Amerigo Wang | 2d5bf28 | 2009-06-03 21:46:09 -0400 | [diff] [blame] | 1 | /* Kernel module help for x86. |
| 2 | Copyright (C) 2001 Rusty Russell. |
| 3 | |
| 4 | This program is free software; you can redistribute it and/or modify |
| 5 | it under the terms of the GNU General Public License as published by |
| 6 | the Free Software Foundation; either version 2 of the License, or |
| 7 | (at your option) any later version. |
| 8 | |
| 9 | This program is distributed in the hope that it will be useful, |
| 10 | but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 11 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 12 | GNU General Public License for more details. |
| 13 | |
| 14 | You should have received a copy of the GNU General Public License |
| 15 | along with this program; if not, write to the Free Software |
| 16 | Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
| 17 | */ |
Joe Perches | c767a54 | 2012-05-21 19:50:07 -0700 | [diff] [blame] | 18 | |
| 19 | #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt |
| 20 | |
Amerigo Wang | 2d5bf28 | 2009-06-03 21:46:09 -0400 | [diff] [blame] | 21 | #include <linux/moduleloader.h> |
| 22 | #include <linux/elf.h> |
| 23 | #include <linux/vmalloc.h> |
| 24 | #include <linux/fs.h> |
| 25 | #include <linux/string.h> |
| 26 | #include <linux/kernel.h> |
Andrey Ryabinin | bebf56a | 2015-02-13 14:40:17 -0800 | [diff] [blame] | 27 | #include <linux/kasan.h> |
Amerigo Wang | 2d5bf28 | 2009-06-03 21:46:09 -0400 | [diff] [blame] | 28 | #include <linux/bug.h> |
| 29 | #include <linux/mm.h> |
Tejun Heo | 5a0e3ad | 2010-03-24 17:04:11 +0900 | [diff] [blame] | 30 | #include <linux/gfp.h> |
Jason Baron | d430d3d | 2011-03-16 17:29:47 -0400 | [diff] [blame] | 31 | #include <linux/jump_label.h> |
Kees Cook | e2b32e6 | 2014-02-25 16:59:17 -0800 | [diff] [blame] | 32 | #include <linux/random.h> |
Amerigo Wang | 2d5bf28 | 2009-06-03 21:46:09 -0400 | [diff] [blame] | 33 | |
Andy Lutomirski | 35de5b0 | 2016-04-26 12:23:24 -0700 | [diff] [blame] | 34 | #include <asm/text-patching.h> |
Amerigo Wang | 2d5bf28 | 2009-06-03 21:46:09 -0400 | [diff] [blame] | 35 | #include <asm/page.h> |
| 36 | #include <asm/pgtable.h> |
Borislav Petkov | 78cac48 | 2015-04-01 12:49:52 +0200 | [diff] [blame] | 37 | #include <asm/setup.h> |
Josh Poimboeuf | ee9f8fc | 2017-07-24 18:36:57 -0500 | [diff] [blame] | 38 | #include <asm/unwind.h> |
Amerigo Wang | 2d5bf28 | 2009-06-03 21:46:09 -0400 | [diff] [blame] | 39 | |
| 40 | #if 0 |
Joe Perches | c767a54 | 2012-05-21 19:50:07 -0700 | [diff] [blame] | 41 | #define DEBUGP(fmt, ...) \ |
| 42 | printk(KERN_DEBUG fmt, ##__VA_ARGS__) |
Amerigo Wang | 2d5bf28 | 2009-06-03 21:46:09 -0400 | [diff] [blame] | 43 | #else |
Joe Perches | c767a54 | 2012-05-21 19:50:07 -0700 | [diff] [blame] | 44 | #define DEBUGP(fmt, ...) \ |
| 45 | do { \ |
| 46 | if (0) \ |
| 47 | printk(KERN_DEBUG fmt, ##__VA_ARGS__); \ |
| 48 | } while (0) |
Amerigo Wang | 2d5bf28 | 2009-06-03 21:46:09 -0400 | [diff] [blame] | 49 | #endif |
| 50 | |
