diff --git a/android/abi_gki_modules_exports b/android/abi_gki_modules_exports deleted file mode 100644 index 88b5a4b3adce..000000000000 --- a/android/abi_gki_modules_exports +++ /dev/null @@ -1 +0,0 @@ -[abi_symbol_list] diff --git a/android/abi_gki_modules_protected b/android/abi_gki_modules_protected deleted file mode 100644 index 88b5a4b3adce..000000000000 --- a/android/abi_gki_modules_protected +++ /dev/null @@ -1 +0,0 @@ -[abi_symbol_list] diff --git a/arch/arm64/configs/gki_defconfig b/arch/arm64/configs/gki_defconfig index e5e76ae4c559..bfc6c9a5edb8 100644 --- a/arch/arm64/configs/gki_defconfig +++ b/arch/arm64/configs/gki_defconfig @@ -81,8 +81,6 @@ CONFIG_SHADOW_CALL_STACK=y CONFIG_MODULES=y CONFIG_MODULE_UNLOAD=y CONFIG_MODVERSIONS=y -CONFIG_MODULE_SIG=y -CONFIG_MODULE_SIG_PROTECT=y CONFIG_BLK_DEV_ZONED=y CONFIG_BLK_INLINE_ENCRYPTION=y CONFIG_BLK_INLINE_ENCRYPTION_FALLBACK=y diff --git a/arch/x86/configs/gki_defconfig b/arch/x86/configs/gki_defconfig index 7ecc97dfb518..b566102368aa 100644 --- a/arch/x86/configs/gki_defconfig +++ b/arch/x86/configs/gki_defconfig @@ -71,8 +71,6 @@ CONFIG_JUMP_LABEL=y CONFIG_MODULES=y CONFIG_MODULE_UNLOAD=y CONFIG_MODVERSIONS=y -CONFIG_MODULE_SIG=y -CONFIG_MODULE_SIG_PROTECT=y CONFIG_BLK_DEV_ZONED=y CONFIG_BLK_INLINE_ENCRYPTION=y CONFIG_BLK_INLINE_ENCRYPTION_FALLBACK=y diff --git a/kernel/Makefile b/kernel/Makefile index fe1b6341e0a4..318789c728d3 100644 --- a/kernel/Makefile +++ b/kernel/Makefile @@ -67,7 +67,6 @@ obj-y += up.o endif obj-$(CONFIG_UID16) += uid16.o obj-$(CONFIG_MODULE_SIG_FORMAT) += module_signature.o -obj-$(CONFIG_MODULE_SIG_PROTECT) += gki_module.o obj-$(CONFIG_KALLSYMS) += kallsyms.o obj-$(CONFIG_BSD_PROCESS_ACCT) += acct.o obj-$(CONFIG_CRASH_CORE) += crash_core.o @@ -159,19 +158,3 @@ $(obj)/kheaders_data.tar.xz: FORCE $(call cmd,genikh) clean-files := kheaders_data.tar.xz kheaders.md5 - -# -# ANDROID: GKI: Generate headerfiles required for gki_module.o -# -# Dependencies on generated files need to be listed explicitly -$(obj)/gki_module.o: $(obj)/gki_module_protected.h $(obj)/gki_module_exported.h - -$(obj)/gki_module_protected.h: $(srctree)/android/abi_gki_modules_protected \ - $(srctree)/scripts/gen_gki_modules_headers.sh - $(Q)$(CONFIG_SHELL) $(srctree)/scripts/gen_gki_modules_headers.sh $@ \ - "$(srctree)" - -$(obj)/gki_module_exported.h: $(srctree)/android/abi_gki_modules_exports \ - $(srctree)/scripts/gen_gki_modules_headers.sh - $(Q)$(CONFIG_SHELL) $(srctree)/scripts/gen_gki_modules_headers.sh $@ \ - "$(srctree)" diff --git a/kernel/gki_module.c b/kernel/gki_module.c deleted file mode 100644 index 24651dfc34f8..000000000000 --- a/kernel/gki_module.c +++ /dev/null @@ -1,50 +0,0 @@ -// SPDX-License-Identifier: GPL-2.0-only -/* - * Copyright 2021 Google LLC - * Author: ramjiyani@google.com (Ramji Jiyani) - */ - -#include -#include -#include -#include -#include - -/* - * Build time generated header files - * - * gki_module_exported.h -- Symbols protected from _export_ by unsigned modules - * gki_module_protected.h -- Symbols protected from _access_ by unsigned modules - */ -#include "gki_module_protected.h" -#include "gki_module_exported.h" - -#define MAX_STRCMP_LEN (max(MAX_PROTECTED_NAME_LEN, MAX_EXPORTED_NAME_LEN)) - -/* bsearch() comparision callback */ -static int cmp_name(const void *sym, const void *protected_sym) -{ - return strncmp(sym, protected_sym, MAX_STRCMP_LEN); -} - -/** - * gki_is_module_protected_symbol - Is a symbol protected from unsigned module? - * - * @name: Symbol being checked against protection from unsigned module - */ -bool gki_is_module_protected_symbol(const char *name) -{ - return bsearch(name, gki_protected_symbols, NO_OF_PROTECTED_SYMBOLS, - MAX_PROTECTED_NAME_LEN, cmp_name) != NULL; -} - -/** - * gki_is_module_exported_symbol - Is a symbol exported from a GKI module? - * - * @name: Symbol being checked against exported symbols from GKI modules - */ -bool gki_is_module_exported_symbol(const char *name) -{ - return bsearch(name, gki_exported_symbols, NO_OF_EXPORTED_SYMBOLS, - MAX_EXPORTED_NAME_LEN, cmp_name) != NULL; -} diff --git a/kernel/module/internal.h b/kernel/module/internal.h index ba60aaebab34..2e2bf236f558 100644 --- a/kernel/module/internal.h +++ b/kernel/module/internal.h @@ -303,17 +303,3 @@ static inline int same_magic(const char *amagic, const char *bmagic, bool has_cr return strcmp(amagic, bmagic) == 0; } #endif /* CONFIG_MODVERSIONS */ - -#ifdef CONFIG_MODULE_SIG_PROTECT -extern bool gki_is_module_exported_symbol(const char *name); -extern bool gki_is_module_protected_symbol(const char *name); -#else -static inline bool gki_is_module_exported_symbol(const char *name) -{ - return 0; -} -static inline bool gki_is_module_protected_symbol(const char *name) -{ - return 0; -} -#endif /* CONFIG_MODULE_SIG_PROTECT */ diff --git a/kernel/module/main.c b/kernel/module/main.c index c1b5a2760821..d02d39c7174e 100644 --- a/kernel/module/main.c +++ b/kernel/module/main.c @@ -1247,14 +1247,6 @@ static int verify_exported_symbols(struct module *mod) .name = kernel_symbol_name(s), .gplok = true, }; - - if (!mod->sig_ok && gki_is_module_exported_symbol( - kernel_symbol_name(s))) { - pr_err("%s: exporting protected symbol(%s)\n", - mod->name, kernel_symbol_name(s)); - return -EACCES; - } - if (find_symbol(&fsa)) { pr_err("%s: exports duplicate symbol %s" " (owned by %s)\n", @@ -1322,13 +1314,6 @@ static int simplify_symbols(struct module *mod, const struct load_info *info) break; case SHN_UNDEF: - if (!mod->sig_ok && - gki_is_module_protected_symbol(name)) { - pr_err("%s: is not an Android GKI signed module. It can not access protected symbol: %s\n", - mod->name, name); - return -EACCES; - } - ksym = resolve_symbol_wait(mod, info, name); /* Ok if resolved. */ if (ksym && !IS_ERR(ksym)) { @@ -2764,8 +2749,6 @@ static int load_module(struct load_info *info, const char __user *uargs, "kernel\n", mod->name); add_taint_module(mod, TAINT_UNSIGNED_MODULE, LOCKDEP_STILL_OK); } -#else - mod->sig_ok = 0; #endif /* To avoid stressing percpu allocator, do this once we're unique. */