1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * s390 code for kexec_file_load system call
4  *
5  * Copyright IBM Corp. 2018
6  *
7  * Author(s): Philipp Rudo <prudo@linux.vnet.ibm.com>
8  */
9 
10 #define pr_fmt(fmt)	"kexec: " fmt
11 
12 #include <linux/elf.h>
13 #include <linux/errno.h>
14 #include <linux/kexec.h>
15 #include <linux/module_signature.h>
16 #include <linux/verification.h>
17 #include <linux/vmalloc.h>
18 #include <asm/boot_data.h>
19 #include <asm/ipl.h>
20 #include <asm/setup.h>
21 
22 const struct kexec_file_ops * const kexec_file_loaders[] = {
23 	&s390_kexec_elf_ops,
24 	&s390_kexec_image_ops,
25 	NULL,
26 };
27 
28 #ifdef CONFIG_KEXEC_SIG
29 int s390_verify_sig(const char *kernel, unsigned long kernel_len)
30 {
31 	const unsigned long marker_len = sizeof(MODULE_SIG_STRING) - 1;
32 	struct module_signature *ms;
33 	unsigned long sig_len;
34 	int ret;
35 
36 	/* Skip signature verification when not secure IPLed. */
37 	if (!ipl_secure_flag)
38 		return 0;
39 
40 	if (marker_len > kernel_len)
41 		return -EKEYREJECTED;
42 
43 	if (memcmp(kernel + kernel_len - marker_len, MODULE_SIG_STRING,
44 		   marker_len))
45 		return -EKEYREJECTED;
46 	kernel_len -= marker_len;
47 
48 	ms = (void *)kernel + kernel_len - sizeof(*ms);
49 	kernel_len -= sizeof(*ms);
50 
51 	sig_len = be32_to_cpu(ms->sig_len);
52 	if (sig_len >= kernel_len)
53 		return -EKEYREJECTED;
54 	kernel_len -= sig_len;
55 
56 	if (ms->id_type != PKEY_ID_PKCS7)
57 		return -EKEYREJECTED;
58 
59 	if (ms->algo != 0 ||
60 	    ms->hash != 0 ||
61 	    ms->signer_len != 0 ||
62 	    ms->key_id_len != 0 ||
63 	    ms->__pad[0] != 0 ||
64 	    ms->__pad[1] != 0 ||
65 	    ms->__pad[2] != 0) {
66 		return -EBADMSG;
67 	}
68 
69 	ret = verify_pkcs7_signature(kernel, kernel_len,
70 				     kernel + kernel_len, sig_len,
71 				     VERIFY_USE_SECONDARY_KEYRING,
72 				     VERIFYING_MODULE_SIGNATURE,
73 				     NULL, NULL);
74 	if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING))
75 		ret = verify_pkcs7_signature(kernel, kernel_len,
76 					     kernel + kernel_len, sig_len,
77 					     VERIFY_USE_PLATFORM_KEYRING,
78 					     VERIFYING_MODULE_SIGNATURE,
79 					     NULL, NULL);
80 	return ret;
81 }
82 #endif /* CONFIG_KEXEC_SIG */
83 
84 static int kexec_file_update_purgatory(struct kimage *image,
85 				       struct s390_load_data *data)
86 {
87 	u64 entry, type;
88 	int ret;
89 
90 	if (image->type == KEXEC_TYPE_CRASH) {
91 		entry = STARTUP_KDUMP_OFFSET;
92 		type = KEXEC_TYPE_CRASH;
93 	} else {
94 		entry = STARTUP_NORMAL_OFFSET;
95 		type = KEXEC_TYPE_DEFAULT;
96 	}
97 
98 	ret = kexec_purgatory_get_set_symbol(image, "kernel_entry", &entry,
99 					     sizeof(entry), false);
100 	if (ret)
101 		return ret;
102 
103 	ret = kexec_purgatory_get_set_symbol(image, "kernel_type", &type,
104 					     sizeof(type), false);
105 	if (ret)
106 		return ret;
107 
108 	if (image->type == KEXEC_TYPE_CRASH) {
109 		u64 crash_size;
110 
111 		ret = kexec_purgatory_get_set_symbol(image, "crash_start",
112 						     &crashk_res.start,
113 						     sizeof(crashk_res.start),
114 						     false);
115 		if (ret)
116 			return ret;
117 
118 		crash_size = crashk_res.end - crashk_res.start + 1;
119 		ret = kexec_purgatory_get_set_symbol(image, "crash_size",
120 						     &crash_size,
121 						     sizeof(crash_size),
122 						     false);
123 	}
124 	return ret;
125 }
126 
127 static int kexec_file_add_purgatory(struct kimage *image,
