Re: [PATCH v12 0/4] Carry forward IMA measurement log on kexec on ARM64

[Lakshmi Ramasubramanian <nramas@linux.microsoft.com>]

On 12/17/20 9:37 AM, Lakshmi Ramasubramanian wrote:
> On kexec file load Integrity Measurement Architecture (IMA) subsystem
> may verify the IMA signature of the kernel and initramfs, and measure
> it. The command line parameters passed to the kernel in the kexec call
> may also be measured by IMA. A remote attestation service can verify
> a TPM quote based on the TPM event log, the IMA measurement list, and
> the TPM PCR data. This can be achieved only if the IMA measurement log
> is carried over from the current kernel to the next kernel across
> the kexec call.

Typo in the email address of James Morse (ARM.com). Sorry about that.
Adding the correct email address.

  -lakshmi

> 
> powerpc already supports carrying forward the IMA measurement log on
> kexec. This patch set adds support for carrying forward the IMA
> measurement log on kexec on ARM64.
> 
> This patch set moves the platform independent code defined for powerpc
> such that it can be reused for other platforms as well. A chosen node
> "linux,ima-kexec-buffer" is added to the DTB for ARM64 to hold
> the address and the size of the memory reserved to carry
> the IMA measurement log.
> 
> This patch set has been tested for ARM64 platform using QEMU.
> I would like help from the community for testing this change on powerpc.
> Thanks.
> 
> This patch set is based on
> commit a29a64445089 ("powerpc: Use common of_kexec_setup_new_fdt()")
> in https://git.kernel.org/pub/scm/linux/kernel/git/robh/linux.git
> "dt/kexec" branch.
>  > Changelog:
> 
> v12
>    - Use fdt_appendprop_addrrange() in setup_ima_buffer()
>      to setup the IMA measurement list property in
>      the device tree.
>    - Moved architecture independent functions from
>      "arch/powerpc/kexec/ima.c" to "drivers/of/kexec."
>    - Deleted "arch/powerpc/kexec/ima.c" and
>      "arch/powerpc/include/asm/ima.h".
> 
> v11
>    - Rebased the changes on the kexec code refactoring done by
>      Rob Herring in his "dt/kexec" branch
>    - Removed "extern" keyword in function declarations
>    - Removed unnecessary header files included in C files
>    - Updated patch descriptions per Thiago's comments
> 
> v10
>    - Moved delete_fdt_mem_rsv(), remove_ima_buffer(),
>      get_ima_kexec_buffer, and get_root_addr_size_cells()
>      to drivers/of/kexec.c
>    - Moved arch_ima_add_kexec_buffer() to
>      security/integrity/ima/ima_kexec.c
>    - Conditionally define IMA buffer fields in struct kimage_arch
> 
> v9
>    - Moved delete_fdt_mem_rsv() to drivers/of/kexec_fdt.c
>    - Defined a new function get_ima_kexec_buffer() in
>      drivers/of/ima_kexec.c to replace do_get_kexec_buffer()
>    - Changed remove_ima_kexec_buffer() to the original function name
>      remove_ima_buffer()
>    - Moved remove_ima_buffer() to drivers/of/ima_kexec.c
>    - Moved ima_get_kexec_buffer() and ima_free_kexec_buffer()
>      to security/integrity/ima/ima_kexec.c
> 
> v8:
>    - Moved remove_ima_kexec_buffer(), do_get_kexec_buffer(), and
>      delete_fdt_mem_rsv() to drivers/of/fdt.c
>    - Moved ima_dump_measurement_list() and ima_add_kexec_buffer()
>      back to security/integrity/ima/ima_kexec.c
> 
> v7:
>    - Renamed remove_ima_buffer() to remove_ima_kexec_buffer() and moved
>      this function definition to kernel.
>    - Moved delete_fdt_mem_rsv() definition to kernel
>    - Moved ima_dump_measurement_list() and ima_add_kexec_buffer() to
>      a new file namely ima_kexec_fdt.c in IMA
> 
> v6:
>    - Remove any existing FDT_PROP_IMA_KEXEC_BUFFER property in the device
