Amerigo Wang | 2d5bf28 | 2009-06-03 21:46:09 -0400 | [diff] [blame] | 1 | /* Kernel module help for x86. |
| 2 | Copyright (C) 2001 Rusty Russell. |
| 3 | |
| 4 | This program is free software; you can redistribute it and/or modify |
| 5 | it under the terms of the GNU General Public License as published by |
| 6 | the Free Software Foundation; either version 2 of the License, or |
| 7 | (at your option) any later version. |
| 8 | |
| 9 | This program is distributed in the hope that it will be useful, |
| 10 | but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 11 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 12 | GNU General Public License for more details. |
| 13 | |
| 14 | You should have received a copy of the GNU General Public License |
| 15 | along with this program; if not, write to the Free Software |
| 16 | Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
| 17 | */ |
Joe Perches | c767a54 | 2012-05-21 19:50:07 -0700 | [diff] [blame] | 18 | |
| 19 | #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt |
| 20 | |
Amerigo Wang | 2d5bf28 | 2009-06-03 21:46:09 -0400 | [diff] [blame] | 21 | #include <linux/moduleloader.h> |
| 22 | #include <linux/elf.h> |
| 23 | #include <linux/vmalloc.h> |
| 24 | #include <linux/fs.h> |
| 25 | #include <linux/string.h> |
| 26 | #include <linux/kernel.h> |
Andrey Ryabinin | bebf56a | 2015-02-13 14:40:17 -0800 | [diff] [blame^] | 27 | #include <linux/kasan.h> |
Amerigo Wang | 2d5bf28 | 2009-06-03 21:46:09 -0400 | [diff] [blame] | 28 | #include <linux/bug.h> |
| 29 | #include <linux/mm.h> |
Tejun Heo | 5a0e3ad | 2010-03-24 17:04:11 +0900 | [diff] [blame] | 30 | #include <linux/gfp.h> |
Jason Baron | d430d3d | 2011-03-16 17:29:47 -0400 | [diff] [blame] | 31 | #include <linux/jump_label.h> |
Kees Cook | e2b32e6 | 2014-02-25 16:59:17 -0800 | [diff] [blame] | 32 | #include <linux/random.h> |
Amerigo Wang | 2d5bf28 | 2009-06-03 21:46:09 -0400 | [diff] [blame] | 33 | |
Amerigo Wang | 2d5bf28 | 2009-06-03 21:46:09 -0400 | [diff] [blame] | 34 | #include <asm/page.h> |
| 35 | #include <asm/pgtable.h> |
| 36 | |
| 37 | #if 0 |
Joe Perches | c767a54 | 2012-05-21 19:50:07 -0700 | [diff] [blame] | 38 | #define DEBUGP(fmt, ...) \ |
| 39 | printk(KERN_DEBUG fmt, ##__VA_ARGS__) |
Amerigo Wang | 2d5bf28 | 2009-06-03 21:46:09 -0400 | [diff] [blame] | 40 | #else |
Joe Perches | c767a54 | 2012-05-21 19:50:07 -0700 | [diff] [blame] | 41 | #define DEBUGP(fmt, ...) \ |
| 42 | do { \ |
| 43 | if (0) \ |
| 44 | printk(KERN_DEBUG fmt, ##__VA_ARGS__); \ |
| 45 | } while (0) |
Amerigo Wang | 2d5bf28 | 2009-06-03 21:46:09 -0400 | [diff] [blame] | 46 | #endif |
| 47 | |
Kees Cook | e2b32e6 | 2014-02-25 16:59:17 -0800 | [diff] [blame] | 48 | #ifdef CONFIG_RANDOMIZE_BASE |
| 49 | static unsigned long module_load_offset; |
| 50 | static int randomize_modules = 1; |
| 51 | |
Kees Cook | 9dd721c | 2014-03-10 13:42:48 -0700 | [diff] [blame] | 52 | /* Mutex protects the module_load_offset. */ |
| 53 | static DEFINE_MUTEX(module_kaslr_mutex); |
| 54 | |
Kees Cook | e2b32e6 | 2014-02-25 16:59:17 -0800 | [diff] [blame] | 55 | static int __init parse_nokaslr(char *p) |
