1 // SPDX-License-Identifier: GPL-2.0-only 1
2 /*
3 * crash.c - kernel crash support code.
4 * Copyright (C) 2002-2004 Eric Biederman <eb
5 */
6
7 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
8
9 #include <linux/buildid.h>
10 #include <linux/init.h>
11 #include <linux/utsname.h>
12 #include <linux/vmalloc.h>
13 #include <linux/sizes.h>
14 #include <linux/kexec.h>
15 #include <linux/memory.h>
16 #include <linux/mm.h>
17 #include <linux/cpuhotplug.h>
18 #include <linux/memblock.h>
19 #include <linux/kmemleak.h>
20 #include <linux/crash_core.h>
21 #include <linux/reboot.h>
22 #include <linux/btf.h>
23 #include <linux/objtool.h>
24
25 #include <asm/page.h>
26 #include <asm/sections.h>
27
28 #include <crypto/sha1.h>
29
30 #include "kallsyms_internal.h"
31 #include "kexec_internal.h"
32
33 /* Per cpu memory for storing cpu states in ca
34 note_buf_t __percpu *crash_notes;
35
36 #ifdef CONFIG_CRASH_DUMP
37
38 int kimage_crash_copy_vmcoreinfo(struct kimage
39 {
40 struct page *vmcoreinfo_page;
41 void *safecopy;
42
43 if (!IS_ENABLED(CONFIG_CRASH_DUMP))
44 return 0;
45 if (image->type != KEXEC_TYPE_CRASH)
46 return 0;
47
48 /*
49 * For kdump, allocate one vmcoreinfo
50 * crash memory. as we have arch_kexec
51 * after kexec syscall, we naturally p
52 * (even read) access under kernel dir
53 * the other hand, we still need to op
54 * happens to generate vmcoreinfo note
55 * vmap for this purpose.
56 */
57 vmcoreinfo_page = kimage_alloc_control
58 if (!vmcoreinfo_page) {
59 pr_warn("Could not allocate vm
60 return -ENOMEM;
61 }
62 safecopy = vmap(&vmcoreinfo_page, 1, V
63 if (!safecopy) {
64 pr_warn("Could not vmap vmcore
65 return -ENOMEM;
66 }
67
68 image->vmcoreinfo_data_copy = safecopy
69 crash_update_vmcoreinfo_safecopy(safec
70
71 return 0;
72 }
73
74
75
76 int kexec_should_crash(struct task_struct *p)
77 {
78 /*
79 * If crash_kexec_post_notifiers is en
80 * crash_kexec() here yet, which must
81 * notifiers in panic().
82 */
83 if (crash_kexec_post_notifiers)
84 return 0;
85 /*
86 * There are 4 panic() calls in make_t
87 * corresponds to each of these 4 cond
88 */
89 if (in_interrupt() || !p->pid || is_gl
90 return 1;
91 return 0;
92 }
93
94 int kexec_crash_loaded(void)
95 {
96 return !!kexec_crash_image;
97 }
98 EXPORT_SYMBOL_GPL(kexec_crash_loaded);
99
100 /*
101 * No panic_cpu check version of crash_kexec()
102 * only when panic_cpu holds the current CPU n
103 * which processes crash_kexec routines.
104 */
105 void __noclone __crash_kexec(struct pt_regs *r
106 {
107 /* Take the kexec_lock here to prevent
108 * running on one cpu from replacing t
109 * we are using after a panic on a dif
110 *
111 * If the crash kernel was not located
112 * of memory the xchg(&kexec_crash_ima
113 * sufficient. But since I reuse the
114 */
115 if (kexec_trylock()) {
116 if (kexec_crash_image) {
117 struct pt_regs fixed_r
118
119 crash_setup_regs(&fixe
120 crash_save_vmcoreinfo(
121 machine_crash_shutdown
122 machine_kexec(kexec_cr
123 }
124 kexec_unlock();
125 }
126 }
127 STACK_FRAME_NON_STANDARD(__crash_kexec);
128
129 __bpf_kfunc void crash_kexec(struct pt_regs *r
130 {
131 int old_cpu, this_cpu;
132
133 /*
134 * Only one CPU is allowed to execute
135 * panic(). Otherwise parallel calls
136 * may stop each other. To exclude th
137 */
138 old_cpu = PANIC_CPU_INVALID;
139 this_cpu = raw_smp_processor_id();
140
141 if (atomic_try_cmpxchg(&panic_cpu, &ol
142 /* This is the 1st CPU which c
143 __crash_kexec(regs);
144
145 /*
146 * Reset panic_cpu to allow an
147 * call.
148 */
149 atomic_set(&panic_cpu, PANIC_C
150 }
151 }
152
153 static inline resource_size_t crash_resource_s
154 {
155 return !res->end ? 0 : resource_size(r
156 }
157
158
159
160
161 int crash_prepare_elf64_headers(struct crash_m
162 void **addr, unsigne
163 {
164 Elf64_Ehdr *ehdr;
165 Elf64_Phdr *phdr;
166 unsigned long nr_cpus = num_possible_c
167 unsigned char *buf;
168 unsigned int cpu, i;
169 unsigned long long notes_addr;
170 unsigned long mstart, mend;
171
172 /* extra phdr for vmcoreinfo ELF note
173 nr_phdr = nr_cpus + 1;
174 nr_phdr += mem->nr_ranges;
175
176 /*
177 * kexec-tools creates an extra PT_LOA
178 * area (for example, ffffffff80000000
179 * I think this is required by tools l
180 * memory will be mapped in two ELF he
181 * text virtual addresses and other wi
182 */
183
184 nr_phdr++;
185 elf_sz = sizeof(Elf64_Ehdr) + nr_phdr
186 elf_sz = ALIGN(elf_sz, ELF_CORE_HEADER
187
188 buf = vzalloc(elf_sz);
189 if (!buf)
190 return -ENOMEM;
191
192 ehdr = (Elf64_Ehdr *)buf;
193 phdr = (Elf64_Phdr *)(ehdr + 1);
194 memcpy(ehdr->e_ident, ELFMAG, SELFMAG)
195 ehdr->e_ident[EI_CLASS] = ELFCLASS64;
196 ehdr->e_ident[EI_DATA] = ELFDATA2LSB;
197 ehdr->e_ident[EI_VERSION] = EV_CURRENT
198 ehdr->e_ident[EI_OSABI] = ELF_OSABI;
199 memset(ehdr->e_ident + EI_PAD, 0, EI_N
200 ehdr->e_type = ET_CORE;
201 ehdr->e_machine = ELF_ARCH;
202 ehdr->e_version = EV_CURRENT;
203 ehdr->e_phoff = sizeof(Elf64_Ehdr);
204 ehdr->e_ehsize = sizeof(Elf64_Ehdr);
205 ehdr->e_phentsize = sizeof(Elf64_Phdr)
206
207 /* Prepare one phdr of type PT_NOTE fo
208 for_each_possible_cpu(cpu) {
209 phdr->p_type = PT_NOTE;
210 notes_addr = per_cpu_ptr_to_ph
211 phdr->p_offset = phdr->p_paddr
212 phdr->p_filesz = phdr->p_memsz
213 (ehdr->e_phnum)++;
214 phdr++;
215 }
216
217 /* Prepare one PT_NOTE header for vmco
218 phdr->p_type = PT_NOTE;
219 phdr->p_offset = phdr->p_paddr = paddr
220 phdr->p_filesz = phdr->p_memsz = VMCOR
221 (ehdr->e_phnum)++;
222 phdr++;
223
224 /* Prepare PT_LOAD type program header
225 if (need_kernel_map) {
226 phdr->p_type = PT_LOAD;
227 phdr->p_flags = PF_R|PF_W|PF_X
228 phdr->p_vaddr = (unsigned long
229 phdr->p_filesz = phdr->p_memsz
230 phdr->p_offset = phdr->p_paddr
231 ehdr->e_phnum++;
232 phdr++;
233 }
234
235 /* Go through all the ranges in mem->r
236 for (i = 0; i < mem->nr_ranges; i++) {
237 mstart = mem->ranges[i].start;
238 mend = mem->ranges[i].end;
239
240 phdr->p_type = PT_LOAD;
241 phdr->p_flags = PF_R|PF_W|PF_X
242 phdr->p_offset = mstart;
243
244 phdr->p_paddr = mstart;
245 phdr->p_vaddr = (unsigned long
246 phdr->p_filesz = phdr->p_memsz
247 phdr->p_align = 0;
248 ehdr->e_phnum++;
249 #ifdef CONFIG_KEXEC_FILE
250 kexec_dprintk("Crash PT_LOAD E
251 phdr, phdr->p_va
252 ehdr->e_phnum, p
253 #endif
254 phdr++;
255 }
256
257 *addr = buf;
258 *sz = elf_sz;
259 return 0;
260 }
261
262 int crash_exclude_mem_range(struct crash_mem *
263 unsigned long long
264 {
265 int i;
266 unsigned long long start, end, p_start
267
268 for (i = 0; i < mem->nr_ranges; i++) {
269 start = mem->ranges[i].start;
270 end = mem->ranges[i].end;
271 p_start = mstart;
272 p_end = mend;
273
274 if (p_start > end)
275 continue;
276
277 /*
278 * Because the memory ranges i
279 * ascending order, when we de
280 * immediately exit the for lo
281 * ranges will definitely be o
282 * for.
