1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright (C) 2016 IBM Corporation
4 *
5 * Authors:
6 * Thiago Jung Bauermann <[email protected]>
7 * Mimi Zohar <[email protected]>
8 */
9
10 #include <linux/seq_file.h>
11 #include <linux/vmalloc.h>
12 #include <linux/kexec.h>
13 #include <linux/of.h>
14 #include <linux/ima.h>
15 #include "ima.h"
16
17 #ifdef CONFIG_IMA_KEXEC
ima_dump_measurement_list(unsigned long * buffer_size,void ** buffer,unsigned long segment_size)18 static int ima_dump_measurement_list(unsigned long *buffer_size, void **buffer,
19 unsigned long segment_size)
20 {
21 struct ima_queue_entry *qe;
22 struct seq_file file;
23 struct ima_kexec_hdr khdr;
24 int ret = 0;
25
26 /* segment size can't change between kexec load and execute */
27 file.buf = vmalloc(segment_size);
28 if (!file.buf) {
29 ret = -ENOMEM;
30 goto out;
31 }
32
33 file.file = NULL;
34 file.size = segment_size;
35 file.read_pos = 0;
36 file.count = sizeof(khdr); /* reserved space */
37
38 memset(&khdr, 0, sizeof(khdr));
39 khdr.version = 1;
40 /* This is an append-only list, no need to hold the RCU read lock */
41 list_for_each_entry_rcu(qe, &ima_measurements, later, true) {
42 if (file.count < file.size) {
43 khdr.count++;
44 ima_measurements_show(&file, qe);
45 } else {
46 ret = -EINVAL;
47 break;
48 }
49 }
50
51 if (ret < 0)
52 goto out;
53
54 /*
55 * fill in reserved space with some buffer details
56 * (eg. version, buffer size, number of measurements)
57 */
58 khdr.buffer_size = file.count;
59 if (ima_canonical_fmt) {
60 khdr.version = cpu_to_le16(khdr.version);
61 khdr.count = cpu_to_le64(khdr.count);
62 khdr.buffer_size = cpu_to_le64(khdr.buffer_size);
63 }
64 memcpy(file.buf, &khdr, sizeof(khdr));
65
66 print_hex_dump_debug("ima dump: ", DUMP_PREFIX_NONE, 16, 1,
67 file.buf, file.count < 100 ? file.count : 100,
68 true);
69
70 *buffer_size = file.count;
71 *buffer = file.buf;
72 out:
73 if (ret == -EINVAL)
74 vfree(file.buf);
75 return ret;
76 }
77
78 /*
79 * Called during kexec_file_load so that IMA can add a segment to the kexec
80 * image for the measurement list for the next kernel.
81 *
82 * This function assumes that kexec_lock is held.
83 */
ima_add_kexec_buffer(struct kimage * image)84 void ima_add_kexec_buffer(struct kimage *image)
85 {
86 struct kexec_buf kbuf = { .image = image, .buf_align = PAGE_SIZE,
87 .buf_min = 0, .buf_max = ULONG_MAX,
88 .top_down = true };
89 unsigned long binary_runtime_size;
90
91 /* use more understandable variable names than defined in kbuf */
92 void *kexec_buffer = NULL;
93 size_t kexec_buffer_size;
94 size_t kexec_segment_size;
95 int ret;
96
97 /*
98 * Reserve an extra half page of memory for additional measurements
99 * added during the kexec load.
100 */
101 binary_runtime_size = ima_get_binary_runtime_size();
102 if (binary_runtime_size >= ULONG_MAX - PAGE_SIZE)
103 kexec_segment_size = ULONG_MAX;
104 else
105 kexec_segment_size = ALIGN(ima_get_binary_runtime_size() +
106 PAGE_SIZE / 2, PAGE_SIZE);
107 if ((kexec_segment_size == ULONG_MAX) ||
108 ((kexec_segment_size >> PAGE_SHIFT) > totalram_pages() / 2)) {
109 pr_err("Binary measurement list too large.\n");
110 return;
111 }
112
113 ima_dump_measurement_list(&kexec_buffer_size, &kexec_buffer,
114 kexec_segment_size);
115 if (!kexec_buffer) {
116 pr_err("Not enough memory for the kexec measurement buffer.\n");
117 return;
118 }
119
120 kbuf.buffer = kexec_buffer;
121 kbuf.bufsz = kexec_buffer_size;
122 kbuf.memsz = kexec_segment_size;
123 ret = kexec_add_buffer(&kbuf);
124 if (ret) {
125 pr_err("Error passing over kexec measurement buffer.\n");
126 vfree(kexec_buffer);
127 return;
128 }
129
130 image->ima_buffer_addr = kbuf.mem;
131 image->ima_buffer_size = kexec_segment_size;
132 image->ima_buffer = kexec_buffer;
133
134 kexec_dprintk("kexec measurement buffer for the loaded kernel at 0x%lx.\n",
135 kbuf.mem);
136 }
137 #endif /* IMA_KEXEC */
138
139 /*
140 * Restore the measurement list from the previous kernel.
141 */
ima_load_kexec_buffer(void)142 void __init ima_load_kexec_buffer(void)
143 {
144 void *kexec_buffer = NULL;
145 size_t kexec_buffer_size = 0;
146 int rc;
147
148 rc = ima_get_kexec_buffer(&kexec_buffer, &kexec_buffer_size);
149 switch (rc) {
150 case 0:
151 rc = ima_restore_measurement_list(kexec_buffer_size,
152 kexec_buffer);
153 if (rc != 0)
154 pr_err("Failed to restore the measurement list: %d\n",
155 rc);
156
157 ima_free_kexec_buffer();
158 break;
159 case -ENOTSUPP:
160 pr_debug("Restoring the measurement list not supported\n");
161 break;
162 case -ENOENT:
163 pr_debug("No measurement list to restore\n");
164 break;
165 default:
166 pr_debug("Error restoring the measurement list: %d\n", rc);
167 }
168 }
169