Re: [PATCH v9 1/7] ima: copy only complete measurement records across kexec

[Mimi Zohar]

On Tue, 2025-03-04 at 21:08 -0500, Mimi Zohar wrote:
> On Tue, 2025-03-04 at 11:03 -0800, steven chen wrote:
> > 
> >  - Compared the memory size allocated with memory size of the entire 
> >    measurement record. Copy only complete measurement records if there 
> >    is enough memory. If there is not enough memory, it will not copy
> >    any IMA measurement records, and this situation will result in a 
> >    failure of remote attestation.
> 
> In discussions with Tushar, I was very clear that as many measurement records as
> possible should be carried over to the kexec'ed kernel.  The main change between
> v8 and v9 was to make sure the last record copied was a complete record.

Steven, let me clarify my comment on v8.  The patch description said,

"Separate allocating the buffer and copying the measurement records into
separate functions in order to allocate the buffer at kexec 'load' and copy the
measurements at kexec 'execute'."

The intention is fine, but it also did other things:
- only copied a full last measurement
- if there wasn't enough room, it didn't copy any measurement records.

Copying a full last measurement should be a separate, new patch to simplify
review.  I'm asking you to separate that change from the rest of the patch, so
that it can be back ported independently of the rest of the patch set.

When splitting the function "that allocates the buffer and copies the
measurement records into separate functions", please make sure it still copies
as many measurement records as possible.

thanks,

Mimi