On 10/20/20 1:01 PM, Mimi Zohar wrote:
On Wed, 2020-09-30 at 13:59 -0700, Lakshmi Ramasubramanian wrote:
The functions ima_get_kexec_buffer() and ima_free_kexec_buffer(),
that handle carrying forward the IMA measurement logs on kexec for
powerpc do not have architecture specific code, but they are currently
defined for powerpc only.
Move ima_get_kexec_buffer() and ima_free_kexec_buffer() to IMA
subsystem. A later patch in this series will use these functions for
carrying forward the IMA measurement log for ARM64.
With the above refactoring arch/powerpc/kexec/ima.c contains only
functions used when CONFIG_IMA_KEXEC is enabled. Update Makefile
in arch/powerpc/kexec to include arch/powerpc/kexec/ima.c only
when CONFIG_IMA_KEXEC is enabled.
Move ima_dump_measurement_list() and ima_add_kexec_buffer() to
a new file namely ima_kexec_fdt.c in IMA. Update
security/integrity/ima/Makefile to include ima_kexec_fdt.c only
when CONFIG_IMA_KEXEC is enabled.
Co-developed-by: Prakhar Srivastava <prsriva@xxxxxxxxxxxxxxxxxxx>
Signed-off-by: Prakhar Srivastava <prsriva@xxxxxxxxxxxxxxxxxxx>
Signed-off-by: Lakshmi Ramasubramanian <nramas@xxxxxxxxxxxxxxxxxxx>
The existing support for carrying the IMA measurement list across kexec
is limited to powerpc. This patch set is adding similar support for
arm64, making as much of the existing code as generic as possible.
However ima_dump_measurement_list() is already generic, but for some
reason this patch moves it to ima_kexec_fdt.c. ima_kexec_fdt.c should
be limited to device tree specific code.
I wanted to split the functions defined under CONFIG_HAVE_IMA_KEXEC and
CONFIG_IMA_KEXEC to separate files so that we can get rid of #ifdef in C
file and instead conditionally compile the C files (using Makefile).
ima_dump_measurement_list() need to be defined only when
CONFIG_IMA_KEXEC is defined. I moved it to ima_kexec_fdt.c
Instead of ima_kexec_fdt.c, where ima_dump_measurement_list() and
ima_add_kexec_buffer() are defined, perhaps I can change the file name
to "ima_kexec_buffer.c". Would that be better?
This patch is probably doing the right thing, but the way the patch is
formatted it replaces parts of a function with a different function.
With the changes suggested above and in 1/4, the next version should
be clearer.
Like I'd stated above, I wanted to remove "#ifdef" from the C files and
hence had to move some functions. But the functionalities haven't been
changed.
thanks,
-lakshmi