283 */
284 if (p_end < start)
285 break;
286
287 /* Truncate any area outside o
288 if (p_start < start)
289 p_start = start;
290 if (p_end > end)
291 p_end = end;
292
293 /* Found completely overlappin
294 if (p_start == start && p_end
295 memmove(&mem->ranges[i
296 (mem->nr_range
297 i--;
298 mem->nr_ranges--;
299 } else if (p_start > start &&
300 /* Split original rang
301 if (mem->nr_ranges >=
302 return -ENOMEM
303
304 memmove(&mem->ranges[i
305 (mem->nr_range
306
307 mem->ranges[i].end = p
308 mem->ranges[i + 1].sta
309 mem->ranges[i + 1].end
310
311 i++;
312 mem->nr_ranges++;
313 } else if (p_start != start)
314 mem->ranges[i].end = p
315 else
316 mem->ranges[i].start =
317 }
318
319 return 0;
320 }
321
322 ssize_t crash_get_memory_size(void)
323 {
324 ssize_t size = 0;
325
326 if (!kexec_trylock())
327 return -EBUSY;
328
329 size += crash_resource_size(&crashk_re
330 size += crash_resource_size(&crashk_lo
331
332 kexec_unlock();
333 return size;
334 }
335
336 static int __crash_shrink_memory(struct resour
337 unsigned long
338 {
339 struct resource *ram_res;
340
341 ram_res = kzalloc(sizeof(*ram_res), GF
342 if (!ram_res)
343 return -ENOMEM;
344
345 ram_res->start = old_res->start + new_
346 ram_res->end = old_res->end;
347 ram_res->flags = IORESOURCE_BUSY | IOR
348 ram_res->name = "System RAM";
349
350 if (!new_size) {
351 release_resource(old_res);
352 old_res->start = 0;
353 old_res->end = 0;
354 } else {
355 crashk_res.end = ram_res->star
356 }
357
358 crash_free_reserved_phys_range(ram_res
359 insert_resource(&iomem_resource, ram_r
360
361 return 0;
362 }
363
364 int crash_shrink_memory(unsigned long new_size
365 {
366 int ret = 0;
367 unsigned long old_size, low_size;
368
369 if (!kexec_trylock())
370 return -EBUSY;
371
372 if (kexec_crash_image) {
373 ret = -ENOENT;
374 goto unlock;
375 }
376
377 low_size = crash_resource_size(&crashk
378 old_size = crash_resource_size(&crashk
379 new_size = roundup(new_size, KEXEC_CRA
380 if (new_size >= old_size) {
381 ret = (new_size == old_size) ?
382 goto unlock;
383 }
384
385 /*
386 * (low_size > new_size) implies that
387 * This also means that if low_size is
388 *
389 * If low_size is greater than 0, (low
390 * crashk_low_res also needs to be shr
391 * needs to be shrunken.
