1
2
3
4
5
6
7
8
9
10#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
11
12#include <linux/capability.h>
13#include <linux/mm.h>
14#include <linux/file.h>
15#include <linux/slab.h>
16#include <linux/kexec.h>
17#include <linux/memblock.h>
18#include <linux/mutex.h>
19#include <linux/list.h>
20#include <linux/fs.h>
21#include <linux/ima.h>
22#include <crypto/hash.h>
23#include <crypto/sha.h>
24#include <linux/elf.h>
25#include <linux/elfcore.h>
26#include <linux/kernel.h>
27#include <linux/syscalls.h>
28#include <linux/vmalloc.h>
29#include "kexec_internal.h"
30
31static int kexec_calculate_store_digests(struct kimage *image);
32
33
34
35
36
37
38int kexec_image_probe_default(struct kimage *image, void *buf,
39 unsigned long buf_len)
40{
41 const struct kexec_file_ops * const *fops;
42 int ret = -ENOEXEC;
43
44 for (fops = &kexec_file_loaders[0]; *fops && (*fops)->probe; ++fops) {
45 ret = (*fops)->probe(buf, buf_len);
46 if (!ret) {
47 image->fops = *fops;
48 return ret;
49 }
50 }
51
52 return ret;
53}
54
55
56int __weak arch_kexec_kernel_image_probe(struct kimage *image, void *buf,
57 unsigned long buf_len)
58{
59 return kexec_image_probe_default(image, buf, buf_len);
60}
61
62static void *kexec_image_load_default(struct kimage *image)
63{
64 if (!image->fops || !image->fops->load)
65 return ERR_PTR(-ENOEXEC);
66
67 return image->fops->load(image, image->kernel_buf,
68 image->kernel_buf_len, image->initrd_buf,
69 image->initrd_buf_len, image->cmdline_buf,
70 image->cmdline_buf_len);
71}
72
73void * __weak arch_kexec_kernel_image_load(struct kimage *image)
74{
75 return kexec_image_load_default(image);
76}
77
78int kexec_image_post_load_cleanup_default(struct kimage *image)
79{
80 if (!image->fops || !image->fops->cleanup)
81 return 0;
82
83 return image->fops->cleanup(image->image_loader_data);
84}
85
86int __weak arch_kimage_file_post_load_cleanup(struct kimage *image)
87{
88 return kexec_image_post_load_cleanup_default(image);
89}
90
91#ifdef CONFIG_KEXEC_VERIFY_SIG
92static int kexec_image_verify_sig_default(struct kimage *image, void *buf,
93 unsigned long buf_len)
94{
95 if (!image->fops || !image->fops->verify_sig) {
96 pr_debug("kernel loader does not support signature verification.\n");
97 return -EKEYREJECTED;
98 }
99
100 return image->fops->verify_sig(buf, buf_len);
101}
102
103int __weak arch_kexec_kernel_verify_sig(struct kimage *image, void *buf,
104 unsigned long buf_len)
105{
106 return kexec_image_verify_sig_default(image, buf, buf_len);
107}
108#endif
109
110
111
112
113
114
115
116
117
118
119int __weak
120arch_kexec_apply_relocations_add(struct purgatory_info *pi, Elf_Shdr *section,
121 const Elf_Shdr *relsec, const Elf_Shdr *symtab)
122{
123 pr_err("RELA relocation unsupported.\n");
124 return -ENOEXEC;
125}
126
127
128
129
130
131
132
133
134
135
136int __weak
137arch_kexec_apply_relocations(struct purgatory_info *pi, Elf_Shdr *section,
138 const Elf_Shdr *relsec, const Elf_Shdr *symtab)
139{
140 pr_err("REL relocation unsupported.\n");
141 return -ENOEXEC;
142}
143
144
145
146
147
148
149void kimage_file_post_load_cleanup(struct kimage *image)
150{
151 struct purgatory_info *pi = &image->purgatory_info;
152
153 vfree(image->kernel_buf);
154 image->kernel_buf = NULL;
155
156 vfree(image->initrd_buf);
157 image->initrd_buf = NULL;
158
159 kfree(image->cmdline_buf);
160 image->cmdline_buf = NULL;
161
162 vfree(pi->purgatory_buf);
163 pi->purgatory_buf = NULL;
164
165 vfree(pi->sechdrs);
