cachepc-linux

Fork of AMDESE/linux with modifications for CachePC side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-linux
Log | Files | Refs | README | LICENSE | sfeed.txt

ima_kexec.c (4145B)

      1// SPDX-License-Identifier: GPL-2.0-or-later
      2/*
      3 * Copyright (C) 2016 IBM Corporation
      4 *
      5 * Authors:
      6 * Thiago Jung Bauermann <bauerman@linux.vnet.ibm.com>
      7 * Mimi Zohar <zohar@linux.vnet.ibm.com>
      8 */
      9
     10#include <linux/seq_file.h>
     11#include <linux/vmalloc.h>
     12#include <linux/kexec.h>
     13#include <linux/of.h>
     14#include <linux/ima.h>
     15#include "ima.h"
     16
     17#ifdef CONFIG_IMA_KEXEC
     18static int ima_dump_measurement_list(unsigned long *buffer_size, void **buffer,
     19				     unsigned long segment_size)
     20{
     21	struct ima_queue_entry *qe;
     22	struct seq_file file;
     23	struct ima_kexec_hdr khdr;
     24	int ret = 0;
     25
     26	/* segment size can't change between kexec load and execute */
     27	file.buf = vmalloc(segment_size);
     28	if (!file.buf) {
     29		ret = -ENOMEM;
     30		goto out;
     31	}
     32
     33	file.size = segment_size;
     34	file.read_pos = 0;
     35	file.count = sizeof(khdr);	/* reserved space */
     36
     37	memset(&khdr, 0, sizeof(khdr));
     38	khdr.version = 1;
     39	list_for_each_entry_rcu(qe, &ima_measurements, later) {
     40		if (file.count < file.size) {
     41			khdr.count++;
     42			ima_measurements_show(&file, qe);
     43		} else {
     44			ret = -EINVAL;
     45			break;
     46		}
     47	}
     48
     49	if (ret < 0)
     50		goto out;
     51
     52	/*
     53	 * fill in reserved space with some buffer details
     54	 * (eg. version, buffer size, number of measurements)
     55	 */
     56	khdr.buffer_size = file.count;
     57	if (ima_canonical_fmt) {
     58		khdr.version = cpu_to_le16(khdr.version);
     59		khdr.count = cpu_to_le64(khdr.count);
     60		khdr.buffer_size = cpu_to_le64(khdr.buffer_size);
     61	}
     62	memcpy(file.buf, &khdr, sizeof(khdr));
     63
     64	print_hex_dump_debug("ima dump: ", DUMP_PREFIX_NONE, 16, 1,
     65			     file.buf, file.count < 100 ? file.count : 100,
     66			     true);
     67
     68	*buffer_size = file.count;
     69	*buffer = file.buf;
     70out:
     71	if (ret == -EINVAL)
     72		vfree(file.buf);
     73	return ret;
     74}
     75
     76/*
     77 * Called during kexec_file_load so that IMA can add a segment to the kexec
     78 * image for the measurement list for the next kernel.
     79 *
     80 * This function assumes that kexec_mutex is held.
     81 */
     82void ima_add_kexec_buffer(struct kimage *image)
     83{
     84	struct kexec_buf kbuf = { .image = image, .buf_align = PAGE_SIZE,
     85				  .buf_min = 0, .buf_max = ULONG_MAX,
     86				  .top_down = true };
     87	unsigned long binary_runtime_size;
     88
     89	/* use more understandable variable names than defined in kbuf */
     90	void *kexec_buffer = NULL;
     91	size_t kexec_buffer_size;
     92	size_t kexec_segment_size;
     93	int ret;
     94
     95	/*
     96	 * Reserve an extra half page of memory for additional measurements
     97	 * added during the kexec load.
     98	 */
     99	binary_runtime_size = ima_get_binary_runtime_size();
    100	if (binary_runtime_size >= ULONG_MAX - PAGE_SIZE)
    101		kexec_segment_size = ULONG_MAX;
    102	else
    103		kexec_segment_size = ALIGN(ima_get_binary_runtime_size() +
    104					   PAGE_SIZE / 2, PAGE_SIZE);
    105	if ((kexec_segment_size == ULONG_MAX) ||
    106	    ((kexec_segment_size >> PAGE_SHIFT) > totalram_pages() / 2)) {
    107		pr_err("Binary measurement list too large.\n");
    108		return;
    109	}
    110
    111	ima_dump_measurement_list(&kexec_buffer_size, &kexec_buffer,
    112				  kexec_segment_size);
    113	if (!kexec_buffer) {
    114		pr_err("Not enough memory for the kexec measurement buffer.\n");
    115		return;
    116	}
    117
    118	kbuf.buffer = kexec_buffer;
    119	kbuf.bufsz = kexec_buffer_size;
    120	kbuf.memsz = kexec_segment_size;
    121	ret = kexec_add_buffer(&kbuf);
    122	if (ret) {
    123		pr_err("Error passing over kexec measurement buffer.\n");
    124		vfree(kexec_buffer);
    125		return;
    126	}
    127
    128	image->ima_buffer_addr = kbuf.mem;
    129	image->ima_buffer_size = kexec_segment_size;
    130	image->ima_buffer = kexec_buffer;
    131
    132	pr_debug("kexec measurement buffer for the loaded kernel at 0x%lx.\n",
    133		 kbuf.mem);
    134}
    135#endif /* IMA_KEXEC */
    136
    137/*
    138 * Restore the measurement list from the previous kernel.
    139 */
    140void ima_load_kexec_buffer(void)
    141{
    142	void *kexec_buffer = NULL;
    143	size_t kexec_buffer_size = 0;
    144	int rc;
    145
    146	rc = ima_get_kexec_buffer(&kexec_buffer, &kexec_buffer_size);
    147	switch (rc) {
    148	case 0:
    149		rc = ima_restore_measurement_list(kexec_buffer_size,
    150						  kexec_buffer);
    151		if (rc != 0)
    152			pr_err("Failed to restore the measurement list: %d\n",
    153				rc);
    154
    155		ima_free_kexec_buffer();
    156		break;
    157	case -ENOTSUPP:
    158		pr_debug("Restoring the measurement list not supported\n");
    159		break;
    160	case -ENOENT:
    161		pr_debug("No measurement list to restore\n");
    162		break;
    163	default:
    164		pr_debug("Error restoring the measurement list: %d\n", rc);
    165	}
    166}