| 56 | { |
| 57 | randomize_modules = 0; |
| 58 | return 0; |
| 59 | } |
| 60 | early_param("nokaslr", parse_nokaslr); |
| 61 | |
| 62 | static unsigned long int get_module_load_offset(void) |
| 63 | { |
| 64 | if (randomize_modules) { |
Kees Cook | 9dd721c | 2014-03-10 13:42:48 -0700 | [diff] [blame] | 65 | mutex_lock(&module_kaslr_mutex); |
Kees Cook | e2b32e6 | 2014-02-25 16:59:17 -0800 | [diff] [blame] | 66 | /* |
| 67 | * Calculate the module_load_offset the first time this |
| 68 | * code is called. Once calculated it stays the same until |
| 69 | * reboot. |
| 70 | */ |
| 71 | if (module_load_offset == 0) |
| 72 | module_load_offset = |
| 73 | (get_random_int() % 1024 + 1) * PAGE_SIZE; |
Kees Cook | 9dd721c | 2014-03-10 13:42:48 -0700 | [diff] [blame] | 74 | mutex_unlock(&module_kaslr_mutex); |
Kees Cook | e2b32e6 | 2014-02-25 16:59:17 -0800 | [diff] [blame] | 75 | } |
| 76 | return module_load_offset; |
| 77 | } |
| 78 | #else |
| 79 | static unsigned long int get_module_load_offset(void) |
| 80 | { |
| 81 | return 0; |
| 82 | } |
| 83 | #endif |
| 84 | |
Amerigo Wang | 0fdc83b | 2009-06-03 21:46:19 -0400 | [diff] [blame] | 85 | void *module_alloc(unsigned long size) |
| 86 | { |
Andrey Ryabinin | bebf56a | 2015-02-13 14:40:17 -0800 | [diff] [blame^] | 87 | void *p; |
| 88 | |
David Rientjes | d0a2126 | 2011-01-13 15:46:02 -0800 | [diff] [blame] | 89 | if (PAGE_ALIGN(size) > MODULES_LEN) |
Amerigo Wang | 0fdc83b | 2009-06-03 21:46:19 -0400 | [diff] [blame] | 90 | return NULL; |
Andrey Ryabinin | bebf56a | 2015-02-13 14:40:17 -0800 | [diff] [blame^] | 91 | |
| 92 | p = __vmalloc_node_range(size, MODULE_ALIGN, |
Kees Cook | e2b32e6 | 2014-02-25 16:59:17 -0800 | [diff] [blame] | 93 | MODULES_VADDR + get_module_load_offset(), |
| 94 | MODULES_END, GFP_KERNEL | __GFP_HIGHMEM, |
Andrey Ryabinin | cb9e3c2 | 2015-02-13 14:40:07 -0800 | [diff] [blame] | 95 | PAGE_KERNEL_EXEC, 0, NUMA_NO_NODE, |
Kees Cook | e2b32e6 | 2014-02-25 16:59:17 -0800 | [diff] [blame] | 96 | __builtin_return_address(0)); |
Andrey Ryabinin | bebf56a | 2015-02-13 14:40:17 -0800 | [diff] [blame^] | 97 | if (p && (kasan_module_alloc(p, size) < 0)) { |
| 98 | vfree(p); |
| 99 | return NULL; |
| 100 | } |
| 101 | |
| 102 | return p; |
Amerigo Wang | 0fdc83b | 2009-06-03 21:46:19 -0400 | [diff] [blame] | 103 | } |
Amerigo Wang | 0fdc83b | 2009-06-03 21:46:19 -0400 | [diff] [blame] | 104 | |
Amerigo Wang | 0fdc83b | 2009-06-03 21:46:19 -0400 | [diff] [blame] | 105 | #ifdef CONFIG_X86_32 |
| 106 | int apply_relocate(Elf32_Shdr *sechdrs, |
| 107 | const char *strtab, |
| 108 | unsigned int symindex, |
| 109 | unsigned int relsec, |
| 110 | struct module *me) |
| 111 | { |
| 112 | unsigned int i; |
| 113 | Elf32_Rel *rel = (void *)sechdrs[relsec].sh_addr; |
| 114 | Elf32_Sym *sym; |
| 115 | uint32_t *location; |
| 116 | |
Joe Perches | c767a54 | 2012-05-21 19:50:07 -0700 | [diff] [blame] | 117 | DEBUGP("Applying relocate section %u to %u\n", |
| 118 | relsec, sechdrs[relsec].sh_info); |
Amerigo Wang | 0fdc83b | 2009-06-03 21:46:19 -0400 | [diff] [blame] | 119 | for (i = 0; i < sechdrs[relsec].sh_size / sizeof(*rel); i++) { |