Kees Cook | e2b32e6 | 2014-02-25 16:59:17 -0800 | [diff] [blame] | 51 | #ifdef CONFIG_RANDOMIZE_BASE |
| 52 | static unsigned long module_load_offset; |
Kees Cook | e2b32e6 | 2014-02-25 16:59:17 -0800 | [diff] [blame] | 53 | |
Kees Cook | 9dd721c | 2014-03-10 13:42:48 -0700 | [diff] [blame] | 54 | /* Mutex protects the module_load_offset. */ |
| 55 | static DEFINE_MUTEX(module_kaslr_mutex); |
| 56 | |
Kees Cook | e2b32e6 | 2014-02-25 16:59:17 -0800 | [diff] [blame] | 57 | static unsigned long int get_module_load_offset(void) |
| 58 | { |
Borislav Petkov | 78cac48 | 2015-04-01 12:49:52 +0200 | [diff] [blame] | 59 | if (kaslr_enabled()) { |
Kees Cook | 9dd721c | 2014-03-10 13:42:48 -0700 | [diff] [blame] | 60 | mutex_lock(&module_kaslr_mutex); |
Kees Cook | e2b32e6 | 2014-02-25 16:59:17 -0800 | [diff] [blame] | 61 | /* |
| 62 | * Calculate the module_load_offset the first time this |
| 63 | * code is called. Once calculated it stays the same until |
| 64 | * reboot. |
| 65 | */ |
| 66 | if (module_load_offset == 0) |
| 67 | module_load_offset = |
| 68 | (get_random_int() % 1024 + 1) * PAGE_SIZE; |
Kees Cook | 9dd721c | 2014-03-10 13:42:48 -0700 | [diff] [blame] | 69 | mutex_unlock(&module_kaslr_mutex); |
Kees Cook | e2b32e6 | 2014-02-25 16:59:17 -0800 | [diff] [blame] | 70 | } |
| 71 | return module_load_offset; |
| 72 | } |
| 73 | #else |
| 74 | static unsigned long int get_module_load_offset(void) |
| 75 | { |
| 76 | return 0; |
| 77 | } |
| 78 | #endif |
| 79 | |
Amerigo Wang | 0fdc83b | 2009-06-03 21:46:19 -0400 | [diff] [blame] | 80 | void *module_alloc(unsigned long size) |
| 81 | { |
Andrey Ryabinin | bebf56a | 2015-02-13 14:40:17 -0800 | [diff] [blame] | 82 | void *p; |
| 83 | |
David Rientjes | d0a2126 | 2011-01-13 15:46:02 -0800 | [diff] [blame] | 84 | if (PAGE_ALIGN(size) > MODULES_LEN) |
Amerigo Wang | 0fdc83b | 2009-06-03 21:46:19 -0400 | [diff] [blame] | 85 | return NULL; |
Andrey Ryabinin | bebf56a | 2015-02-13 14:40:17 -0800 | [diff] [blame] | 86 | |
| 87 | p = __vmalloc_node_range(size, MODULE_ALIGN, |
Kees Cook | e2b32e6 | 2014-02-25 16:59:17 -0800 | [diff] [blame] | 88 | MODULES_VADDR + get_module_load_offset(), |
Michal Hocko | 19809c2 | 2017-05-08 15:57:44 -0700 | [diff] [blame] | 89 | MODULES_END, GFP_KERNEL, |
Andrey Ryabinin | cb9e3c2 | 2015-02-13 14:40:07 -0800 | [diff] [blame] | 90 | PAGE_KERNEL_EXEC, 0, NUMA_NO_NODE, |
Kees Cook | e2b32e6 | 2014-02-25 16:59:17 -0800 | [diff] [blame] | 91 | __builtin_return_address(0)); |
Andrey Ryabinin | bebf56a | 2015-02-13 14:40:17 -0800 | [diff] [blame] | 92 | if (p && (kasan_module_alloc(p, size) < 0)) { |
| 93 | vfree(p); |
| 94 | return NULL; |
| 95 | } |
| 96 | |
| 97 | return p; |
Amerigo Wang | 0fdc83b | 2009-06-03 21:46:19 -0400 | [diff] [blame] | 98 | } |
Amerigo Wang | 0fdc83b | 2009-06-03 21:46:19 -0400 | [diff] [blame] | 99 | |
Amerigo Wang | 0fdc83b | 2009-06-03 21:46:19 -0400 | [diff] [blame] | 100 | #ifdef CONFIG_X86_32 |
| 101 | int apply_relocate(Elf32_Shdr *sechdrs, |
| 102 | const char *strtab, |
