Re: [PATCH v7 2/4] powerpc: Refactor kexec functions to move arch independent code to ima

[Lakshmi Ramasubramanian]

On 10/20/20 8:50 PM, Mimi Zohar wrote:
> Hi Lakshmi,
>
> On Tue, 2020-10-20 at 19:38 -0700, Lakshmi Ramasubramanian wrote:
> > On 10/20/20 1:01 PM, Mimi Zohar wrote:
> > > On Wed, 2020-09-30 at 13:59 -0700, Lakshmi Ramasubramanian wrote:
> > > > The functions ima_get_kexec_buffer() and ima_free_kexec_buffer(),
> > > > that handle carrying forward the IMA measurement logs on kexec for
> > > > powerpc do not have architecture specific code, but they are currently
> > > > defined for powerpc only.
> > > >
> > > > Move ima_get_kexec_buffer() and ima_free_kexec_buffer() to IMA
> > > > subsystem. A later patch in this series will use these functions for
> > > > carrying forward the IMA measurement log for ARM64.
> > > >
> > > > With the above refactoring arch/powerpc/kexec/ima.c contains only
> > > > functions used when CONFIG_IMA_KEXEC is enabled. Update Makefile
> > > > in arch/powerpc/kexec to include arch/powerpc/kexec/ima.c only
> > > > when CONFIG_IMA_KEXEC is enabled.
> > > >
> > > > Move ima_dump_measurement_list() and ima_add_kexec_buffer() to
> > > > a new file namely ima_kexec_fdt.c in IMA. Update
> > > > security/integrity/ima/Makefile to include ima_kexec_fdt.c only
> > > > when CONFIG_IMA_KEXEC is enabled.
> > > >
> > > > Co-developed-by: Prakhar Srivastava <prsriva@xxxxxxxxxxxxxxxxxxx>
> > > > Signed-off-by: Prakhar Srivastava <prsriva@xxxxxxxxxxxxxxxxxxx>
> > > > Signed-off-by: Lakshmi Ramasubramanian <nramas@xxxxxxxxxxxxxxxxxxx>
> > >
> > > The existing support for carrying the IMA measurement list across kexec
> > > is limited to powerpc.  This patch set is adding similar support for
> > > arm64, making as much of the existing code as generic as possible.
> > > However ima_dump_measurement_list() is already generic, but for some
> > > reason this patch moves it to ima_kexec_fdt.c.  ima_kexec_fdt.c should
> > > be limited to device tree specific code.
> >
> > I wanted to split the functions defined under CONFIG_HAVE_IMA_KEXEC and
> > CONFIG_IMA_KEXEC to separate files so that we can get rid of #ifdef in C
> > file and instead conditionally compile the C files (using Makefile).
> >
> > ima_dump_measurement_list() need to be defined only when
> > CONFIG_IMA_KEXEC is defined. I moved it to ima_kexec_fdt.c
>
> In this case, everything in ima_kexec.c relates to carrying or
> restoring the measurement list.  It's a logical unit.  Separating them
> doesn't make sense.

Sounds good - I'll keep ima_dump_measurement_list() and 
ima_add_kexec_buffer() in ima_kexec.c as it was earlier.

> > Instead of ima_kexec_fdt.c, where ima_dump_measurement_list() and
> > ima_add_kexec_buffer() are defined, perhaps I can change the file name
> > to "ima_kexec_buffer.c". Would that be better?
>
> I don't understand why adding support for carrying the IMA measurement
> across kexec on ARM64, should require any changes in the IMA loading
> and restoring the measurement list code itself.  Please minimize the
> changes.

Agreed - will do.

thanks,
 -lakshmi