166 pi->sechdrs = NULL;
167
168
169 arch_kimage_file_post_load_cleanup(image);
170
171
172
173
174
175
176 kfree(image->image_loader_data);
177 image->image_loader_data = NULL;
178}
179
180
181
182
183
184static int
185kimage_file_prepare_segments(struct kimage *image, int kernel_fd, int initrd_fd,
186 const char __user *cmdline_ptr,
187 unsigned long cmdline_len, unsigned flags)
188{
189 int ret = 0;
190 void *ldata;
191 loff_t size;
192
193 ret = kernel_read_file_from_fd(kernel_fd, &image->kernel_buf,
194 &size, INT_MAX, READING_KEXEC_IMAGE);
195 if (ret)
196 return ret;
197 image->kernel_buf_len = size;
198
199
200 ret = arch_kexec_kernel_image_probe(image, image->kernel_buf,
201 image->kernel_buf_len);
202 if (ret)
203 goto out;
204
205#ifdef CONFIG_KEXEC_VERIFY_SIG
206 ret = arch_kexec_kernel_verify_sig(image, image->kernel_buf,
207 image->kernel_buf_len);
208 if (ret) {
209 pr_debug("kernel signature verification failed.\n");
210 goto out;
211 }
212 pr_debug("kernel signature verification successful.\n");
213#endif
214
215 if (!(flags & KEXEC_FILE_NO_INITRAMFS)) {
216 ret = kernel_read_file_from_fd(initrd_fd, &image->initrd_buf,
217 &size, INT_MAX,
218 READING_KEXEC_INITRAMFS);
219 if (ret)
220 goto out;
221 image->initrd_buf_len = size;
222 }
223
224 if (cmdline_len) {
225 image->cmdline_buf = memdup_user(cmdline_ptr, cmdline_len);
226 if (IS_ERR(image->cmdline_buf)) {
227 ret = PTR_ERR(image->cmdline_buf);
228 image->cmdline_buf = NULL;
229 goto out;
230 }
231
232 image->cmdline_buf_len = cmdline_len;
233
234
235 if (image->cmdline_buf[cmdline_len - 1] != '\0') {
236 ret = -EINVAL;
237 goto out;
238 }
239
240 ima_kexec_cmdline(image->cmdline_buf,
241 image->cmdline_buf_len - 1);
242 }
243
244
245 ima_add_kexec_buffer(image);
246
247
248 ldata = arch_kexec_kernel_image_load(image);
249
250 if (IS_ERR(ldata)) {
251 ret = PTR_ERR(ldata);
252 goto out;
253 }
254
255 image->image_loader_data = ldata;
256out:
257
258 if (ret)
259 kimage_file_post_load_cleanup(image);
260 return ret;
261}
262
263static int
264kimage_file_alloc_init(struct kimage **rimage, int kernel_fd,
265 int initrd_fd, const char __user *cmdline_ptr,
266 unsigned long cmdline_len, unsigned long flags)
267{
268 int ret;
269 struct kimage *image;
270 bool kexec_on_panic = flags & KEXEC_FILE_ON_CRASH;
271
272 image = do_kimage_alloc_init();
273 if (!image)
274 return -ENOMEM;
275
276 image->file_mode = 1;
277
278 if (kexec_on_panic) {
279
280 image->control_page = crashk_res.start;
281 image->type = KEXEC_TYPE_CRASH;
282 }
283
284 ret = kimage_file_prepare_segments(image, kernel_fd, initrd_fd,
285 cmdline_ptr, cmdline_len, flags);
286 if (ret)
287 goto out_free_image;
288
289 ret = sanity_check_segment_list(image);
290 if (ret)
291 goto out_free_post_load_bufs;
292
293 ret = -ENOMEM;
294 image->control_code_page = kimage_alloc_control_pages(image,
295 get_order(KEXEC_CONTROL_PAGE_SIZE));
296 if (!image->control_code_page) {
297 pr_err("Could not allocate control_code_buffer\n");
298 goto out_free_post_load_bufs;
299 }
300
301 if (!kexec_on_panic) {
302 image->swap_page = kimage_alloc_control_pages(image, 0);
303 if (!image->swap_page) {
304 pr_err("Could not allocate swap buffer\n");
305 goto out_free_control_pages;
306 }
307 }
308
309 *rimage = image;
310 return 0;
311out_free_control_pages:
312 kimage_free_page_list(&image->control_pages);
313out_free_post_load_bufs:
314 kimage_file_post_load_cleanup(image);
315out_free_image:
316 kfree(image);
317 return ret;
318}
319
320SYSCALL_DEFINE5(kexec_file_load, int, kernel_fd, int, initrd_fd,
321 unsigned long, cmdline_len, const char __user *, cmdline_ptr,
322 unsigned long, flags)
323{
324 int ret = 0, i;
325 struct kimage **dest_image, *image;
326
327
328 if (!capable(CAP_SYS_BOOT) || kexec_load_disabled)
329 return -EPERM;
330
331
332 if (flags != (flags & KEXEC_FILE_FLAGS))
333 return -EINVAL;
334
335 image = NULL;
336
337 if (!mutex_trylock(&kexec_mutex))
338 return -EBUSY;
339
340 dest_image = &kexec_image;
341 if (flags & KEXEC_FILE_ON_CRASH) {
342 dest_image = &kexec_crash_image;
343 if (kexec_crash_image)
344 arch_kexec_unprotect_crashkres();
345 }
346
347 if (flags & KEXEC_FILE_UNLOAD)
348 goto exchange;
349
350
351
352
353
354
355 if (flags & KEXEC_FILE_ON_CRASH)
356 kimage_free(xchg(&kexec_crash_image, NULL));
357
358 ret = kimage_file_alloc_init(&image, kernel_fd, initrd_fd, cmdline_ptr,
359 cmdline_len, flags);
360 if (ret)
361 goto out;
362
363 ret = machine_kexec_prepare(image);
364 if (ret)
365 goto out;
366
367
368
369
370
371 ret = kimage_crash_copy_vmcoreinfo(image);
372 if (ret)
373 goto out;
374
375 ret = kexec_calculate_store_digests(image);
376 if (ret)
377 goto out;
378
379 for (i = 0; i < image->nr_segments; i++) {
380 struct kexec_segment *ksegment;
381
382 ksegment = &image->segment[i];
383 pr_debug("Loading segment %d: buf=0x%p bufsz=0x%zx mem=0x%lx memsz=0x%zx\n",
384 i, ksegment->buf, ksegment->bufsz, ksegment->mem,
385 ksegment->memsz);
386
387 ret = kimage_load_segment(image, &image->segment[i]);
388 if (ret)
389 goto out;
390 }
391
392 kimage_terminate(image);
393
394
395
396
397
398 kimage_file_post_load_cleanup(image);
399exchange:
400 image = xchg(dest_image, image);
401out:
402 if ((flags & KEXEC_FILE_ON_CRASH) && kexec_crash_image)
403 arch_kexec_protect_crashkres();
404
405 mutex_unlock(&kexec_mutex);
406 kimage_free(image);
407 return ret;
408}
409
410static int locate_mem_hole_top_down(unsigned long start, unsigned long end,
411 struct kexec_buf *kbuf)
412{
413 struct kimage *image = kbuf->image;
414 unsigned long temp_start, temp_end;
415
416 temp_end = min(end, kbuf->buf_max);
417 temp_start = temp_end - kbuf->memsz;
418
419 do {
420
421 temp_start = temp_start & (~(kbuf->buf_align - 1));
422
423 if (temp_start < start || temp_start < kbuf->buf_min)
424 return 0;
425
426 temp_end = temp_start + kbuf->memsz - 1;
427
428
429
430
431
432 if (kimage_is_destination_range(image, temp_start, temp_end)) {
433 temp_start = temp_start - PAGE_SIZE;
434 continue;
435 }
436
437
438 break;
439 } while (1);
440
441
442 kbuf->mem = temp_start;
443
444
445 return 1;
446}
447
448static int locate_mem_hole_bottom_up(unsigned long start, unsigned long end,
449 struct kexec_buf *kbuf)
450{
451 struct kimage *image = kbuf->image;
452 unsigned long temp_start, temp_end;
453
454 temp_start = max(start, kbuf->buf_min);
455
456 do {
457 temp_start = ALIGN(temp_start, kbuf->buf_align);
458 temp_end = temp_start + kbuf->memsz - 1;
459
460 if (temp_end > end || temp_end > kbuf->buf_max)
461 return 0;
462
463
464
465
466 if (kimage_is_destination_range(image, temp_start, temp_end)) {
467 temp_start = temp_start + PAGE_SIZE;
468 continue;
469 }
470
471
472 break;
473 } while (1);
474
475
476 kbuf->mem = temp_start;
477
478
479 return 1;
480}
481
482static int locate_mem_hole_callback(struct resource *res, void *arg)
483{
484 struct kexec_buf *kbuf = (struct kexec_buf *)arg;
