diff options
| author | Jonathan McDowell <noodles@fb.com> | 2022-06-30 08:36:12 +0000 |
|---|---|---|
| committer | Borislav Petkov <bp@suse.de> | 2022-07-01 15:22:16 +0200 |
| commit | b69a2afd5afce9bf6d56e349d6ab592c916e20f2 (patch) | |
| tree | 3406ca4a696ef1e6e3eab66a446ae5dfb56f1c73 /drivers/of | |
| parent | 03c765b0e3b4cb5063276b086c76f7a612856a9a (diff) | |
| download | linux-b69a2afd5afce9bf6d56e349d6ab592c916e20f2.tar.gz | |
x86/kexec: Carry forward IMA measurement log on kexec
On kexec file load, the Integrity Measurement Architecture (IMA) subsystem may verify the IMA signature of the kernel and initramfs, and measure it. The command line parameters passed to the kernel in the kexec call may also be measured by IMA. A remote attestation service can verify a TPM quote based on the TPM event log, the IMA measurement list and the TPM PCR data. This can be achieved only if the IMA measurement log is carried over from the current kernel to the next kernel across the kexec call. PowerPC and ARM64 both achieve this using device tree with a "linux,ima-kexec-buffer" node. x86 platforms generally don't make use of device tree, so use the setup_data mechanism to pass the IMA buffer to the new kernel. Signed-off-by: Jonathan McDowell <noodles@fb.com> Signed-off-by: Borislav Petkov <bp@suse.de> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> # IMA function definitions Link: https://lore.kernel.org/r/YmKyvlF3my1yWTvK@noodles-fedora-PC23Y6EG
Diffstat (limited to 'drivers/of')
| -rw-r--r-- | drivers/of/kexec.c | 13 |
1 files changed, 5 insertions, 8 deletions
diff --git a/drivers/of/kexec.c b/drivers/of/kexec.c index 8d374cc552be..f2e58ddfaed2 100644 --- a/drivers/of/kexec.c +++ b/drivers/of/kexec.c @@ -9,6 +9,7 @@ * Copyright (C) 2016 IBM Corporation */ +#include <linux/ima.h> #include <linux/kernel.h> #include <linux/kexec.h> #include <linux/memblock.h> @@ -115,6 +116,7 @@ static int do_get_kexec_buffer(const void *prop, int len, unsigned long *addr, return 0; } +#ifdef CONFIG_HAVE_IMA_KEXEC /** * ima_get_kexec_buffer - get IMA buffer from the previous kernel * @addr: On successful return, set to point to the buffer contents. @@ -122,16 +124,13 @@ static int do_get_kexec_buffer(const void *prop, int len, unsigned long *addr, * * Return: 0 on success, negative errno on error. */ -int ima_get_kexec_buffer(void **addr, size_t *size) +int __init ima_get_kexec_buffer(void **addr, size_t *size) { int ret, len; unsigned long tmp_addr; size_t tmp_size; const void *prop; - if (!IS_ENABLED(CONFIG_HAVE_IMA_KEXEC)) - return -ENOTSUPP; - prop = of_get_property(of_chosen, "linux,ima-kexec-buffer", &len); if (!prop) return -ENOENT; @@ -149,16 +148,13 @@ int ima_get_kexec_buffer(void **addr, size_t *size) /** * ima_free_kexec_buffer - free memory used by the IMA buffer */ -int ima_free_kexec_buffer(void) +int __init ima_free_kexec_buffer(void) { int ret; unsigned long addr; size_t size; struct property *prop; - if (!IS_ENABLED(CONFIG_HAVE_IMA_KEXEC)) - return -ENOTSUPP; - prop = of_find_property(of_chosen, "linux,ima-kexec-buffer", NULL); if (!prop) return -ENOENT; @@ -173,6 +169,7 @@ int ima_free_kexec_buffer(void) return memblock_phys_free(addr, size); } +#endif /** * remove_ima_buffer - remove the IMA buffer property and reservation from @fdt |