuxfoundation.org \
--cc=hsinyi@chromium.org \
--cc=james.morse@arm.com \
--cc=jmorris@namei.org \
--cc=kstewart@linuxfoundation.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mark.rutland@arm.com \
--cc=masahiroy@kernel.org \
--cc=mbrugger@suse.com \
--cc=mpe@ellerman.id.au \
--cc=pasha.tatashin@soleen.com \
--cc=paulus@samba.org \
--cc=prsriva@linux.microsoft.com \
--cc=robh+dt@kernel.org \
--cc=robh@kernel.org \
--cc=sashal@kernel.org \
--cc=serge@hallyn.com \
--cc=takahiro.akashi@linaro.org \
--cc=tao.li@vivo.com \
--cc=tglx@linutronix.de \
--cc=vincenzo.frascino@arm.com \
--cc=will@kernel.org \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.