1 /*
2  * Kexec bzImage loader
3  *
4  * Copyright (C) 2014 Red Hat Inc.
5  * Authors:
6  *      Vivek Goyal <vgoyal@redhat.com>
7  *
8  * This source code is licensed under the GNU General Public License,
9  * Version 2.  See the file COPYING for more details.
10  */
11 
12 #define pr_fmt(fmt)	"kexec-bzImage64: " fmt
13 
14 #include <linux/string.h>
15 #include <linux/printk.h>
16 #include <linux/errno.h>
17 #include <linux/slab.h>
18 #include <linux/kexec.h>
19 #include <linux/kernel.h>
20 #include <linux/mm.h>
21 #include <linux/efi.h>
22 #include <linux/verification.h>
23 
24 #include <asm/bootparam.h>
25 #include <asm/setup.h>
26 #include <asm/crash.h>
27 #include <asm/efi.h>
28 #include <asm/e820/api.h>
29 #include <asm/kexec-bzimage64.h>
30 
31 #define MAX_ELFCOREHDR_STR_LEN	30	/* elfcorehdr=0x<64bit-value> */
32 
33 /*
34  * Defines lowest physical address for various segments. Not sure where
35  * exactly these limits came from. Current bzimage64 loader in kexec-tools
36  * uses these so I am retaining it. It can be changed over time as we gain
37  * more insight.
38  */
39 #define MIN_PURGATORY_ADDR	0x3000
40 #define MIN_BOOTPARAM_ADDR	0x3000
41 #define MIN_KERNEL_LOAD_ADDR	0x100000
42 #define MIN_INITRD_LOAD_ADDR	0x1000000
43 
44 /*
45  * This is a place holder for all boot loader specific data structure which
46  * gets allocated in one call but gets freed much later during cleanup
47  * time. Right now there is only one field but it can grow as need be.
48  */
49 struct bzimage64_data {
50 	/*
51 	 * Temporary buffer to hold bootparams buffer. This should be
52 	 * freed once the bootparam segment has been loaded.
53 	 */
54 	void *bootparams_buf;
55 };
56 
57 static int setup_initrd(struct boot_params *params,
58 		unsigned long initrd_load_addr, unsigned long initrd_len)
59 {
60 	params->hdr.ramdisk_image = initrd_load_addr & 0xffffffffUL;
61 	params->hdr.ramdisk_size = initrd_len & 0xffffffffUL;
62 
63 	params->ext_ramdisk_image = initrd_load_addr >> 32;
64 	params->ext_ramdisk_size = initrd_len >> 32;
65 
66 	return 0;
67 }
68 
69 static int setup_cmdline(struct kimage *image, struct boot_params *params,
70 			 unsigned long bootparams_load_addr,
71 			 unsigned long cmdline_offset, char *cmdline,
72 			 unsigned long cmdline_len)
73 {
74 	char *cmdline_ptr = ((char *)params) + cmdline_offset;
75 	unsigned long cmdline_ptr_phys, len = 0;
76 	uint32_t cmdline_low_32, cmdline_ext_32;
77 
78 	if (image->type == KEXEC_TYPE_CRASH) {
79 		len = sprintf(cmdline_ptr,
80 			"elfcorehdr=0x%lx ", image->arch.elf_load_addr);
81 	}
82 	memcpy(cmdline_ptr + len, cmdline, cmdline_len);
83 	cmdline_len += len;
84 
85 	cmdline_ptr[cmdline_len - 1] = '\0';
86 
87 	pr_debug("Final command line is: %s\n", cmdline_ptr);
88 	cmdline_ptr_phys = bootparams_load_addr + cmdline_offset;
89 	cmdline_low_32 = cmdline_ptr_phys & 0xffffffffUL;
90 	cmdline_ext_32 = cmdline_ptr_phys >> 32;
91 
92 	params->hdr.cmd_line_ptr = cmdline_low_32;
93 	if (cmdline_ext_32)
94 		params->ext_cmd_line_ptr = cmdline_ext_32;
95 
96 	return 0;
97 }
98 
99 static int setup_e820_entries(struct boot_params *params)
100 {
101 	unsigned int nr_e820_entries;
102 
103 	nr_e820_entries = e820_table_kexec->nr_entries;
104 
105 	/* TODO: Pass entries more than E820_MAX_ENTRIES_ZEROPAGE in bootparams setup data */
106 	if (nr_e820_entries > E820_MAX_ENTRIES_ZEROPAGE)
107 		nr_e820_entries = E820_MAX_ENTRIES_ZEROPAGE;
108 
109 	params->e820_entries = nr_e820_entries;