392 */
393 if (low_size > new_size) {
394 ret = __crash_shrink_memory(&c
395 if (ret)
396 goto unlock;
397
398 ret = __crash_shrink_memory(&c
399 } else {
400 ret = __crash_shrink_memory(&c
401 }
402
403 /* Swap crashk_res and crashk_low_res
404 if (!crashk_res.end && crashk_low_res.
405 crashk_res.start = crashk_low_
406 crashk_res.end = crashk_low_
407 release_resource(&crashk_low_r
408 crashk_low_res.start = 0;
409 crashk_low_res.end = 0;
410 insert_resource(&iomem_resourc
411 }
412
413 unlock:
414 kexec_unlock();
415 return ret;
416 }
417
418 void crash_save_cpu(struct pt_regs *regs, int
419 {
420 struct elf_prstatus prstatus;
421 u32 *buf;
422
423 if ((cpu < 0) || (cpu >= nr_cpu_ids))
424 return;
425
426 /* Using ELF notes here is opportunist
427 * I need a well defined structure for
428 * for the data I pass, and I need tag
429 * on the data to indicate what inform
430 * squirrelled away. ELF notes happen
431 * all of that, so there is no need to
432 */
433 buf = (u32 *)per_cpu_ptr(crash_notes,
434 if (!buf)
435 return;
436 memset(&prstatus, 0, sizeof(prstatus))
437 prstatus.common.pr_pid = current->pid;
438 elf_core_copy_regs(&prstatus.pr_reg, r
439 buf = append_elf_note(buf, KEXEC_CORE_
440 &prstatus, sizeo
441 final_note(buf);
442 }
443
444
445
446 static int __init crash_notes_memory_init(void
447 {
448 /* Allocate memory for saving cpu regi
449 size_t size, align;
450
451 /*
452 * crash_notes could be allocated acro
453 * is vmalloc based . vmalloc doesn't
454 * pages are also on 2 continuous phys
455 * 2nd part of crash_notes in 2nd page
456 * starting address and size of crash_
457 * Here round up the size of crash_not
458 * and pass it to __alloc_percpu as al
459 * crash_notes is allocated inside one
460 */
461 size = sizeof(note_buf_t);
462 align = min(roundup_pow_of_two(sizeof(
463
464 /*
465 * Break compile if size is bigger tha
466 * definitely will be in 2 pages with
467 */
468 BUILD_BUG_ON(size > PAGE_SIZE);
469
470 crash_notes = __alloc_percpu(size, ali
471 if (!crash_notes) {
472 pr_warn("Memory allocation for
473 return -ENOMEM;
474 }
475 return 0;
476 }
477 subsys_initcall(crash_notes_memory_init);
478
479 #endif /*CONFIG_CRASH_DUMP*/
480
481 #ifdef CONFIG_CRASH_HOTPLUG
482 #undef pr_fmt
483 #define pr_fmt(fmt) "crash hp: " fmt
484
485 /*
486 * Different than kexec/kdump loading/unloadin
487 * usually rarely happen, there will be many c
488 * during one short period, e.g one memory boa
489 * regions are online. So mutex lock __crash_
490 * serialize the crash hotplug handling specif
491 */
492 static DEFINE_MUTEX(__crash_hotplug_lock);
493 #define crash_hotplug_lock() mutex_lock(&__cra
494 #define crash_hotplug_unlock() mutex_unlock(&_
495
496 /*
497 * This routine utilized when the crash_hotplu
498 * It reflects the kernel's ability/permission
499 * image directly.
500 */
501 int crash_check_hotplug_support(void)
502 {
503 int rc = 0;
504
505 crash_hotplug_lock();
506 /* Obtain lock while reading crash inf
507 if (!kexec_trylock()) {
508 pr_info("kexec_trylock() faile
509 crash_hotplug_unlock();
510 return 0;
511 }
512 if (kexec_crash_image) {
513 rc = kexec_crash_image->hotplu
514 }
515 /* Release lock now that update comple
516 kexec_unlock();
517 crash_hotplug_unlock();
518
519 return rc;
520 }
521
522 /*
523 * To accurately reflect hot un/plug changes o
524 * (including onling and offlining of those re
525 * kexec segments must be updated with latest
526 *
527 * Architectures must ensure two things for al
528 * updating during hotplug events:
529 *
530 * 1. Segments must be large enough to accommo
531 * resources.
