12d5bf28fSAmerigo Wang /* Kernel module help for x86. 22d5bf28fSAmerigo Wang Copyright (C) 2001 Rusty Russell. 32d5bf28fSAmerigo Wang 42d5bf28fSAmerigo Wang This program is free software; you can redistribute it and/or modify 52d5bf28fSAmerigo Wang it under the terms of the GNU General Public License as published by 62d5bf28fSAmerigo Wang the Free Software Foundation; either version 2 of the License, or 72d5bf28fSAmerigo Wang (at your option) any later version. 82d5bf28fSAmerigo Wang 92d5bf28fSAmerigo Wang This program is distributed in the hope that it will be useful, 102d5bf28fSAmerigo Wang but WITHOUT ANY WARRANTY; without even the implied warranty of 112d5bf28fSAmerigo Wang MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 122d5bf28fSAmerigo Wang GNU General Public License for more details. 132d5bf28fSAmerigo Wang 142d5bf28fSAmerigo Wang You should have received a copy of the GNU General Public License 152d5bf28fSAmerigo Wang along with this program; if not, write to the Free Software 162d5bf28fSAmerigo Wang Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 172d5bf28fSAmerigo Wang */ 18c767a54bSJoe Perches 19c767a54bSJoe Perches #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 20c767a54bSJoe Perches 212d5bf28fSAmerigo Wang #include <linux/moduleloader.h> 222d5bf28fSAmerigo Wang #include <linux/elf.h> 232d5bf28fSAmerigo Wang #include <linux/vmalloc.h> 242d5bf28fSAmerigo Wang #include <linux/fs.h> 252d5bf28fSAmerigo Wang #include <linux/string.h> 262d5bf28fSAmerigo Wang #include <linux/kernel.h> 27*bebf56a1SAndrey Ryabinin #include <linux/kasan.h> 282d5bf28fSAmerigo Wang #include <linux/bug.h> 292d5bf28fSAmerigo Wang #include <linux/mm.h> 305a0e3ad6STejun Heo #include <linux/gfp.h> 31d430d3d7SJason Baron #include <linux/jump_label.h> 32e2b32e67SKees Cook #include <linux/random.h> 332d5bf28fSAmerigo Wang 342d5bf28fSAmerigo Wang #include <asm/page.h> 352d5bf28fSAmerigo Wang #include <asm/pgtable.h> 362d5bf28fSAmerigo Wang 372d5bf28fSAmerigo Wang #if 0 38c767a54bSJoe Perches #define DEBUGP(fmt, ...) \ 39c767a54bSJoe Perches printk(KERN_DEBUG fmt, ##__VA_ARGS__) 402d5bf28fSAmerigo Wang #else 41c767a54bSJoe Perches #define DEBUGP(fmt, ...) \ 42c767a54bSJoe Perches do { \ 43c767a54bSJoe Perches if (0) \ 44c767a54bSJoe Perches printk(KERN_DEBUG fmt, ##__VA_ARGS__); \ 45c767a54bSJoe Perches } while (0) 462d5bf28fSAmerigo Wang #endif 472d5bf28fSAmerigo Wang 48e2b32e67SKees Cook #ifdef CONFIG_RANDOMIZE_BASE 49e2b32e67SKees Cook static unsigned long module_load_offset; 50e2b32e67SKees Cook static int randomize_modules = 1; 51e2b32e67SKees Cook 529dd721c6SKees Cook /* Mutex protects the module_load_offset. */ 539dd721c6SKees Cook static DEFINE_MUTEX(module_kaslr_mutex); 549dd721c6SKees Cook 55e2b32e67SKees Cook static int __init parse_nokaslr(char *p) 56e2b32e67SKees Cook { 57e2b32e67SKees Cook randomize_modules = 0; 58e2b32e67SKees Cook return 0; 59e2b32e67SKees Cook } 60e2b32e67SKees Cook early_param("nokaslr", parse_nokaslr); 61e2b32e67SKees Cook 62e2b32e67SKees Cook static unsigned long int get_module_load_offset(void) 63e2b32e67SKees Cook { 64e2b32e67SKees Cook if (randomize_modules) { 659dd721c6SKees Cook mutex_lock(&module_kaslr_mutex); 66e2b32e67SKees Cook /* 67e2b32e67SKees Cook * Calculate the module_load_offset the first time this 68e2b32e67SKees Cook * code is called. Once calculated it stays the same until 69e2b32e67SKees Cook * reboot. 