485 u64 start = res->start, end = res->end;
486 unsigned long sz = end - start + 1;
487
488
489 if (sz < kbuf->memsz)
490 return 0;
491
492 if (end < kbuf->buf_min || start > kbuf->buf_max)
493 return 0;
494
495
496
497
498
499 if (kbuf->top_down)
500 return locate_mem_hole_top_down(start, end, kbuf);
501 return locate_mem_hole_bottom_up(start, end, kbuf);
502}
503
504#ifdef CONFIG_ARCH_KEEP_MEMBLOCK
505static int kexec_walk_memblock(struct kexec_buf *kbuf,
506 int (*func)(struct resource *, void *))
507{
508 int ret = 0;
509 u64 i;
510 phys_addr_t mstart, mend;
511 struct resource res = { };
512
513 if (kbuf->image->type == KEXEC_TYPE_CRASH)
514 return func(&crashk_res, kbuf);
515
516 if (kbuf->top_down) {
517 for_each_free_mem_range_reverse(i, NUMA_NO_NODE, MEMBLOCK_NONE,
518 &mstart, &mend, NULL) {
519
520
521
522
523
524 res.start = mstart;
525 res.end = mend - 1;
526 ret = func(&res, kbuf);
527 if (ret)
528 break;
529 }
530 } else {
531 for_each_free_mem_range(i, NUMA_NO_NODE, MEMBLOCK_NONE,
532 &mstart, &mend, NULL) {
533
534
535
536
537
538 res.start = mstart;
539 res.end = mend - 1;
540 ret = func(&res, kbuf);
541 if (ret)
542 break;
543 }
544 }
545
546 return ret;
547}
548#else
549static int kexec_walk_memblock(struct kexec_buf *kbuf,
550 int (*func)(struct resource *, void *))
551{
552 return 0;
553}
554#endif
555
556
557
558
559
560
561
562
563
564
565static int kexec_walk_resources(struct kexec_buf *kbuf,
566 int (*func)(struct resource *, void *))
567{
568 if (kbuf->image->type == KEXEC_TYPE_CRASH)
569 return walk_iomem_res_desc(crashk_res.desc,
570 IORESOURCE_SYSTEM_RAM | IORESOURCE_BUSY,
571 crashk_res.start, crashk_res.end,
572 kbuf, func);
573 else
574 return walk_system_ram_res(0, ULONG_MAX, kbuf, func);
575}
576
577
578
579
580
581
582
583
584
585int kexec_locate_mem_hole(struct kexec_buf *kbuf)
586{
587 int ret;
588
589
590 if (kbuf->mem != KEXEC_BUF_MEM_UNKNOWN)
591 return 0;
592
593 if (!IS_ENABLED(CONFIG_ARCH_KEEP_MEMBLOCK))
594 ret = kexec_walk_resources(kbuf, locate_mem_hole_callback);
595 else
596 ret = kexec_walk_memblock(kbuf, locate_mem_hole_callback);
597
598 return ret == 1 ? 0 : -EADDRNOTAVAIL;
599}
600
601
602
603
604
605
606
607
608
609
610
611int kexec_add_buffer(struct kexec_buf *kbuf)
612{
613
614 struct kexec_segment *ksegment;
615 int ret;
616
617
618 if (!kbuf->image->file_mode)
619 return -EINVAL;
620
621 if (kbuf->image->nr_segments >= KEXEC_SEGMENT_MAX)
622 return -EINVAL;
623
624
625
626
627
628
629
630
631 if (!list_empty(&kbuf->image->control_pages)) {
632 WARN_ON(1);
633 return -EINVAL;
634 }
635
636
637 kbuf->memsz = ALIGN(kbuf->memsz, PAGE_SIZE);
638 kbuf->buf_align = max(kbuf->buf_align, PAGE_SIZE);
639
640
641 ret = kexec_locate_mem_hole(kbuf);
642 if (ret)
643 return ret;
644
645
646 ksegment = &kbuf->image->segment[kbuf->image->nr_segments];
647 ksegment->kbuf = kbuf->buffer;
648 ksegment->bufsz = kbuf->bufsz;
649 ksegment->mem = kbuf->mem;
650 ksegment->memsz = kbuf->memsz;
651 kbuf->image->nr_segments++;
652 return 0;
653}
654
655
656static int kexec_calculate_store_digests(struct kimage *image)
657{
658 struct crypto_shash *tfm;
659 struct shash_desc *desc;
660 int ret = 0, i, j, zero_buf_sz, sha_region_sz;
661 size_t desc_size, nullsz;
662 char *digest;
663 void *zero_buf;
664 struct kexec_sha_region *sha_regions;
665 struct purgatory_info *pi = &image->purgatory_info;
666
667 if (!IS_ENABLED(CONFIG_ARCH_HAS_KEXEC_PURGATORY))
668 return 0;
