模塊加載

load_module()函數(shù)調用的功能函數(shù)如下：

• module_sig_check()函數(shù)用于檢查模塊的簽名驗證
• elf_header_check()函數(shù)用于檢查模塊的elf頭和區(qū)段有效性
• layout_and_allocate()函數(shù)用于分配內核內存空間，把模塊相關的節(jié)區(qū)復制過來
• audit_log_kern_module()函數(shù)用于檢查是否開啟了安全審計
• add_unformed_module()函數(shù)用于判斷模塊是否已經加載，若沒有則將模塊添加到內核模塊鏈表中
• percpu_modalloc()函數(shù)用于申請percpu變量內存，這個變量每個CPU都有一份，無相獨立
• module_unload_init()函數(shù)用于初始化化模塊依賴和引用鏈表，并對模塊引用計數(shù)加1
• init_param_lock()函數(shù)用于初始化互斥鎖
• find_module_sections()函數(shù)用于遍歷模塊中的其它分段
• check_module_license_and_versions()函數(shù)用于檢測模塊的CRC是否正確，license授權是否正確
• setup_modinfo()函數(shù)根據(jù).modinfo段設置模塊信息
• simplify_symbols()函數(shù)用于將模塊內存中的靜態(tài)鏈接重定位表中的符號，全部指向其真實的內存地址
• apply_relocations()函數(shù)用于遍歷目標文件中的所有內存節(jié)區(qū)的重定位節(jié)區(qū)，并遍歷每個節(jié)區(qū)中的每個靜態(tài)鏈接重定位表項，對其做靜態(tài)鏈接
• post_relocation()函數(shù)用于對重定位后的percpu變量重新賦值，并將即將加載完成的模塊的符號加入到內核模塊的符號鏈表中，如果成功加載此模塊且內核配置了CONFIG_KALLSYMS，那么在/proc/kallsyms下可以看到此模塊的符號
• flush_module_icache()函數(shù)用于刷新模塊的init_layout和core_layout的cache。
• strndup_user()函數(shù)用于復制用戶空間的參數(shù)到內核空間
• dynamic_debug_setup()函數(shù)用于處理debug節(jié)區(qū)，需要開啟內核CONFIG_DYNAMIC_DEBUG才會啟用
• ftrace_module_init()函數(shù)需要開啟相關的ftrace配置
• complete_formation()函數(shù)用于遍歷模塊中的所有導出函數(shù)，并檢查在內核中是否有同名的導出符號，為模塊的init_layout/core_layout做RONX保護
• prepare_coming_module()函數(shù)用于發(fā)送模塊加載通知鏈
• parse_args()函數(shù)用于參數(shù)解析與sysfs、livepatch的設置
• mod_sysfs_setup()函數(shù)用于在sysfs中創(chuàng)建模塊相應的項
• is_livepatch_module()函數(shù)用于檢查模塊是否是熱補丁模塊
• copy_module_elf()函數(shù)用于拷貝模塊的elf頭
• free_copy()函數(shù)用于釋放最初內核申請的用于保存模塊原文件信息的內存
• trace_module_load()函數(shù)用于加載一些和trace相關的內容，便于后期跟蹤調試
• do_init_module()函數(shù)用于調用模塊的初始化函數(shù)

static int load_module(struct load_info *info, const char __user *uargs,
         int flags)
{
 struct module *mod;
 long err;
 char *after_dashes;

 err = module_sig_check(info, flags);
 if (err)
  goto free_copy;

 err = elf_header_check(info);
 if (err)
  goto free_copy;

 /* Figure out module layout, and allocate all the memory. */
 mod = layout_and_allocate(info, flags);
 if (IS_ERR(mod)) {
  err = PTR_ERR(mod);
  goto free_copy;
 }

 audit_log_kern_module(mod- >name);

 /* Reserve our place in the list. */
 err = add_unformed_module(mod);
 if (err)
  goto free_module;

#ifdef CONFIG_MODULE_SIG
 mod- >sig_ok = info- >sig_ok;
 if (!mod- >sig_ok) {
  pr_notice_once("%s: module verification failed: signature "
          "and/or required key missing - tainting "
          "kernel\\n", mod- >name);
  add_taint_module(mod, TAINT_UNSIGNED_MODULE, LOCKDEP_STILL_OK);
 }
#endif

