From 973e23bf27b0b2e5021321357fc570cccea3104c Mon Sep 17 00:00:00 2001

From: Dave Anderson <anderson@redhat.com>

Date: Tue, 26 Nov 2013 12:42:46 -0500

Subject: [PATCH] crash-driver

Bugzilla: N/A

Upstream-status: Fedora mustard

---

 arch/arm/include/asm/crash-driver.h     |   6 ++

 arch/arm64/include/asm/crash-driver.h   |   6 ++

 arch/ia64/include/asm/crash-driver.h    |  90 ++++++++++++++++++++++

 arch/ia64/kernel/ia64_ksyms.c           |   3 +

 arch/powerpc/include/asm/crash-driver.h |   6 ++

 arch/s390/include/asm/crash-driver.h    |  60 +++++++++++++++

 arch/s390/mm/maccess.c                  |   2 +

 arch/x86/include/asm/crash-driver.h     |   6 ++

 drivers/char/Kconfig                    |   3 +

 drivers/char/Makefile                   |   2 +

 drivers/char/crash.c                    | 128 ++++++++++++++++++++++++++++++++

 include/asm-generic/crash-driver.h      |  72 ++++++++++++++++++

 12 files changed, 384 insertions(+)

 create mode 100644 arch/arm/include/asm/crash-driver.h

 create mode 100644 arch/arm64/include/asm/crash-driver.h

 create mode 100644 arch/ia64/include/asm/crash-driver.h

 create mode 100644 arch/powerpc/include/asm/crash-driver.h

 create mode 100644 arch/s390/include/asm/crash-driver.h

 create mode 100644 arch/x86/include/asm/crash-driver.h

 create mode 100644 drivers/char/crash.c

 create mode 100644 include/asm-generic/crash-driver.h

diff --git a/arch/arm/include/asm/crash-driver.h b/arch/arm/include/asm/crash-driver.h

new file mode 100644

index 0000000..06e7ae9

--- /dev/null

+++ b/arch/arm/include/asm/crash-driver.h

@@ -0,0 +1,6 @@

+#ifndef _ARM_CRASH_H

+#define _ARM_CRASH_H

+

+#include <asm-generic/crash-driver.h>

+

+#endif /* _ARM_CRASH_H */

diff --git a/arch/arm64/include/asm/crash-driver.h b/arch/arm64/include/asm/crash-driver.h

new file mode 100644

index 0000000..43b26da

--- /dev/null

+++ b/arch/arm64/include/asm/crash-driver.h

@@ -0,0 +1,6 @@

+#ifndef _ARM64_CRASH_H

+#define _ARM64_CRASH_H

+

+#include <asm-generic/crash-driver.h>

+

+#endif /* _ARM64_CRASH_H */

diff --git a/arch/ia64/include/asm/crash-driver.h b/arch/ia64/include/asm/crash-driver.h

new file mode 100644

index 0000000..404bcb9

--- /dev/null

+++ b/arch/ia64/include/asm/crash-driver.h

@@ -0,0 +1,90 @@

+#ifndef _ASM_IA64_CRASH_H

+#define _ASM_IA64_CRASH_H

+

+/*

+ * linux/include/asm-ia64/crash-driver.h

+ *

+ * Copyright (c) 2004 Red Hat, Inc. All rights reserved.

+ *

+ * This program is free software; you can redistribute it and/or modify

+ * it under the terms of the GNU General Public License as published by

+ * the Free Software Foundation; either version 2, or (at your option)

+ * any later version.

+ *

+ * This program is distributed in the hope that it will be useful,

+ * but WITHOUT ANY WARRANTY; without even the implied warranty of

+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

+ * GNU General Public License for more details.

+ *

+ * You should have received a copy of the GNU General Public License

+ * along with this program; if not, write to the Free Software

+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.

