Skip to content

Commit d00a137

Browse files
lealem47lealem47
authored
Merge pull request wolfSSL#10344 from douzzer/20260416-linuxkm-fips-rodata-canonify
20260416-linuxkm-fips-rodata-canonify
2 parents a057975 + 5dbf2e7 commit d00a137

16 files changed

Lines changed: 627 additions & 328 deletions

‎linuxkm/Kbuild‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -118,11 +118,11 @@ ifeq "$(ENABLED_LINUXKM_PIE)" "yes"
118118
ifndef NO_PIE_FLAG
119119
ifeq ($(KERNEL_ARCH),arm)
120120
ifeq ($(intcmp $(VERSION),5,1,0,0),1)
121-
NO_PIE_FLAG :=
121+
NO_PIE_FLAG := 1
122122
$(info Note: disabling -fPIE to avoid R_ARM_REL32 on pre-5.11 target kernel.)
123123
else
124124
ifeq ($(intcmp $(VERSION),5,0,1,0)-$(intcmp $(PATCHLEVEL),11,1,0,0),1-1)
125-
NO_PIE_FLAG :=
125+
NO_PIE_FLAG := 1
126126
$(info Note: disabling -fPIE to avoid R_ARM_REL32 on pre-5.11 target kernel.)
127127
endif
128128
endif

‎linuxkm/Makefile‎

Lines changed: 41 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -157,30 +157,48 @@ GENERATE_SECTION_MAP := $(AWK) 'BEGIN { printf("") >ENVIRON["SECTION_MAP"]; } \
157157
}'
158158

159159
GENERATE_RELOC_TAB := $(AWK) ' \
160-
BEGIN { \
161-
n=0; \
160+
function open_seg(seg) { \
161+
seen_seg[seg] = 1; \
162+
printf("%s\n ", \
163+
"WOLFSSL_LOCAL const struct wc_reloc_table_ent wc_linuxkm_pie_" seg "_reloc_tab[] = { "); \
164+
cur_seg = seg; \
165+
} \
166+
function close_cur_seg() { \
167+
print " { .offset = ~0U, .dest_offset = ~0U, .dest_addend = 0, .dest_segment = WC_R_SEG_NONE, .reloc_type = WC_R_NONE } };"; \
168+
print "WOLFSSL_LOCAL const unsigned int wc_linuxkm_pie_" cur_seg "_reloc_tab_length = (unsigned int)(sizeof wc_linuxkm_pie_" cur_seg "_reloc_tab / sizeof wc_linuxkm_pie_" cur_seg "_reloc_tab[0]);"; \
169+
cur_seg = ""; \
170+
} \
171+
BEGIN { \
162172
bad_relocs=0; \
163173
print "\#include <wolfssl/wolfcrypt/libwolfssl_sources.h>"; \
164174
print "\#include <wolfssl/wolfcrypt/memory.h>"; \
165-
printf("%s\n ", \
166-
"WOLFSSL_LOCAL const struct wc_reloc_table_ent wc_linuxkm_pie_reloc_tab[] = { "); \
175+
print ""; \
167176
if ("SECTION_MAP" in ENVIRON) { \
168177
while (getline <ENVIRON["SECTION_MAP"] > 0) \
169178
section_map[$$1] = $$2; \
170179
close(ENVIRON["SECTION_MAP"]); \
171180
} \
172181
} \
173-
/^Relocation section '\''\.rela?\.text_wolfcrypt'\''/ { \
174-
p=1; \
175-
next; \
176-
} \
182+
\
177183
/^Relocation section/ { \
178-
p=0; \
184+
if (cur_seg) { \
185+
close_cur_seg(); \
186+
} \
187+
{ \
188+
if (match($$0, "^Relocation section '\''\\.rela?\\.(text|rodata)_wolfcrypt'\''", a)) {\
189+
open_seg(a[1]); \
190+
next; \
191+
} \
192+
} \
193+
} \
194+
\
195+
{ \
196+
if (! cur_seg) \
197+
next; \
179198
} \
180199
/^0/ { \
181-
if (p) { \
182-
if ($$3 !~ "^(R_X86_64_PLT32|R_X86_64_PC32|R_AARCH64_.*|R_ARM.*)$$") { \
183-
print "Unexpected relocation type:\n" $$0 >"/dev/stderr"; \
200+
if ($$3 !~ "^(R_X86_.*|R_AARCH64_.*|R_ARM.*)$$") { \
201+
print "Unexpected relocation type in " cur_seg ":\n" $$0 >"/dev/stderr"; \
184202
++bad_relocs; \
185203
} \
186204
if ($$5 in section_map) \
@@ -224,15 +242,22 @@ GENERATE_RELOC_TAB := $(AWK) ' \
224242
strtonum("0x" $$4), \
225243
$$6 strtonum("0x" $$7), \
226244
section_tag, reloc_type); \
227-
} \
228245
} \
229246
END { \
247+
if (cur_seg) { \
248+
close_cur_seg(); \
249+
} \
250+
n = split("text rodata", segs, " "); \
251+
for (i = 1; i <= n; ++i) { \
252+
if (! (segs[i] in seen_seg)) { \
253+
open_seg(segs[i]); \
254+
close_cur_seg(); \
255+
} \
256+
} \
230257
if (bad_relocs) { \
231258
print "Found " bad_relocs " unresolvable relocations." >"/dev/stderr"; \
232259
exit(1); \
233260
} \
234-
print " { .offset = ~0U, .dest_offset = ~0U, .dest_addend = 0, .dest_segment = WC_R_SEG_NONE, .reloc_type = WC_R_NONE } };"; \
235-
print "WOLFSSL_LOCAL const unsigned int wc_linuxkm_pie_reloc_tab_length = (unsigned int)(sizeof wc_linuxkm_pie_reloc_tab / sizeof wc_linuxkm_pie_reloc_tab[0]);"; \
236261
}'
237262

