Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
195d331
riscv: kexec_file: Fix crashk_low_res not exclude bug
ruanjinjie-eng May 25, 2026
fa61e18
powerpc/crash: Fix possible memory leak in update_crash_elfcorehdr()
ruanjinjie-eng May 25, 2026
e6256e4
powerpc/crash: sort crash memory ranges before preparing elfcorehdr
sourabhjains May 25, 2026
0dbcbef
arm64: kexec: Fix image->elf_headers memory leak during retry loop
ruanjinjie-eng May 25, 2026
b3b2f5a
x86/kexec: Fix potential buffer overflow in prepare_elf_headers()
ruanjinjie-eng May 25, 2026
440ad06
arm64: kexec_file: Fix potential buffer overflow in prepare_elf_heade…
ruanjinjie-eng May 25, 2026
3d9c844
riscv: kexec_file: Fix potential buffer overflow in prepare_elf_heade…
ruanjinjie-eng May 25, 2026
17e0daa
LoongArch: kexec: Fix potential buffer overflow in prepare_elf_headers()
ruanjinjie-eng May 25, 2026
1eaa0fd
crash: Add crash_prepare_headers() to exclude crash kernel memory
ruanjinjie-eng May 25, 2026
ae99b96
arm64: kexec_file: Use crash_prepare_headers() helper to simplify code
ruanjinjie-eng May 25, 2026
9d948a7
x86/kexec: Use crash_prepare_headers() helper to simplify code
ruanjinjie-eng May 25, 2026
a6749dc
riscv: kexec_file: Use crash_prepare_headers() helper to simplify code
ruanjinjie-eng May 25, 2026
d02dee6
LoongArch: kexec: Use crash_prepare_headers() helper to simplify code
ruanjinjie-eng May 25, 2026
ea75385
crash: Use crash_exclude_core_ranges() on powerpc
ruanjinjie-eng May 25, 2026
d3c88d1
arm64: kexec: Add support for crashkernel CMA reservation
ruanjinjie-eng May 25, 2026
49285ed
riscv: kexec: Add support for crashkernel CMA reservation
ruanjinjie-eng May 25, 2026
ec1ddd4
arm64/crash: Add crash hotplug support
ruanjinjie-eng May 25, 2026
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 8 additions & 8 deletions Documentation/admin-guide/kernel-parameters.txt
Original file line number Diff line number Diff line change
Expand Up @@ -1119,14 +1119,14 @@ Kernel parameters
It will be ignored when crashkernel=X,high is not used
or memory reserved is below 4G.
crashkernel=size[KMG],cma
[KNL, X86, ppc] Reserve additional crash kernel memory from
CMA. This reservation is usable by the first system's
userspace memory and kernel movable allocations (memory
balloon, zswap). Pages allocated from this memory range
will not be included in the vmcore so this should not
be used if dumping of userspace memory is intended and
it has to be expected that some movable kernel pages
may be missing from the dump.
[KNL, X86, ARM64, RISCV, PPC] Reserve additional crash
kernel memory from CMA. This reservation is usable by
the first system's userspace memory and kernel movable
allocations (memory balloon, zswap). Pages allocated
from this memory range will not be included in the vmcore
so this should not be used if dumping of userspace memory
is intended and it has to be expected that some movable
kernel pages may be missing from the dump.

A standard crashkernel reservation, as described above,
is still needed to hold the crash kernel and initrd.
Expand Down
3 changes: 3 additions & 0 deletions arch/arm64/Kconfig
Original file line number Diff line number Diff line change
Expand Up @@ -1609,6 +1609,9 @@ config ARCH_DEFAULT_CRASH_DUMP
config ARCH_HAS_GENERIC_CRASHKERNEL_RESERVATION
def_bool CRASH_RESERVE

config ARCH_SUPPORTS_CRASH_HOTPLUG
def_bool y

config TRANS_TABLE
def_bool y
depends on HIBERNATION || KEXEC_CORE
Expand Down
14 changes: 13 additions & 1 deletion arch/arm64/include/asm/kexec.h
Original file line number Diff line number Diff line change
Expand Up @@ -127,7 +127,19 @@ int arch_kimage_file_post_load_cleanup(struct kimage *image);
extern int load_other_segments(struct kimage *image,
unsigned long kernel_load_addr, unsigned long kernel_size,
char *initrd, unsigned long initrd_len,
char *cmdline);
char *cmdline, void *headers, unsigned long headers_size);
extern int prepare_elf_headers(void **addr, unsigned long *sz);
#endif