669
670 zero_buf = __va(page_to_pfn(ZERO_PAGE(0)) << PAGE_SHIFT);
671 zero_buf_sz = PAGE_SIZE;
672
673 tfm = crypto_alloc_shash("sha256", 0, 0);
674 if (IS_ERR(tfm)) {
675 ret = PTR_ERR(tfm);
676 goto out;
677 }
678
679 desc_size = crypto_shash_descsize(tfm) + sizeof(*desc);
680 desc = kzalloc(desc_size, GFP_KERNEL);
681 if (!desc) {
682 ret = -ENOMEM;
683 goto out_free_tfm;
684 }
685
686 sha_region_sz = KEXEC_SEGMENT_MAX * sizeof(struct kexec_sha_region);
687 sha_regions = vzalloc(sha_region_sz);
688 if (!sha_regions)
689 goto out_free_desc;
690
691 desc->tfm = tfm;
692
693 ret = crypto_shash_init(desc);
694 if (ret < 0)
695 goto out_free_sha_regions;
696
697 digest = kzalloc(SHA256_DIGEST_SIZE, GFP_KERNEL);
698 if (!digest) {
699 ret = -ENOMEM;
700 goto out_free_sha_regions;
701 }
702
703 for (j = i = 0; i < image->nr_segments; i++) {
704 struct kexec_segment *ksegment;
705
706 ksegment = &image->segment[i];
707
708
709
710
711 if (ksegment->kbuf == pi->purgatory_buf)
712 continue;
713
714 ret = crypto_shash_update(desc, ksegment->kbuf,
715 ksegment->bufsz);
716 if (ret)
717 break;
718
719
720
721
722
723 nullsz = ksegment->memsz - ksegment->bufsz;
724 while (nullsz) {
725 unsigned long bytes = nullsz;
726
727 if (bytes > zero_buf_sz)
728 bytes = zero_buf_sz;
729 ret = crypto_shash_update(desc, zero_buf, bytes);
730 if (ret)
731 break;
732 nullsz -= bytes;
733 }
734
735 if (ret)
736 break;
737
738 sha_regions[j].start = ksegment->mem;
739 sha_regions[j].len = ksegment->memsz;
740 j++;
741 }
742
743 if (!ret) {
744 ret = crypto_shash_final(desc, digest);
745 if (ret)
746 goto out_free_digest;
747 ret = kexec_purgatory_get_set_symbol(image, "purgatory_sha_regions",
748 sha_regions, sha_region_sz, 0);
749 if (ret)
750 goto out_free_digest;
751
752 ret = kexec_purgatory_get_set_symbol(image, "purgatory_sha256_digest",
753 digest, SHA256_DIGEST_SIZE, 0);
754 if (ret)
755 goto out_free_digest;
756 }
757
758out_free_digest:
759 kfree(digest);
760out_free_sha_regions:
761 vfree(sha_regions);
762out_free_desc:
763 kfree(desc);
764out_free_tfm:
765 kfree(tfm);
766out:
767 return ret;
768}
769
770#ifdef CONFIG_ARCH_HAS_KEXEC_PURGATORY
771
772
773
774
775
776
777
778
779
780
781static int kexec_purgatory_setup_kbuf(struct purgatory_info *pi,
782 struct kexec_buf *kbuf)
783{
784 const Elf_Shdr *sechdrs;
785 unsigned long bss_align;
786 unsigned long bss_sz;
787 unsigned long align;
788 int i, ret;
789
790 sechdrs = (void *)pi->ehdr + pi->ehdr->e_shoff;
791 kbuf->buf_align = bss_align = 1;
792 kbuf->bufsz = bss_sz = 0;
793
794 for (i = 0; i < pi->ehdr->e_shnum; i++) {
795 if (!(sechdrs[i].sh_flags & SHF_ALLOC))
796 continue;
797
798 align = sechdrs[i].sh_addralign;
799 if (sechdrs[i].sh_type != SHT_NOBITS) {
800 if (kbuf->buf_align < align)
801 kbuf->buf_align = align;
802 kbuf->bufsz = ALIGN(kbuf->bufsz, align);
803 kbuf->bufsz += sechdrs[i].sh_size;
804 } else {
805 if (bss_align < align)
806 bss_align = align;
807 bss_sz = ALIGN(bss_sz, align);
808 bss_sz += sechdrs[i].sh_size;
809 }
810 }
811 kbuf->bufsz = ALIGN(kbuf->bufsz, bss_align);
812 kbuf->memsz = kbuf->bufsz + bss_sz;
813 if (kbuf->buf_align < bss_align)
814 kbuf->buf_align = bss_align;
815
816 kbuf->buffer = vzalloc(kbuf->bufsz);
817 if (!kbuf->buffer)
818 return -ENOMEM;
819 pi->purgatory_buf = kbuf->buffer;
820
821 ret = kexec_add_buffer(kbuf);
822 if (ret)
823 goto out;
824
825 return 0;
826out:
827 vfree(pi->purgatory_buf);
828 pi->purgatory_buf = NULL;