| 103 | unsigned int symindex, |
| 104 | unsigned int relsec, |
| 105 | struct module *me) |
| 106 | { |
| 107 | unsigned int i; |
| 108 | Elf32_Rel *rel = (void *)sechdrs[relsec].sh_addr; |
| 109 | Elf32_Sym *sym; |
| 110 | uint32_t *location; |
| 111 | |
Joe Perches | c767a54 | 2012-05-21 19:50:07 -0700 | [diff] [blame] | 112 | DEBUGP("Applying relocate section %u to %u\n", |
| 113 | relsec, sechdrs[relsec].sh_info); |
Amerigo Wang | 0fdc83b | 2009-06-03 21:46:19 -0400 | [diff] [blame] | 114 | for (i = 0; i < sechdrs[relsec].sh_size / sizeof(*rel); i++) { |
| 115 | /* This is where to make the change */ |
| 116 | location = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr |
| 117 | + rel[i].r_offset; |
| 118 | /* This is the symbol it is referring to. Note that all |
| 119 | undefined symbols have been resolved. */ |
| 120 | sym = (Elf32_Sym *)sechdrs[symindex].sh_addr |
| 121 | + ELF32_R_SYM(rel[i].r_info); |
| 122 | |
| 123 | switch (ELF32_R_TYPE(rel[i].r_info)) { |
| 124 | case R_386_32: |
| 125 | /* We add the value into the location given */ |
| 126 | *location += sym->st_value; |
| 127 | break; |
| 128 | case R_386_PC32: |
Geert Uytterhoeven | 2e76c28 | 2012-07-19 22:29:11 +0200 | [diff] [blame] | 129 | /* Add the value, subtract its position */ |
Amerigo Wang | 0fdc83b | 2009-06-03 21:46:19 -0400 | [diff] [blame] | 130 | *location += sym->st_value - (uint32_t)location; |
| 131 | break; |
| 132 | default: |
Joe Perches | c767a54 | 2012-05-21 19:50:07 -0700 | [diff] [blame] | 133 | pr_err("%s: Unknown relocation: %u\n", |
Amerigo Wang | 0fdc83b | 2009-06-03 21:46:19 -0400 | [diff] [blame] | 134 | me->name, ELF32_R_TYPE(rel[i].r_info)); |
| 135 | return -ENOEXEC; |
| 136 | } |
| 137 | } |
| 138 | return 0; |
| 139 | } |
Amerigo Wang | 0fdc83b | 2009-06-03 21:46:19 -0400 | [diff] [blame] | 140 | #else /*X86_64*/ |
| 141 | int apply_relocate_add(Elf64_Shdr *sechdrs, |
| 142 | const char *strtab, |
| 143 | unsigned int symindex, |
| 144 | unsigned int relsec, |
| 145 | struct module *me) |
| 146 | { |
| 147 | unsigned int i; |
| 148 | Elf64_Rela *rel = (void *)sechdrs[relsec].sh_addr; |
| 149 | Elf64_Sym *sym; |
| 150 | void *loc; |
| 151 | u64 val; |
| 152 | |
Joe Perches | c767a54 | 2012-05-21 19:50:07 -0700 | [diff] [blame] | 153 | DEBUGP("Applying relocate section %u to %u\n", |
| 154 | relsec, sechdrs[relsec].sh_info); |
Amerigo Wang | 0fdc83b | 2009-06-03 21:46:19 -0400 | [diff] [blame] | 155 | for (i = 0; i < sechdrs[relsec].sh_size / sizeof(*rel); i++) { |
| 156 | /* This is where to make the change */ |
| 157 | loc = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr |
| 158 | + rel[i].r_offset; |
| 159 | |
| 160 | /* This is the symbol it is referring to. Note that all |
| 161 | undefined symbols have been resolved. */ |
| 162 | sym = (Elf64_Sym *)sechdrs[symindex].sh_addr |
| 163 | + ELF64_R_SYM(rel[i].r_info); |
| 164 | |
| 165 | DEBUGP("type %d st_value %Lx r_addend %Lx loc %Lx\n", |
Joe Perches | c767a54 | 2012-05-21 19:50:07 -0700 | [diff] [blame] | 166 | (int)ELF64_R_TYPE(rel[i].r_info), |