#ifdef CONFIG_CRASH_HOTPLUG
void arch_crash_handle_hotplug_event(struct kimage *image, void *arg);
#define arch_crash_handle_hotplug_event arch_crash_handle_hotplug_event

int arch_crash_hotplug_support(struct kimage *image, unsigned long kexec_flags);
#define arch_crash_hotplug_support arch_crash_hotplug_support

unsigned int arch_crash_get_elfcorehdr_size(void);
#define crash_get_elfcorehdr_size arch_crash_get_elfcorehdr_size
#endif

#endif /* __ASSEMBLER__ */
Expand Down
1 change: 1 addition & 0 deletions arch/arm64/kernel/Makefile
Original file line number Diff line number Diff line change
Expand Up @@ -65,6 +65,7 @@ obj-$(CONFIG_KEXEC_FILE) += machine_kexec_file.o kexec_image.o
obj-$(CONFIG_ARM64_RELOC_TEST) += arm64-reloc-test.o
arm64-reloc-test-y := reloc_test_core.o reloc_test_syms.o
obj-$(CONFIG_CRASH_DUMP) += crash_dump.o
obj-$(CONFIG_CRASH_HOTPLUG) += crash.o
obj-$(CONFIG_VMCORE_INFO) += vmcore_info.o
obj-$(CONFIG_ARM_SDE_INTERFACE) += sdei.o
obj-$(CONFIG_ARM64_PTR_AUTH) += pointer_auth.o
Expand Down
125 changes: 125 additions & 0 deletions arch/arm64/kernel/crash.c
Original file line number Diff line number Diff line change
@@ -0,0 +1,125 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
* Architecture specific functions for kexec based crash dumps.
*/

#define pr_fmt(fmt) "crash hp: " fmt

#include <linux/kexec.h>
#include <linux/elf.h>
#include <linux/vmalloc.h>
#include <linux/crash_core.h>

#include <asm/kexec.h>

#ifdef CONFIG_CRASH_HOTPLUG

int arch_crash_hotplug_support(struct kimage *image, unsigned long kexec_flags)
{
#ifdef CONFIG_KEXEC_FILE
if (image->file_mode)
return 1;
#endif
/*
* For kexec_load syscall, crash hotplug support requires
* KEXEC_CRASH_HOTPLUG_SUPPORT flag to be passed by userspace.
*/
return kexec_flags & KEXEC_CRASH_HOTPLUG_SUPPORT;
}

unsigned int arch_crash_get_elfcorehdr_size(void)
{
unsigned int phdr_cnt;

/* A program header for possible CPUs, vmcoreinfo and kernel_map */
phdr_cnt = 2 + num_possible_cpus();
if (IS_ENABLED(CONFIG_MEMORY_HOTPLUG))
phdr_cnt += CONFIG_CRASH_MAX_MEMORY_RANGES;

return sizeof(Elf64_Ehdr) + phdr_cnt * sizeof(Elf64_Phdr);
}

/**
* update_crash_elfcorehdr() - Recreate the elfcorehdr and replace it with old
* elfcorehdr in the kexec segment array.
* @image: the active struct kimage
*/
static void update_crash_elfcorehdr(struct kimage *image)
{
void *elfbuf = NULL, *old_elfcorehdr;
unsigned long mem, memsz;
unsigned long elfsz = 0;

/*
* Create the new elfcorehdr reflecting the changes to CPU and/or
* memory resources.
*/
if (crash_prepare_headers(true, &elfbuf, &elfsz, NULL)) {
pr_err("unable to create new elfcorehdr");
goto out;
}

/*
* Obtain address and size of the elfcorehdr segment, and
* check it against the new elfcorehdr buffer.
*/
mem = image->segment[image->elfcorehdr_index].mem;
memsz = image->segment[image->elfcorehdr_index].memsz;
if (elfsz > memsz) {
pr_err("update elfcorehdr elfsz %lu > memsz %lu",
elfsz, memsz);
goto out;
}

/*
* Copy new elfcorehdr over the old elfcorehdr at destination.
*/
old_elfcorehdr = (void *)__va(mem);
if (!old_elfcorehdr) {
pr_err("mapping elfcorehdr segment failed\n");
goto out;
}

