kexec.c 8.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * kexec.c - kexec_load system call
  4. * Copyright (C) 2002-2004 Eric Biederman <ebiederm@xmission.com>
  5. */
  6. #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  7. #include <linux/capability.h>
  8. #include <linux/mm.h>
  9. #include <linux/file.h>
  10. #include <linux/security.h>
  11. #include <linux/kexec.h>
  12. #include <linux/mutex.h>
  13. #include <linux/list.h>
  14. #include <linux/syscalls.h>
  15. #include <linux/vmalloc.h>
  16. #include <linux/slab.h>
  17. #include "kexec_internal.h"
  18. static int copy_user_segment_list(struct kimage *image,
  19. unsigned long nr_segments,
  20. struct kexec_segment __user *segments)
  21. {
  22. int ret;
  23. size_t segment_bytes;
  24. /* Read in the segments */
  25. image->nr_segments = nr_segments;
  26. segment_bytes = nr_segments * sizeof(*segments);
  27. ret = copy_from_user(image->segment, segments, segment_bytes);
  28. if (ret)
  29. ret = -EFAULT;
  30. return ret;
  31. }
  32. static int kimage_alloc_init(struct kimage **rimage, unsigned long entry,
  33. unsigned long nr_segments,
  34. struct kexec_segment __user *segments,
  35. unsigned long flags)
  36. {
  37. int ret;
  38. struct kimage *image;
  39. bool kexec_on_panic = flags & KEXEC_ON_CRASH;
  40. if (kexec_on_panic) {
  41. /* Verify we have a valid entry point */
  42. if ((entry < phys_to_boot_phys(crashk_res.start)) ||
  43. (entry > phys_to_boot_phys(crashk_res.end)))
  44. return -EADDRNOTAVAIL;
  45. }
  46. /* Allocate and initialize a controlling structure */
  47. image = do_kimage_alloc_init();
  48. if (!image)
  49. return -ENOMEM;
  50. image->start = entry;
  51. ret = copy_user_segment_list(image, nr_segments, segments);
  52. if (ret)
  53. goto out_free_image;
  54. if (kexec_on_panic) {
  55. /* Enable special crash kernel control page alloc policy. */
  56. image->control_page = crashk_res.start;
  57. image->type = KEXEC_TYPE_CRASH;
  58. }
  59. ret = sanity_check_segment_list(image);
  60. if (ret)
  61. goto out_free_image;
  62. /*
  63. * Find a location for the control code buffer, and add it
  64. * the vector of segments so that it's pages will also be
  65. * counted as destination pages.
  66. */
  67. ret = -ENOMEM;
  68. image->control_code_page = kimage_alloc_control_pages(image,
  69. get_order(KEXEC_CONTROL_PAGE_SIZE));
  70. if (!image->control_code_page) {
  71. pr_err("Could not allocate control_code_buffer\n");
  72. goto out_free_image;
  73. }
  74. if (!kexec_on_panic) {
  75. image->swap_page = kimage_alloc_control_pages(image, 0);
  76. if (!image->swap_page) {
  77. pr_err("Could not allocate swap buffer\n");
  78. goto out_free_control_pages;
  79. }
  80. }
  81. *rimage = image;
  82. return 0;
  83. out_free_control_pages:
  84. kimage_free_page_list(&image->control_pages);
  85. out_free_image:
  86. kfree(image);
  87. return ret;
  88. }
  89. static int do_kexec_load(unsigned long entry, unsigned long nr_segments,
  90. struct kexec_segment __user *segments, unsigned long flags)
  91. {
  92. struct kimage **dest_image, *image;
  93. unsigned long i;
  94. int ret;
  95. if (flags & KEXEC_ON_CRASH) {
  96. dest_image = &kexec_crash_image;
  97. if (kexec_crash_image)
  98. arch_kexec_unprotect_crashkres();
  99. } else {
  100. dest_image = &kexec_image;
  101. }
  102. if (nr_segments == 0) {
  103. /* Uninstall image */
  104. kimage_free(xchg(dest_image, NULL));
  105. return 0;
  106. }
  107. if (flags & KEXEC_ON_CRASH) {
  108. /*
  109. * Loading another kernel to switch to if this one
  110. * crashes. Free any current crash dump kernel before
  111. * we corrupt it.
  112. */
  113. kimage_free(xchg(&kexec_crash_image, NULL));
  114. }
  115. ret = kimage_alloc_init(&image, entry, nr_segments, segments, flags);
  116. if (ret)
  117. return ret;
  118. if (flags & KEXEC_PRESERVE_CONTEXT)
  119. image->preserve_context = 1;
  120. ret = machine_kexec_prepare(image);
  121. if (ret)
  122. goto out;
  123. /*
  124. * Some architecture(like S390) may touch the crash memory before
  125. * machine_kexec_prepare(), we must copy vmcoreinfo data after it.
  126. */
  127. ret = kimage_crash_copy_vmcoreinfo(image);
  128. if (ret)
  129. goto out;
  130. for (i = 0; i < nr_segments; i++) {
  131. ret = kimage_load_segment(image, &image->segment[i]);
  132. if (ret)
  133. goto out;
  134. }
  135. kimage_terminate(image);
  136. ret = machine_kexec_post_load(image);
  137. if (ret)
  138. goto out;
  139. /* Install the new kernel and uninstall the old */
  140. image = xchg(dest_image, image);
  141. out:
  142. if ((flags & KEXEC_ON_CRASH) && kexec_crash_image)
  143. arch_kexec_protect_crashkres();
  144. kimage_free(image);
  145. return ret;
  146. }
  147. /*
  148. * Exec Kernel system call: for obvious reasons only root may call it.