+ *

+ */

+

+#ifdef __KERNEL__

+

+#include <linux/efi.h>

+#include <linux/mm.h>

+#include <asm/mmzone.h>

+

+static inline void *

+map_virtual(u64 offset, struct page **pp)

+{

+	struct page *page;

+	unsigned long pfn;

+	u32 type;

+

+	if (REGION_NUMBER(offset) == 5) {

+		char byte;

+

+		if (__get_user(byte, (char *)offset) == 0)

+			return (void *)offset;

+		else

+			return NULL;

+	}

+

+	switch (type = efi_mem_type(offset))

+	{

+	case EFI_LOADER_CODE:

+	case EFI_LOADER_DATA:

+	case EFI_BOOT_SERVICES_CODE:

+	case EFI_BOOT_SERVICES_DATA:

+	case EFI_CONVENTIONAL_MEMORY:

+		break;

+

+	default:

+		printk(KERN_INFO

+		    "crash memory driver: invalid memory type for %lx: %d\n",

+			offset, type);

+		return NULL;

+	}

+

+	pfn = offset >> PAGE_SHIFT;

+

+	if (!pfn_valid(pfn)) {

+		printk(KERN_INFO

+			"crash memory driver: invalid pfn: %lx )\n", pfn);

+		return NULL;

+	}

+

+	page = pfn_to_page(pfn);

+

+	if (!page->virtual) {

+		printk(KERN_INFO

+		    "crash memory driver: offset: %lx page: %lx page->virtual: NULL\n",

+			offset, (unsigned long)page);

+		return NULL;

+	}

+

+	return (page->virtual + (offset & (PAGE_SIZE-1)));

+}

+

+static inline void unmap_virtual(struct page *page)

+{

+	return;

+}

+

+#endif /* __KERNEL__ */

+

+#endif /* _ASM_IA64_CRASH_H */

diff --git a/arch/ia64/kernel/ia64_ksyms.c b/arch/ia64/kernel/ia64_ksyms.c

index d111248..b14b4c6 100644

--- a/arch/ia64/kernel/ia64_ksyms.c

+++ b/arch/ia64/kernel/ia64_ksyms.c

@@ -9,3 +9,6 @@

 EXPORT_SYMBOL(min_low_pfn);	/* defined by bootmem.c, but not exported by generic code */

 EXPORT_SYMBOL(max_low_pfn);	/* defined by bootmem.c, but not exported by generic code */

 #endif

+

+#include <linux/efi.h>

+EXPORT_SYMBOL_GPL(efi_mem_type);

diff --git a/arch/powerpc/include/asm/crash-driver.h b/arch/powerpc/include/asm/crash-driver.h

new file mode 100644

index 0000000..50092d9

--- /dev/null

+++ b/arch/powerpc/include/asm/crash-driver.h

@@ -0,0 +1,6 @@

+#ifndef _PPC64_CRASH_H

+#define _PPC64_CRASH_H

+

+#include <asm-generic/crash-driver.h>

+

+#endif /* _PPC64_CRASH_H */

diff --git a/arch/s390/include/asm/crash-driver.h b/arch/s390/include/asm/crash-driver.h

new file mode 100644

index 0000000..552be5e

--- /dev/null

+++ b/arch/s390/include/asm/crash-driver.h

@@ -0,0 +1,60 @@

+#ifndef _S390_CRASH_H

+#define _S390_CRASH_H

+

+#ifdef __KERNEL__

+

+#include <linux/mm.h>

+#include <linux/highmem.h>

+

+/*

+ * For swapped prefix pages get bounce buffer using xlate_dev_mem_ptr()

+ */

+static inline void *map_virtual(u64 offset, struct page **pp)

+{

+	struct page *page;

+	unsigned long pfn;

+	void *vaddr;

+

+	vaddr = xlate_dev_mem_ptr(offset);

+	pfn = ((unsigned long) vaddr) >> PAGE_SHIFT;

+	if ((unsigned long) vaddr != offset)

+		page = pfn_to_page(pfn);

+	else

+		page = NULL;

+

+	if (!page_is_ram(pfn)) {

+		printk(KERN_INFO

+		    "crash memory driver: !page_is_ram(pfn: %lx)\n", pfn);

+		return NULL;

+	}

+

+	if (!pfn_valid(pfn)) {

+		printk(KERN_INFO

+		    "crash memory driver: invalid pfn: %lx )\n", pfn);

+		return NULL;

+	}

+

+	*pp = page;

+	return vaddr;

+}

+

+/*

+ * Free bounce buffer if necessary

+ */

+static inline void unmap_virtual(struct page *page)

+{

+	void *vaddr;

+

+	if (page) {

+		/*

+		 * Because for bounce buffers vaddr will never be 0

+		 * unxlate_dev_mem_ptr() will always free the bounce buffer.