/*
* Temporarily invalidate the crash image while the
* elfcorehdr is updated.
*/
xchg(&kexec_crash_image, NULL);
memcpy_flushcache(old_elfcorehdr, elfbuf, elfsz);
xchg(&kexec_crash_image, image);
pr_debug("updated elfcorehdr\n");

out:
vfree(elfbuf);
}

/**
* arch_crash_handle_hotplug_event() - Handle hotplug elfcorehdr changes
* @image: a pointer to kexec_crash_image
* @arg: struct memory_notify handler for memory hotplug case and
* NULL for CPU hotplug case.
*
* Update the kdump image based on the type of hotplug event:
* - CPU add and remove: No action is needed.
* - Memory add/remove: Update the elfcorehdr to reflect the current memory layout.
*
* Prepare the new elfcorehdr and replace the existing elfcorehdr.
*/
void arch_crash_handle_hotplug_event(struct kimage *image, void *arg)
{
switch (image->hp_action) {
case KEXEC_CRASH_HP_ADD_CPU:
fallthrough;
case KEXEC_CRASH_HP_REMOVE_CPU:
if (image->file_mode || image->elfcorehdr_updated)
return;
fallthrough;
case KEXEC_CRASH_HP_ADD_MEMORY:
case KEXEC_CRASH_HP_REMOVE_MEMORY:
update_crash_elfcorehdr(image);
return;
default:
pr_warn_once("Unknown hotplug action\n");
}
}
#endif /* CONFIG_CRASH_HOTPLUG */
22 changes: 20 additions & 2 deletions arch/arm64/kernel/kexec_image.c
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,11 @@ static void *image_load(struct kimage *image,
struct kexec_buf kbuf = {};
unsigned long text_offset, kernel_segment_number;
struct kexec_segment *kernel_segment;
#ifdef CONFIG_CRASH_DUMP
/* load elf core header */
unsigned long headers_sz;
void *headers;
#endif
int ret;

/*
Expand Down Expand Up @@ -89,6 +94,18 @@ static void *image_load(struct kimage *image,

kernel_segment_number = image->nr_segments;

#ifdef CONFIG_CRASH_DUMP
if (image->type == KEXEC_TYPE_CRASH) {
ret = crash_prepare_headers_locked(true, &headers, &headers_sz, NULL);
if (ret) {
pr_err("Preparing elf core header failed\n");
return ERR_PTR(ret);
}
image->elf_headers = headers;
image->elf_headers_sz = headers_sz;
}
#endif

/*
* The location of the kernel segment may make it impossible to satisfy
* the other segment requirements, so we try repeatedly to find a
Expand All @@ -99,15 +116,16 @@ static void *image_load(struct kimage *image,
kernel_segment = &image->segment[kernel_segment_number];
ret = load_other_segments(image, kernel_segment->mem,
kernel_segment->memsz, initrd,
initrd_len, cmdline);
initrd_len, cmdline,
headers, headers_sz);
if (!ret)
break;

/*
* We couldn't find space for the other segments; erase the
* kernel segment and try the next available hole.
*/
image->nr_segments -= 1;
image->nr_segments = kernel_segment_number;
kbuf.buf_min = kernel_segment->mem + kernel_segment->memsz;
kbuf.mem = KEXEC_BUF_MEM_UNKNOWN;
}
Expand Down
78 changes: 37 additions & 41 deletions arch/arm64/kernel/machine_kexec_file.c
Original file line number Diff line number Diff line change
Expand Up @@ -40,46 +40,33 @@ int arch_kimage_file_post_load_cleanup(struct kimage *image)
}

#ifdef CONFIG_CRASH_DUMP
static int prepare_elf_headers(void **addr, unsigned long *sz)
unsigned int arch_get_system_nr_ranges(void)
{
struct crash_mem *cmem;
unsigned int nr_ranges;
int ret;
u64 i;
unsigned int nr_ranges = 2 + crashk_cma_cnt; /* for exclusion of crashkernel region */
phys_addr_t start, end;
u64 i;

nr_ranges = 2; /* for exclusion of crashkernel region */
for_each_mem_range(i, &start, &end)
nr_ranges++;

cmem = kmalloc_flex(*cmem, ranges, nr_ranges);
if (!cmem)
return -ENOMEM;
return nr_ranges;
}

int arch_crash_populate_cmem(struct crash_mem *cmem)
{
phys_addr_t start, end;
u64 i;

cmem->max_nr_ranges = nr_ranges;
cmem->nr_ranges = 0;
for_each_mem_range(i, &start, &end) {
if (WARN_ON_ONCE(cmem->nr_ranges >= cmem->max_nr_ranges))
return -EAGAIN;

cmem->ranges[cmem->nr_ranges].start = start;
cmem->ranges[cmem->nr_ranges].end = end - 1;
cmem->nr_ranges++;
}