 /* To avoid stressing percpu allocator, do this once we're unique. */
 err = percpu_modalloc(mod, info);
 if (err)
  goto unlink_mod;

 /* Now module is in final location, initialize linked lists, etc. */
 err = module_unload_init(mod);
 if (err)
  goto unlink_mod;

 init_param_lock(mod);

 /* Now we've got everything in the final locations, we can
  * find optional sections. */
 err = find_module_sections(mod, info);
 if (err)
  goto free_unload;

 err = check_module_license_and_versions(mod);
 if (err)
  goto free_unload;

 /* Set up MODINFO_ATTR fields */
 setup_modinfo(mod, info);

 /* Fix up syms, so that st_value is a pointer to location. */
 err = simplify_symbols(mod, info);
 if (err < 0)
  goto free_modinfo;

 err = apply_relocations(mod, info);
 if (err < 0)
  goto free_modinfo;

 err = post_relocation(mod, info);
 if (err < 0)
  goto free_modinfo;

 flush_module_icache(mod);

 /* Now copy in args */
 mod- >args = strndup_user(uargs, ~0UL > > 1);
 if (IS_ERR(mod- >args)) {
  err = PTR_ERR(mod- >args);
  goto free_arch_cleanup;
 }

 dynamic_debug_setup(mod, info- >debug, info- >num_debug);

 /* Ftrace init must be called in the MODULE_STATE_UNFORMED state */
 ftrace_module_init(mod);

 /* Finally it's fully formed, ready to start executing. */
 err = complete_formation(mod, info);
 if (err)
  goto ddebug_cleanup;

 err = prepare_coming_module(mod);
 if (err)
  goto bug_cleanup;

 /* Module is ready to execute: parsing args may do that. */
 after_dashes = parse_args(mod- >name, mod- >args, mod- >kp, mod- >num_kp,
      -32768, 32767, mod,
      unknown_module_param_cb);
 if (IS_ERR(after_dashes)) {
  err = PTR_ERR(after_dashes);
  goto coming_cleanup;
 } else if (after_dashes) {
  pr_warn("%s: parameters '%s' after `--' ignored\\n",
         mod- >name, after_dashes);
 }

 /* Link in to sysfs. */
 err = mod_sysfs_setup(mod, info, mod- >kp, mod- >num_kp);
 if (err < 0)
  goto coming_cleanup;

 if (is_livepatch_module(mod)) {
  err = copy_module_elf(mod, info);
  if (err < 0)
   goto sysfs_cleanup;
 }

 /* Get rid of temporary copy. */
 free_copy(info);

 /* Done! */
 trace_module_load(mod);

 return do_init_module(mod);

 sysfs_cleanup:
 mod_sysfs_teardown(mod);
 coming_cleanup:
 mod- >state = MODULE_STATE_GOING;
 destroy_params(mod- >kp, mod- >num_kp);
 blocking_notifier_call_chain(&module_notify_list,
         MODULE_STATE_GOING, mod);
 klp_module_going(mod);
 bug_cleanup:
 mod- >state = MODULE_STATE_GOING;
 /* module_bug_cleanup needs module_mutex protection */
 mutex_lock(&module_mutex);
 module_bug_cleanup(mod);
 mutex_unlock(&module_mutex);

 /* we can't deallocate the module until we clear memory protection */
 module_disable_ro(mod);
 module_disable_nx(mod);

 ddebug_cleanup:
 dynamic_debug_remove(mod, info- >debug);
 synchronize_sched();
 kfree(mod- >args);
 free_arch_cleanup:
 module_arch_cleanup(mod);
 free_modinfo:
 free_modinfo(mod);
 free_unload:
 module_unload_free(mod);
 unlink_mod:
 mutex_lock(&module_mutex);
 /* Unlink carefully: kallsyms could be walking list. */
 list_del_rcu(&mod- >list);
 mod_tree_remove(mod);
 wake_up_all(&module_wq);
 /* Wait for RCU-sched synchronizing before releasing mod- >list. */
 synchronize_sched();
 mutex_unlock(&module_mutex);
 free_module:
 /*
  * Ftrace needs to clean up what it initialized.
  * This does nothing if ftrace_module_init() wasn't called,
  * but it must be called outside of module_mutex.
  */
 ftrace_release_mod(mod);
 /* Free lock-classes; relies on the preceding sync_rcu() */
 lockdep_free_key_range(mod- >core_layout.base, mod- >core_layout.size);