110 	memcpy(&params->e820_table, &e820_table_kexec->entries, nr_e820_entries*sizeof(struct e820_entry));
111 
112 	return 0;
113 }
114 
115 #ifdef CONFIG_EFI
116 static int setup_efi_info_memmap(struct boot_params *params,
117 				  unsigned long params_load_addr,
118 				  unsigned int efi_map_offset,
119 				  unsigned int efi_map_sz)
120 {
121 	void *efi_map = (void *)params + efi_map_offset;
122 	unsigned long efi_map_phys_addr = params_load_addr + efi_map_offset;
123 	struct efi_info *ei = &params->efi_info;
124 
125 	if (!efi_map_sz)
126 		return 0;
127 
128 	efi_runtime_map_copy(efi_map, efi_map_sz);
129 
130 	ei->efi_memmap = efi_map_phys_addr & 0xffffffff;
131 	ei->efi_memmap_hi = efi_map_phys_addr >> 32;
132 	ei->efi_memmap_size = efi_map_sz;
133 
134 	return 0;
135 }
136 
137 static int
138 prepare_add_efi_setup_data(struct boot_params *params,
139 		       unsigned long params_load_addr,
140 		       unsigned int efi_setup_data_offset)
141 {
142 	unsigned long setup_data_phys;
143 	struct setup_data *sd = (void *)params + efi_setup_data_offset;
144 	struct efi_setup_data *esd = (void *)sd + sizeof(struct setup_data);
145 
146 	esd->fw_vendor = efi.fw_vendor;
147 	esd->runtime = efi.runtime;
148 	esd->tables = efi.config_table;
149 	esd->smbios = efi.smbios;
150 
151 	sd->type = SETUP_EFI;
152 	sd->len = sizeof(struct efi_setup_data);
153 
154 	/* Add setup data */
155 	setup_data_phys = params_load_addr + efi_setup_data_offset;
156 	sd->next = params->hdr.setup_data;
157 	params->hdr.setup_data = setup_data_phys;
158 
159 	return 0;
160 }
161 
162 static int
163 setup_efi_state(struct boot_params *params, unsigned long params_load_addr,
164 		unsigned int efi_map_offset, unsigned int efi_map_sz,
165 		unsigned int efi_setup_data_offset)
166 {
167 	struct efi_info *current_ei = &boot_params.efi_info;
168 	struct efi_info *ei = &params->efi_info;
169 
170 	if (!current_ei->efi_memmap_size)
171 		return 0;
172 
173 	/*
174 	 * If 1:1 mapping is not enabled, second kernel can not setup EFI
175 	 * and use EFI run time services. User space will have to pass
176 	 * acpi_rsdp=<addr> on kernel command line to make second kernel boot
177 	 * without efi.
178 	 */
179 	if (efi_enabled(EFI_OLD_MEMMAP))
180 		return 0;
181 
182 	ei->efi_loader_signature = current_ei->efi_loader_signature;
183 	ei->efi_systab = current_ei->efi_systab;
184 	ei->efi_systab_hi = current_ei->efi_systab_hi;
185 
186 	ei->efi_memdesc_version = current_ei->efi_memdesc_version;
187 	ei->efi_memdesc_size = efi_get_runtime_map_desc_size();
188 
189 	setup_efi_info_memmap(params, params_load_addr, efi_map_offset,
190 			      efi_map_sz);
191 	prepare_add_efi_setup_data(params, params_load_addr,
192 				   efi_setup_data_offset);
193 	return 0;
194 }
195 #endif /* CONFIG_EFI */
196 
197 static int
198 setup_boot_parameters(struct kimage *image, struct boot_params *params,
199 		      unsigned long params_load_addr,
200 		      unsigned int efi_map_offset, unsigned int efi_map_sz,
201 		      unsigned int efi_setup_data_offset)
202 {
203 	unsigned int nr_e820_entries;
204 	unsigned long long mem_k, start, end;
205 	int i, ret = 0;
206 
207 	/* Get subarch from existing bootparams */
208 	params->hdr.hardware_subarch = boot_params.hdr.hardware_subarch;
209 
210 	/* Copying screen_info will do? */
211 	memcpy(&params->screen_info, &boot_params.screen_info,
212 				sizeof(struct screen_info));
213 
214 	/* Fill in memsize later */
215 	params->screen_info.ext_mem_k = 0;
216 	params->alt_mem_k = 0;
217 