/* Exclude crashkernel region */
ret = crash_exclude_mem_range(cmem, crashk_res.start, crashk_res.end);
if (ret)
goto out;

if (crashk_low_res.end) {
ret = crash_exclude_mem_range(cmem, crashk_low_res.start, crashk_low_res.end);
if (ret)
goto out;
}

ret = crash_prepare_elf64_headers(cmem, true, addr, sz);

out:
kfree(cmem);
return ret;
return 0;
}
#endif

Expand All @@ -92,33 +79,43 @@ int load_other_segments(struct kimage *image,
unsigned long kernel_load_addr,
unsigned long kernel_size,
char *initrd, unsigned long initrd_len,
char *cmdline)
char *cmdline, void *headers,
unsigned long headers_sz)
{
struct kexec_buf kbuf = {};
void *dtb = NULL;
unsigned long initrd_load_addr = 0, dtb_len,
orig_segments = image->nr_segments;
struct kexec_buf kbuf = {};
unsigned long pnum = 0;
void *dtb = NULL;
int ret = 0;

kbuf.image = image;
/* not allocate anything below the kernel */
kbuf.buf_min = kernel_load_addr + kernel_size;

#ifdef CONFIG_CRASH_DUMP
/* load elf core header */
void *headers;
unsigned long headers_sz;
if (image->type == KEXEC_TYPE_CRASH) {
ret = prepare_elf_headers(&headers, &headers_sz);
if (ret) {
pr_err("Preparing elf core header failed\n");
goto out_err;
}

kbuf.buffer = headers;
kbuf.bufsz = headers_sz;
kbuf.mem = KEXEC_BUF_MEM_UNKNOWN;
kbuf.memsz = headers_sz;

#ifdef CONFIG_CRASH_HOTPLUG
/*
* The elfcorehdr segment size accounts for VMCOREINFO, kernel_map
* maximum CPUs and maximum memory ranges.
*/
if (IS_ENABLED(CONFIG_MEMORY_HOTPLUG))
pnum = 2 + num_possible_cpus() + CONFIG_CRASH_MAX_MEMORY_RANGES;
else
pnum += 2 + num_possible_cpus();

if (pnum < (unsigned long)PN_XNUM)
kbuf.memsz = pnum * sizeof(Elf64_Phdr) + sizeof(Elf64_Ehdr);
else
pr_err("number of Phdrs %lu exceeds max\n", pnum);
#endif

kbuf.buf_align = SZ_64K; /* largest supported page size */
kbuf.buf_max = ULONG_MAX;
kbuf.top_down = true;
Expand All @@ -128,9 +125,8 @@ int load_other_segments(struct kimage *image,
vfree(headers);
goto out_err;
}
image->elf_headers = headers;
image->elf_load_addr = kbuf.mem;
image->elf_headers_sz = headers_sz;
image->elf_headers_sz = kbuf.memsz;

kexec_dprintk("Loaded elf core header at 0x%lx bufsz=0x%lx memsz=0x%lx\n",
image->elf_load_addr, kbuf.bufsz, kbuf.memsz);
Expand Down
5 changes: 3 additions & 2 deletions arch/arm64/mm/init.c
Original file line number Diff line number Diff line change
Expand Up @@ -96,8 +96,8 @@ phys_addr_t __ro_after_init arm64_dma_phys_limit;

static void __init arch_reserve_crashkernel(void)
{
unsigned long long crash_base, crash_size, cma_size = 0;
unsigned long long low_size = 0;
unsigned long long crash_base, crash_size;
bool high = false;
int ret;

Expand All @@ -106,11 +106,12 @@ static void __init arch_reserve_crashkernel(void)

ret = parse_crashkernel(boot_command_line, memblock_phys_mem_size(),
&crash_size, &crash_base,
&low_size, NULL, &high);
&low_size, &cma_size, &high);
if (ret)
return;

reserve_crashkernel_generic(crash_size, crash_base, low_size, high);
reserve_crashkernel_cma(cma_size);
}

static phys_addr_t __init max_zone_phys(phys_addr_t zone_limit)
Expand Down
Loading
Loading