 module_deallocate(mod, info);
 free_copy:
 free_copy(info);
 return err;
}

module_sig_check()函數(shù)首先判斷elf模塊文件長度是否大于簽名字符串長度。然后比較該elf格式的模塊文件是否在文件末尾有signature string，若有的話則將該文件長度減去該字符串長度。最后調用mod_verify_sig()函數(shù)驗證模塊簽名。

static int module_sig_check(struct load_info *info, int flags)
{
 int err = -ENOKEY;
 const unsigned long markerlen = sizeof(MODULE_SIG_STRING) - 1;
 const void *mod = info- >hdr;

 /*
  * Require flags == 0, as a module with version information
  * removed is no longer the module that was signed
  */
 if (flags == 0 &&
     info- >len > markerlen &&
     memcmp(mod + info- >len - markerlen, MODULE_SIG_STRING, markerlen) == 0) {
  /* We truncate the module to discard the signature */
  info- >len -= markerlen;
  err = mod_verify_sig(mod, &info- >len);
 }

 if (!err) {
  info- >sig_ok = true;
  return 0;
 }

 /* Not having a signature is only an error if we're strict. */
 if (err == -ENOKEY && !sig_enforce)
  err = 0;

 return err;
}

mod_verify_sig()函數(shù)首先提取模塊簽名字符串中的module_signature結構并保存在變量ms中，然后修改模塊的文件長度，然后獲取簽名數(shù)據(jù)長度保存在變量sig_len變量中，最后調用verify_pkcs7_signature()函數(shù)對內核模塊中的PKCS#7格式的消息進行驗證。

int mod_verify_sig(const void *mod, unsigned long *_modlen)
{
 struct module_signature ms;
 size_t modlen = *_modlen, sig_len;

 pr_devel("== >%s(,%zu)\\n", __func__, modlen);

 if (modlen <= sizeof(ms))
  return -EBADMSG;

 memcpy(&ms, mod + (modlen - sizeof(ms)), sizeof(ms));
 modlen -= sizeof(ms);

 sig_len = be32_to_cpu(ms.sig_len);
 if (sig_len >= modlen)
  return -EBADMSG;
 modlen -= sig_len;
 *_modlen = modlen;

 if (ms.id_type != PKEY_ID_PKCS7) {
  pr_err("Module is not signed with expected PKCS#7 message\\n");
  return -ENOPKG;
 }

 if (ms.algo != 0 ||
     ms.hash != 0 ||
     ms.signer_len != 0 ||
     ms.key_id_len != 0 ||
     ms.__pad[0] != 0 ||
     ms.__pad[1] != 0 ||
     ms.__pad[2] != 0) {
  pr_err("PKCS#7 signature info has unexpected non-zero params\\n");
  return -EBADMSG;
 }

 return verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
          NULL, VERIFYING_MODULE_SIGNATURE,
          NULL, NULL);
}

elf_header_check()函數(shù)檢查elf文件頭，以及文件類型,架構以及節(jié)區(qū)大小是否設置正確，檢查節(jié)區(qū)的偏移地址

static int elf_header_check(struct load_info *info)
{
 if (info- >len < sizeof(*(info- >hdr)))
  return -ENOEXEC;

 if (memcmp(info- >hdr- >e_ident, ELFMAG, SELFMAG) != 0
     || info- >hdr- >e_type != ET_REL
     || !elf_check_arch(info- >hdr)
     || info- >hdr- >e_shentsize != sizeof(Elf_Shdr))
  return -ENOEXEC;

 if (info- >hdr- >e_shoff >= info- >len
     || (info- >hdr- >e_shnum * sizeof(Elf_Shdr) >
  info- >len - info- >hdr- >e_shoff))
  return -ENOEXEC;