>      tree and also its corresponding memory reservation in the currently
>      running kernel.
>    - Moved the function remove_ima_buffer() defined for powerpc to IMA
>      and renamed the function to ima_remove_kexec_buffer(). Also, moved
>      delete_fdt_mem_rsv() from powerpc to IMA.
> 
> v5:
>    - Merged get_addr_size_cells() and do_get_kexec_buffer() into a single
>      function when moving the arch independent code from powerpc to IMA
>    - Reverted the change to use FDT functions in powerpc code and added
>      back the original code in get_addr_size_cells() and
>      do_get_kexec_buffer() for powerpc.
>    - Added fdt_add_mem_rsv() for ARM64 to reserve the memory for
>      the IMA log buffer during kexec.
>    - Fixed the warning reported by kernel test bot for ARM64
>      arch_ima_add_kexec_buffer() - moved this function to a new file
>      namely arch/arm64/kernel/ima_kexec.c
> 
> v4:
>    - Submitting the patch series on behalf of the original author
>      Prakhar Srivastava <prsriva@linux.microsoft.com>
>    - Moved FDT_PROP_IMA_KEXEC_BUFFER ("linux,ima-kexec-buffer") to
>      libfdt.h so that it can be shared by multiple platforms.
> 
> v3:
> Breakup patches further into separate patches.
>    - Refactoring non architecture specific code out of powerpc
>    - Update powerpc related code to use fdt functions
>    - Update IMA buffer read related code to use of functions
>    - Add support to store the memory information of the IMA
>      measurement logs to be carried forward.
>    - Update the property strings to align with documented nodes
>      https://github.com/devicetree-org/dt-schema/pull/46
> 
> v2:
>    Break patches into separate patches.
>    - Powerpc related Refactoring
>    - Updating the docuemntation for chosen node
>    - Updating arm64 to support IMA buffer pass
> 
> v1:
>    Refactoring carrying over IMA measuremnet logs over Kexec. This patch
>      moves the non-architecture specific code out of powerpc and adds to
>      security/ima.(Suggested by Thiago)
>    Add Documentation regarding the ima-kexec-buffer node in the chosen
>      node documentation
> 
> v0:
>    Add a layer of abstraction to use the memory reserved by device tree
>      for ima buffer pass.
>    Add support for ima buffer pass using reserved memory for arm64 kexec.
>      Update the arch sepcific code path in kexec file load to store the
>      ima buffer in the reserved memory. The same reserved memory is read
>      on kexec or cold boot.
> 
> Lakshmi Ramasubramanian (4):
>    powerpc: Use fdt_appendprop_addrrange() to add ima buffer to FDT
>    powerpc: Move arch independent ima kexec functions to
>      drivers/of/kexec.c
>    arm64: Free DTB buffer if fdt_open_into() fails
>    arm64: Add IMA log information in kimage used for kexec
> 
>   arch/arm64/Kconfig                     |   1 +
>   arch/arm64/include/asm/kexec.h         |   5 +
>   arch/arm64/kernel/machine_kexec_file.c |   4 +-
>   arch/powerpc/include/asm/ima.h         |  30 ----
>   arch/powerpc/include/asm/kexec.h       |   1 -
>   arch/powerpc/kexec/Makefile            |   7 -
>   arch/powerpc/kexec/file_load.c         |  39 -----
>   arch/powerpc/kexec/ima.c               | 219 -------------------------
>   drivers/of/kexec.c                     | 198 ++++++++++++++++++++++
>   include/linux/of.h                     |  17 ++
>   security/integrity/ima/ima.h           |   4 -
>   security/integrity/ima/ima_kexec.c     |   2 +
>   12 files changed, 226 insertions(+), 301 deletions(-)
>   delete mode 100644 arch/powerpc/include/asm/ima.h
>   delete mode 100644 arch/powerpc/kexec/ima.c
>