Messages in this thread | | | Subject | Re: [PATCH v7 2/4] powerpc: Refactor kexec functions to move arch independent code to ima | From | Lakshmi Ramasubramanian <> | Date | Wed, 21 Oct 2020 09:20:30 -0700 |
| |
On 10/20/20 8:50 PM, Mimi Zohar wrote: > Hi Lakshmi, > > On Tue, 2020-10-20 at 19:38 -0700, Lakshmi Ramasubramanian wrote: >> On 10/20/20 1:01 PM, Mimi Zohar wrote: >>> On Wed, 2020-09-30 at 13:59 -0700, Lakshmi Ramasubramanian wrote: >>>> The functions ima_get_kexec_buffer() and ima_free_kexec_buffer(), >>>> that handle carrying forward the IMA measurement logs on kexec for >>>> powerpc do not have architecture specific code, but they are currently >>>> defined for powerpc only. >>>> >>>> Move ima_get_kexec_buffer() and ima_free_kexec_buffer() to IMA >>>> subsystem. A later patch in this series will use these functions for >>>> carrying forward the IMA measurement log for ARM64. >>>> >>>> With the above refactoring arch/powerpc/kexec/ima.c contains only >>>> functions used when CONFIG_IMA_KEXEC is enabled. Update Makefile >>>> in arch/powerpc/kexec to include arch/powerpc/kexec/ima.c only >>>> when CONFIG_IMA_KEXEC is enabled. >>>> >>>> Move ima_dump_measurement_list() and ima_add_kexec_buffer() to >>>> a new file namely ima_kexec_fdt.c in IMA. Update >>>> security/integrity/ima/Makefile to include ima_kexec_fdt.c only >>>> when CONFIG_IMA_KEXEC is enabled. >>>> >>>> Co-developed-by: Prakhar Srivastava <prsriva@linux.microsoft.com> >>>> Signed-off-by: Prakhar Srivastava <prsriva@linux.microsoft.com> >>>> Signed-off-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com> >>> >>> The existing support for carrying the IMA measurement list across kexec >>> is limited to powerpc. This patch set is adding similar support for >>> arm64, making as much of the existing code as generic as possible. >>> However ima_dump_measurement_list() is already generic, but for some >>> reason this patch moves it to ima_kexec_fdt.c. ima_kexec_fdt.c should >>> be limited to device tree specific code. >> >> I wanted to split the functions defined under CONFIG_HAVE_IMA_KEXEC and >> CONFIG_IMA_KEXEC to separate files so that we can get rid of #ifdef in C >> file and instead conditionally compile the C files (using Makefile). >> >> ima_dump_measurement_list() need to be defined only when >> CONFIG_IMA_KEXEC is defined. I moved it to ima_kexec_fdt.c > > In this case, everything in ima_kexec.c relates to carrying or > restoring the measurement list. It's a logical unit. Separating them > doesn't make sense. >
Sounds good - I'll keep ima_dump_measurement_list() and ima_add_kexec_buffer() in ima_kexec.c as it was earlier.
>> >> Instead of ima_kexec_fdt.c, where ima_dump_measurement_list() and >> ima_add_kexec_buffer() are defined, perhaps I can change the file name >> to "ima_kexec_buffer.c". Would that be better? > > I don't understand why adding support for carrying the IMA measurement > across kexec on ARM64, should require any changes in the IMA loading > and restoring the measurement list code itself. Please minimize the > changes.
Agreed - will do.
thanks, -lakshmi
| |