128 				    struct s390_load_data *data)
129 {
130 	struct kexec_buf buf;
131 	int ret;
132 
133 	buf.image = image;
134 
135 	data->memsz = ALIGN(data->memsz, PAGE_SIZE);
136 	buf.mem = data->memsz;
137 	if (image->type == KEXEC_TYPE_CRASH)
138 		buf.mem += crashk_res.start;
139 
140 	ret = kexec_load_purgatory(image, &buf);
141 	if (ret)
142 		return ret;
143 	data->memsz += buf.memsz;
144 
145 	return kexec_file_update_purgatory(image, data);
146 }
147 
148 static int kexec_file_add_initrd(struct kimage *image,
149 				 struct s390_load_data *data)
150 {
151 	struct kexec_buf buf;
152 	int ret;
153 
154 	buf.image = image;
155 
156 	buf.buffer = image->initrd_buf;
157 	buf.bufsz = image->initrd_buf_len;
158 
159 	data->memsz = ALIGN(data->memsz, PAGE_SIZE);
160 	buf.mem = data->memsz;
161 	if (image->type == KEXEC_TYPE_CRASH)
162 		buf.mem += crashk_res.start;
163 	buf.memsz = buf.bufsz;
164 
165 	data->parm->initrd_start = data->memsz;
166 	data->parm->initrd_size = buf.memsz;
167 	data->memsz += buf.memsz;
168 
169 	ret = kexec_add_buffer(&buf);
170 	if (ret)
171 		return ret;
172 
173 	return ipl_report_add_component(data->report, &buf, 0, 0);
174 }
175 
176 static int kexec_file_add_ipl_report(struct kimage *image,
177 				     struct s390_load_data *data)
178 {
179 	__u32 *lc_ipl_parmblock_ptr;
180 	unsigned int len, ncerts;
181 	struct kexec_buf buf;
182 	unsigned long addr;
183 	void *ptr, *end;
184 	int ret;
185 
186 	buf.image = image;
187 
188 	data->memsz = ALIGN(data->memsz, PAGE_SIZE);
189 	buf.mem = data->memsz;
190 	if (image->type == KEXEC_TYPE_CRASH)
191 		buf.mem += crashk_res.start;
192 
193 	ptr = (void *)ipl_cert_list_addr;
194 	end = ptr + ipl_cert_list_size;
195 	ncerts = 0;
196 	while (ptr < end) {
197 		ncerts++;
198 		len = *(unsigned int *)ptr;
199 		ptr += sizeof(len);
200 		ptr += len;
201 	}
202 
203 	addr = data->memsz + data->report->size;
204 	addr += ncerts * sizeof(struct ipl_rb_certificate_entry);
205 	ptr = (void *)ipl_cert_list_addr;
206 	while (ptr < end) {
207 		len = *(unsigned int *)ptr;
208 		ptr += sizeof(len);
209 		ipl_report_add_certificate(data->report, ptr, addr, len);
210 		addr += len;
211 		ptr += len;
212 	}
213 
214 	ret = -ENOMEM;
215 	buf.buffer = ipl_report_finish(data->report);
216 	if (!buf.buffer)
217 		goto out;
218 	buf.bufsz = data->report->size;
219 	buf.memsz = buf.bufsz;
220 	image->arch.ipl_buf = buf.buffer;
221 
222 	data->memsz += buf.memsz;
223 
224 	lc_ipl_parmblock_ptr =
225 		data->kernel_buf + offsetof(struct lowcore, ipl_parmblock_ptr);
226 	*lc_ipl_parmblock_ptr = (__u32)buf.mem;
227 
228 	ret = kexec_add_buffer(&buf);
229 out:
230 	return ret;
231 }
232 
233 void *kexec_file_add_components(struct kimage *image,
234 				int (*add_kernel)(struct kimage *image,
235 						  struct s390_load_data *data))
236 {
237 	unsigned long max_command_line_size = LEGACY_COMMAND_LINE_SIZE;
238 	struct s390_load_data data = {0};
239 	unsigned long minsize;
240 	int ret;
241 
242 	data.report = ipl_report_init(&ipl_block);
243 	if (IS_ERR(data.report))
244 		return data.report;
245 
246 	ret = add_kernel(image, &data);
247 	if (ret)
248 		goto out;
249 
250 	ret = -EINVAL;
251 	minsize = PARMAREA + offsetof(struct parmarea, command_line);
252 	if (image->kernel_buf_len < minsize)
253 		goto out;
254 
255 	if (data.parm->max_command_line_size)
256 		max_command_line_size = data.parm->max_command_line_size;
257 
258 	if (minsize + max_command_line_size < minsize)