+		 */

+		vaddr = (void *)(page_to_pfn(page) << PAGE_SHIFT);

+		unxlate_dev_mem_ptr(0, vaddr);

+	}

+}

+

+#endif /* __KERNEL__ */

+

+#endif /* _S390_CRASH_H */

diff --git a/arch/s390/mm/maccess.c b/arch/s390/mm/maccess.c

index 792f9c6..3197995 100644

--- a/arch/s390/mm/maccess.c

+++ b/arch/s390/mm/maccess.c

@@ -201,6 +201,7 @@ void *xlate_dev_mem_ptr(phys_addr_t addr)

 	put_online_cpus();

 	return bounce;

 }

+EXPORT_SYMBOL_GPL(xlate_dev_mem_ptr);

 /*

  * Free converted buffer for /dev/mem access (if necessary)

@@ -210,3 +211,4 @@ void unxlate_dev_mem_ptr(phys_addr_t addr, void *buf)

 	if ((void *) addr != buf)

 		free_page((unsigned long) buf);

 }

+EXPORT_SYMBOL_GPL(unxlate_dev_mem_ptr);

diff --git a/arch/x86/include/asm/crash-driver.h b/arch/x86/include/asm/crash-driver.h

new file mode 100644

index 0000000..fd4736e

--- /dev/null

+++ b/arch/x86/include/asm/crash-driver.h

@@ -0,0 +1,6 @@

+#ifndef _X86_CRASH_H

+#define _X86_CRASH_H

+

+#include <asm-generic/crash-driver.h>

+

+#endif /* _X86_CRASH_H */

diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig

index dcc0973..99b99d5 100644

--- a/drivers/char/Kconfig

+++ b/drivers/char/Kconfig

@@ -4,6 +4,9 @@

 menu "Character devices"

+config CRASH

+	tristate "Crash Utility memory driver"

+

 source "drivers/tty/Kconfig"

 config DEVMEM

diff --git a/drivers/char/Makefile b/drivers/char/Makefile

index 6e6c244..29cc9c8 100644

--- a/drivers/char/Makefile

+++ b/drivers/char/Makefile

@@ -60,3 +60,5 @@ js-rtc-y = rtc.o

 obj-$(CONFIG_TILE_SROM)		+= tile-srom.o

 obj-$(CONFIG_XILLYBUS)		+= xillybus/

 obj-$(CONFIG_POWERNV_OP_PANEL)	+= powernv-op-panel.o

+

+obj-$(CONFIG_CRASH)            += crash.o

diff --git a/drivers/char/crash.c b/drivers/char/crash.c

new file mode 100644

index 0000000..085378a

--- /dev/null

+++ b/drivers/char/crash.c

@@ -0,0 +1,128 @@

+/*

+ *  linux/drivers/char/crash.c

+ *

+ *  Copyright (C) 2004  Dave Anderson <anderson@redhat.com>

+ *  Copyright (C) 2004  Red Hat, Inc.

+ */

+

+/******************************************************************************

+ *

+ *   This program is free software; you can redistribute it and/or modify

+ *   it under the terms of the GNU General Public License as published by

+ *   the Free Software Foundation; either version 2, or (at your option)

+ *   any later version.

+ *

+ *   This program is distributed in the hope that it will be useful,

+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of

+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

+ *   GNU General Public License for more details.

+ *

+ *   You should have received a copy of the GNU General Public License

+ *   along with this program; if not, write to the Free Software

+ *   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.

