1 // SPDX-License-Identifier: GPL-2.0-only
3 * kexec.c - kexec_load system call
4 * Copyright (C) 2002-2004 Eric Biederman <ebiederm@xmission.com>
7 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
9 #include <linux/capability.h>
11 #include <linux/file.h>
12 #include <linux/security.h>
13 #include <linux/kexec.h>
14 #include <linux/mutex.h>
15 #include <linux/list.h>
16 #include <linux/syscalls.h>
17 #include <linux/vmalloc.h>
18 #include <linux/slab.h>
20 #include "kexec_internal.h"
22 static int kimage_alloc_init(struct kimage
**rimage
, unsigned long entry
,
23 unsigned long nr_segments
,
24 struct kexec_segment
*segments
,
29 bool kexec_on_panic
= flags
& KEXEC_ON_CRASH
;
32 /* Verify we have a valid entry point */
33 if ((entry
< phys_to_boot_phys(crashk_res
.start
)) ||
34 (entry
> phys_to_boot_phys(crashk_res
.end
)))
35 return -EADDRNOTAVAIL
;
38 /* Allocate and initialize a controlling structure */
39 image
= do_kimage_alloc_init();
44 image
->nr_segments
= nr_segments
;
45 memcpy(image
->segment
, segments
, nr_segments
* sizeof(*segments
));
48 /* Enable special crash kernel control page alloc policy. */
49 image
->control_page
= crashk_res
.start
;
50 image
->type
= KEXEC_TYPE_CRASH
;
53 ret
= sanity_check_segment_list(image
);
58 * Find a location for the control code buffer, and add it
59 * the vector of segments so that it's pages will also be
60 * counted as destination pages.
63 image
->control_code_page
= kimage_alloc_control_pages(image
,
64 get_order(KEXEC_CONTROL_PAGE_SIZE
));
65 if (!image
->control_code_page
) {
66 pr_err("Could not allocate control_code_buffer\n");
70 if (!kexec_on_panic
) {
71 image
->swap_page
= kimage_alloc_control_pages(image
, 0);
72 if (!image
->swap_page
) {
73 pr_err("Could not allocate swap buffer\n");
74 goto out_free_control_pages
;
80 out_free_control_pages
:
81 kimage_free_page_list(&image
->control_pages
);
87 static int do_kexec_load(unsigned long entry
, unsigned long nr_segments
,
88 struct kexec_segment
*segments
, unsigned long flags
)
90 struct kimage
**dest_image
, *image
;
95 * Because we write directly to the reserved memory region when loading
96 * crash kernels we need a mutex here to prevent multiple crash kernels
97 * from attempting to load simultaneously, and to prevent a crash kernel
98 * from loading over the top of a in use crash kernel.
100 * KISS: always take the mutex.
102 if (!mutex_trylock(&kexec_mutex
))
105 if (flags
& KEXEC_ON_CRASH
) {
106 dest_image
= &kexec_crash_image
;
107 if (kexec_crash_image
)
108 arch_kexec_unprotect_crashkres();
110 dest_image
= &kexec_image
;
113 if (nr_segments
== 0) {
114 /* Uninstall image */
115 kimage_free(xchg(dest_image
, NULL
));
119 if (flags
& KEXEC_ON_CRASH
) {
121 * Loading another kernel to switch to if this one
122 * crashes. Free any current crash dump kernel before
125 kimage_free(xchg(&kexec_crash_image
, NULL
));
128 ret
= kimage_alloc_init(&image
, entry
, nr_segments
, segments
, flags
);
132 if (flags
& KEXEC_PRESERVE_CONTEXT
)
133 image
->preserve_context
= 1;
135 ret
= machine_kexec_prepare(image
);
140 * Some architecture(like S390) may touch the crash memory before
141 * machine_kexec_prepare(), we must copy vmcoreinfo data after it.
143 ret
= kimage_crash_copy_vmcoreinfo(image
);
147 for (i
= 0; i
< nr_segments
; i
++) {
148 ret
= kimage_load_segment(image
, &image
->segment
[i
]);
153 kimage_terminate(image
);
155 ret
= machine_kexec_post_load(image
);
159 /* Install the new kernel and uninstall the old */
160 image
= xchg(dest_image
, image
);
163 if ((flags
& KEXEC_ON_CRASH
) && kexec_crash_image
)
164 arch_kexec_protect_crashkres();
168 mutex_unlock(&kexec_mutex
);
173 * Exec Kernel system call: for obvious reasons only root may call it.
175 * This call breaks up into three pieces.
176 * - A generic part which loads the new kernel from the current
177 * address space, and very carefully places the data in the
180 * - A generic part that interacts with the kernel and tells all of
181 * the devices to shut down. Preventing on-going dmas, and placing
182 * the devices in a consistent state so a later kernel can
185 * - A machine specific part that includes the syscall number
186 * and then copies the image to it's final destination. And
187 * jumps into the image at entry.
189 * kexec does not sync, or unmount filesystems so if you need
190 * that to happen you need to do that yourself.
193 static inline int kexec_load_check(unsigned long nr_segments
,
198 /* We only trust the superuser with rebooting the system. */
199 if (!capable(CAP_SYS_BOOT
) || kexec_load_disabled
)
202 /* Permit LSMs and IMA to fail the kexec */
203 result
= security_kernel_load_data(LOADING_KEXEC_IMAGE
, false);
208 * kexec can be used to circumvent module loading restrictions, so
209 * prevent loading in that case
211 result
= security_locked_down(LOCKDOWN_KEXEC
);
216 * Verify we have a legal set of flags
217 * This leaves us room for future extensions.
219 if ((flags
& KEXEC_FLAGS
) != (flags
& ~KEXEC_ARCH_MASK
))
222 /* Put an artificial cap on the number
223 * of segments passed to kexec_load.
225 if (nr_segments
> KEXEC_SEGMENT_MAX
)
231 SYSCALL_DEFINE4(kexec_load
, unsigned long, entry
, unsigned long, nr_segments
,
232 struct kexec_segment __user
*, segments
, unsigned long, flags
)
234 struct kexec_segment
*ksegments
;
235 unsigned long result
;
237 result
= kexec_load_check(nr_segments
, flags
);
241 /* Verify we are on the appropriate architecture */
242 if (((flags
& KEXEC_ARCH_MASK
) != KEXEC_ARCH
) &&
243 ((flags
& KEXEC_ARCH_MASK
) != KEXEC_ARCH_DEFAULT
))
246 ksegments
= memdup_user(segments
, nr_segments
* sizeof(ksegments
[0]));
247 if (IS_ERR(ksegments
))
248 return PTR_ERR(ksegments
);
250 result
= do_kexec_load(entry
, nr_segments
, ksegments
, flags
);
257 COMPAT_SYSCALL_DEFINE4(kexec_load
, compat_ulong_t
, entry
,
258 compat_ulong_t
, nr_segments
,
259 struct compat_kexec_segment __user
*, segments
,
260 compat_ulong_t
, flags
)
262 struct compat_kexec_segment in
;
263 struct kexec_segment
*ksegments
;
264 unsigned long i
, result
;
266 result
= kexec_load_check(nr_segments
, flags
);
270 /* Don't allow clients that don't understand the native
271 * architecture to do anything.
273 if ((flags
& KEXEC_ARCH_MASK
) == KEXEC_ARCH_DEFAULT
)
276 ksegments
= kmalloc_array(nr_segments
, sizeof(ksegments
[0]),
281 for (i
= 0; i
< nr_segments
; i
++) {
282 result
= copy_from_user(&in
, &segments
[i
], sizeof(in
));
286 ksegments
[i
].buf
= compat_ptr(in
.buf
);
287 ksegments
[i
].bufsz
= in
.bufsz
;
288 ksegments
[i
].mem
= in
.mem
;
289 ksegments
[i
].memsz
= in
.memsz
;
292 result
= do_kexec_load(entry
, nr_segments
, ksegments
, flags
);