Merge tag 'powerpc-5.7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc...
[linux-2.6-microblaze.git] / security / integrity / ima / ima_kexec.c
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  * Copyright (C) 2016 IBM Corporation
4  *
5  * Authors:
6  * Thiago Jung Bauermann <bauerman@linux.vnet.ibm.com>
7  * Mimi Zohar <zohar@linux.vnet.ibm.com>
8  */
9
10 #include <linux/seq_file.h>
11 #include <linux/vmalloc.h>
12 #include <linux/kexec.h>
13 #include "ima.h"
14
15 #ifdef CONFIG_IMA_KEXEC
16 static int ima_dump_measurement_list(unsigned long *buffer_size, void **buffer,
17                                      unsigned long segment_size)
18 {
19         struct ima_queue_entry *qe;
20         struct seq_file file;
21         struct ima_kexec_hdr khdr;
22         int ret = 0;
23
24         /* segment size can't change between kexec load and execute */
25         file.buf = vmalloc(segment_size);
26         if (!file.buf) {
27                 ret = -ENOMEM;
28                 goto out;
29         }
30
31         file.size = segment_size;
32         file.read_pos = 0;
33         file.count = sizeof(khdr);      /* reserved space */
34
35         memset(&khdr, 0, sizeof(khdr));
36         khdr.version = 1;
37         list_for_each_entry_rcu(qe, &ima_measurements, later) {
38                 if (file.count < file.size) {
39                         khdr.count++;
40                         ima_measurements_show(&file, qe);
41                 } else {
42                         ret = -EINVAL;
43                         break;
44                 }
45         }
46
47         if (ret < 0)
48                 goto out;
49
50         /*
51          * fill in reserved space with some buffer details
52          * (eg. version, buffer size, number of measurements)
53          */
54         khdr.buffer_size = file.count;
55         if (ima_canonical_fmt) {
56                 khdr.version = cpu_to_le16(khdr.version);
57                 khdr.count = cpu_to_le64(khdr.count);
58                 khdr.buffer_size = cpu_to_le64(khdr.buffer_size);
59         }
60         memcpy(file.buf, &khdr, sizeof(khdr));
61
62         print_hex_dump(KERN_DEBUG, "ima dump: ", DUMP_PREFIX_NONE,
63                         16, 1, file.buf,
64                         file.count < 100 ? file.count : 100, true);
65
66         *buffer_size = file.count;
67         *buffer = file.buf;
68 out:
69         if (ret == -EINVAL)
70                 vfree(file.buf);
71         return ret;
72 }
73
74 /*
75  * Called during kexec_file_load so that IMA can add a segment to the kexec
76  * image for the measurement list for the next kernel.
77  *
78  * This function assumes that kexec_mutex is held.
79  */
80 void ima_add_kexec_buffer(struct kimage *image)
81 {
82         struct kexec_buf kbuf = { .image = image, .buf_align = PAGE_SIZE,
83                                   .buf_min = 0, .buf_max = ULONG_MAX,
84                                   .top_down = true };
85         unsigned long binary_runtime_size;
86
87         /* use more understandable variable names than defined in kbuf */
88         void *kexec_buffer = NULL;
89         size_t kexec_buffer_size;
90         size_t kexec_segment_size;
91         int ret;
92
93         /*
94          * Reserve an extra half page of memory for additional measurements
95          * added during the kexec load.
96          */
97         binary_runtime_size = ima_get_binary_runtime_size();
98         if (binary_runtime_size >= ULONG_MAX - PAGE_SIZE)
99                 kexec_segment_size = ULONG_MAX;
100         else
101                 kexec_segment_size = ALIGN(ima_get_binary_runtime_size() +
102                                            PAGE_SIZE / 2, PAGE_SIZE);
103         if ((kexec_segment_size == ULONG_MAX) ||
104             ((kexec_segment_size >> PAGE_SHIFT) > totalram_pages() / 2)) {
105                 pr_err("Binary measurement list too large.\n");
106                 return;
107         }
108
109         ima_dump_measurement_list(&kexec_buffer_size, &kexec_buffer,
110                                   kexec_segment_size);
111         if (!kexec_buffer) {
112                 pr_err("Not enough memory for the kexec measurement buffer.\n");
113                 return;
114         }
115
116         kbuf.buffer = kexec_buffer;
117         kbuf.bufsz = kexec_buffer_size;
118         kbuf.memsz = kexec_segment_size;
119         ret = kexec_add_buffer(&kbuf);
120         if (ret) {
121                 pr_err("Error passing over kexec measurement buffer.\n");
122                 return;
123         }
124
125         ret = arch_ima_add_kexec_buffer(image, kbuf.mem, kexec_segment_size);
126         if (ret) {
127                 pr_err("Error passing over kexec measurement buffer.\n");
128                 return;
129         }
130
131         pr_debug("kexec measurement buffer for the loaded kernel at 0x%lx.\n",
132                  kbuf.mem);
133 }
134 #endif /* IMA_KEXEC */
135
136 /*
137  * Restore the measurement list from the previous kernel.
138  */
139 void ima_load_kexec_buffer(void)
140 {
141         void *kexec_buffer = NULL;
142         size_t kexec_buffer_size = 0;
143         int rc;
144
145         rc = ima_get_kexec_buffer(&kexec_buffer, &kexec_buffer_size);
146         switch (rc) {
147         case 0:
148                 rc = ima_restore_measurement_list(kexec_buffer_size,
149                                                   kexec_buffer);
150                 if (rc != 0)
151                         pr_err("Failed to restore the measurement list: %d\n",
152                                 rc);
153
154                 ima_free_kexec_buffer();
155                 break;
156         case -ENOTSUPP:
157                 pr_debug("Restoring the measurement list not supported\n");
158                 break;
159         case -ENOENT:
160                 pr_debug("No measurement list to restore\n");
161                 break;
162         default:
163                 pr_debug("Error restoring the measurement list: %d\n", rc);
164         }
165 }