+ *

+ *****************************************************************************/

+

+#include <linux/module.h>

+#include <linux/types.h>

+#include <linux/miscdevice.h>

+#include <linux/init.h>

+#include <asm/io.h>

+#include <asm/uaccess.h>

+#include <asm/types.h>

+#include <asm/crash-driver.h>

+

+#define CRASH_VERSION   "1.0"

+

+/*

+ *  These are the file operation functions that allow crash utility

+ *  access to physical memory.

+ */

+

+static loff_t

+crash_llseek(struct file * file, loff_t offset, int orig)

+{

+	switch (orig) {

+	case 0:

+		file->f_pos = offset;

+		return file->f_pos;

+	case 1:

+		file->f_pos += offset;

+		return file->f_pos;

+	default:

+		return -EINVAL;

+	}

+}

+

+/*

+ *  Determine the page address for an address offset value,

+ *  get a virtual address for it, and copy it out.

+ *  Accesses must fit within a page.

+ */

+static ssize_t

+crash_read(struct file *file, char *buf, size_t count, loff_t *poff)

+{

+	void *vaddr;

+	struct page *page;

+	u64 offset;

+	ssize_t read;

+

+	offset = *poff;

+	if (offset >> PAGE_SHIFT != (offset+count-1) >> PAGE_SHIFT)

+		return -EINVAL;

+

+	vaddr = map_virtual(offset, &page);

+	if (!vaddr)

+		return -EFAULT;

+

+	if (copy_to_user(buf, vaddr, count)) {

+		unmap_virtual(page);

+		return -EFAULT;

+	}

+	unmap_virtual(page);

+

+	read = count;

+	*poff += read;

+	return read;

+}

+

+static struct file_operations crash_fops = {

+	.owner = THIS_MODULE,

+	.llseek = crash_llseek,

+	.read = crash_read,

+};

+

+static struct miscdevice crash_dev = {

+	MISC_DYNAMIC_MINOR,

+	"crash",

+	&crash_fops

+};

+

+static int __init

+crash_init(void)

+{

+	int ret;

+

+	ret = misc_register(&crash_dev);

+	if (ret) {

+		printk(KERN_ERR

+		    "crash memory driver: cannot misc_register (MISC_DYNAMIC_MINOR)\n");

+		goto out;

+	}

+

+	ret = 0;

+	printk(KERN_INFO "crash memory driver: version %s\n", CRASH_VERSION);

+out:

+	return ret;

+}

+

+static void __exit

+crash_cleanup_module(void)

+{

+	misc_deregister(&crash_dev);

+}

+

+module_init(crash_init);

+module_exit(crash_cleanup_module);

+

+MODULE_LICENSE("GPL");

diff --git a/include/asm-generic/crash-driver.h b/include/asm-generic/crash-driver.h

new file mode 100644

index 0000000..25ab986

--- /dev/null

+++ b/include/asm-generic/crash-driver.h

@@ -0,0 +1,72 @@

+#ifndef __CRASH_H__

+#define __CRASH_H__

+

+/*

+ * include/linux/crash-driver.h

+ *

+ * Copyright (c) 2013 Red Hat, Inc. All rights reserved.

+ *

+ * This program is free software; you can redistribute it and/or modify

+ * it under the terms of the GNU General Public License as published by

+ * the Free Software Foundation; either version 2, or (at your option)

+ * any later version.

+ *

+ * This program is distributed in the hope that it will be useful,

+ * but WITHOUT ANY WARRANTY; without even the implied warranty of

+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

+ * GNU General Public License for more details.

+ *

+ * You should have received a copy of the GNU General Public License

+ * along with this program; if not, write to the Free Software

+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.

+ *

+ */

+

+#ifdef __KERNEL__

+

+#include <linux/mm.h>

+#include <linux/highmem.h>

+

+static inline void *

+map_virtual(u64 offset, struct page **pp)

+{

+	struct page *page;

+	unsigned long pfn;

+	void *vaddr;

+

+	pfn = (unsigned long)(offset >> PAGE_SHIFT);

+

+	if (!page_is_ram(pfn)) {

+		printk(KERN_INFO

+		    "crash memory driver: !page_is_ram(pfn: %lx)\n", pfn);

+		return NULL;

+	}

+

+	if (!pfn_valid(pfn)) {

+		printk(KERN_INFO

+		    "crash memory driver: invalid pfn: %lx )\n", pfn);

+		return NULL;

+	}

+

+	page = pfn_to_page(pfn);

+

+	vaddr = kmap(page);

+	if (!vaddr) {

+		printk(KERN_INFO

+		    "crash memory driver: pfn: %lx kmap(page: %lx) failed\n",

+			pfn, (unsigned long)page);

+		return NULL;

+	}

+

+	*pp = page;

+	return (vaddr + (offset & (PAGE_SIZE-1)));

+}

+

+static inline void unmap_virtual(struct page *page)

+{

+	kunmap(page);

+}

+

+#endif /* __KERNEL__ */

+

+#endif /* __CRASH_H__ */

-- 

2.7.4

From 23d8bd48303acda2d3a95a3e1a662784a4fa9fcd Mon Sep 17 00:00:00 2001

From: Fedora Kernel Team <kernel-team@fedoraproject.org>

Date: Tue, 20 Sep 2016 19:39:46 +0200

Subject: [PATCH] Update of crash driver to handle CONFIG_HARDENED_USERCOPY and

 to restrict the supported architectures.

---

 drivers/char/Kconfig |  1 +

 drivers/char/crash.c | 33 ++++++++++++++++++++++++++++++---

 2 files changed, 31 insertions(+), 3 deletions(-)

diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig

index 99b99d5..be6a3ae 100644

--- a/drivers/char/Kconfig

+++ b/drivers/char/Kconfig

@@ -6,6 +6,7 @@ menu "Character devices"

 config CRASH

 	tristate "Crash Utility memory driver"

+	depends on X86_32 || X86_64 || ARM || ARM64 || PPC64 || S390

 source "drivers/tty/Kconfig"

diff --git a/drivers/char/crash.c b/drivers/char/crash.c

index 085378a..0258bf8 100644

--- a/drivers/char/crash.c

+++ b/drivers/char/crash.c

@@ -32,7 +32,7 @@

 #include <asm/types.h>

 #include <asm/crash-driver.h>

-#define CRASH_VERSION   "1.0"

+#define CRASH_VERSION   "1.2"

 /*

  *  These are the file operation functions that allow crash utility

@@ -66,6 +66,7 @@ crash_read(struct file *file, char *buf, size_t count, loff_t *poff)

 	struct page *page;

 	u64 offset;

 	ssize_t read;

+	char *buffer = file->private_data;

 	offset = *poff;

 	if (offset >> PAGE_SHIFT != (offset+count-1) >> PAGE_SHIFT)

@@ -74,8 +75,12 @@ crash_read(struct file *file, char *buf, size_t count, loff_t *poff)

 	vaddr = map_virtual(offset, &page);

 	if (!vaddr)

 		return -EFAULT;

-

-	if (copy_to_user(buf, vaddr, count)) {

+	/*

+	 * Use bounce buffer to bypass the CONFIG_HARDENED_USERCOPY

+	 * kernel text restriction.

+	*/

+	memcpy(buffer, (char *)vaddr, count);

+	if (copy_to_user(buf, buffer, count)) {

 		unmap_virtual(page);

 		return -EFAULT;

 	}

@@ -86,10 +91,32 @@ crash_read(struct file *file, char *buf, size_t count, loff_t *poff)

 	return read;

 }

+static int

+crash_open(struct inode * inode, struct file * filp)

+{

+	if (!capable(CAP_SYS_RAWIO))

+		return -EPERM;

+

+	filp->private_data = (void *)__get_free_page(GFP_KERNEL);

+	if (!filp->private_data)

+		return -ENOMEM;

+

+	return 0;

+}

+

+static int

+crash_release(struct inode *inode, struct file *filp)

+{

+	free_pages((unsigned long)filp->private_data, 0);

+	return 0;

+}

+

 static struct file_operations crash_fops = {

 	.owner = THIS_MODULE,

 	.llseek = crash_llseek,

 	.read = crash_read,

+	.open = crash_open,

+	.release = crash_release,

 };

 static struct miscdevice crash_dev = {

-- 

2.7.4