829 return ret;
830}
831
832
833
834
835
836
837
838
839
840
841
842static int kexec_purgatory_setup_sechdrs(struct purgatory_info *pi,
843 struct kexec_buf *kbuf)
844{
845 unsigned long bss_addr;
846 unsigned long offset;
847 Elf_Shdr *sechdrs;
848 int i;
849
850
851
852
853
854 sechdrs = vzalloc(array_size(sizeof(Elf_Shdr), pi->ehdr->e_shnum));
855 if (!sechdrs)
856 return -ENOMEM;
857 memcpy(sechdrs, (void *)pi->ehdr + pi->ehdr->e_shoff,
858 pi->ehdr->e_shnum * sizeof(Elf_Shdr));
859 pi->sechdrs = sechdrs;
860
861 offset = 0;
862 bss_addr = kbuf->mem + kbuf->bufsz;
863 kbuf->image->start = pi->ehdr->e_entry;
864
865 for (i = 0; i < pi->ehdr->e_shnum; i++) {
866 unsigned long align;
867 void *src, *dst;
868
869 if (!(sechdrs[i].sh_flags & SHF_ALLOC))
870 continue;
871
872 align = sechdrs[i].sh_addralign;
873 if (sechdrs[i].sh_type == SHT_NOBITS) {
874 bss_addr = ALIGN(bss_addr, align);
875 sechdrs[i].sh_addr = bss_addr;
876 bss_addr += sechdrs[i].sh_size;
877 continue;
878 }
879
880 offset = ALIGN(offset, align);
881 if (sechdrs[i].sh_flags & SHF_EXECINSTR &&
882 pi->ehdr->e_entry >= sechdrs[i].sh_addr &&
883 pi->ehdr->e_entry < (sechdrs[i].sh_addr
884 + sechdrs[i].sh_size)) {
885 kbuf->image->start -= sechdrs[i].sh_addr;
886 kbuf->image->start += kbuf->mem + offset;
887 }
888
889 src = (void *)pi->ehdr + sechdrs[i].sh_offset;
890 dst = pi->purgatory_buf + offset;
891 memcpy(dst, src, sechdrs[i].sh_size);
892
893 sechdrs[i].sh_addr = kbuf->mem + offset;
894 sechdrs[i].sh_offset = offset;
895 offset += sechdrs[i].sh_size;
896 }
897
898 return 0;
899}
900
901static int kexec_apply_relocations(struct kimage *image)
902{
903 int i, ret;
904 struct purgatory_info *pi = &image->purgatory_info;
905 const Elf_Shdr *sechdrs;
906
907 sechdrs = (void *)pi->ehdr + pi->ehdr->e_shoff;
908
909 for (i = 0; i < pi->ehdr->e_shnum; i++) {
910 const Elf_Shdr *relsec;
911 const Elf_Shdr *symtab;
912 Elf_Shdr *section;
913
914 relsec = sechdrs + i;
915
916 if (relsec->sh_type != SHT_RELA &&
917 relsec->sh_type != SHT_REL)
918 continue;
919
920
921
922
923
924
925
926 if (relsec->sh_info >= pi->ehdr->e_shnum ||
927 relsec->sh_link >= pi->ehdr->e_shnum)
928 return -ENOEXEC;
929
930 section = pi->sechdrs + relsec->sh_info;
931 symtab = sechdrs + relsec->sh_link;
932
933 if (!(section->sh_flags & SHF_ALLOC))
934 continue;
935
936
937
938
939
940 if (symtab->sh_link >= pi->ehdr->e_shnum)
941
942 continue;
943
944
945
946
947
948 if (relsec->sh_type == SHT_RELA)
949 ret = arch_kexec_apply_relocations_add(pi, section,
950 relsec, symtab);
951 else if (relsec->sh_type == SHT_REL)
952 ret = arch_kexec_apply_relocations(pi, section,
953 relsec, symtab);
954 if (ret)
955 return ret;
956 }
957
958 return 0;
959}
960
961
962
963
964
965
966
967
968
969
970
971
972int kexec_load_purgatory(struct kimage *image, struct kexec_buf *kbuf)
973{
974 struct purgatory_info *pi = &image->purgatory_info;
975 int ret;
976
977 if (kexec_purgatory_size <= 0)
978 return -EINVAL;
979
980 pi->ehdr = (const Elf_Ehdr *)kexec_purgatory;
981
982 ret = kexec_purgatory_setup_kbuf(pi, kbuf);
983 if (ret)
984 return ret;
985
986 ret = kexec_purgatory_setup_sechdrs(pi, kbuf);
987 if (ret)
988 goto out_free_kbuf;
989
990 ret = kexec_apply_relocations(image);
991 if (ret)
992 goto out;
993
994 return 0;
995out:
996 vfree(pi->sechdrs);
997 pi->sechdrs = NULL;
998out_free_kbuf:
999 vfree(pi->purgatory_buf);
1000 pi->purgatory_buf = NULL;
1001 return ret;