70e2b32e67SKees Cook */ 71e2b32e67SKees Cook if (module_load_offset == 0) 72e2b32e67SKees Cook module_load_offset = 73e2b32e67SKees Cook (get_random_int() % 1024 + 1) * PAGE_SIZE; 749dd721c6SKees Cook mutex_unlock(&module_kaslr_mutex); 75e2b32e67SKees Cook } 76e2b32e67SKees Cook return module_load_offset; 77e2b32e67SKees Cook } 78e2b32e67SKees Cook #else 79e2b32e67SKees Cook static unsigned long int get_module_load_offset(void) 80e2b32e67SKees Cook { 81e2b32e67SKees Cook return 0; 82e2b32e67SKees Cook } 83e2b32e67SKees Cook #endif 84e2b32e67SKees Cook 850fdc83b9SAmerigo Wang void *module_alloc(unsigned long size) 860fdc83b9SAmerigo Wang { 87*bebf56a1SAndrey Ryabinin void *p; 88*bebf56a1SAndrey Ryabinin 89d0a21265SDavid Rientjes if (PAGE_ALIGN(size) > MODULES_LEN) 900fdc83b9SAmerigo Wang return NULL; 91*bebf56a1SAndrey Ryabinin 92*bebf56a1SAndrey Ryabinin p = __vmalloc_node_range(size, MODULE_ALIGN, 93e2b32e67SKees Cook MODULES_VADDR + get_module_load_offset(), 94e2b32e67SKees Cook MODULES_END, GFP_KERNEL | __GFP_HIGHMEM, 95cb9e3c29SAndrey Ryabinin PAGE_KERNEL_EXEC, 0, NUMA_NO_NODE, 96e2b32e67SKees Cook __builtin_return_address(0)); 97*bebf56a1SAndrey Ryabinin if (p && (kasan_module_alloc(p, size) < 0)) { 98*bebf56a1SAndrey Ryabinin vfree(p); 99*bebf56a1SAndrey Ryabinin return NULL; 100*bebf56a1SAndrey Ryabinin } 101*bebf56a1SAndrey Ryabinin 102*bebf56a1SAndrey Ryabinin return p; 1030fdc83b9SAmerigo Wang } 1040fdc83b9SAmerigo Wang 1050fdc83b9SAmerigo Wang #ifdef CONFIG_X86_32 1060fdc83b9SAmerigo Wang int apply_relocate(Elf32_Shdr *sechdrs, 1070fdc83b9SAmerigo Wang const char *strtab, 1080fdc83b9SAmerigo Wang unsigned int symindex, 1090fdc83b9SAmerigo Wang unsigned int relsec, 1100fdc83b9SAmerigo Wang struct module *me) 1110fdc83b9SAmerigo Wang { 1120fdc83b9SAmerigo Wang unsigned int i; 1130fdc83b9SAmerigo Wang Elf32_Rel *rel = (void *)sechdrs[relsec].sh_addr; 1140fdc83b9SAmerigo Wang Elf32_Sym *sym; 1150fdc83b9SAmerigo Wang uint32_t *location; 1160fdc83b9SAmerigo Wang 117c767a54bSJoe Perches DEBUGP("Applying relocate section %u to %u\n", 118c767a54bSJoe Perches relsec, sechdrs[relsec].sh_info); 1190fdc83b9SAmerigo Wang for (i = 0; i < sechdrs[relsec].sh_size / sizeof(*rel); i++) { 1200fdc83b9SAmerigo Wang /* This is where to make the change */ 1210fdc83b9SAmerigo Wang location = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr 1220fdc83b9SAmerigo Wang + rel[i].r_offset; 1230fdc83b9SAmerigo Wang /* This is the symbol it is referring to. Note that all 1240fdc83b9SAmerigo Wang undefined symbols have been resolved. */ 1250fdc83b9SAmerigo Wang sym = (Elf32_Sym *)sechdrs[symindex].sh_addr 1260fdc83b9SAmerigo Wang + ELF32_R_SYM(rel[i].r_info); 1270fdc83b9SAmerigo Wang 1280fdc83b9SAmerigo Wang switch (ELF32_R_TYPE(rel[i].r_info)) { 1290fdc83b9SAmerigo Wang case R_386_32: 1300fdc83b9SAmerigo Wang /* We add the value into the location