lkml.org 
[lkml]   [2017]   [Aug]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Subject[PATCH 00/14] arm64: kexec: add kexec_file_load support
    Date
    This is the initial attempt of implementing kexec_file_load() support
    on arm64.[1]
    Most of the code is based on kexec-tools (along with some kernel code
    from x86 and from powerpc, which also came from kexec-tools).


    This patch series enables us to
    * load the kernel, either Image or vmlinux, with kexec_file_load
    system call, and
    * optionally verify its signature at load time for trusted boot.

    To load the kernel via kexec_file_load system call, a small change
    needs to be applied on kexec-tools. See [2]. This enables '-s' option.

    As we discussed a long time ago, users may not be allowed to specify
    device-tree file of the 2nd kernel explicitly with kexec-tools, therefore
    re-using the blob of the first kernel.

    Regarding a method of placing the signature into the kernel binary,
    * for 'Image', we conform with x86 (or rather Microsoft?) style of
    signing since the binary can also be seen as in PE format
    (assuming that CONFIG_EFI is enabled),
    * for 'vmlinux', we follow powerpc approach[3]: The signature will
    be appended just after the binary itself as module signing does.
    This implies that we need to enable CONFIG_MODULE_SIG, too.

    Powerpc is also going to support extended-file-attribute-based
    verification[3], but arm64 doesn't for now partly because we don't
    have TPM-based IMA at this moment.

    Accordingly, we can use the existing commands, sbsign and sig-file
    respectively, to sign the kernel. Please note that it is totally up to
    the system what key/certificate is used for signing.

    Some concerns(or future works):
    * Even if the kernel is configured with CONFIG_RANDOMIZE_BASE, the 2nd
    kernel won't be placed at a randomized address. We will have to
    add some boot code similar to efi-stub to implement the feature.
    * While big-endian kernel can support kernel signing, I'm not sure that
    Image can be recognized as in PE format because x86 standard only
    defines little-endian-based format.
    So I tested big-endian kernel signing only with vmlinux.
    * IMA(and file extended attribute)-based kexec


    Patch #1 to #7 are all preparatory patches on generic side.
    (Patch #1 is not part of mine, but a prerequisite from [4].)
    Patch #8 and #9 are purgatory code.
    Patch #10 to #12 are common for enabling kexec_file_load.
    Patch #13 is for 'Image' support.
    Patch #14 is for 'vmlinux' support.


    [1] http://git.linaro.org/people/takahiro.akashi/linux-aarch64.git
    branch:arm64/kexec_file
    [2] http://git.linaro.org/people/takahiro.akashi/kexec-tools.git
    branch:arm64/kexec_file
    [3] http://lkml.iu.edu//hypermail/linux/kernel/1707.0/03669.html
    [4] http://lkml.iu.edu//hypermail/linux/kernel/1707.0/03670.html


    AKASHI Takahiro (13):
    include: pe.h: remove message[] from mz header definition
    resource: add walk_system_ram_res_rev()
    kexec_file: factor out vmlinux (elf) parser from powerpc
    kexec_file: factor out crashdump elf header function from x86
    kexec_file: add kexec_add_segment()
    asm-generic: add kexec_file_load system call to unistd.h
    arm64: kexec_file: create purgatory
    arm64: kexec_file: add sha256 digest check in purgatory
    arm64: kexec_file: load initrd, device-tree and purgatory segments
    arm64: kexec_file: set up for crash dump adding elf core header
    arm64: enable KEXEC_FILE config
    arm64: kexec_file: add Image format support
    arm64: kexec_file: add vmlinux format support

    Thiago Jung Bauermann (1):
    MODSIGN: Export module signature definitions

    arch/Kconfig | 3 +
    arch/arm64/Kconfig | 33 ++
    arch/arm64/Makefile | 1 +
    arch/arm64/crypto/sha256-core.S_shipped | 2 +
    arch/arm64/include/asm/kexec.h | 23 ++
    arch/arm64/include/asm/kexec_file.h | 84 +++++
    arch/arm64/kernel/Makefile | 5 +-
    arch/arm64/kernel/kexec_elf.c | 216 ++++++++++++
    arch/arm64/kernel/kexec_image.c | 112 ++++++
    arch/arm64/kernel/machine_kexec_file.c | 606 ++++++++++++++++++++++++++++++++
    arch/arm64/purgatory/Makefile | 43 +++
    arch/arm64/purgatory/entry.S | 41 +++
    arch/arm64/purgatory/purgatory.c | 20 ++
    arch/arm64/purgatory/sha256-core.S | 1 +
    arch/arm64/purgatory/sha256.c | 79 +++++
    arch/arm64/purgatory/sha256.h | 1 +
    arch/arm64/purgatory/string.c | 32 ++
    arch/arm64/purgatory/string.h | 5 +
    arch/powerpc/Kconfig | 1 +
    arch/powerpc/kernel/kexec_elf_64.c | 464 ------------------------
    arch/x86/kernel/crash.c | 324 -----------------
    include/linux/elf.h | 62 ++++
    include/linux/ioport.h | 3 +
    include/linux/kexec.h | 39 ++
    include/linux/module.h | 3 -
    include/linux/module_signature.h | 47 +++
    include/linux/pe.h | 2 +-
    include/uapi/asm-generic/unistd.h | 4 +-
    init/Kconfig | 6 +-
    kernel/Makefile | 3 +-
    kernel/crash_core.c | 333 ++++++++++++++++++
    kernel/kexec_file.c | 47 +++
    kernel/kexec_file_elf.c | 454 ++++++++++++++++++++++++
    kernel/module.c | 1 +
    kernel/module_signing.c | 74 ++--
    kernel/resource.c | 48 +++
    36 files changed, 2383 insertions(+), 839 deletions(-)
    create mode 100644 arch/arm64/include/asm/kexec_file.h
    create mode 100644 arch/arm64/kernel/kexec_elf.c
    create mode 100644 arch/arm64/kernel/kexec_image.c
    create mode 100644 arch/arm64/kernel/machine_kexec_file.c
    create mode 100644 arch/arm64/purgatory/Makefile
    create mode 100644 arch/arm64/purgatory/entry.S
    create mode 100644 arch/arm64/purgatory/purgatory.c
    create mode 100644 arch/arm64/purgatory/sha256-core.S
    create mode 100644 arch/arm64/purgatory/sha256.c
    create mode 100644 arch/arm64/purgatory/sha256.h
    create mode 100644 arch/arm64/purgatory/string.c
    create mode 100644 arch/arm64/purgatory/string.h
    create mode 100644 include/linux/module_signature.h
    create mode 100644 kernel/kexec_file_elf.c

    --
    2.14.1

    \
     
     \ /
      Last update: 2017-08-24 10:20    [W:4.640 / U:0.064 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site