218 	/* Default APM info */
219 	memset(&params->apm_bios_info, 0, sizeof(params->apm_bios_info));
220 
221 	/* Default drive info */
222 	memset(&params->hd0_info, 0, sizeof(params->hd0_info));
223 	memset(&params->hd1_info, 0, sizeof(params->hd1_info));
224 
225 	if (image->type == KEXEC_TYPE_CRASH) {
226 		ret = crash_setup_memmap_entries(image, params);
227 		if (ret)
228 			return ret;
229 	} else
230 		setup_e820_entries(params);
231 
232 	nr_e820_entries = params->e820_entries;
233 
234 	for (i = 0; i < nr_e820_entries; i++) {
235 		if (params->e820_table[i].type != E820_TYPE_RAM)
236 			continue;
237 		start = params->e820_table[i].addr;
238 		end = params->e820_table[i].addr + params->e820_table[i].size - 1;
239 
240 		if ((start <= 0x100000) && end > 0x100000) {
241 			mem_k = (end >> 10) - (0x100000 >> 10);
242 			params->screen_info.ext_mem_k = mem_k;
243 			params->alt_mem_k = mem_k;
244 			if (mem_k > 0xfc00)
245 				params->screen_info.ext_mem_k = 0xfc00; /* 64M*/
246 			if (mem_k > 0xffffffff)
247 				params->alt_mem_k = 0xffffffff;
248 		}
249 	}
250 
251 #ifdef CONFIG_EFI
252 	/* Setup EFI state */
253 	setup_efi_state(params, params_load_addr, efi_map_offset, efi_map_sz,
254 			efi_setup_data_offset);
255 #endif
256 
257 	/* Setup EDD info */
258 	memcpy(params->eddbuf, boot_params.eddbuf,
259 				EDDMAXNR * sizeof(struct edd_info));
260 	params->eddbuf_entries = boot_params.eddbuf_entries;
261 
262 	memcpy(params->edd_mbr_sig_buffer, boot_params.edd_mbr_sig_buffer,
263 	       EDD_MBR_SIG_MAX * sizeof(unsigned int));
264 
265 	return ret;
266 }
267 
268 static int bzImage64_probe(const char *buf, unsigned long len)
269 {
270 	int ret = -ENOEXEC;
271 	struct setup_header *header;
272 
273 	/* kernel should be at least two sectors long */
274 	if (len < 2 * 512) {
275 		pr_err("File is too short to be a bzImage\n");
276 		return ret;
277 	}
278 
279 	header = (struct setup_header *)(buf + offsetof(struct boot_params, hdr));
280 	if (memcmp((char *)&header->header, "HdrS", 4) != 0) {
281 		pr_err("Not a bzImage\n");
282 		return ret;
283 	}
284 
285 	if (header->boot_flag != 0xAA55) {
286 		pr_err("No x86 boot sector present\n");
287 		return ret;
288 	}
289 
290 	if (header->version < 0x020C) {
291 		pr_err("Must be at least protocol version 2.12\n");
292 		return ret;
293 	}
294 
295 	if (!(header->loadflags & LOADED_HIGH)) {
296 		pr_err("zImage not a bzImage\n");
297 		return ret;
298 	}
299 
300 	if (!(header->xloadflags & XLF_KERNEL_64)) {
301 		pr_err("Not a bzImage64. XLF_KERNEL_64 is not set.\n");
302 		return ret;
303 	}
304 
305 	if (!(header->xloadflags & XLF_CAN_BE_LOADED_ABOVE_4G)) {
306 		pr_err("XLF_CAN_BE_LOADED_ABOVE_4G is not set.\n");
307 		return ret;
308 	}
309 
310 	/*
311 	 * Can't handle 32bit EFI as it does not allow loading kernel
312 	 * above 4G. This should be handled by 32bit bzImage loader
313 	 */
314 	if (efi_enabled(EFI_RUNTIME_SERVICES) && !efi_enabled(EFI_64BIT)) {
315 		pr_debug("EFI is 32 bit. Can't load kernel above 4G.\n");
316 		return ret;
317 	}
318 
319 	/* I've got a bzImage */
320 	pr_debug("It's a relocatable bzImage64\n");
321 	ret = 0;
322 
323 	return ret;
324 }
325 
326 static void *bzImage64_load(struct kimage *image, char *kernel,
327 			    unsigned long kernel_len, char *initrd,
328 			    unsigned long initrd_len, char *cmdline,
329 			    unsigned long cmdline_len)
330 {
331 
332 	struct setup_header *header;
333 	int setup_sects, kern16_size, ret = 0;
334 	unsigned long setup_header_size, params_cmdline_sz;
335 	struct boot_params *params;
336 	unsigned long bootparam_load_addr, kernel_load_addr, initrd_load_addr;
337 	unsigned long purgatory_load_addr;
338 	struct bzimage64_data *ldata;
339 	struct kexec_entry64_regs regs64;
340 	void *stack;
341 	unsigned int setup_hdr_offset = offsetof(struct boot_params, hdr);
342 	unsigned int efi_map_offset, efi_map_sz, efi_setup_data_offset;
343 	struct kexec_buf kbuf = { .image = image, .buf_max = ULONG_MAX,
344 				  .top_down = true };
345 
346 	header = (struct setup_header *)(kernel + setup_hdr_offset);
347 	setup_sects = header->setup_sects;
348 	if (setup_sects == 0)
349 		setup_sects = 4;
350 
351 	kern16_size = (setup_sects + 1) * 512;
352 	if (kernel_len < kern16_size) {
353 		pr_err("bzImage truncated\n");
354 		return ERR_PTR(-ENOEXEC);
355 	}
356 
357 	if (cmdline_len > header->cmdline_size) {
358 		pr_err("Kernel command line too long\n");
359 		return ERR_PTR(-EINVAL);
360 	}
361 
362 	/*
363 	 * In case of crash dump, we will append elfcorehdr=<addr> to
364 	 * command line. Make sure it does not overflow
365 	 */
366 	if (cmdline_len + MAX_ELFCOREHDR_STR_LEN > header->cmdline_size) {
367 		pr_debug("Appending elfcorehdr=<addr> to command line exceeds maximum allowed length\n");
368 		return ERR_PTR(-EINVAL);
369 	}
370 
371 	/* Allocate and load backup region */
372 	if (image->type == KEXEC_TYPE_CRASH) {
373 		ret = crash_load_segments(image);
374 		if (ret)
375 			return ERR_PTR(ret);
376 	}
377 
378 	/*
379 	 * Load purgatory. For 64bit entry point, purgatory  code can be
380 	 * anywhere.
381 	 */
382 	ret = kexec_load_purgatory(image, MIN_PURGATORY_ADDR, ULONG_MAX, 1,
383 				   &purgatory_load_addr);
384 	if (ret) {
385 		pr_err("Loading purgatory failed\n");
386 		return ERR_PTR(ret);
387 	}
388 
389 	pr_debug("Loaded purgatory at 0x%lx\n", purgatory_load_addr);
390 
391 
392 	/*
393 	 * Load Bootparams and cmdline and space for efi stuff.
394 	 *
395 	 * Allocate memory together for multiple data structures so
396 	 * that they all can go in single area/segment and we don't
397 	 * have to create separate segment for each. Keeps things
398 	 * little bit simple
399 	 */
400 	efi_map_sz = efi_get_runtime_map_size();
401 	efi_map_sz = ALIGN(efi_map_sz, 16);
402 	params_cmdline_sz = sizeof(struct boot_params) + cmdline_len +
403 				MAX_ELFCOREHDR_STR_LEN;
404 	params_cmdline_sz = ALIGN(params_cmdline_sz, 16);
405 	kbuf.bufsz = params_cmdline_sz + efi_map_sz +
406 				sizeof(struct setup_data) +
407 				sizeof(struct efi_setup_data);
408 
409 	params = kzalloc(kbuf.bufsz, GFP_KERNEL);
410 	if (!params)
411 		return ERR_PTR(-ENOMEM);
412 	efi_map_offset = params_cmdline_sz;
413 	efi_setup_data_offset = efi_map_offset + efi_map_sz;
414 
415 	/* Copy setup header onto bootparams. Documentation/x86/boot.txt */
416 	setup_header_size = 0x0202 + kernel[0x0201] - setup_hdr_offset;
417 
418 	/* Is there a limit on setup header size? */
419 	memcpy(&params->hdr, (kernel + setup_hdr_offset), setup_header_size);
420 
421 	kbuf.buffer = params;
422 	kbuf.memsz = kbuf.bufsz;
423 	kbuf.buf_align = 16;
424 	kbuf.buf_min = MIN_BOOTPARAM_ADDR;
425 	ret = kexec_add_buffer(&kbuf);
426 	if (ret)
427 		goto out_free_params;
428 	bootparam_load_addr = kbuf.mem;
429 	pr_debug("Loaded boot_param, command line and misc at 0x%lx bufsz=0x%lx memsz=0x%lx\n",
430 		 bootparam_load_addr, kbuf.bufsz, kbuf.bufsz);
431 
432 	/* Load kernel */
433 	kbuf.buffer = kernel + kern16_size;
434 	kbuf.bufsz =  kernel_len - kern16_size;