given */ 1310fdc83b9SAmerigo Wang *location += sym->st_value; 1320fdc83b9SAmerigo Wang break; 1330fdc83b9SAmerigo Wang case R_386_PC32: 1342e76c283SGeert Uytterhoeven /* Add the value, subtract its position */ 1350fdc83b9SAmerigo Wang *location += sym->st_value - (uint32_t)location; 1360fdc83b9SAmerigo Wang break; 1370fdc83b9SAmerigo Wang default: 138c767a54bSJoe Perches pr_err("%s: Unknown relocation: %u\n", 1390fdc83b9SAmerigo Wang me->name, ELF32_R_TYPE(rel[i].r_info)); 1400fdc83b9SAmerigo Wang return -ENOEXEC; 1410fdc83b9SAmerigo Wang } 1420fdc83b9SAmerigo Wang } 1430fdc83b9SAmerigo Wang return 0; 1440fdc83b9SAmerigo Wang } 1450fdc83b9SAmerigo Wang #else /*X86_64*/ 1460fdc83b9SAmerigo Wang int apply_relocate_add(Elf64_Shdr *sechdrs, 1470fdc83b9SAmerigo Wang const char *strtab, 1480fdc83b9SAmerigo Wang unsigned int symindex, 1490fdc83b9SAmerigo Wang unsigned int relsec, 1500fdc83b9SAmerigo Wang struct module *me) 1510fdc83b9SAmerigo Wang { 1520fdc83b9SAmerigo Wang unsigned int i; 1530fdc83b9SAmerigo Wang Elf64_Rela *rel = (void *)sechdrs[relsec].sh_addr; 1540fdc83b9SAmerigo Wang Elf64_Sym *sym; 1550fdc83b9SAmerigo Wang void *loc; 1560fdc83b9SAmerigo Wang u64 val; 1570fdc83b9SAmerigo Wang 158c767a54bSJoe Perches DEBUGP("Applying relocate section %u to %u\n", 159c767a54bSJoe Perches relsec, sechdrs[relsec].sh_info); 1600fdc83b9SAmerigo Wang for (i = 0; i < sechdrs[relsec].sh_size / sizeof(*rel); i++) { 1610fdc83b9SAmerigo Wang /* This is where to make the change */ 1620fdc83b9SAmerigo Wang loc = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr 1630fdc83b9SAmerigo Wang + rel[i].r_offset; 1640fdc83b9SAmerigo Wang 1650fdc83b9SAmerigo Wang /* This is the symbol it is referring to. Note that all 1660fdc83b9SAmerigo Wang undefined symbols have been resolved. */ 1670fdc83b9SAmerigo Wang sym = (Elf64_Sym *)sechdrs[symindex].sh_addr 1680fdc83b9SAmerigo Wang + ELF64_R_SYM(rel[i].r_info); 1690fdc83b9SAmerigo Wang 1700fdc83b9SAmerigo Wang DEBUGP("type %d st_value %Lx r_addend %Lx loc %Lx\n", 1710fdc83b9SAmerigo Wang (int)ELF64_R_TYPE(rel[i].r_info), 1720fdc83b9SAmerigo Wang sym->st_value, rel[i].r_addend, (u64)loc); 1730fdc83b9SAmerigo Wang 1740fdc83b9SAmerigo Wang val = sym->st_value + rel[i].r_addend; 1750fdc83b9SAmerigo Wang 1760fdc83b9SAmerigo Wang switch (ELF64_R_TYPE(rel[i].r_info)) { 1770fdc83b9SAmerigo Wang case R_X86_64_NONE: 1780fdc83b9SAmerigo Wang break; 1790fdc83b9SAmerigo Wang case R_X86_64_64: 1800fdc83b9SAmerigo Wang *(u64 *)loc = val; 1810fdc83b9SAmerigo Wang break; 1820fdc83b9SAmerigo Wang case R_X86_64_32: 1830fdc83b9SAmerigo Wang *(u32 *)loc = val; 1840fdc83b9SAmerigo Wang if (val != *(u32 *)loc) 1850fdc83b9SAmerigo Wang goto overflow; 1860fdc83b9SAmerigo Wang break; 1870fdc83b9SAmerigo Wang case R_X86_64_32S: 1880fdc83b9SAmerigo Wang *(s32 *)loc = val; 1890fdc83b9SAmerigo Wang if ((s64)val != *(s32 *)loc) 1900fdc83b9SAmerigo Wang goto overflow; 1910fdc83b9SAmerigo Wang break; 1920fdc83b9SAmerigo Wang case R_X86_64_PC32: 1930fdc83b9SAmerigo Wang val -= (u64)loc; 1940fdc83b9SAmerigo Wang *(u32 *)loc = val; 1950fdc83b9SAmerigo Wang #if 0 1960fdc83b9SAmerigo Wang if ((s64)val != *(s32 *)loc) 1970fdc83b9SAmerigo Wang goto overflow; 1980fdc83b9SAmerigo Wang #endif 1990fdc83b9SAmerigo Wang break; 2000fdc83b9SAmerigo Wang default: 201c767a54bSJoe Perches pr_err("%s: Unknown rela relocation: %llu\n", 2020fdc83b9SAmerigo Wang me->name, ELF64_R_TYPE(rel[i].r_info)); 2030fdc83b9SAmerigo Wang return -ENOEXEC; 2040fdc83b9SAmerigo Wang } 2050fdc83b9SAmerigo Wang } 2060fdc83b9SAmerigo Wang return 0; 2070fdc83b9SAmerigo Wang 2080fdc83b9SAmerigo Wang overflow: 209c767a54bSJoe Perches pr_err("overflow in relocation type %d val %Lx\n", 2100fdc83b9SAmerigo Wang (int)ELF64_R_TYPE(rel[i].r_info), val); 211c767a54bSJoe Perches pr_err("`%s' likely not compiled with -mcmodel=kernel\n", 2120fdc83b9SAmerigo Wang me->name); 2130fdc83b9SAmerigo Wang return -ENOEXEC; 2140fdc83b9SAmerigo Wang } 2150fdc83b9SAmerigo Wang #endif 2160fdc83b9SAmerigo Wang 2172d5bf28fSAmerigo Wang int module_finalize(const Elf_Ehdr *hdr, 2182d5bf28fSAmerigo Wang const Elf_Shdr *sechdrs, 2192d5bf28fSAmerigo Wang struct module *me) 2202d5bf28fSAmerigo Wang { 2212d5bf28fSAmerigo Wang const Elf_Shdr *s, *text = NULL, *alt = NULL, *locks = NULL, 2222d5bf28fSAmerigo Wang *para = NULL; 2232d5bf28fSAmerigo Wang char *secstrings = (void *)hdr + sechdrs[hdr->e_shstrndx].sh_offset; 2242d5bf28fSAmerigo Wang 2252d5bf28fSAmerigo Wang for (s = sechdrs; s < sechdrs + hdr->e_shnum; s++) { 2262d5bf28fSAmerigo Wang if (!strcmp(".text", secstrings + s->sh_name)) 2272d5bf28fSAmerigo Wang text = s; 2282d5bf28fSAmerigo Wang if (!strcmp(".altinstructions", secstrings + s->sh_name)) 2292d5bf28fSAmerigo Wang alt = s; 2302d5bf28fSAmerigo Wang if (!strcmp(".smp_locks", secstrings + s->sh_name)) 2312d5bf28fSAmerigo Wang locks = s; 2322d5bf28fSAmerigo Wang if (!strcmp(".parainstructions", secstrings + s->sh_name)) 2332d5bf28fSAmerigo Wang para = s; 2342d5bf28fSAmerigo Wang } 2352d5bf28fSAmerigo Wang 2362d5bf28fSAmerigo Wang if (alt) { 2372d5bf28fSAmerigo Wang /* patch .altinstructions */ 2382d5bf28fSAmerigo Wang void *aseg = (void *)alt->sh_addr; 2392d5bf28fSAmerigo Wang apply_alternatives(aseg, aseg + alt->sh_size); 2402d5bf28fSAmerigo Wang } 2412d5bf28fSAmerigo Wang if (locks && text) { 2422d5bf28fSAmerigo Wang void *lseg = (void *)locks->sh_addr; 2432d5bf28fSAmerigo Wang void *tseg = (void *)text->sh_addr; 2442d5bf28fSAmerigo Wang alternatives_smp_module_add(me, me->name, 2452d5bf28fSAmerigo Wang lseg, lseg + locks->sh_size, 2462d5bf28fSAmerigo Wang tseg, tseg + text->sh_size); 2472d5bf28fSAmerigo Wang } 2482d5bf28fSAmerigo Wang 2492d5bf28fSAmerigo Wang if (para) { 2502d5bf28fSAmerigo Wang void *pseg = (void *)para->sh_addr; 2512d5bf28fSAmerigo Wang apply_paravirt(pseg, pseg + para->sh_size); 2522d5bf28fSAmerigo Wang } 2532d5bf28fSAmerigo Wang 254d9f5ab7bSJason Baron /* make jump label nops */ 255d9f5ab7bSJason Baron jump_label_apply_nops(me); 256d9f5ab7bSJason Baron 2575336377dSLinus Torvalds return 0; 2582d5bf28fSAmerigo Wang } 2592d5bf28fSAmerigo Wang 2602d5bf28fSAmerigo Wang void module_arch_cleanup(struct module *mod) 2612d5bf28fSAmerigo Wang { 2622d5bf28fSAmerigo Wang alternatives_smp_module_del(mod); 2632d5bf28fSAmerigo Wang } 264