| 167 | sym->st_value, rel[i].r_addend, (u64)loc); |
Amerigo Wang | 0fdc83b | 2009-06-03 21:46:19 -0400 | [diff] [blame] | 168 | |
| 169 | val = sym->st_value + rel[i].r_addend; |
| 170 | |
| 171 | switch (ELF64_R_TYPE(rel[i].r_info)) { |
| 172 | case R_X86_64_NONE: |
| 173 | break; |
| 174 | case R_X86_64_64: |
Josh Poimboeuf | eda9cec | 2017-11-03 07:58:54 -0500 | [diff] [blame] | 175 | if (*(u64 *)loc != 0) |
| 176 | goto invalid_relocation; |
Amerigo Wang | 0fdc83b | 2009-06-03 21:46:19 -0400 | [diff] [blame] | 177 | *(u64 *)loc = val; |
| 178 | break; |
| 179 | case R_X86_64_32: |
Josh Poimboeuf | eda9cec | 2017-11-03 07:58:54 -0500 | [diff] [blame] | 180 | if (*(u32 *)loc != 0) |
| 181 | goto invalid_relocation; |
Amerigo Wang | 0fdc83b | 2009-06-03 21:46:19 -0400 | [diff] [blame] | 182 | *(u32 *)loc = val; |
| 183 | if (val != *(u32 *)loc) |
| 184 | goto overflow; |
| 185 | break; |
| 186 | case R_X86_64_32S: |
Josh Poimboeuf | eda9cec | 2017-11-03 07:58:54 -0500 | [diff] [blame] | 187 | if (*(s32 *)loc != 0) |
| 188 | goto invalid_relocation; |
Amerigo Wang | 0fdc83b | 2009-06-03 21:46:19 -0400 | [diff] [blame] | 189 | *(s32 *)loc = val; |
| 190 | if ((s64)val != *(s32 *)loc) |
| 191 | goto overflow; |
| 192 | break; |
| 193 | case R_X86_64_PC32: |
H.J. Lu | b21ebf2f | 2018-02-07 14:20:09 -0800 | [diff] [blame] | 194 | case R_X86_64_PLT32: |
Josh Poimboeuf | eda9cec | 2017-11-03 07:58:54 -0500 | [diff] [blame] | 195 | if (*(u32 *)loc != 0) |
| 196 | goto invalid_relocation; |
Amerigo Wang | 0fdc83b | 2009-06-03 21:46:19 -0400 | [diff] [blame] | 197 | val -= (u64)loc; |
| 198 | *(u32 *)loc = val; |
| 199 | #if 0 |
| 200 | if ((s64)val != *(s32 *)loc) |
| 201 | goto overflow; |
| 202 | #endif |
| 203 | break; |
Ard Biesheuvel | b40a142 | 2018-09-18 23:51:39 -0700 | [diff] [blame] | 204 | case R_X86_64_PC64: |
| 205 | if (*(u64 *)loc != 0) |
| 206 | goto invalid_relocation; |
| 207 | val -= (u64)loc; |
| 208 | *(u64 *)loc = val; |
| 209 | break; |
Amerigo Wang | 0fdc83b | 2009-06-03 21:46:19 -0400 | [diff] [blame] | 210 | default: |
Joe Perches | c767a54 | 2012-05-21 19:50:07 -0700 | [diff] [blame] | 211 | pr_err("%s: Unknown rela relocation: %llu\n", |
Amerigo Wang | 0fdc83b | 2009-06-03 21:46:19 -0400 | [diff] [blame] | 212 | me->name, ELF64_R_TYPE(rel[i].r_info)); |
| 213 | return -ENOEXEC; |
| 214 | } |
| 215 | } |
| 216 | return 0; |
| 217 | |
Josh Poimboeuf | eda9cec | 2017-11-03 07:58:54 -0500 | [diff] [blame] | 218 | invalid_relocation: |
| 219 | pr_err("x86/modules: Skipping invalid relocation target, existing value is nonzero for type %d, loc %p, val %Lx\n", |
| 220 | (int)ELF64_R_TYPE(rel[i].r_info), loc, val); |
| 221 | return -ENOEXEC; |
| 222 | |
Amerigo Wang | 0fdc83b | 2009-06-03 21:46:19 -0400 | [diff] [blame] | 223 | overflow: |
Joe Perches | c767a54 | 2012-05-21 19:50:07 -0700 | [diff] [blame] | 224 | pr_err("overflow in relocation type %d val %Lx\n", |
Amerigo Wang | 0fdc83b | 2009-06-03 21:46:19 -0400 | [diff] [blame] | 225 | (int)ELF64_R_TYPE(rel[i].r_info), val); |
