^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) // SPDX-License-Identifier: GPL-2.0-or-later
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) * Copyright (C) 2016 IBM Corporation
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) * Authors:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6) * Thiago Jung Bauermann <bauerman@linux.vnet.ibm.com>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7) * Mimi Zohar <zohar@linux.vnet.ibm.com>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10) #include <linux/seq_file.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11) #include <linux/vmalloc.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12) #include <linux/kexec.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13) #include "ima.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15) #ifdef CONFIG_IMA_KEXEC
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16) static int ima_dump_measurement_list(unsigned long *buffer_size, void **buffer,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17) unsigned long segment_size)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19) struct ima_queue_entry *qe;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20) struct seq_file file;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21) struct ima_kexec_hdr khdr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22) int ret = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) /* segment size can't change between kexec load and execute */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) file.buf = vmalloc(segment_size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26) if (!file.buf) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27) ret = -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) file.size = segment_size;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32) file.read_pos = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33) file.count = sizeof(khdr); /* reserved space */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35) memset(&khdr, 0, sizeof(khdr));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36) khdr.version = 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37) list_for_each_entry_rcu(qe, &ima_measurements, later) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38) if (file.count < file.size) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) khdr.count++;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40) ima_measurements_show(&file, qe);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) ret = -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47) if (ret < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51) * fill in reserved space with some buffer details
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52) * (eg. version, buffer size, number of measurements)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54) khdr.buffer_size = file.count;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) if (ima_canonical_fmt) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56) khdr.version = cpu_to_le16(khdr.version);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57) khdr.count = cpu_to_le64(khdr.count);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58) khdr.buffer_size = cpu_to_le64(khdr.buffer_size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60) memcpy(file.buf, &khdr, sizeof(khdr));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62) print_hex_dump(KERN_DEBUG, "ima dump: ", DUMP_PREFIX_NONE,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63) 16, 1, file.buf,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64) file.count < 100 ? file.count : 100, true);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66) *buffer_size = file.count;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67) *buffer = file.buf;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68) out:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69) if (ret == -EINVAL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70) vfree(file.buf);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75) * Called during kexec_file_load so that IMA can add a segment to the kexec
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76) * image for the measurement list for the next kernel.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78) * This function assumes that kexec_mutex is held.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 79) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 80) void ima_add_kexec_buffer(struct kimage *image)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 81) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 82) struct kexec_buf kbuf = { .image = image, .buf_align = PAGE_SIZE,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 83) .buf_min = 0, .buf_max = ULONG_MAX,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 84) .top_down = true };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 85) unsigned long binary_runtime_size;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 86)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 87) /* use more understandable variable names than defined in kbuf */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 88) void *kexec_buffer = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 89) size_t kexec_buffer_size;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 90) size_t kexec_segment_size;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 91) int ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 92)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 93) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 94) * Reserve an extra half page of memory for additional measurements
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 95) * added during the kexec load.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 96) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 97) binary_runtime_size = ima_get_binary_runtime_size();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 98) if (binary_runtime_size >= ULONG_MAX - PAGE_SIZE)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 99) kexec_segment_size = ULONG_MAX;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101) kexec_segment_size = ALIGN(ima_get_binary_runtime_size() +
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102) PAGE_SIZE / 2, PAGE_SIZE);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103) if ((kexec_segment_size == ULONG_MAX) ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104) ((kexec_segment_size >> PAGE_SHIFT) > totalram_pages() / 2)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105) pr_err("Binary measurement list too large.\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109) ima_dump_measurement_list(&kexec_buffer_size, &kexec_buffer,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110) kexec_segment_size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111) if (!kexec_buffer) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112) pr_err("Not enough memory for the kexec measurement buffer.\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 115)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 116) kbuf.buffer = kexec_buffer;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 117) kbuf.bufsz = kexec_buffer_size;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 118) kbuf.memsz = kexec_segment_size;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 119) ret = kexec_add_buffer(&kbuf);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 120) if (ret) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 121) pr_err("Error passing over kexec measurement buffer.\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 122) vfree(kexec_buffer);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 123) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 124) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 125)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 126) ret = arch_ima_add_kexec_buffer(image, kbuf.mem, kexec_segment_size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 127) if (ret) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 128) pr_err("Error passing over kexec measurement buffer.\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 129) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 130) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 131)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 132) image->ima_buffer = kexec_buffer;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 133)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 134) pr_debug("kexec measurement buffer for the loaded kernel at 0x%lx.\n",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 135) kbuf.mem);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 136) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 137) #endif /* IMA_KEXEC */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 138)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 139) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 140) * Restore the measurement list from the previous kernel.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 141) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 142) void ima_load_kexec_buffer(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 143) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 144) void *kexec_buffer = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 145) size_t kexec_buffer_size = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 146) int rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 147)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 148) rc = ima_get_kexec_buffer(&kexec_buffer, &kexec_buffer_size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 149) switch (rc) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 150) case 0:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 151) rc = ima_restore_measurement_list(kexec_buffer_size,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 152) kexec_buffer);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 153) if (rc != 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 154) pr_err("Failed to restore the measurement list: %d\n",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 155) rc);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 156)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 157) ima_free_kexec_buffer();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 158) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 159) case -ENOTSUPP:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 160) pr_debug("Restoring the measurement list not supported\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 161) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 162) case -ENOENT:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 163) pr_debug("No measurement list to restore\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 164) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 165) default:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 166) pr_debug("Error restoring the measurement list: %d\n", rc);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 167) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 168) }
Orange Pi5 kernel
Deprecated Linux kernel 5.10.110 for OrangePi 5/5B/5+ boards
3 Commits
0 Branches
0 Tags