Hi Dave,
On Thu, 2016-09-01 at 09:57 +0800, Dave Young wrote:
> On 08/30/16 at 06:40pm, Mimi Zohar wrote:
> > + * Called during kexec_file_load so that IMA can add a segment to the kexec
> > + * image for the measurement list for the next kernel.
> > + */
> > +void ima_add_kexec_buffer(struct kimage *image)
> > +{
> > + static int registered = 0;
> > + struct kexec_buf kbuf = { .image = image, .buf_align = PAGE_SIZE,
> > + .buf_min = 0, .buf_max = ULONG_MAX,
> > + .top_down = true, .skip_checksum = true };
> > + int ret;
> > +
> > + if (!kexec_can_hand_over_buffer())
> > + return;
> > +
> > + kexec_segment_size = ALIGN(ima_get_binary_runtime_size() + PAGE_SIZE,
> > + PAGE_SIZE);
> > +
> > + if (kexec_segment_size >= (ULONG_MAX - sizeof(long))) {
> > + pr_err("Binary measurement list too large.\n");
> > + return;
> > + }
>
> Now we added a limitation that total segment size can not be larger than
> half of totalram. see kernel/kexec_core.c sanity_check_segment_list()
>
> So can it fail early here if kexec_segment_size is over half of total
> ram?
Sure, I'll include this change in the next post.
Mimi