  149. *
  150. * This call breaks up into three pieces.
  151. * - A generic part which loads the new kernel from the current
  152. * address space, and very carefully places the data in the
  153. * allocated pages.
  154. *
  155. * - A generic part that interacts with the kernel and tells all of
  156. * the devices to shut down. Preventing on-going dmas, and placing
  157. * the devices in a consistent state so a later kernel can
  158. * reinitialize them.
  159. *
  160. * - A machine specific part that includes the syscall number
  161. * and then copies the image to it's final destination. And
  162. * jumps into the image at entry.
  163. *
  164. * kexec does not sync, or unmount filesystems so if you need
  165. * that to happen you need to do that yourself.
  166. */
  167. static inline int kexec_load_check(unsigned long nr_segments,
  168. unsigned long flags)
  169. {
  170. int result;
  171. /* We only trust the superuser with rebooting the system. */
  172. if (!capable(CAP_SYS_BOOT) || kexec_load_disabled)
  173. return -EPERM;
  174. /* Permit LSMs and IMA to fail the kexec */
  175. result = security_kernel_load_data(LOADING_KEXEC_IMAGE, false);
  176. if (result < 0)
  177. return result;
  178. /*
  179. * kexec can be used to circumvent module loading restrictions, so
  180. * prevent loading in that case
  181. */
  182. result = security_locked_down(LOCKDOWN_KEXEC);
  183. if (result)
  184. return result;
  185. /*
  186. * Verify we have a legal set of flags
  187. * This leaves us room for future extensions.
  188. */
  189. if ((flags & KEXEC_FLAGS) != (flags & ~KEXEC_ARCH_MASK))
  190. return -EINVAL;
  191. /* Put an artificial cap on the number
  192. * of segments passed to kexec_load.
  193. */
  194. if (nr_segments > KEXEC_SEGMENT_MAX)
  195. return -EINVAL;
  196. return 0;
  197. }
  198. SYSCALL_DEFINE4(kexec_load, unsigned long, entry, unsigned long, nr_segments,
  199. struct kexec_segment __user *, segments, unsigned long, flags)
  200. {
  201. int result;
  202. result = kexec_load_check(nr_segments, flags);
  203. if (result)
  204. return result;
  205. /* Verify we are on the appropriate architecture */
  206. if (((flags & KEXEC_ARCH_MASK) != KEXEC_ARCH) &&
  207. ((flags & KEXEC_ARCH_MASK) != KEXEC_ARCH_DEFAULT))
  208. return -EINVAL;
  209. /* Because we write directly to the reserved memory
  210. * region when loading crash kernels we need a mutex here to
  211. * prevent multiple crash kernels from attempting to load
  212. * simultaneously, and to prevent a crash kernel from loading
  213. * over the top of a in use crash kernel.
  214. *
  215. * KISS: always take the mutex.
  216. */
  217. if (!mutex_trylock(&kexec_mutex))
  218. return -EBUSY;
  219. result = do_kexec_load(entry, nr_segments, segments, flags);
  220. mutex_unlock(&kexec_mutex);
  221. return result;
  222. }
  223. #ifdef CONFIG_COMPAT
  224. COMPAT_SYSCALL_DEFINE4(kexec_load, compat_ulong_t, entry,
  225. compat_ulong_t, nr_segments,
  226. struct compat_kexec_segment __user *, segments,
  227. compat_ulong_t, flags)
  228. {
  229. struct compat_kexec_segment in;
  230. struct kexec_segment *ksegments;
  231. unsigned long i, result;
  232. result = kexec_load_check(nr_segments, flags);
  233. if (result)
  234. return result;
  235. /* Don't allow clients that don't understand the native
  236. * architecture to do anything.
  237. */
  238. if ((flags & KEXEC_ARCH_MASK) == KEXEC_ARCH_DEFAULT)
  239. return -EINVAL;
  240. ksegments = kmalloc_array(nr_segments, sizeof(ksegments[0]),
  241. GFP_KERNEL);
  242. if (!ksegments)
  243. return -ENOMEM;
  244. for (i = 0; i < nr_segments; i++) {
  245. result = copy_from_user(&in, &segments[i], sizeof(in));
  246. if (result)
  247. goto fail;
  248. ksegments[i].buf = compat_ptr(in.buf);
  249. ksegments[i].bufsz = in.bufsz;
  250. ksegments[i].mem = in.mem;
  251. ksegments[i].memsz = in.memsz;
  252. }
  253. /* Because we write directly to the reserved memory
  254. * region when loading crash kernels we need a mutex here to
  255. * prevent multiple crash kernels from attempting to load
  256. * simultaneously, and to prevent a crash kernel from loading
  257. * over the top of a in use crash kernel.
  258. *
  259. * KISS: always take the mutex.
  260. */
  261. if (!mutex_trylock(&kexec_mutex))
  262. return -EBUSY;
  263. result = do_kexec_load(entry, nr_segments, ksegments, flags);
  264. mutex_unlock(&kexec_mutex);
  265. fail:
  266. kfree(ksegments);
  267. return result;
  268. }
  269. #endif