238263
ifeq "$(V)" "1"
@@ -384,7 +409,7 @@ $(MODULE_TOP)/libwolfssl-user-build/src/.libs/libwolfssl.so: $(LIBWOLFSSL_NAME).
384409
@ echo 'Using existing Makefile for libwolfssl.so.'
385410
@else
386411
@ echo -n 'Configuring user libwolfssl.so...'
387-
@ $(FRESH_ENV) ./configure $(QFLAG) $(VFLAG) --disable-jobserver --enable-cryptonly --enable-fips="$$FIPS_FLAVOR" CFLAGS='-DWC_SYM_RELOC_TABLES_SUPPORT -DWOLFCRYPT_FIPS_CORE_DYNAMIC_HASH_VALUE -DWOLFSSL_USER_SETTINGS -DWOLFSSL_USER_SETTINGS_ASM' $(if $(HOSTCC),CC='$(HOSTCC)')
412+
@ $(FRESH_ENV) ./configure $(QFLAG) $(VFLAG) --disable-jobserver --enable-cryptonly --enable-fips="$$FIPS_FLAVOR" CFLAGS='-DWC_SYM_RELOC_TABLES_SUPPORT -DWOLFCRYPT_FIPS_CORE_DYNAMIC_HASH_VALUE -DWOLFSSL_USER_SETTINGS -DWOLFSSL_USER_SETTINGS_ASM -DDEBUG_LINUXKM_PIE_SUPPORT' $(if $(HOSTCC),CC='$(HOSTCC)')
388413
@ echo ' done.'
389414
@fi
390415
@echo -n 'Building user libwolfssl.so...'