| 120 | /* This is where to make the change */ |
| 121 | location = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr |
| 122 | + rel[i].r_offset; |
| 123 | /* This is the symbol it is referring to. Note that all |
| 124 | undefined symbols have been resolved. */ |
| 125 | sym = (Elf32_Sym *)sechdrs[symindex].sh_addr |
| 126 | + ELF32_R_SYM(rel[i].r_info); |
| 127 | |
| 128 | switch (ELF32_R_TYPE(rel[i].r_info)) { |
| 129 | case R_386_32: |
| 130 | /* We add the value into the location given */ |
| 131 | *location += sym->st_value; |
| 132 | break; |
| 133 | case R_386_PC32: |
Geert Uytterhoeven | 2e76c28 | 2012-07-19 22:29:11 +0200 | [diff] [blame] | 134 | /* Add the value, subtract its position */ |
Amerigo Wang | 0fdc83b | 2009-06-03 21:46:19 -0400 | [diff] [blame] | 135 | *location += sym->st_value - (uint32_t)location; |
| 136 | break; |
| 137 | default: |
Joe Perches | c767a54 | 2012-05-21 19:50:07 -0700 | [diff] [blame] | 138 | pr_err("%s: Unknown relocation: %u\n", |
Amerigo Wang | 0fdc83b | 2009-06-03 21:46:19 -0400 | [diff] [blame] | 139 | me->name, ELF32_R_TYPE(rel[i].r_info)); |
| 140 | return -ENOEXEC; |
| 141 | } |
| 142 | } |
| 143 | return 0; |
| 144 | } |
Amerigo Wang | 0fdc83b | 2009-06-03 21:46:19 -0400 | [diff] [blame] | 145 | #else /*X86_64*/ |
| 146 | int apply_relocate_add(Elf64_Shdr *sechdrs, |
| 147 | const char *strtab, |
| 148 | unsigned int symindex, |
| 149 | unsigned int relsec, |
| 150 | struct module *me) |
| 151 | { |
| 152 | unsigned int i; |
| 153 | Elf64_Rela *rel = (void *)sechdrs[relsec].sh_addr; |
| 154 | Elf64_Sym *sym; |
| 155 | void *loc; |
| 156 | u64 val; |
| 157 | |
Joe Perches | c767a54 | 2012-05-21 19:50:07 -0700 | [diff] [blame] | 158 | DEBUGP("Applying relocate section %u to %u\n", |
| 159 | relsec, sechdrs[relsec].sh_info); |
Amerigo Wang | 0fdc83b | 2009-06-03 21:46:19 -0400 | [diff] [blame] | 160 | for (i = 0; i < sechdrs[relsec].sh_size / sizeof(*rel); i++) { |
| 161 | /* This is where to make the change */ |
| 162 | loc = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr |
| 163 | + rel[i].r_offset; |
| 164 | |
| 165 | /* This is the symbol it is referring to. Note that all |
| 166 | undefined symbols have been resolved. */ |
| 167 | sym = (Elf64_Sym *)sechdrs[symindex].sh_addr |
| 168 | + ELF64_R_SYM(rel[i].r_info); |
| 169 | |
| 170 | DEBUGP("type %d st_value %Lx r_addend %Lx loc %Lx\n", |
Joe Perches | c767a54 | 2012-05-21 19:50:07 -0700 | [diff] [blame] | 171 | (int)ELF64_R_TYPE(rel[i].r_info), |
| 172 | sym->st_value, rel[i].r_addend, (u64)loc); |
Amerigo Wang | 0fdc83b | 2009-06-03 21:46:19 -0400 | [diff] [blame] | 173 | |
| 174 | val = sym->st_value + rel[i].r_addend; |
| 175 | |
| 176 | switch (ELF64_R_TYPE(rel[i].r_info)) { |
| 177 | case R_X86_64_NONE: |
| 178 | break; |
| 179 | case R_X86_64_64: |
| 180 | *(u64 *)loc = val; |
| 181 | break; |
| 182 | case R_X86_64_32: |
| 183 | *(u32 *)loc = val; |
| 184 | if (val != *(u32 *)loc) |
| 185 | goto overflow; |
| 186 | break; |
| 187 | case R_X86_64_32S: |
| 188 | *(s32 *)loc = val; |
| 189 | if ((s64)val != *(s32 *)loc) |