 return 0;
}

layout_and_allocate()函數(shù)調用setup_load_info()函數(shù)初始化load_info結構體變量info，調用blacklisted()函數(shù)檢查模塊名字字符串是否在模塊加載黑名單中，調用check_modinfo()函數(shù)檢查modinfo節(jié)區(qū)信息，module_frob_arch_sections()函數(shù)在arm32架構下為空，調用find_sec()函數(shù)為.data..ro_after_init節(jié)區(qū)段加上ro_after_init屬性，調用layout_sections()函數(shù)計算模塊內存ELF節(jié)區(qū)最終需要的內存大小和總大小，并記錄到core_layout/init_layout中，調用layout_symtab()函數(shù)在init_layout為靜態(tài)鏈接符號表,core_layout為核心符號表預留空間，調用move_module()函數(shù)分配模塊內存布局，復制模塊二進制代碼到真正運行時內存，修復所有模塊內存ELF對應節(jié)區(qū)頭部表指向內存布局，切換模塊的struct module結構體變量mod指向最終模塊內存布局中的位置，調用kmemleak_load_module()函數(shù)掃描檢查各個節(jié)區(qū)的內存分布。

static struct module *layout_and_allocate(struct load_info *info, int flags)
{
 /* Module within temporary copy. */
 struct module *mod;
 unsigned int ndx;
 int err;

 mod = setup_load_info(info, flags);
 if (IS_ERR(mod))
  return mod;

 if (blacklisted(info- >name))
  return ERR_PTR(-EPERM);

 err = check_modinfo(mod, info, flags);
 if (err)
  return ERR_PTR(err);

 /* Allow arches to frob section contents and sizes.  */
 err = module_frob_arch_sections(info- >hdr, info- >sechdrs,
     info- >secstrings, mod);
 if (err < 0)
  return ERR_PTR(err);

 /* We will do a special allocation for per-cpu sections later. */
 info- >sechdrs[info- >index.pcpu].sh_flags &= ~(unsigned long)SHF_ALLOC;

 /*
  * Mark ro_after_init section with SHF_RO_AFTER_INIT so that
  * layout_sections() can put it in the right place.
  * Note: ro_after_init sections also have SHF_{WRITE,ALLOC} set.
  */
 ndx = find_sec(info, ".data..ro_after_init");
 if (ndx)
  info- >sechdrs[ndx].sh_flags |= SHF_RO_AFTER_INIT;

 /* Determine total sizes, and put offsets in sh_entsize.  For now
    this is done generically; there doesn't appear to be any
    special cases for the architectures. */
 layout_sections(mod, info);
 layout_symtab(mod, info);

 /* Allocate and move to the final place */
 err = move_module(mod, info);
 if (err)
  return ERR_PTR(err);

 /* Module has been copied to its final place now: return it. */
 mod = (void *)info- >sechdrs[info- >index.mod].sh_addr;
 kmemleak_load_module(mod, info);
 return mod;
}

add_unformed_module()函數(shù)調用find_module_all()函數(shù)遍歷內核中的所有模塊檢查是否有同名模塊已經存在或正在加載，最后調用mod_update_bounds()函數(shù)更新內核已有模塊的地址范圍邊界。

static int add_unformed_module(struct module *mod)
{
 int err;
 struct module *old;

 mod- >state = MODULE_STATE_UNFORMED;

again:
 mutex_lock(&module_mutex);
 old = find_module_all(mod- >name, strlen(mod- >name), true);
 if (old != NULL) {
  if (old- >state != MODULE_STATE_LIVE) {
   /* Wait in case it fails to load. */
   mutex_unlock(&module_mutex);
   err = wait_event_interruptible(module_wq,
            finished_loading(mod- >name));
   if (err)
    goto out_unlocked;
   goto again;
  }
  err = -EEXIST;
  goto out;
 }
 mod_update_bounds(mod);
 list_add_rcu(&mod- >list, &modules);
 mod_tree_insert(mod);
 err = 0;

out:
 mutex_unlock(&module_mutex);
out_unlocked:
 return err;
}

未完待續(xù)。。。。。。

總結

本篇主要介紹了load_module()函數(shù)的前半部分實現(xiàn)，主要是模塊的簽名驗簽和拷貝模塊到真正運行時內存。