‎linuxkm/linuxkm-fips-hash-wrapper.sh‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -48,15 +48,19 @@ fi
4848
# shellcheck disable=SC2016 # using $AWK instead of awk confuses shellcheck.
4949
readarray -t fenceposts < <(readelf --wide --sections --symbols "$mod_path" | "$AWK" '
5050
BEGIN {
51-
fips_fenceposts["wc_linuxkm_pie_reloc_tab"] = "reloc_tab_start";
52-
fips_fenceposts["wc_linuxkm_pie_reloc_tab_length"] = "reloc_tab_len_start";
51+
fips_fenceposts["wc_linuxkm_pie_text_reloc_tab"] = "text_reloc_tab.start";
52+
fips_fenceposts["wc_linuxkm_pie_text_reloc_tab_length"] = "text_reloc_tab.len_start";
53+
fips_fenceposts["wc_linuxkm_pie_rodata_reloc_tab"] = "rodata_reloc_tab.start";
54+
fips_fenceposts["wc_linuxkm_pie_rodata_reloc_tab_length"] = "rodata_reloc_tab.len_start";
5355
fips_fenceposts["verifyCore"] = "verifyCore_start";
5456
fips_fenceposts["wolfCrypt_FIPS_first"] = "fips_text_start";
5557
fips_fenceposts["wolfCrypt_FIPS_last"] = "fips_text_end";
5658
fips_fenceposts["wolfCrypt_FIPS_ro_start"] = "fips_rodata_start";
5759
fips_fenceposts["wolfCrypt_FIPS_ro_end"] = "fips_rodata_end";
58-
singleton_ends["wc_linuxkm_pie_reloc_tab"] = "reloc_tab_end";
59-
singleton_ends["wc_linuxkm_pie_reloc_tab_length"] = "reloc_tab_len_end";
60+
singleton_ends["wc_linuxkm_pie_text_reloc_tab"] = "text_reloc_tab.end";
61+
singleton_ends["wc_linuxkm_pie_text_reloc_tab_length"] = "text_reloc_tab.len_end";
62+
singleton_ends["wc_linuxkm_pie_rodata_reloc_tab"] = "rodata_reloc_tab.end";
63+
singleton_ends["wc_linuxkm_pie_rodata_reloc_tab_length"] = "rodata_reloc_tab.len_end";
6064
singleton_ends["verifyCore"] = "verifyCore_end";
6165
}
6266

‎linuxkm/linuxkm-fips-hash.c‎

Lines changed: 41 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -104,10 +104,14 @@ int main(int argc, char **argv)
104104
.val = FENCEPOST_OPT_FLAG | offsetof(typeof(seg_map), x) }
105105
FENCEPOST_OPT(text_start),
106106
FENCEPOST_OPT(text_end),
107-
FENCEPOST_OPT(reloc_tab_start),
108-
FENCEPOST_OPT(reloc_tab_end),
109-
FENCEPOST_OPT(reloc_tab_len_start),
110-
FENCEPOST_OPT(reloc_tab_len_end),
107+
FENCEPOST_OPT(text_reloc_tab.start),
108+
FENCEPOST_OPT(text_reloc_tab.end),
109+
FENCEPOST_OPT(text_reloc_tab.len_start),
110+
FENCEPOST_OPT(text_reloc_tab.len_end),
111+
FENCEPOST_OPT(rodata_reloc_tab.start),
112+
FENCEPOST_OPT(rodata_reloc_tab.end),
113+
FENCEPOST_OPT(rodata_reloc_tab.len_start),
114+
FENCEPOST_OPT(rodata_reloc_tab.len_end),
111115
FENCEPOST_OPT(fips_text_start),
112116
FENCEPOST_OPT(fips_text_end),
113117
FENCEPOST_OPT(rodata_start),
@@ -228,10 +232,14 @@ int main(int argc, char **argv)
228232