| 190 | goto overflow; |
| 191 | break; |
| 192 | case R_X86_64_PC32: |
| 193 | val -= (u64)loc; |
| 194 | *(u32 *)loc = val; |
| 195 | #if 0 |
| 196 | if ((s64)val != *(s32 *)loc) |
| 197 | goto overflow; |
| 198 | #endif |
| 199 | break; |
| 200 | default: |
Joe Perches | c767a54 | 2012-05-21 19:50:07 -0700 | [diff] [blame] | 201 | pr_err("%s: Unknown rela relocation: %llu\n", |
Amerigo Wang | 0fdc83b | 2009-06-03 21:46:19 -0400 | [diff] [blame] | 202 | me->name, ELF64_R_TYPE(rel[i].r_info)); |
| 203 | return -ENOEXEC; |
| 204 | } |
| 205 | } |
| 206 | return 0; |
| 207 | |
| 208 | overflow: |
Joe Perches | c767a54 | 2012-05-21 19:50:07 -0700 | [diff] [blame] | 209 | pr_err("overflow in relocation type %d val %Lx\n", |
Amerigo Wang | 0fdc83b | 2009-06-03 21:46:19 -0400 | [diff] [blame] | 210 | (int)ELF64_R_TYPE(rel[i].r_info), val); |
Joe Perches | c767a54 | 2012-05-21 19:50:07 -0700 | [diff] [blame] | 211 | pr_err("`%s' likely not compiled with -mcmodel=kernel\n", |
Amerigo Wang | 0fdc83b | 2009-06-03 21:46:19 -0400 | [diff] [blame] | 212 | me->name); |
| 213 | return -ENOEXEC; |
| 214 | } |
Amerigo Wang | 0fdc83b | 2009-06-03 21:46:19 -0400 | [diff] [blame] | 215 | #endif |
| 216 | |
Amerigo Wang | 2d5bf28 | 2009-06-03 21:46:09 -0400 | [diff] [blame] | 217 | int module_finalize(const Elf_Ehdr *hdr, |
| 218 | const Elf_Shdr *sechdrs, |
| 219 | struct module *me) |
| 220 | { |
| 221 | const Elf_Shdr *s, *text = NULL, *alt = NULL, *locks = NULL, |
| 222 | *para = NULL; |
| 223 | char *secstrings = (void *)hdr + sechdrs[hdr->e_shstrndx].sh_offset; |
| 224 | |
| 225 | for (s = sechdrs; s < sechdrs + hdr->e_shnum; s++) { |
| 226 | if (!strcmp(".text", secstrings + s->sh_name)) |
| 227 | text = s; |
| 228 | if (!strcmp(".altinstructions", secstrings + s->sh_name)) |
| 229 | alt = s; |
| 230 | if (!strcmp(".smp_locks", secstrings + s->sh_name)) |
| 231 | locks = s; |
| 232 | if (!strcmp(".parainstructions", secstrings + s->sh_name)) |
| 233 | para = s; |
| 234 | } |
| 235 | |
| 236 | if (alt) { |
| 237 | /* patch .altinstructions */ |
| 238 | void *aseg = (void *)alt->sh_addr; |
| 239 | apply_alternatives(aseg, aseg + alt->sh_size); |
| 240 | } |
| 241 | if (locks && text) { |
| 242 | void *lseg = (void *)locks->sh_addr; |
| 243 | void *tseg = (void *)text->sh_addr; |
| 244 | alternatives_smp_module_add(me, me->name, |
| 245 | lseg, lseg + locks->sh_size, |
| 246 | tseg, tseg + text->sh_size); |
| 247 | } |
| 248 | |
| 249 | if (para) { |
| 250 | void *pseg = (void *)para->sh_addr; |
| 251 | apply_paravirt(pseg, pseg + para->sh_size); |
| 252 | } |
| 253 | |
Jason Baron | d9f5ab7 | 2010-09-17 11:09:22 -0400 | [diff] [blame] | 254 | /* make jump label nops */ |
| 255 | jump_label_apply_nops(me); |
| 256 | |
Linus Torvalds | 5336377 | 2010-10-05 11:29:27 -0700 | [diff] [blame] | 257 | return 0; |
Amerigo Wang | 2d5bf28 | 2009-06-03 21:46:09 -0400 | [diff] [blame] | 258 | } |
| 259 | |
| 260 | void module_arch_cleanup(struct module *mod) |
| 261 | { |
| 262 | alternatives_smp_module_del(mod); |
Amerigo Wang | 2d5bf28 | 2009-06-03 21:46:09 -0400 | [diff] [blame] | 263 | } |