Ard Biesheuvel
6b995f5a54
Instead of having a special case in the core kernel's module loader that treats a module called 'fips140.ko' in a special way, use a host tool to tweak the ELF metadata of this module so that the RELA data is preserved and accessible to the module init code. This is done in the following way: - each RELA section that we care about (the ones for .text and .rodata at the moment) is copied into a new section called .init.rela.<name> with the SHF_ALLOC attribute, so that the module loader will copy it into __init memory at load time; - for each such section, an offset/count tuple is added as a global variable to the module; - the count field of those tuples is populated directly by the host tool based on the actual size of the RELA section in question; - the offset field is decorated with a place-relative relocation against the start of the copied RELA section via a weak symbol reference, which causes an entry to be emitted into the ELF symbol table; - these ELF symbol table entries are updated by the host tool and turned into STT_SECTION type symbols with STB_GLOBAL linkage, carrying the correct section index. With these changes in place, the unmodified module loader will load all required information into memory in a way that permits the module init code to locate the relocations, and apply them in reverse. Bug: 153614920 Bug: 188620248 Change-Id: I07d9704febdf913834502dd09c19aa4a04d983b1 Signed-off-by: Ard Biesheuvel <ardb@google.com> (cherry picked from commit 502af6e3490d3ed51cf2131306303445b0d56579)
49 lines
1.4 KiB
Makefile
49 lines
1.4 KiB
Makefile
# SPDX-License-Identifier: GPL-2.0
|
|
|
|
#
|
|
# This file is included by the generic Kbuild makefile to permit the
|
|
# architecture to perform postlink actions on vmlinux and any .ko module file.
|
|
# In this case, we only need it for fips140.ko, which needs some postprocessing
|
|
# for the integrity check mandated by FIPS. This involves making copies of the
|
|
# relocation sections so that the module will have access to them at
|
|
# initialization time, and calculating and injecting a HMAC digest into the
|
|
# module. All other targets are NOPs.
|
|
#
|
|
|
|
PHONY := __archpost
|
|
__archpost:
|
|
|
|
-include include/config/auto.conf
|
|
include scripts/Kbuild.include
|
|
|
|
CMD_FIPS140_GEN_HMAC = crypto/fips140_gen_hmac
|
|
quiet_cmd_gen_hmac = HMAC $@
|
|
cmd_gen_hmac = $(OBJCOPY) $@ \
|
|
--dump-section=$(shell $(READELF) -SW $@|grep -Eo '\.rela\.text\S*')=$@.rela.text \
|
|
--dump-section=$(shell $(READELF) -SW $@|grep -Eo '\.rela\.rodata\S*')=$@.rela.rodata \
|
|
--add-section=.init.rela.text=$@.rela.text \
|
|
--add-section=.init.rela.rodata=$@.rela.rodata \
|
|
--set-section-flags=.init.rela.text=alloc,readonly \
|
|
--set-section-flags=.init.rela.rodata=alloc,readonly && \
|
|
$(CMD_FIPS140_GEN_HMAC) $@
|
|
|
|
# `@true` prevents complaints when there is nothing to be done
|
|
|
|
vmlinux: FORCE
|
|
@true
|
|
|
|
$(objtree)/crypto/fips140.ko: FORCE
|
|
$(call cmd,gen_hmac)
|
|
|
|
%.ko: FORCE
|
|
@true
|
|
|
|
clean:
|
|
rm -f $(objtree)/crypto/fips140.ko.rela.*
|
|
|
|
PHONY += FORCE clean
|
|
|
|
FORCE:
|
|
|
|
.PHONY: $(PHONY)
|