532 * 2. Exclude the segments from SHA verificati
533 *
534 * For example, on most architectures, the elf
535 * to the crash kernel via the elfcorehdr= par
536 * new list of CPUs and memory. To make change
537 * should be large enough to permit a growing
538 * resources. One can estimate the elfcorehdr
539 * NR_CPUS_DEFAULT and CRASH_MAX_MEMORY_RANGES
540 * excluded from SHA verification by default i
541 * supports crash hotplug.
542 */
543 static void crash_handle_hotplug_event(unsigne
544 {
545 struct kimage *image;
546
547 crash_hotplug_lock();
548 /* Obtain lock while changing crash in
549 if (!kexec_trylock()) {
550 pr_info("kexec_trylock() faile
551 crash_hotplug_unlock();
552 return;
553 }
554
555 /* Check kdump is not loaded */
556 if (!kexec_crash_image)
557 goto out;
558
559 image = kexec_crash_image;
560
561 /* Check that kexec segments update is
562 if (!image->hotplug_support)
563 goto out;
564
565 if (hp_action == KEXEC_CRASH_HP_ADD_CP
566 hp_action == KEXEC_CRASH_HP_RE
567 pr_debug("hp_action %u, cpu %u
568 else
569 pr_debug("hp_action %u\n", hp_
570
571 /*
572 * The elfcorehdr_index is set to -1 w
573 * is allocated. Find the segment cont
574 * if not already found.
575 */
576 if (image->elfcorehdr_index < 0) {
577 unsigned long mem;
578 unsigned char *ptr;
579 unsigned int n;
580
581 for (n = 0; n < image->nr_segm
582 mem = image->segment[n
583 ptr = kmap_local_page(
584 if (ptr) {
585 /* The segment
586 if (memcmp(ptr
587 image-
588 kunmap_local(p
589 }
590 }
591 }
592
593 if (image->elfcorehdr_index < 0) {
594 pr_err("unable to locate elfco
595 goto out;
596 }
597
598 /* Needed in order for the segments to
599 arch_kexec_unprotect_crashkres();
600
601 /* Differentiate between normal load a
602 image->hp_action = hp_action;
603
604 /* Now invoke arch-specific update han
605 arch_crash_handle_hotplug_event(image,
606
607 /* No longer handling a hotplug event
608 image->hp_action = KEXEC_CRASH_HP_NONE
609 image->elfcorehdr_updated = true;
610
611 /* Change back to read-only */
612 arch_kexec_protect_crashkres();
613
614 /* Errors in the callback is not a rea
615 out:
616 /* Release lock now that update comple
617 kexec_unlock();
618 crash_hotplug_unlock();
619 }
620
621 static int crash_memhp_notifier(struct notifie
622 {
623 switch (val) {
624 case MEM_ONLINE:
625 crash_handle_hotplug_event(KEX
626 KEXEC_CRASH_HP_INVALID
627 break;
628
629 case MEM_OFFLINE:
630 crash_handle_hotplug_event(KEX
631 KEXEC_CRASH_HP_INVALID
632 break;
633 }
634 return NOTIFY_OK;
635 }
636
637 static struct notifier_block crash_memhp_nb =
638 .notifier_call = crash_memhp_notifier,
639 .priority = 0
640 };
641
642 static int crash_cpuhp_online(unsigned int cpu
643 {
644 crash_handle_hotplug_event(KEXEC_CRASH
645 return 0;
646 }
647
648 static int crash_cpuhp_offline(unsigned int cp
649 {
650 crash_handle_hotplug_event(KEXEC_CRASH
651 return 0;
652 }
653
654 static int __init crash_hotplug_init(void)
655 {
656 int result = 0;
657
658 if (IS_ENABLED(CONFIG_MEMORY_HOTPLUG))
659 register_memory_notifier(&cras
660
661 if (IS_ENABLED(CONFIG_HOTPLUG_CPU)) {
662 result = cpuhp_setup_state_noc
663 "crash/cpuhp", crash_c
664 }
665
666 return result;
667 }
668
669 subsys_initcall(crash_hotplug_init);
670 #endif
671
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.