435 	kbuf.memsz = PAGE_ALIGN(header->init_size);
436 	kbuf.buf_align = header->kernel_alignment;
437 	kbuf.buf_min = MIN_KERNEL_LOAD_ADDR;
438 	ret = kexec_add_buffer(&kbuf);
439 	if (ret)
440 		goto out_free_params;
441 	kernel_load_addr = kbuf.mem;
442 
443 	pr_debug("Loaded 64bit kernel at 0x%lx bufsz=0x%lx memsz=0x%lx\n",
444 		 kernel_load_addr, kbuf.bufsz, kbuf.memsz);
445 
446 	/* Load initrd high */
447 	if (initrd) {
448 		kbuf.buffer = initrd;
449 		kbuf.bufsz = kbuf.memsz = initrd_len;
450 		kbuf.buf_align = PAGE_SIZE;
451 		kbuf.buf_min = MIN_INITRD_LOAD_ADDR;
452 		ret = kexec_add_buffer(&kbuf);
453 		if (ret)
454 			goto out_free_params;
455 		initrd_load_addr = kbuf.mem;
456 
457 		pr_debug("Loaded initrd at 0x%lx bufsz=0x%lx memsz=0x%lx\n",
458 				initrd_load_addr, initrd_len, initrd_len);
459 
460 		setup_initrd(params, initrd_load_addr, initrd_len);
461 	}
462 
463 	setup_cmdline(image, params, bootparam_load_addr,
464 		      sizeof(struct boot_params), cmdline, cmdline_len);
465 
466 	/* bootloader info. Do we need a separate ID for kexec kernel loader? */
467 	params->hdr.type_of_loader = 0x0D << 4;
468 	params->hdr.loadflags = 0;
469 
470 	/* Setup purgatory regs for entry */
471 	ret = kexec_purgatory_get_set_symbol(image, "entry64_regs", &regs64,
472 					     sizeof(regs64), 1);
473 	if (ret)
474 		goto out_free_params;
475 
476 	regs64.rbx = 0; /* Bootstrap Processor */
477 	regs64.rsi = bootparam_load_addr;
478 	regs64.rip = kernel_load_addr + 0x200;
479 	stack = kexec_purgatory_get_symbol_addr(image, "stack_end");
480 	if (IS_ERR(stack)) {
481 		pr_err("Could not find address of symbol stack_end\n");
482 		ret = -EINVAL;
483 		goto out_free_params;
484 	}
485 
486 	regs64.rsp = (unsigned long)stack;
487 	ret = kexec_purgatory_get_set_symbol(image, "entry64_regs", &regs64,
488 					     sizeof(regs64), 0);
489 	if (ret)
490 		goto out_free_params;
491 
492 	ret = setup_boot_parameters(image, params, bootparam_load_addr,
493 				    efi_map_offset, efi_map_sz,
494 				    efi_setup_data_offset);
495 	if (ret)
496 		goto out_free_params;
497 
498 	/* Allocate loader specific data */
499 	ldata = kzalloc(sizeof(struct bzimage64_data), GFP_KERNEL);
500 	if (!ldata) {
501 		ret = -ENOMEM;
502 		goto out_free_params;
503 	}
504 
505 	/*
506 	 * Store pointer to params so that it could be freed after loading
507 	 * params segment has been loaded and contents have been copied
508 	 * somewhere else.
509 	 */
510 	ldata->bootparams_buf = params;
511 	return ldata;
512 
513 out_free_params:
514 	kfree(params);
515 	return ERR_PTR(ret);
516 }
517 
518 /* This cleanup function is called after various segments have been loaded */
519 static int bzImage64_cleanup(void *loader_data)
520 {
521 	struct bzimage64_data *ldata = loader_data;
522 
523 	if (!ldata)
524 		return 0;
525 
526 	kfree(ldata->bootparams_buf);
527 	ldata->bootparams_buf = NULL;
528 
529 	return 0;
530 }
531 
532 #ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
533 static int bzImage64_verify_sig(const char *kernel, unsigned long kernel_len)
534 {
535 	return verify_pefile_signature(kernel, kernel_len,
536 				       NULL,
537 				       VERIFYING_KEXEC_PE_SIGNATURE);
538 }
539 #endif
540 
541 struct kexec_file_ops kexec_bzImage64_ops = {
542 	.probe = bzImage64_probe,
543 	.load = bzImage64_load,
544 	.cleanup = bzImage64_cleanup,
545 #ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
546 	.verify_sig = bzImage64_verify_sig,
547 #endif
548 };
549