Hi Steven, I'm ignoring this version of v7. Please remember to update the version to v8 before re- posting and update the change log. thanks, Mimi On Tue, 2025-02-18 at 09:20 -0800, steven chen wrote: > The current kernel behavior is IMA measurements snapshot is taken at > kexec 'load' and not at kexec 'execute'. IMA log is then carried > over to the new kernel after kexec 'execute'. > > New events can be measured during/after the IMA log snapshot at kexec > 'load' and before the system boots to the new kernel. In this scenario, > the TPM PCRs are extended with these events, but they are not carried > over to the new kernel after kexec soft reboot since the snapshot is > already taken. This results in mismatch between TPM PCR quotes and the > actual IMA measurements list after kexec soft reboot, which in turn > results in remote attestation failure. > > To solve this problem - > - allocate the necessary buffer at kexec 'load' time, > - populate the buffer with the IMA measurements at kexec 'execute' time, > - and measure two new IMA events 'kexec_load' and 'kexec_execute' as > critical data to help detect missing events after kexec soft reboot. [ ... ] > Change Log v7: > - Incorporated feedback from the community (Stefan Berger, Tyler Hicks) > on v6 of this series[8]. > - Verified all the patches are bisect-safe by booting into each > patch and verifying multiple kexec 'load' operations work, > and also verifying kexec soft reboot works, and IMA log gets > carried over for each patch.