1002}
1003
1004
1005
1006
1007
1008
1009
1010
1011static const Elf_Sym *kexec_purgatory_find_symbol(struct purgatory_info *pi,
1012 const char *name)
1013{
1014 const Elf_Shdr *sechdrs;
1015 const Elf_Ehdr *ehdr;
1016 const Elf_Sym *syms;
1017 const char *strtab;
1018 int i, k;
1019
1020 if (!pi->ehdr)
1021 return NULL;
1022
1023 ehdr = pi->ehdr;
1024 sechdrs = (void *)ehdr + ehdr->e_shoff;
1025
1026 for (i = 0; i < ehdr->e_shnum; i++) {
1027 if (sechdrs[i].sh_type != SHT_SYMTAB)
1028 continue;
1029
1030 if (sechdrs[i].sh_link >= ehdr->e_shnum)
1031
1032 continue;
1033 strtab = (void *)ehdr + sechdrs[sechdrs[i].sh_link].sh_offset;
1034 syms = (void *)ehdr + sechdrs[i].sh_offset;
1035
1036
1037 for (k = 0; k < sechdrs[i].sh_size/sizeof(Elf_Sym); k++) {
1038 if (ELF_ST_BIND(syms[k].st_info) != STB_GLOBAL)
1039 continue;
1040
1041 if (strcmp(strtab + syms[k].st_name, name) != 0)
1042 continue;
1043
1044 if (syms[k].st_shndx == SHN_UNDEF ||
1045 syms[k].st_shndx >= ehdr->e_shnum) {
1046 pr_debug("Symbol: %s has bad section index %d.\n",
1047 name, syms[k].st_shndx);
1048 return NULL;
1049 }
1050
1051
1052 return &syms[k];
1053 }
1054 }
1055
1056 return NULL;
1057}
1058
1059void *kexec_purgatory_get_symbol_addr(struct kimage *image, const char *name)
1060{
1061 struct purgatory_info *pi = &image->purgatory_info;
1062 const Elf_Sym *sym;
1063 Elf_Shdr *sechdr;
1064
1065 sym = kexec_purgatory_find_symbol(pi, name);
1066 if (!sym)
1067 return ERR_PTR(-EINVAL);
1068
1069 sechdr = &pi->sechdrs[sym->st_shndx];
1070
1071
1072
1073
1074
1075 return (void *)(sechdr->sh_addr + sym->st_value);
1076}
1077
1078
1079
1080
1081
1082int kexec_purgatory_get_set_symbol(struct kimage *image, const char *name,
1083 void *buf, unsigned int size, bool get_value)
1084{
1085 struct purgatory_info *pi = &image->purgatory_info;
1086 const Elf_Sym *sym;
1087 Elf_Shdr *sec;
1088 char *sym_buf;
1089
1090 sym = kexec_purgatory_find_symbol(pi, name);
1091 if (!sym)
1092 return -EINVAL;
1093
1094 if (sym->st_size != size) {
1095 pr_err("symbol %s size mismatch: expected %lu actual %u\n",
1096 name, (unsigned long)sym->st_size, size);
1097 return -EINVAL;
1098 }
1099
1100 sec = pi->sechdrs + sym->st_shndx;
1101
1102 if (sec->sh_type == SHT_NOBITS) {
1103 pr_err("symbol %s is in a bss section. Cannot %s\n", name,
1104 get_value ? "get" : "set");
1105 return -EINVAL;
1106 }
1107
1108 sym_buf = (char *)pi->purgatory_buf + sec->sh_offset + sym->st_value;
1109
1110 if (get_value)
1111 memcpy((void *)buf, sym_buf, size);
1112 else
1113 memcpy((void *)sym_buf, buf, size);
1114
1115 return 0;
1116}
1117#endif
1118
1119int crash_exclude_mem_range(struct crash_mem *mem,
1120 unsigned long long mstart, unsigned long long mend)
1121{
1122 int i, j;
1123 unsigned long long start, end;
1124 struct crash_mem_range temp_range = {0, 0};
1125
1126 for (i = 0; i < mem->nr_ranges; i++) {
1127 start = mem->ranges[i].start;
1128 end = mem->ranges[i].end;
1129
1130 if (mstart > end || mend < start)
1131 continue;
1132
1133
1134 if (mstart < start)
1135 mstart = start;
1136 if (mend > end)
1137 mend = end;
1138
1139
1140 if (mstart == start && mend == end) {
1141 mem->ranges[i].start = 0;
1142 mem->ranges[i].end = 0;
1143 if (i < mem->nr_ranges - 1) {
1144
1145 for (j = i; j < mem->nr_ranges - 1; j++) {
1146 mem->ranges[j].start =
1147 mem->ranges[j+1].start;
1148 mem->ranges[j].end =
1149 mem->ranges[j+1].end;
1150 }
1151 }
1152 mem->nr_ranges--;
1153 return 0;