259 		goto out;
260 
261 	if (image->kernel_buf_len < minsize + max_command_line_size)
262 		goto out;
263 
264 	if (image->cmdline_buf_len >= max_command_line_size)
265 		goto out;
266 
267 	memcpy(data.parm->command_line, image->cmdline_buf,
268 	       image->cmdline_buf_len);
269 
270 	if (image->type == KEXEC_TYPE_CRASH) {
271 		data.parm->oldmem_base = crashk_res.start;
272 		data.parm->oldmem_size = crashk_res.end - crashk_res.start + 1;
273 	}
274 
275 	if (image->initrd_buf) {
276 		ret = kexec_file_add_initrd(image, &data);
277 		if (ret)
278 			goto out;
279 	}
280 
281 	ret = kexec_file_add_purgatory(image, &data);
282 	if (ret)
283 		goto out;
284 
285 	if (data.kernel_mem == 0) {
286 		unsigned long restart_psw =  0x0008000080000000UL;
287 		restart_psw += image->start;
288 		memcpy(data.kernel_buf, &restart_psw, sizeof(restart_psw));
289 		image->start = 0;
290 	}
291 
292 	ret = kexec_file_add_ipl_report(image, &data);
293 out:
294 	ipl_report_free(data.report);
295 	return ERR_PTR(ret);
296 }
297 
298 int arch_kexec_apply_relocations_add(struct purgatory_info *pi,
299 				     Elf_Shdr *section,
300 				     const Elf_Shdr *relsec,
301 				     const Elf_Shdr *symtab)
302 {
303 	const char *strtab, *name, *shstrtab;
304 	const Elf_Shdr *sechdrs;
305 	Elf_Rela *relas;
306 	int i, r_type;
307 	int ret;
308 
309 	/* String & section header string table */
310 	sechdrs = (void *)pi->ehdr + pi->ehdr->e_shoff;
311 	strtab = (char *)pi->ehdr + sechdrs[symtab->sh_link].sh_offset;
312 	shstrtab = (char *)pi->ehdr + sechdrs[pi->ehdr->e_shstrndx].sh_offset;
313 
314 	relas = (void *)pi->ehdr + relsec->sh_offset;
315 
316 	for (i = 0; i < relsec->sh_size / sizeof(*relas); i++) {
317 		const Elf_Sym *sym;	/* symbol to relocate */
318 		unsigned long addr;	/* final location after relocation */
319 		unsigned long val;	/* relocated symbol value */
320 		void *loc;		/* tmp location to modify */
321 
322 		sym = (void *)pi->ehdr + symtab->sh_offset;
323 		sym += ELF64_R_SYM(relas[i].r_info);
324 
325 		if (sym->st_name)
326 			name = strtab + sym->st_name;
327 		else
328 			name = shstrtab + sechdrs[sym->st_shndx].sh_name;
329 
330 		if (sym->st_shndx == SHN_UNDEF) {
331 			pr_err("Undefined symbol: %s\n", name);
332 			return -ENOEXEC;
333 		}
334 
335 		if (sym->st_shndx == SHN_COMMON) {
336 			pr_err("symbol '%s' in common section\n", name);
337 			return -ENOEXEC;
338 		}
339 
340 		if (sym->st_shndx >= pi->ehdr->e_shnum &&
341 		    sym->st_shndx != SHN_ABS) {
342 			pr_err("Invalid section %d for symbol %s\n",
343 			       sym->st_shndx, name);
344 			return -ENOEXEC;
345 		}
346 
347 		loc = pi->purgatory_buf;
348 		loc += section->sh_offset;
349 		loc += relas[i].r_offset;
350 
351 		val = sym->st_value;
352 		if (sym->st_shndx != SHN_ABS)
353 			val += pi->sechdrs[sym->st_shndx].sh_addr;
354 		val += relas[i].r_addend;
355 
356 		addr = section->sh_addr + relas[i].r_offset;
357 
358 		r_type = ELF64_R_TYPE(relas[i].r_info);
359 
360 		if (r_type == R_390_PLT32DBL)
361 			r_type = R_390_PC32DBL;
362 
363 		ret = arch_kexec_do_relocs(r_type, loc, val, addr);
364 		if (ret) {
365 			pr_err("Unknown rela relocation: %d\n", r_type);
366 			return -ENOEXEC;
367 		}
368 	}
369 	return 0;
370 }
371 
372 int arch_kimage_file_post_load_cleanup(struct kimage *image)
373 {
374 	vfree(image->arch.ipl_buf);
375 	image->arch.ipl_buf = NULL;
376 
377 	return kexec_image_post_load_cleanup_default(image);
378 }
379