linux-toradex.git/kernel/kexec.c, branch v3.17-rc6

kexec: create a new config option CONFIG_KEXEC_FILE for new syscall

2014-08-29T23:28:16+00:00

Currently new system call kexec_file_load() and all the associated code
compiles if CONFIG_KEXEC=y.  But new syscall also compiles purgatory
code which currently uses gcc option -mcmodel=large.  This option seems
to be available only gcc 4.4 onwards.

Hiding new functionality behind a new config option will not break
existing users of old gcc.  Those who wish to enable new functionality
will require new gcc.  Having said that, I am trying to figure out how
can I move away from using -mcmodel=large but that can take a while.

I think there are other advantages of introducing this new config
option.  As this option will be enabled only on x86_64, other arches
don't have to compile generic kexec code which will never be used.  This
new code selects CRYPTO=y and CRYPTO_SHA256=y.  And all other arches had
to do this for CONFIG_KEXEC.  Now with introduction of new config
option, we can remove crypto dependency from other arches.

Now CONFIG_KEXEC_FILE is available only on x86_64.  So whereever I had
CONFIG_X86_64 defined, I got rid of that.

For CONFIG_KEXEC_FILE, instead of doing select CRYPTO=y, I changed it to
"depends on CRYPTO=y".  This should be safer as "select" is not
recursive.

Signed-off-by: Vivek Goyal 
Cc: Eric Biederman 
Cc: H. Peter Anvin 
Tested-by: Shaun Ruffell 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

kexec: verify the signature of signed PE bzImage

2014-08-08T22:57:33+00:00

This is the final piece of the puzzle of verifying kernel image signature
during kexec_file_load() syscall.

This patch calls into PE file routines to verify signature of bzImage.  If
signature are valid, kexec_file_load() succeeds otherwise it fails.

Two new config options have been introduced.  First one is
CONFIG_KEXEC_VERIFY_SIG.  This option enforces that kernel has to be
validly signed otherwise kernel load will fail.  If this option is not
set, no signature verification will be done.  Only exception will be when
secureboot is enabled.  In that case signature verification should be
automatically enforced when secureboot is enabled.  But that will happen
when secureboot patches are merged.

Second config option is CONFIG_KEXEC_BZIMAGE_VERIFY_SIG.  This option
enables signature verification support on bzImage.  If this option is not
set and previous one is set, kernel image loading will fail because kernel
does not have support to verify signature of bzImage.

I tested these patches with both "pesign" and "sbsign" signed bzImages.

I used signing_key.priv key and signing_key.x509 cert for signing as
generated during kernel build process (if module signing is enabled).

Used following method to sign bzImage.

pesign
======
- Convert DER format cert to PEM format cert
openssl x509 -in signing_key.x509 -inform DER -out signing_key.x509.PEM -outform
PEM

- Generate a .p12 file from existing cert and private key file
openssl pkcs12 -export -out kernel-key.p12 -inkey signing_key.priv -in
signing_key.x509.PEM

- Import .p12 file into pesign db
pk12util -i /tmp/kernel-key.p12 -d /etc/pki/pesign

- Sign bzImage
pesign -i /boot/vmlinuz-3.16.0-rc3+ -o /boot/vmlinuz-3.16.0-rc3+.signed.pesign
-c "Glacier signing key - Magrathea" -s

sbsign
======
sbsign --key signing_key.priv --cert signing_key.x509.PEM --output
/boot/vmlinuz-3.16.0-rc3+.signed.sbsign /boot/vmlinuz-3.16.0-rc3+

Patch details:

Well all the hard work is done in previous patches.  Now bzImage loader
has just call into that code and verify whether bzImage signature are
valid or not.

Also create two config options.  First one is CONFIG_KEXEC_VERIFY_SIG.
This option enforces that kernel has to be validly signed otherwise kernel
load will fail.  If this option is not set, no signature verification will
be done.  Only exception will be when secureboot is enabled.  In that case
signature verification should be automatically enforced when secureboot is
enabled.  But that will happen when secureboot patches are merged.

Second config option is CONFIG_KEXEC_BZIMAGE_VERIFY_SIG.  This option
enables signature verification support on bzImage.  If this option is not
set and previous one is set, kernel image loading will fail because kernel
does not have support to verify signature of bzImage.

Signed-off-by: Vivek Goyal 
Cc: Borislav Petkov 
Cc: Michael Kerrisk 
Cc: Yinghai Lu 
Cc: Eric Biederman 
Cc: H. Peter Anvin 
Cc: Matthew Garrett 
Cc: Greg Kroah-Hartman 
Cc: Dave Young 
Cc: WANG Chao 
Cc: Baoquan He 
Cc: Andy Lutomirski 
Cc: Matt Fleming 
Cc: David Howells 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

kexec: support for kexec on panic using new system call

2014-08-08T22:57:33+00:00

This patch adds support for loading a kexec on panic (kdump) kernel usning
new system call.

It prepares ELF headers for memory areas to be dumped and for saved cpu
registers.  Also prepares the memory map for second kernel and limits its
boot to reserved areas only.

Signed-off-by: Vivek Goyal 
Cc: Borislav Petkov 
Cc: Michael Kerrisk 
Cc: Yinghai Lu 
Cc: Eric Biederman 
Cc: H. Peter Anvin 
Cc: Matthew Garrett 
Cc: Greg Kroah-Hartman 
Cc: Dave Young 
Cc: WANG Chao 
Cc: Baoquan He 
Cc: Andy Lutomirski 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

kexec-bzImage64: support for loading bzImage using 64bit entry

2014-08-08T22:57:33+00:00

This is loader specific code which can load bzImage and set it up for
64bit entry.  This does not take care of 32bit entry or real mode entry.

