From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3FB871F9F70; Thu, 12 Mar 2026 20:17:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773346655; cv=none; b=t0ad9uZh9/XCOw7YfbyQg2Gp0aZKJm55SpsDmlSaI3sbyEu+HBFi0Z2EoKiqt/PsdH8xCwlPeBd5rlEI2/VZmKkZZeUitSfrgUlUYhK6pzJ9QPKyNXQ9ruIQpmHO3nZutSsD36UZ9SbJa9/aUwY//x3584rqiFDdJE598ORhJxM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773346655; c=relaxed/simple; bh=831aHmP6TQ940U43avw1sp+fND8j8YgLDepCvh0pVLA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=N6wnYy42cso3CbdAli2PcEGTqMGs12RgALRCUqIzGOPAciV0WTUtAo8aj0doS7LWYXukOVakydIxil17faViDKbo2Bk4OzFxZws2+3CKj0Bkc6tf2sbgSSi0N/dkNGsmkhSzn/fJpXYjGyY6N5MOAetUPmbgPXLM6Mndobh6DyI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=GsilSX3w; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="GsilSX3w" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 60A8AC4CEF7; Thu, 12 Mar 2026 20:17:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1773346655; bh=831aHmP6TQ940U43avw1sp+fND8j8YgLDepCvh0pVLA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=GsilSX3wl9F7fVR1IdNUPwk6AsVekqfl4053CbZsf0VJ3MX/JcERI1fYwVp4VSH2P s1qNFR6AMtDSElDDpwQXDkvCQEe5CxN/QGb8HfX7I29kriySTs/9RiA0H3dAeQzIRi 1EgoTnb5AlxMOBt3L7MNMfeG8JzNPaY+UNlKN3N4= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Tushar Sugandhi , Eric Biederman , Baoquan He , Vivek Goyal , Dave Young , Steven Chen , Stefan Berger , Mimi Zohar , Sasha Levin Subject: [PATCH 6.12 092/265] ima: kexec: define functions to copy IMA log at soft boot Date: Thu, 12 Mar 2026 21:07:59 +0100 Message-ID: <20260312201021.549837900@linuxfoundation.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260312201018.128816016@linuxfoundation.org> References: <20260312201018.128816016@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Steven Chen [ Upstream commit f18e502db673c75f762d47101dafcf58f30e2733 ] The IMA log is currently copied to the new kernel during kexec 'load' using ima_dump_measurement_list(). However, the log copied at kexec 'load' may result in loss of IMA measurements that only occurred after kexec "load'. Setup the needed infrastructure to move the IMA log copy from kexec 'load' to 'execute'. Define a new IMA hook ima_update_kexec_buffer() as a stub function. It will be used to call ima_dump_measurement_list() during kexec 'execute'. Implement ima_kexec_post_load() function to be invoked after the new Kernel image has been loaded for kexec. ima_kexec_post_load() maps the IMA buffer to a segment in the newly loaded Kernel. It also registers the reboot notifier_block to trigger ima_update_kexec_buffer() at kexec 'execute'. Set the priority of register_reboot_notifier to INT_MIN to ensure that the IMA log copy operation will happen at the end of the operation chain, so that all the IMA measurement records extended into the TPM are copied Co-developed-by: Tushar Sugandhi Signed-off-by: Tushar Sugandhi Cc: Eric Biederman Cc: Baoquan He Cc: Vivek Goyal Cc: Dave Young Signed-off-by: Steven Chen Reviewed-by: Stefan Berger Acked-by: Baoquan He Tested-by: Stefan Berger # ppc64/kvm Signed-off-by: Mimi Zohar Stable-dep-of: 10d1c75ed438 ("ima: verify the previous kernel's IMA buffer lies in addressable RAM") Signed-off-by: Sasha Levin --- include/linux/ima.h | 3 ++ security/integrity/ima/ima_kexec.c | 47 ++++++++++++++++++++++++++++++ 2 files changed, 50 insertions(+) diff --git a/include/linux/ima.h b/include/linux/ima.h index 0bae61a15b60b..8e29cb4e6a01d 100644 --- a/include/linux/ima.h +++ b/include/linux/ima.h @@ -32,6 +32,9 @@ static inline void ima_appraise_parse_cmdline(void) {} #ifdef CONFIG_IMA_KEXEC extern void ima_add_kexec_buffer(struct kimage *image); +extern void ima_kexec_post_load(struct kimage *image); +#else +static inline void ima_kexec_post_load(struct kimage *image) {} #endif #else diff --git a/security/integrity/ima/ima_kexec.c b/security/integrity/ima/ima_kexec.c index b12ac3619b8fd..a22eeac9320aa 100644 --- a/security/integrity/ima/ima_kexec.c +++ b/security/integrity/ima/ima_kexec.c @@ -12,10 +12,14 @@ #include #include #include +#include +#include #include "ima.h" #ifdef CONFIG_IMA_KEXEC +static bool ima_kexec_update_registered; static struct seq_file ima_kexec_file; +static void *ima_kexec_buffer; static void ima_free_kexec_file_buf(struct seq_file *sf) { @@ -159,6 +163,49 @@ void ima_add_kexec_buffer(struct kimage *image) kexec_dprintk("kexec measurement buffer for the loaded kernel at 0x%lx.\n", kbuf.mem); } + +/* + * Called during kexec execute so that IMA can update the measurement list. + */ +static int ima_update_kexec_buffer(struct notifier_block *self, + unsigned long action, void *data) +{ + return NOTIFY_OK; +} + +static struct notifier_block update_buffer_nb = { + .notifier_call = ima_update_kexec_buffer, + .priority = INT_MIN +}; + +/* + * Create a mapping for the source pages that contain the IMA buffer + * so we can update it later. + */ +void ima_kexec_post_load(struct kimage *image) +{ + if (ima_kexec_buffer) { + kimage_unmap_segment(ima_kexec_buffer); + ima_kexec_buffer = NULL; + } + + if (!image->ima_buffer_addr) + return; + + ima_kexec_buffer = kimage_map_segment(image, + image->ima_buffer_addr, + image->ima_buffer_size); + if (!ima_kexec_buffer) { + pr_err("Could not map measurements buffer.\n"); + return; + } + + if (!ima_kexec_update_registered) { + register_reboot_notifier(&update_buffer_nb); + ima_kexec_update_registered = true; + } +} + #endif /* IMA_KEXEC */ /* -- 2.51.0