Hi Tushar, On Thu, 2023-05-25 at 10:21 -0700, Tushar Sugandhi wrote: > The issue of IMA measurements getting lost between kexec 'load' and 'execute' still exists. > I verified it on the mainline kernel 6.4.rc3. See *Appendix A* for details. > > I went through Thiago's patches he wrote several years ago, and tried to develop a solution. > > I was facing some issues with physical to virtual address translation. > One of my co-worker at Microsoft helped my re-write the logic which seems to be working. > See the attached patch and *Appendix B* for details. > > The basic functionality is working. I need to polish the code, and handle error paths in a better way. > But before doing that, I need your feedback on the fundamental approach. > Since I am not a kexec expert, it’d be great if I could get help with the code review > and also suggestions on scenarios to test to validate the patch thoroughly. > Let me know if I should first post the patch as RFC on public forums for that. Thanks, Tushar. Measurements can and are currently being added to the IMA measurement list between kexec load and execute, but are not being carried across kexec. These measurements also extend the TPM. After the soft reboot, without these additional measurements the IMA measurement list cannot be verified against the TPM PCRs. Your proposed patch, like Thiago's, saved the entire IMA measurement list again. Assuming the buffer size can't change between kexec load and execute, as per the comment, why not just allocate the buffer on kexec load and fill it on kexec exec? To simulate the existing behavior, fill the buffer with as many complete measurement records as the buffer will hold. -- thanks, Mimi _______________________________________________ kexec mailing list kexec@xxxxxxxxxxxxxxxxxxx http://lists.infradead.org/mailman/listinfo/kexec