1154 }
1155
1156 if (mstart > start && mend < end) {
1157
1158 mem->ranges[i].end = mstart - 1;
1159 temp_range.start = mend + 1;
1160 temp_range.end = end;
1161 } else if (mstart != start)
1162 mem->ranges[i].end = mstart - 1;
1163 else
1164 mem->ranges[i].start = mend + 1;
1165 break;
1166 }
1167
1168
1169 if (!temp_range.end)
1170 return 0;
1171
1172
1173 if (i == mem->max_nr_ranges - 1)
1174 return -ENOMEM;
1175
1176
1177 j = i + 1;
1178 if (j < mem->nr_ranges) {
1179
1180 for (i = mem->nr_ranges - 1; i >= j; i--)
1181 mem->ranges[i + 1] = mem->ranges[i];
1182 }
1183
1184 mem->ranges[j].start = temp_range.start;
1185 mem->ranges[j].end = temp_range.end;
1186 mem->nr_ranges++;
1187 return 0;
1188}
1189
1190int crash_prepare_elf64_headers(struct crash_mem *mem, int kernel_map,
1191 void **addr, unsigned long *sz)
1192{
1193 Elf64_Ehdr *ehdr;
1194 Elf64_Phdr *phdr;
1195 unsigned long nr_cpus = num_possible_cpus(), nr_phdr, elf_sz;
1196 unsigned char *buf;
1197 unsigned int cpu, i;
1198 unsigned long long notes_addr;
1199 unsigned long mstart, mend;
1200
1201
1202 nr_phdr = nr_cpus + 1;
1203 nr_phdr += mem->nr_ranges;
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213 nr_phdr++;
1214 elf_sz = sizeof(Elf64_Ehdr) + nr_phdr * sizeof(Elf64_Phdr);
1215 elf_sz = ALIGN(elf_sz, ELF_CORE_HEADER_ALIGN);
1216
1217 buf = vzalloc(elf_sz);
1218 if (!buf)
1219 return -ENOMEM;
1220
1221 ehdr = (Elf64_Ehdr *)buf;
1222 phdr = (Elf64_Phdr *)(ehdr + 1);
1223 memcpy(ehdr->e_ident, ELFMAG, SELFMAG);
1224 ehdr->e_ident[EI_CLASS] = ELFCLASS64;
1225 ehdr->e_ident[EI_DATA] = ELFDATA2LSB;
1226 ehdr->e_ident[EI_VERSION] = EV_CURRENT;
1227 ehdr->e_ident[EI_OSABI] = ELF_OSABI;
1228 memset(ehdr->e_ident + EI_PAD, 0, EI_NIDENT - EI_PAD);
1229 ehdr->e_type = ET_CORE;
1230 ehdr->e_machine = ELF_ARCH;
1231 ehdr->e_version = EV_CURRENT;
1232 ehdr->e_phoff = sizeof(Elf64_Ehdr);
1233 ehdr->e_ehsize = sizeof(Elf64_Ehdr);
1234 ehdr->e_phentsize = sizeof(Elf64_Phdr);
1235
1236
1237 for_each_present_cpu(cpu) {
1238 phdr->p_type = PT_NOTE;
1239 notes_addr = per_cpu_ptr_to_phys(per_cpu_ptr(crash_notes, cpu));
1240 phdr->p_offset = phdr->p_paddr = notes_addr;
1241 phdr->p_filesz = phdr->p_memsz = sizeof(note_buf_t);
1242 (ehdr->e_phnum)++;
1243 phdr++;
1244 }
1245
1246
1247 phdr->p_type = PT_NOTE;
1248 phdr->p_offset = phdr->p_paddr = paddr_vmcoreinfo_note();
1249 phdr->p_filesz = phdr->p_memsz = VMCOREINFO_NOTE_SIZE;
1250 (ehdr->e_phnum)++;
1251 phdr++;
1252
1253
1254 if (kernel_map) {
1255 phdr->p_type = PT_LOAD;
1256 phdr->p_flags = PF_R|PF_W|PF_X;
1257 phdr->p_vaddr = (Elf64_Addr)_text;
1258 phdr->p_filesz = phdr->p_memsz = _end - _text;
1259 phdr->p_offset = phdr->p_paddr = __pa_symbol(_text);
1260 ehdr->e_phnum++;
1261 phdr++;
1262 }
1263
1264
1265 for (i = 0; i < mem->nr_ranges; i++) {
1266 mstart = mem->ranges[i].start;
1267 mend = mem->ranges[i].end;
1268
1269 phdr->p_type = PT_LOAD;
1270 phdr->p_flags = PF_R|PF_W|PF_X;
1271 phdr->p_offset = mstart;
1272
1273 phdr->p_paddr = mstart;
1274 phdr->p_vaddr = (unsigned long long) __va(mstart);
1275 phdr->p_filesz = phdr->p_memsz = mend - mstart + 1;
1276 phdr->p_align = 0;
1277 ehdr->e_phnum++;
1278 phdr++;
1279 pr_debug("Crash PT_LOAD elf header. phdr=%p vaddr=0x%llx, paddr=0x%llx, sz=0x%llx e_phnum=%d p_offset=0x%llx\n",
1280 phdr, phdr->p_vaddr, phdr->p_paddr, phdr->p_filesz,
1281 ehdr->e_phnum, phdr->p_offset);
1282 }
1283
1284 *addr = buf;
1285 *sz = elf_sz;
1286 return 0;
1287}
1288