229233
if ((seg_map.text_start == ~0UL) ||
230234
(seg_map.text_end == ~0UL) ||
231-
(seg_map.reloc_tab_start == ~0UL) ||
232-
(seg_map.reloc_tab_end == ~0UL) ||
233-
(seg_map.reloc_tab_len_start == ~0UL) ||
234-
(seg_map.reloc_tab_len_end == ~0UL) ||
235+
(seg_map.text_reloc_tab.start == ~0UL) ||
236+
(seg_map.text_reloc_tab.end == ~0UL) ||
237+
(seg_map.text_reloc_tab.len_start == ~0UL) ||
238+
(seg_map.text_reloc_tab.len_end == ~0UL) ||
239+
(seg_map.rodata_reloc_tab.start == ~0UL) ||
240+
(seg_map.rodata_reloc_tab.end == ~0UL) ||
241+
(seg_map.rodata_reloc_tab.len_start == ~0UL) ||
242+
(seg_map.rodata_reloc_tab.len_end == ~0UL) ||
235243
(seg_map.fips_text_start == ~0UL) ||
236244
(seg_map.fips_text_end == ~0UL) ||
237245
(seg_map.rodata_start == ~0UL) ||
@@ -267,12 +275,23 @@ int main(int argc, char **argv)
267275
exit(1);
268276
}
269277

270-
if ((seg_map.reloc_tab_start >= seg_map.reloc_tab_end) ||
271-
(seg_map.reloc_tab_end >= (unsigned long)st.st_size) ||
272-
(seg_map.reloc_tab_len_start >= seg_map.reloc_tab_len_end) ||
273-
(seg_map.reloc_tab_len_end >= (unsigned long)st.st_size))
278+
if ((seg_map.text_reloc_tab.start >= seg_map.text_reloc_tab.end) ||
279+
(seg_map.text_reloc_tab.end >= (unsigned long)st.st_size) ||
280+
(seg_map.text_reloc_tab.len_start >= seg_map.text_reloc_tab.len_end) ||
281+
(seg_map.text_reloc_tab.len_end >= (unsigned long)st.st_size))
274282
{
275-
fprintf(stderr, "%s: supplied reloc_tab fencepost(s) are out of bounds "
283+
fprintf(stderr, "%s: supplied text_reloc_tab fencepost(s) are out of bounds "
284+
"for supplied module %s with length %lu.\n",
285+
progname, mod_path, (unsigned long)st.st_size);
286+
exit(1);
287+
}
288+
289+
if ((seg_map.rodata_reloc_tab.start >= seg_map.rodata_reloc_tab.end) ||
290+
(seg_map.rodata_reloc_tab.end >= (unsigned long)st.st_size) ||
291+
(seg_map.rodata_reloc_tab.len_start >= seg_map.rodata_reloc_tab.len_end) ||
292+
(seg_map.rodata_reloc_tab.len_end >= (unsigned long)st.st_size))
293+
{
294+
fprintf(stderr, "%s: supplied rodata_reloc_tab fencepost(s) are out of bounds "
276295
"for supplied module %s with length %lu.\n",
277296
progname, mod_path, (unsigned long)st.st_size);
278297
exit(1);
@@ -291,10 +310,15 @@ int main(int argc, char **argv)
291310
seg_map.start = (unsigned long)mod_map;
292311
seg_map.end = (unsigned long)mod_map + st.st_size;
293312

294-
seg_map.reloc_tab_start += (unsigned long)mod_map;
295-
seg_map.reloc_tab_end += (unsigned long)mod_map;
296-
seg_map.reloc_tab_len_start += (unsigned long)mod_map;
297-
seg_map.reloc_tab_len_end += (unsigned long)mod_map;
313+
seg_map.text_reloc_tab.start += (unsigned long)mod_map;
314+
seg_map.text_reloc_tab.end += (unsigned long)mod_map;
315+
seg_map.text_reloc_tab.len_start += (unsigned long)mod_map;
316+
seg_map.text_reloc_tab.len_end += (unsigned long)mod_map;
317+
318+
seg_map.rodata_reloc_tab.start += (unsigned long)mod_map;
319+
seg_map.rodata_reloc_tab.end += (unsigned long)mod_map;
320+
seg_map.rodata_reloc_tab.len_start += (unsigned long)mod_map;
321+
seg_map.rodata_reloc_tab.len_end += (unsigned long)mod_map;
298322

299323
seg_map.verifyCore_start += (unsigned long)mod_map;
300324
seg_map.verifyCore_end += (unsigned long)mod_map;

0 commit comments

Comments
 (0)