Joe Perches | c767a54 | 2012-05-21 19:50:07 -0700 | [diff] [blame] | 226 | pr_err("`%s' likely not compiled with -mcmodel=kernel\n", |
Amerigo Wang | 0fdc83b | 2009-06-03 21:46:19 -0400 | [diff] [blame] | 227 | me->name); |
| 228 | return -ENOEXEC; |
| 229 | } |
Amerigo Wang | 0fdc83b | 2009-06-03 21:46:19 -0400 | [diff] [blame] | 230 | #endif |
| 231 | |
Amerigo Wang | 2d5bf28 | 2009-06-03 21:46:09 -0400 | [diff] [blame] | 232 | int module_finalize(const Elf_Ehdr *hdr, |
| 233 | const Elf_Shdr *sechdrs, |
| 234 | struct module *me) |
| 235 | { |
| 236 | const Elf_Shdr *s, *text = NULL, *alt = NULL, *locks = NULL, |
Josh Poimboeuf | ee9f8fc | 2017-07-24 18:36:57 -0500 | [diff] [blame] | 237 | *para = NULL, *orc = NULL, *orc_ip = NULL; |
Amerigo Wang | 2d5bf28 | 2009-06-03 21:46:09 -0400 | [diff] [blame] | 238 | char *secstrings = (void *)hdr + sechdrs[hdr->e_shstrndx].sh_offset; |
| 239 | |
| 240 | for (s = sechdrs; s < sechdrs + hdr->e_shnum; s++) { |
| 241 | if (!strcmp(".text", secstrings + s->sh_name)) |
| 242 | text = s; |
| 243 | if (!strcmp(".altinstructions", secstrings + s->sh_name)) |
| 244 | alt = s; |
| 245 | if (!strcmp(".smp_locks", secstrings + s->sh_name)) |
| 246 | locks = s; |
| 247 | if (!strcmp(".parainstructions", secstrings + s->sh_name)) |
| 248 | para = s; |
Josh Poimboeuf | ee9f8fc | 2017-07-24 18:36:57 -0500 | [diff] [blame] | 249 | if (!strcmp(".orc_unwind", secstrings + s->sh_name)) |
| 250 | orc = s; |
| 251 | if (!strcmp(".orc_unwind_ip", secstrings + s->sh_name)) |
| 252 | orc_ip = s; |
Amerigo Wang | 2d5bf28 | 2009-06-03 21:46:09 -0400 | [diff] [blame] | 253 | } |
| 254 | |
| 255 | if (alt) { |
| 256 | /* patch .altinstructions */ |
| 257 | void *aseg = (void *)alt->sh_addr; |
| 258 | apply_alternatives(aseg, aseg + alt->sh_size); |
| 259 | } |
| 260 | if (locks && text) { |
| 261 | void *lseg = (void *)locks->sh_addr; |
| 262 | void *tseg = (void *)text->sh_addr; |
| 263 | alternatives_smp_module_add(me, me->name, |
| 264 | lseg, lseg + locks->sh_size, |
| 265 | tseg, tseg + text->sh_size); |
| 266 | } |
| 267 | |
| 268 | if (para) { |
| 269 | void *pseg = (void *)para->sh_addr; |
| 270 | apply_paravirt(pseg, pseg + para->sh_size); |
| 271 | } |
| 272 | |
Jason Baron | d9f5ab7 | 2010-09-17 11:09:22 -0400 | [diff] [blame] | 273 | /* make jump label nops */ |
| 274 | jump_label_apply_nops(me); |
| 275 | |
Josh Poimboeuf | ee9f8fc | 2017-07-24 18:36:57 -0500 | [diff] [blame] | 276 | if (orc && orc_ip) |
| 277 | unwind_module_init(me, (void *)orc_ip->sh_addr, orc_ip->sh_size, |
| 278 | (void *)orc->sh_addr, orc->sh_size); |
| 279 | |
Linus Torvalds | 5336377 | 2010-10-05 11:29:27 -0700 | [diff] [blame] | 280 | return 0; |
Amerigo Wang | 2d5bf28 | 2009-06-03 21:46:09 -0400 | [diff] [blame] | 281 | } |
| 282 | |
| 283 | void module_arch_cleanup(struct module *mod) |
| 284 | { |
| 285 | alternatives_smp_module_del(mod); |
Amerigo Wang | 2d5bf28 | 2009-06-03 21:46:09 -0400 | [diff] [blame] | 286 | } |