32bit mode entry can be implemented if somebody needs it.

Signed-off-by: Vivek Goyal 
Cc: Borislav Petkov 
Cc: Michael Kerrisk 
Cc: Yinghai Lu 
Cc: Eric Biederman 
Cc: H. Peter Anvin 
Cc: Matthew Garrett 
Cc: Greg Kroah-Hartman 
Cc: Dave Young 
Cc: WANG Chao 
Cc: Baoquan He 
Cc: Andy Lutomirski 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

kexec: load and relocate purgatory at kernel load time

2014-08-08T22:57:32+00:00

Load purgatory code in RAM and relocate it based on the location.
Relocation code has been inspired by module relocation code and purgatory
relocation code in kexec-tools.

Also compute the checksums of loaded kexec segments and store them in
purgatory.

Arch independent code provides this functionality so that arch dependent
bootloaders can make use of it.

Helper functions are provided to get/set symbol values in purgatory which
are used by bootloaders later to set things like stack and entry point of
second kernel etc.

Signed-off-by: Vivek Goyal 
Cc: Borislav Petkov 
Cc: Michael Kerrisk 
Cc: Yinghai Lu 
Cc: Eric Biederman 
Cc: H. Peter Anvin 
Cc: Matthew Garrett 
Cc: Greg Kroah-Hartman 
Cc: Dave Young 
Cc: WANG Chao 
Cc: Baoquan He 
Cc: Andy Lutomirski 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

kexec: implementation of new syscall kexec_file_load

2014-08-08T22:57:32+00:00

Previous patch provided the interface definition and this patch prvides
implementation of new syscall.

Previously segment list was prepared in user space.  Now user space just
passes kernel fd, initrd fd and command line and kernel will create a
segment list internally.

This patch contains generic part of the code.  Actual segment preparation
and loading is done by arch and image specific loader.  Which comes in
next patch.

[akpm@linux-foundation.org: coding-style fixes]
Signed-off-by: Vivek Goyal 
Cc: Borislav Petkov 
Cc: Michael Kerrisk 
Cc: Yinghai Lu 
Cc: Eric Biederman 
Cc: H. Peter Anvin 
Cc: Matthew Garrett 
Cc: Greg Kroah-Hartman 
Cc: Dave Young 
Cc: WANG Chao 
Cc: Baoquan He 
Cc: Andy Lutomirski 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

kexec: new syscall kexec_file_load() declaration

2014-08-08T22:57:32+00:00

This is the new syscall kexec_file_load() declaration/interface.  I have
reserved the syscall number only for x86_64 so far.  Other architectures
(including i386) can reserve syscall number when they enable the support
for this new syscall.

Signed-off-by: Vivek Goyal 
Cc: Michael Kerrisk 
Cc: Borislav Petkov 
Cc: Yinghai Lu 
Cc: Eric Biederman 
Cc: H. Peter Anvin 
Cc: Matthew Garrett 
Cc: Greg Kroah-Hartman 
Cc: Dave Young 
Cc: WANG Chao 
Cc: Baoquan He 
Cc: Andy Lutomirski 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

kexec: use common function for kimage_normal_alloc() and kimage_crash_alloc()

2014-08-08T22:57:32+00:00

kimage_normal_alloc() and kimage_crash_alloc() are doing lot of similar
things and differ only little.  So instead of having two separate
functions create a common function kimage_alloc_init() and pass it the
"flags" argument which tells whether it is normal kexec or kexec_on_panic.
 And this function should be able to deal with both the cases.

This consolidation also helps later where we can use a common function
kimage_file_alloc_init() to handle normal and crash cases for new file
based kexec syscall.

Signed-off-by: Vivek Goyal 
Cc: Borislav Petkov 
Cc: Michael Kerrisk 
Cc: Yinghai Lu 
Cc: Eric Biederman 
Cc: H. Peter Anvin 
Cc: Matthew Garrett 
Cc: Greg Kroah-Hartman 
Cc: Dave Young 
Cc: WANG Chao 
Cc: Baoquan He 
Cc: Andy Lutomirski 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

kexec: move segment verification code in a separate function

2014-08-08T22:57:32+00:00

Previously do_kimage_alloc() will allocate a kimage structure, copy
segment list from user space and then do the segment list sanity
verification.

Break down this function in 3 parts.  do_kimage_alloc_init() to do actual
allocation and basic initialization of kimage structure.
copy_user_segment_list() to copy segment list from user space and
sanity_check_segment_list() to verify the sanity of segment list as passed
by user space.

In later patches, I need to only allocate kimage and not copy segment list
from user space.  So breaking down in smaller functions enables re-use of
code at other places.

Signed-off-by: Vivek Goyal 
Cc: Borislav Petkov 
Cc: Michael Kerrisk 
Cc: Yinghai Lu 
Cc: Eric Biederman 
Cc: H. Peter Anvin 
Cc: Matthew Garrett 
Cc: Greg Kroah-Hartman 
Cc: Dave Young 
Cc: WANG Chao 
Cc: Baoquan He 
Cc: Andy Lutomirski 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

kexec: rename unusebale_pages to unusable_pages

2014-08-08T22:57:32+00:00

Let's use the more common "unusable".

This patch was originally written and posted by Boris. I am including it
in this patch series.

Signed-off-by: Borislav Petkov 
Signed-off-by: Vivek Goyal 
Cc: Borislav Petkov 
Cc: Michael Kerrisk 
Cc: Yinghai Lu 
Cc: Eric Biederman 
Cc: H. Peter Anvin 
Cc: Matthew Garrett 
Cc: Greg Kroah-Hartman 
Cc: Dave Young 
Cc: WANG Chao 
Cc: Baoquan He 
Cc: Andy Lutomirski 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds