7 files changed, 724 insertions, 25 deletions

diff --git a/arch/x86/include/asm/crash.h b/arch/x86/include/asm/crash.h
new file mode 100644
index 000000000000..f498411f2500
--- /dev/null
+++ b/arch/x86/include/asm/crash.h
@@ -0,0 +1,9 @@
+#ifndef _ASM_X86_CRASH_H
+#define _ASM_X86_CRASH_H
+
+int crash_load_segments(struct kimage *image);
+int crash_copy_backup_region(struct kimage *image);
+int crash_setup_memmap_entries(struct kimage *image,
+                struct boot_params *params);
+
+#endif /* _ASM_X86_CRASH_H */
diff --git a/arch/x86/include/asm/kexec.h b/arch/x86/include/asm/kexec.h
index 0dfccced4edf..d2434c1cad05 100644
--- a/arch/x86/include/asm/kexec.h
+++ b/arch/x86/include/asm/kexec.h
@@ -25,6 +25,8 @@
 #include <asm/ptrace.h>
 #include <asm/bootparam.h>
 
+struct kimage;
+
 /*
  * KEXEC_SOURCE_MEMORY_LIMIT maximum page get_free_page can return.
  * I.e. Maximum page that is mapped directly into kernel memory,
@@ -62,6 +64,10 @@
 # define KEXEC_ARCH KEXEC_ARCH_X86_64
 #endif
 
+/* Memory to backup during crash kdump */
+#define KEXEC_BACKUP_SRC_START  (0UL)
+#define KEXEC_BACKUP_SRC_END    (640 * 1024UL)  /* 640K */
+
 /*
  * CPU does not save ss and sp on stack if execution is already
  * running in kernel mode at the time of NMI occurrence. This code
@@ -161,17 +167,35 @@ struct kimage_arch {
         pud_t *pud;
         pmd_t *pmd;
         pte_t *pte;
+        /* Details of backup region */
+        unsigned long backup_src_start;
+        unsigned long backup_src_sz;
+
+        /* Physical address of backup segment */
+        unsigned long backup_load_addr;
+
+        /* Core ELF header buffer */
+        void *elf_headers;
+        unsigned long elf_headers_sz;
+        unsigned long elf_load_addr;
 };
+#endif /* CONFIG_X86_32 */
 
+#ifdef CONFIG_X86_64
+/*
+ * Number of elements and order of elements in this structure should match
+ * with the ones in arch/x86/purgatory/entry64.S. If you make a change here
+ * make an appropriate change in purgatory too.
+ */
 struct kexec_entry64_regs {
         uint64_t rax;
-        uint64_t rbx;
         uint64_t rcx;
         uint64_t rdx;
-        uint64_t rsi;
-        uint64_t rdi;
+        uint64_t rbx;
         uint64_t rsp;
         uint64_t rbp;
+        uint64_t rsi;
+        uint64_t rdi;
         uint64_t r8;
         uint64_t r9;
         uint64_t r10;
diff --git a/arch/x86/kernel/crash.c b/arch/x86/kernel/crash.c
index 507de8066594..0553a34fa0df 100644
--- a/arch/x86/kernel/crash.c
+++ b/arch/x86/kernel/crash.c
@@ -4,9 +4,14 @@
  * Created by: Hariprasad Nellitheertha (hari@in.ibm.com)
  *
  * Copyright (C) IBM Corporation, 2004. All rights reserved.
+ * Copyright (C) Red Hat Inc., 2014. All rights reserved.
+ * Authors:
+ *      Vivek Goyal <vgoyal@redhat.com>
  *
  */
 
+#define pr_fmt(fmt)     "kexec: " fmt
+
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/smp.h>
@@ -16,6 +21,7 @@
 #include <linux/elf.h>
 #include <linux/elfcore.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 
 #include <asm/processor.h>
 #include <asm/hardirq.h>
@@ -28,6 +34,45 @@
 #include <asm/reboot.h>
 #include <asm/virtext.h>
 
+/* Alignment required for elf header segment */
+#define ELF_CORE_HEADER_ALIGN   4096
+
+/* This primarily represents number of split ranges due to exclusion */
+#define CRASH_MAX_RANGES        16
+
+struct crash_mem_range {
+        u64 start, end;
+};
+
+struct crash_mem {
+        unsigned int nr_ranges;
+        struct crash_mem_range ranges[CRASH_MAX_RANGES];
+};
+
+/* Misc data about ram ranges needed to prepare elf headers */
+struct crash_elf_data {
+        struct kimage *image;
+        /*
+         * Total number of ram ranges we have after various adjustments for
+         * GART, crash reserved region etc.
+         */
+        unsigned int max_nr_ranges;
+        unsigned long gart_start, gart_end;
+
+        /* Pointer to elf header */
+        void *ehdr;
+        /* Pointer to next phdr */
+        void *bufp;
+        struct crash_mem mem;
+};
+
+/* Used while preparing memory map entries for second kernel */
+struct crash_memmap_data {
+        struct boot_params *params;
+        /* Type of memory */
+        unsigned int type;
+};
+
 int in_crash_kexec;
 
 /*
@@ -39,6 +84,7 @@ int in_crash_kexec;
  */
 crash_vmclear_fn __rcu *crash_vmclear_loaded_vmcss = NULL;
 EXPORT_SYMBOL_GPL(crash_vmclear_loaded_vmcss);
+unsigned long crash_zero_bytes;
 
 static inline void cpu_crash_vmclear_loaded_vmcss(void)
 {
@@ -135,3 +181,520 @@ void native_machine_crash_shutdown(struct pt_regs *regs)
 #endif
         crash_save_cpu(regs, safe_smp_processor_id());
 }
+
+#ifdef CONFIG_X86_64
+
+static int get_nr_ram_ranges_callback(unsigned long start_pfn,
+                                unsigned long nr_pfn, void *arg)
+{
+        int *nr_ranges = arg;
+
+        (*nr_ranges)++;
+        return 0;
+}
+
+static int get_gart_ranges_callback(u64 start, u64 end, void *arg)
+{
+        struct crash_elf_data *ced = arg;
+
+        ced->gart_start = start;
+        ced->gart_end = end;
+
+        /* Not expecting more than 1 gart aperture */
+        return 1;
+}
+
+
+/* Gather all the required information to prepare elf headers for ram regions */
+static void fill_up_crash_elf_data(struct crash_elf_data *ced,
+                                   struct kimage *image)
+{
+        unsigned int nr_ranges = 0;
+
+        ced->image = image;
+
+        walk_system_ram_range(0, -1, &nr_ranges,
+                                get_nr_ram_ranges_callback);
+
+        ced->max_nr_ranges = nr_ranges;
+
+        /*
+         * We don't create ELF headers for GART aperture as an attempt
+         * to dump this memory in second kernel leads to hang/crash.
+         * If gart aperture is present, one needs to exclude that region
+         * and that could lead to need of extra phdr.
+         */
+        walk_iomem_res("GART", IORESOURCE_MEM, 0, -1,
+                                ced, get_gart_ranges_callback);
+
+        /*
+         * If we have gart region, excluding that could potentially split
+         * a memory range, resulting in extra header. Account for  that.
+         */
+        if (ced->gart_end)
+                ced->max_nr_ranges++;
+
+        /* Exclusion of crash region could split memory ranges */
+        ced->max_nr_ranges++;
+
+        /* If crashk_low_res is not 0, another range split possible */
+        if (crashk_low_res.end != 0)
+                ced->max_nr_ranges++;
+}
+
+static int exclude_mem_range(struct crash_mem *mem,
+                unsigned long long mstart, unsigned long long mend)
+{
+        int i, j;
+        unsigned long long start, end;
+        struct crash_mem_range temp_range = {0, 0};
+
+        for (i = 0; i < mem->nr_ranges; i++) {
+                start = mem->ranges[i].start;
+                end = mem->ranges[i].end;
+
+                if (mstart > end || mend < start)
+                        continue;
+
+                /* Truncate any area outside of range */
+                if (mstart < start)
+                        mstart = start;
+                if (mend > end)
+                        mend = end;
+
+                /* Found completely overlapping range */
+                if (mstart == start && mend == end) {
+                        mem->ranges[i].start = 0;
+                        mem->ranges[i].end = 0;
+                        if (i < mem->nr_ranges - 1) {
+                                /* Shift rest of the ranges to left */
+                                for (j = i; j < mem->nr_ranges - 1; j++) {
+                                        mem->ranges[j].start =
+                                                mem->ranges[j+1].start;
+                                        mem->ranges[j].end =
+                                                        mem->ranges[j+1].end;
+                                }
+                        }
+                        mem->nr_ranges--;
+                        return 0;
+                }
+
+                if (mstart > start && mend < end) {
+                        /* Split original range */
+                        mem->ranges[i].end = mstart - 1;
+                        temp_range.start = mend + 1;
+                        temp_range.end = end;
+                } else if (mstart != start)
+                        mem->ranges[i].end = mstart - 1;
+                else
+                        mem->ranges[i].start = mend + 1;
+                break;
+        }
+
+        /* If a split happend, add the split to array */
+        if (!temp_range.end)
+                return 0;
+
+        /* Split happened */
+        if (i == CRASH_MAX_RANGES - 1) {
+                pr_err("Too many crash ranges after split\n");
+                return -ENOMEM;
+        }
+
+        /* Location where new range should go */
+        j = i + 1;
+        if (j < mem->nr_ranges) {
+                /* Move over all ranges one slot towards the end */
+                for (i = mem->nr_ranges - 1; i >= j; i--)
+                        mem->ranges[i + 1] = mem->ranges[i];
+        }
+
+        mem->ranges[j].start = temp_range.start;
+        mem->ranges[j].end = temp_range.end;
+        mem->nr_ranges++;
+        return 0;
+}
+
+/*
+ * Look for any unwanted ranges between mstart, mend and remove them. This
+ * might lead to split and split ranges are put in ced->mem.ranges[] array
+ */
+static int elf_header_exclude_ranges(struct crash_elf_data *ced,
+                unsigned long long mstart, unsigned long long mend)
+{
+        struct crash_mem *cmem = &ced->mem;
+        int ret = 0;
+
+        memset(cmem->ranges, 0, sizeof(cmem->ranges));
+
+        cmem->ranges[0].start = mstart;
+        cmem->ranges[0].end = mend;
+        cmem->nr_ranges = 1;
+
+        /* Exclude crashkernel region */
+        ret = exclude_mem_range(cmem, crashk_res.start, crashk_res.end);
+        if (ret)
+                return ret;
+
+        ret = exclude_mem_range(cmem, crashk_low_res.start, crashk_low_res.end);
+        if (ret)
+                return ret;
+
+        /* Exclude GART region */
+        if (ced->gart_end) {
+                ret = exclude_mem_range(cmem, ced->gart_start, ced->gart_end);
+                if (ret)
+                        return ret;
+        }
+
+        return ret;
+}
+
+static int prepare_elf64_ram_headers_callback(u64 start, u64 end, void *arg)
+{
+        struct crash_elf_data *ced = arg;
+        Elf64_Ehdr *ehdr;
+        Elf64_Phdr *phdr;
+        unsigned long mstart, mend;
+        struct kimage *image = ced->image;
+        struct crash_mem *cmem;
+        int ret, i;
+
+        ehdr = ced->ehdr;
+
+        /* Exclude unwanted mem ranges */
+        ret = elf_header_exclude_ranges(ced, start, end);
+        if (ret)
+                return ret;
+
+        /* Go through all the ranges in ced->mem.ranges[] and prepare phdr */
+        cmem = &ced->mem;
+
+        for (i = 0; i < cmem->nr_ranges; i++) {
+                mstart = cmem->ranges[i].start;
+                mend = cmem->ranges[i].end;
+
+                phdr = ced->bufp;
+                ced->bufp += sizeof(Elf64_Phdr);
+
+                phdr->p_type = PT_LOAD;
+                phdr->p_flags = PF_R|PF_W|PF_X;
+                phdr->p_offset  = mstart;
+
+                /*
+                 * If a range matches backup region, adjust offset to backup
+                 * segment.
+                 */
+                if (mstart == image->arch.backup_src_start &&
+                    (mend - mstart + 1) == image->arch.backup_src_sz)
+                        phdr->p_offset = image->arch.backup_load_addr;
+
+                phdr->p_paddr = mstart;
+                phdr->p_vaddr = (unsigned long long) __va(mstart);
+                phdr->p_filesz = phdr->p_memsz = mend - mstart + 1;
+                phdr->p_align = 0;
+                ehdr->e_phnum++;
+                pr_debug("Crash PT_LOAD elf header. phdr=%p vaddr=0x%llx, paddr=0x%llx, sz=0x%llx e_phnum=%d p_offset=0x%llx\n",
+                        phdr, phdr->p_vaddr, phdr->p_paddr, phdr->p_filesz,
+                        ehdr->e_phnum, phdr->p_offset);
+        }
+
+        return ret;
+}
+
+static int prepare_elf64_headers(struct crash_elf_data *ced,
+                void **addr, unsigned long *sz)
+{
+        Elf64_Ehdr *ehdr;
+        Elf64_Phdr *phdr;
+        unsigned long nr_cpus = num_possible_cpus(), nr_phdr, elf_sz;
+        unsigned char *buf, *bufp;
+        unsigned int cpu;
+        unsigned long long notes_addr;
+        int ret;
+
+        /* extra phdr for vmcoreinfo elf note */
+        nr_phdr = nr_cpus + 1;
+        nr_phdr += ced->max_nr_ranges;
+
+        /*
+         * kexec-tools creates an extra PT_LOAD phdr for kernel text mapping
+         * area on x86_64 (ffffffff80000000 - ffffffffa0000000).
+         * I think this is required by tools like gdb. So same physical
+         * memory will be mapped in two elf headers. One will contain kernel
+         * text virtual addresses and other will have __va(physical) addresses.
+         */
+
+        nr_phdr++;
+        elf_sz = sizeof(Elf64_Ehdr) + nr_phdr * sizeof(Elf64_Phdr);
+        elf_sz = ALIGN(elf_sz, ELF_CORE_HEADER_ALIGN);
+
+        buf = vzalloc(elf_sz);
+        if (!buf)
+                return -ENOMEM;
+
+        bufp = buf;
+        ehdr = (Elf64_Ehdr *)bufp;
+        bufp += sizeof(Elf64_Ehdr);
+        memcpy(ehdr->e_ident, ELFMAG, SELFMAG);
+        ehdr->e_ident[EI_CLASS] = ELFCLASS64;
+        ehdr->e_ident[EI_DATA] = ELFDATA2LSB;
+        ehdr->e_ident[EI_VERSION] = EV_CURRENT;
+        ehdr->e_ident[EI_OSABI] = ELF_OSABI;
+        memset(ehdr->e_ident + EI_PAD, 0, EI_NIDENT - EI_PAD);
+        ehdr->e_type = ET_CORE;
+        ehdr->e_machine = ELF_ARCH;
+        ehdr->e_version = EV_CURRENT;
+        ehdr->e_phoff = sizeof(Elf64_Ehdr);
+        ehdr->e_ehsize = sizeof(Elf64_Ehdr);
+        ehdr->e_phentsize = sizeof(Elf64_Phdr);
+
+        /* Prepare one phdr of type PT_NOTE for each present cpu */
+        for_each_present_cpu(cpu) {
+                phdr = (Elf64_Phdr *)bufp;
+                bufp += sizeof(Elf64_Phdr);
+                phdr->p_type = PT_NOTE;
+                notes_addr = per_cpu_ptr_to_phys(per_cpu_ptr(crash_notes, cpu));
+                phdr->p_offset = phdr->p_paddr = notes_addr;
+                phdr->p_filesz = phdr->p_memsz = sizeof(note_buf_t);
+                (ehdr->e_phnum)++;
+        }
+
+        /* Prepare one PT_NOTE header for vmcoreinfo */
+        phdr = (Elf64_Phdr *)bufp;
+        bufp += sizeof(Elf64_Phdr);
+        phdr->p_type = PT_NOTE;
+        phdr->p_offset = phdr->p_paddr = paddr_vmcoreinfo_note();
+        phdr->p_filesz = phdr->p_memsz = sizeof(vmcoreinfo_note);
+        (ehdr->e_phnum)++;
+
+#ifdef CONFIG_X86_64
+        /* Prepare PT_LOAD type program header for kernel text region */
+        phdr = (Elf64_Phdr *)bufp;
+        bufp += sizeof(Elf64_Phdr);
+        phdr->p_type = PT_LOAD;
+        phdr->p_flags = PF_R|PF_W|PF_X;
+        phdr->p_vaddr = (Elf64_Addr)_text;
+        phdr->p_filesz = phdr->p_memsz = _end - _text;
+        phdr->p_offset = phdr->p_paddr = __pa_symbol(_text);
+        (ehdr->e_phnum)++;
+#endif
+
+        /* Prepare PT_LOAD headers for system ram chunks. */
+        ced->ehdr = ehdr;
+        ced->bufp = bufp;
+        ret = walk_system_ram_res(0, -1, ced,
+                        prepare_elf64_ram_headers_callback);
+        if (ret < 0)
+                return ret;
+
+        *addr = buf;
+        *sz = elf_sz;
+        return 0;
+}
+
+/* Prepare elf headers. Return addr and size */
+static int prepare_elf_headers(struct kimage *image, void **addr,
+                                        unsigned long *sz)
+{
+        struct crash_elf_data *ced;
+        int ret;
+
+        ced = kzalloc(sizeof(*ced), GFP_KERNEL);
+        if (!ced)
+                return -ENOMEM;
+
+        fill_up_crash_elf_data(ced, image);
+
+        /* By default prepare 64bit headers */
+        ret =  prepare_elf64_headers(ced, addr, sz);
+        kfree(ced);
+        return ret;
+}
+
+static int add_e820_entry(struct boot_params *params, struct e820entry *entry)
+{
+        unsigned int nr_e820_entries;
+
+        nr_e820_entries = params->e820_entries;
+        if (nr_e820_entries >= E820MAX)
+                return 1;
+
+        memcpy(&params->e820_map[nr_e820_entries], entry,
+                        sizeof(struct e820entry));
+        params->e820_entries++;
+        return 0;
+}
+
+static int memmap_entry_callback(u64 start, u64 end, void *arg)
+{
+        struct crash_memmap_data *cmd = arg;
+        struct boot_params *params = cmd->params;
+        struct e820entry ei;
+
+        ei.addr = start;
+        ei.size = end - start + 1;
+        ei.type = cmd->type;
+        add_e820_entry(params, &ei);
+
+        return 0;
+}
+
+static int memmap_exclude_ranges(struct kimage *image, struct crash_mem *cmem,
+                                 unsigned long long mstart,
+                                 unsigned long long mend)
+{
+        unsigned long start, end;
+        int ret = 0;
+
+        cmem->ranges[0].start = mstart;
+        cmem->ranges[0].end = mend;
+        cmem->nr_ranges = 1;
+
+        /* Exclude Backup region */
+        start = image->arch.backup_load_addr;
+        end = start + image->arch.backup_src_sz - 1;
+        ret = exclude_mem_range(cmem, start, end);
+        if (ret)
+                return ret;
+
+        /* Exclude elf header region */
+        start = image->arch.elf_load_addr;
+        end = start + image->arch.elf_headers_sz - 1;
+        return exclude_mem_range(cmem, start, end);
+}
+
+/* Prepare memory map for crash dump kernel */
+int crash_setup_memmap_entries(struct kimage *image, struct boot_params *params)
+{
+        int i, ret = 0;
+        unsigned long flags;
+        struct e820entry ei;
+        struct crash_memmap_data cmd;
+        struct crash_mem *cmem;
+
+        cmem = vzalloc(sizeof(struct crash_mem));
+        if (!cmem)
+                return -ENOMEM;
+
+        memset(&cmd, 0, sizeof(struct crash_memmap_data));
+        cmd.params = params;
+
+        /* Add first 640K segment */
+        ei.addr = image->arch.backup_src_start;
+        ei.size = image->arch.backup_src_sz;
+        ei.type = E820_RAM;
+        add_e820_entry(params, &ei);
+
+        /* Add ACPI tables */
+        cmd.type = E820_ACPI;
+        flags = IORESOURCE_MEM | IORESOURCE_BUSY;
+        walk_iomem_res("ACPI Tables", flags, 0, -1, &cmd,
+                       memmap_entry_callback);
+
+        /* Add ACPI Non-volatile Storage */
+        cmd.type = E820_NVS;
+        walk_iomem_res("ACPI Non-volatile Storage", flags, 0, -1, &cmd,
+                        memmap_entry_callback);
+
+        /* Add crashk_low_res region */
+        if (crashk_low_res.end) {
+                ei.addr = crashk_low_res.start;
+                ei.size = crashk_low_res.end - crashk_low_res.start + 1;
+                ei.type = E820_RAM;
+                add_e820_entry(params, &ei);
+        }
+
+        /* Exclude some ranges from crashk_res and add rest to memmap */
+        ret = memmap_exclude_ranges(image, cmem, crashk_res.start,
+                                                crashk_res.end);
+        if (ret)
+                goto out;
+
+        for (i = 0; i < cmem->nr_ranges; i++) {
+                ei.size = cmem->ranges[i].end - cmem->ranges[i].start + 1;
+
+                /* If entry is less than a page, skip it */
+                if (ei.size < PAGE_SIZE)
+                        continue;
+                ei.addr = cmem->ranges[i].start;
+                ei.type = E820_RAM;
+                add_e820_entry(params, &ei);
+        }
+
+out:
+        vfree(cmem);
+        return ret;
+}
+
+static int determine_backup_region(u64 start, u64 end, void *arg)
+{
+        struct kimage *image = arg;
+
+        image->arch.backup_src_start = start;
+        image->arch.backup_src_sz = end - start + 1;
+
+        /* Expecting only one range for backup region */
+        return 1;
+}
+
+int crash_load_segments(struct kimage *image)
+{
+        unsigned long src_start, src_sz, elf_sz;
+        void *elf_addr;
+        int ret;
+
+        /*
+         * Determine and load a segment for backup area. First 640K RAM
+         * region is backup source
+         */
+
+        ret = walk_system_ram_res(KEXEC_BACKUP_SRC_START, KEXEC_BACKUP_SRC_END,
+                                image, determine_backup_region);
+
+        /* Zero or postive return values are ok */
+        if (ret < 0)
+                return ret;
+
+        src_start = image->arch.backup_src_start;
+        src_sz = image->arch.backup_src_sz;
+
+        /* Add backup segment. */
+        if (src_sz) {
+                /*
+                 * Ideally there is no source for backup segment. This is
+                 * copied in purgatory after crash. Just add a zero filled
+                 * segment for now to make sure checksum logic works fine.
+                 */
+                ret = kexec_add_buffer(image, (char *)&crash_zero_bytes,
+                                       sizeof(crash_zero_bytes), src_sz,
+                                       PAGE_SIZE, 0, -1, 0,
+                                       &image->arch.backup_load_addr);
+                if (ret)
+                        return ret;
+                pr_debug("Loaded backup region at 0x%lx backup_start=0x%lx memsz=0x%lx\n",
+                         image->arch.backup_load_addr, src_start, src_sz);
+        }
+
+        /* Prepare elf headers and add a segment */
+        ret = prepare_elf_headers(image, &elf_addr, &elf_sz);
+        if (ret)
+                return ret;
+
+        image->arch.elf_headers = elf_addr;
+        image->arch.elf_headers_sz = elf_sz;
+
+        ret = kexec_add_buffer(image, (char *)elf_addr, elf_sz, elf_sz,
+                        ELF_CORE_HEADER_ALIGN, 0, -1, 0,
+                        &image->arch.elf_load_addr);
+        if (ret) {
+                vfree((void *)image->arch.elf_headers);
+                return ret;
+        }
+        pr_debug("Loaded ELF headers at 0x%lx bufsz=0x%lx memsz=0x%lx\n",
+                 image->arch.elf_load_addr, elf_sz, elf_sz);
+
+        return ret;
+}
+
+#endif /* CONFIG_X86_64 */
diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
index bcedd100192f..a8e646458a10 100644
--- a/arch/x86/kernel/kexec-bzimage64.c
+++ b/arch/x86/kernel/kexec-bzimage64.c
@@ -21,6 +21,9 @@
 
 #include <asm/bootparam.h>
 #include <asm/setup.h>
+#include <asm/crash.h>
+
+#define MAX_ELFCOREHDR_STR_LEN  30      /* elfcorehdr=0x<64bit-value> */
 
 /*
  * Defines lowest physical address for various segments. Not sure where
@@ -58,18 +61,24 @@ static int setup_initrd(struct boot_params *params,
         return 0;
 }
 
-static int setup_cmdline(struct boot_params *params,
+static int setup_cmdline(struct kimage *image, struct boot_params *params,
                          unsigned long bootparams_load_addr,
                          unsigned long cmdline_offset, char *cmdline,
                          unsigned long cmdline_len)
 {
         char *cmdline_ptr = ((char *)params) + cmdline_offset;
-        unsigned long cmdline_ptr_phys;
+        unsigned long cmdline_ptr_phys, len;
         uint32_t cmdline_low_32, cmdline_ext_32;
 
         memcpy(cmdline_ptr, cmdline, cmdline_len);
+        if (image->type == KEXEC_TYPE_CRASH) {
+                len = sprintf(cmdline_ptr + cmdline_len - 1,
+                        " elfcorehdr=0x%lx", image->arch.elf_load_addr);
+                cmdline_len += len;
+        }
         cmdline_ptr[cmdline_len - 1] = '\0';
 
+        pr_debug("Final command line is: %s\n", cmdline_ptr);
         cmdline_ptr_phys = bootparams_load_addr + cmdline_offset;
         cmdline_low_32 = cmdline_ptr_phys & 0xffffffffUL;
         cmdline_ext_32 = cmdline_ptr_phys >> 32;
@@ -98,11 +107,12 @@ static int setup_memory_map_entries(struct boot_params *params)
         return 0;
 }
 
-static int setup_boot_parameters(struct boot_params *params)
+static int setup_boot_parameters(struct kimage *image,
+                                 struct boot_params *params)
 {
         unsigned int nr_e820_entries;
         unsigned long long mem_k, start, end;
-        int i;
+        int i, ret = 0;
 
         /* Get subarch from existing bootparams */
         params->hdr.hardware_subarch = boot_params.hdr.hardware_subarch;
@@ -125,7 +135,13 @@ static int setup_boot_parameters(struct boot_params *params)
         /* Default sysdesc table */
         params->sys_desc_table.length = 0;
 
-        setup_memory_map_entries(params);
+        if (image->type == KEXEC_TYPE_CRASH) {
+                ret = crash_setup_memmap_entries(image, params);
+                if (ret)
+                        return ret;
+        } else
+                setup_memory_map_entries(params);
+
         nr_e820_entries = params->e820_entries;
 
         for (i = 0; i < nr_e820_entries; i++) {
@@ -153,7 +169,7 @@ static int setup_boot_parameters(struct boot_params *params)
         memcpy(params->edd_mbr_sig_buffer, boot_params.edd_mbr_sig_buffer,
                EDD_MBR_SIG_MAX * sizeof(unsigned int));
 
-        return 0;
+        return ret;
 }
 
 int bzImage64_probe(const char *buf, unsigned long len)
@@ -241,6 +257,22 @@ void *bzImage64_load(struct kimage *image, char *kernel,
         }
 
         /*
+         * In case of crash dump, we will append elfcorehdr=<addr> to
+         * command line. Make sure it does not overflow
+         */
+        if (cmdline_len + MAX_ELFCOREHDR_STR_LEN > header->cmdline_size) {
+                pr_debug("Appending elfcorehdr=<addr> to command line exceeds maximum allowed length\n");
+                return ERR_PTR(-EINVAL);
+        }
+
+        /* Allocate and load backup region */
+        if (image->type == KEXEC_TYPE_CRASH) {
+                ret = crash_load_segments(image);
+                if (ret)
+                        return ERR_PTR(ret);
+        }
+
+        /*
          * Load purgatory. For 64bit entry point, purgatory  code can be
          * anywhere.
          */
@@ -254,7 +286,8 @@ void *bzImage64_load(struct kimage *image, char *kernel,
         pr_debug("Loaded purgatory at 0x%lx\n", purgatory_load_addr);
 
         /* Load Bootparams and cmdline */
-        params_cmdline_sz = sizeof(struct boot_params) + cmdline_len;
+        params_cmdline_sz = sizeof(struct boot_params) + cmdline_len +
+                                MAX_ELFCOREHDR_STR_LEN;
         params = kzalloc(params_cmdline_sz, GFP_KERNEL);
         if (!params)
                 return ERR_PTR(-ENOMEM);
@@ -303,8 +336,8 @@ void *bzImage64_load(struct kimage *image, char *kernel,
                 setup_initrd(params, initrd_load_addr, initrd_len);
         }
 
-        setup_cmdline(params, bootparam_load_addr, sizeof(struct boot_params),
-                      cmdline, cmdline_len);
+        setup_cmdline(image, params, bootparam_load_addr,
+                      sizeof(struct boot_params), cmdline, cmdline_len);
 
         /* bootloader info. Do we need a separate ID for kexec kernel loader? */
         params->hdr.type_of_loader = 0x0D << 4;
@@ -332,7 +365,9 @@ void *bzImage64_load(struct kimage *image, char *kernel,
         if (ret)
                 goto out_free_params;
 
-        setup_boot_parameters(params);
+        ret = setup_boot_parameters(image, params);
+        if (ret)
+                goto out_free_params;
 
         /* Allocate loader specific data */
         ldata = kzalloc(sizeof(struct bzimage64_data), GFP_KERNEL);
diff --git a/arch/x86/kernel/machine_kexec_64.c b/arch/x86/kernel/machine_kexec_64.c
index 18d0f9e0b6da..9330434da777 100644
--- a/arch/x86/kernel/machine_kexec_64.c
+++ b/arch/x86/kernel/machine_kexec_64.c
@@ -178,6 +178,38 @@ static void load_segments(void)
                 );
 }
 
+/* Update purgatory as needed after various image segments have been prepared */
+static int arch_update_purgatory(struct kimage *image)
+{
+        int ret = 0;
+
+        if (!image->file_mode)
+                return 0;
+
+        /* Setup copying of backup region */
+        if (image->type == KEXEC_TYPE_CRASH) {
+                ret = kexec_purgatory_get_set_symbol(image, "backup_dest",
+                                &image->arch.backup_load_addr,
+                                sizeof(image->arch.backup_load_addr), 0);
+                if (ret)
+                        return ret;
+
+                ret = kexec_purgatory_get_set_symbol(image, "backup_src",
+                                &image->arch.backup_src_start,
+                                sizeof(image->arch.backup_src_start), 0);
+                if (ret)
+                        return ret;
+
+                ret = kexec_purgatory_get_set_symbol(image, "backup_sz",
+                                &image->arch.backup_src_sz,
+                                sizeof(image->arch.backup_src_sz), 0);
+                if (ret)
+                        return ret;
+        }
+
+        return ret;
+}
+
 int machine_kexec_prepare(struct kimage *image)
 {
         unsigned long start_pgtable;
@@ -191,6 +223,11 @@ int machine_kexec_prepare(struct kimage *image)
         if (result)
                 return result;
 
+        /* update purgatory as needed */
+        result = arch_update_purgatory(image);
+        if (result)
+                return result;
+
         return 0;
 }
 
@@ -315,6 +352,9 @@ int arch_kexec_kernel_image_probe(struct kimage *image, void *buf,
 
 void *arch_kexec_kernel_image_load(struct kimage *image)
 {
+        vfree(image->arch.elf_headers);
+        image->arch.elf_headers = NULL;
+
         if (!image->fops || !image->fops->load)
                 return ERR_PTR(-ENOEXEC);
 
diff --git a/arch/x86/purgatory/entry64.S b/arch/x86/purgatory/entry64.S
index be3249d7ed2d..d1a4291d3568 100644
--- a/arch/x86/purgatory/entry64.S
+++ b/arch/x86/purgatory/entry64.S
@@ -61,13 +61,13 @@ new_cs_exit:
         .balign 4
 entry64_regs:
 rax:    .quad 0x0
-rbx:    .quad 0x0
 rcx:    .quad 0x0
 rdx:    .quad 0x0
-rsi:    .quad 0x0
-rdi:    .quad 0x0
+rbx:    .quad 0x0
 rsp:    .quad 0x0
 rbp:    .quad 0x0
+rsi:    .quad 0x0
+rdi:    .quad 0x0
 r8:     .quad 0x0
 r9:     .quad 0x0
 r10:    .quad 0x0
diff --git a/kernel/kexec.c b/kernel/kexec.c
index 0926f2a3ed03..f18c780f9716 100644
--- a/kernel/kexec.c
+++ b/kernel/kexec.c
@@ -548,6 +548,7 @@ kimage_file_alloc_init(struct kimage **rimage, int kernel_fd,
 {
         int ret;
         struct kimage *image;
+        bool kexec_on_panic = flags & KEXEC_FILE_ON_CRASH;
 
         image = do_kimage_alloc_init();
         if (!image)
@@ -555,6 +556,12 @@ kimage_file_alloc_init(struct kimage **rimage, int kernel_fd,
 
         image->file_mode = 1;
 
+        if (kexec_on_panic) {
+                /* Enable special crash kernel control page alloc policy. */
+                image->control_page = crashk_res.start;
+                image->type = KEXEC_TYPE_CRASH;
+        }
+
         ret = kimage_file_prepare_segments(image, kernel_fd, initrd_fd,
                                            cmdline_ptr, cmdline_len, flags);
         if (ret)
@@ -572,10 +579,12 @@ kimage_file_alloc_init(struct kimage **rimage, int kernel_fd,
                 goto out_free_post_load_bufs;
         }
 
-        image->swap_page = kimage_alloc_control_pages(image, 0);
-        if (!image->swap_page) {
-                pr_err(KERN_ERR "Could not allocate swap buffer\n");
-                goto out_free_control_pages;
+        if (!kexec_on_panic) {
+                image->swap_page = kimage_alloc_control_pages(image, 0);
+                if (!image->swap_page) {
+                        pr_err(KERN_ERR "Could not allocate swap buffer\n");
+                        goto out_free_control_pages;
+                }
         }
 
         *rimage = image;
@@ -1113,10 +1122,14 @@ static int kimage_load_crash_segment(struct kimage *image,
         unsigned long maddr;
         size_t ubytes, mbytes;
         int result;
-        unsigned char __user *buf;
+        unsigned char __user *buf = NULL;
+        unsigned char *kbuf = NULL;
 
         result = 0;
-        buf = segment->buf;
+        if (image->file_mode)
+                kbuf = segment->kbuf;
+        else
+                buf = segment->buf;
         ubytes = segment->bufsz;
         mbytes = segment->memsz;
         maddr = segment->mem;
@@ -1139,7 +1152,12 @@ static int kimage_load_crash_segment(struct kimage *image,
                         /* Zero the trailing part of the page */
                         memset(ptr + uchunk, 0, mchunk - uchunk);
                 }
-                result = copy_from_user(ptr, buf, uchunk);
+
+                /* For file based kexec, source pages are in kernel memory */
+                if (image->file_mode)
+                        memcpy(ptr, kbuf, uchunk);
+                else
+                        result = copy_from_user(ptr, buf, uchunk);
                 kexec_flush_icache_page(page);
                 kunmap(page);
                 if (result) {
@@ -1148,7 +1166,10 @@ static int kimage_load_crash_segment(struct kimage *image,
                 }
                 ubytes -= uchunk;
                 maddr  += mchunk;
-                buf += mchunk;
+                if (image->file_mode)
+                        kbuf += mchunk;
+                else
+                        buf += mchunk;
                 mbytes -= mchunk;
         }
 out:
@@ -2127,7 +2148,14 @@ int kexec_add_buffer(struct kimage *image, char *buffer, unsigned long bufsz,
         kbuf->top_down = top_down;
 
         /* Walk the RAM ranges and allocate a suitable range for the buffer */
-        ret = walk_system_ram_res(0, -1, kbuf, locate_mem_hole_callback);
+        if (image->type == KEXEC_TYPE_CRASH)
+                ret = walk_iomem_res("Crash kernel",
+                                     IORESOURCE_MEM | IORESOURCE_BUSY,
+                                     crashk_res.start, crashk_res.end, kbuf,
+                                     locate_mem_hole_callback);
+        else
+                ret = walk_system_ram_res(0, -1, kbuf,
+                                          locate_mem_hole_callback);
         if (ret != 1) {
                 /* A suitable memory range could not be found for buffer */
                 return -EADDRNOTAVAIL;