2121.ONESHELL :
2222SHELL =bash
2323
24- all : libwolfssl.ko libwolfssl.ko.signed
24+ ifeq "$(quiet ) " "silent_"
25+ QFLAG := --quiet
26+ else ifeq "$(V)" "1"
27+ VFLAG := --verbose
28+ else
29+ QFLAG := --quiet
30+ endif
31+
32+ ifndef LIBWOLFSSL_NAME
33+ LIBWOLFSSL_NAME := libwolfssl
34+ endif
35+
36+ all : $(LIBWOLFSSL_NAME ) .ko $(LIBWOLFSSL_NAME ) .ko.signed
2537
2638ifndef MODULE_TOP
2739 MODULE_TOP =$(CURDIR )
@@ -147,8 +159,9 @@ GENERATE_RELOC_TAB := $(AWK) ' \
147159 n=0; \
148160 bad_relocs=0; \
149161 print "\# include <wolfssl/wolfcrypt/libwolfssl_sources.h>"; \
162+ print "\#include <wolfssl/wolfcrypt/memory.h>"; \
150163 printf("%s\n ", \
151- "WOLFSSL_LOCAL const struct wc_linuxkm_pie_reloc_tab_ent wc_linuxkm_pie_reloc_tab[] = { "); \
164+ "WOLFSSL_LOCAL const struct wc_reloc_table_ent wc_linuxkm_pie_reloc_tab[] = { "); \
152165 if ("SECTION_MAP" in ENVIRON) { \
153166 while (getline <ENVIRON["SECTION_MAP"] > 0) \
154167 section_map[$$1] = $$2; \
@@ -204,8 +217,10 @@ GENERATE_RELOC_TAB := $(AWK) ' \
204217 print >"/dev/stderr"; \
205218 exit(1); \
206219 } \
207- printf(" { .offset = 0x%xU, .dest_segment = %s, .reloc_type = WC_%s },\n", \
208- strtonum("0x" gensub("^0*","",1,$$1)), \
220+ printf(" { .offset = 0x%xU, .dest_offset = 0x%xU, .dest_addend = %+d, .dest_segment = %s, .reloc_type = WC_%s },\n", \
221+ strtonum("0x" $$1), \
222+ strtonum("0x" $$4), \
223+ $$6 strtonum("0x" $$7), \
209224 section_tag, reloc_type); \
210225 } \
211226 } \
@@ -214,8 +229,8 @@ GENERATE_RELOC_TAB := $(AWK) ' \
214229 print "Found " bad_relocs " unresolvable relocations." >"/dev/stderr"; \
215230 exit(1); \
216231 } \
217- print " { .offset = ~0U, .dest_segment = WC_R_SEG_NONE, .reloc_type = WC_R_NONE } };"; \
218- print "WOLFSSL_LOCAL const unsigned long wc_linuxkm_pie_reloc_tab_length = sizeof wc_linuxkm_pie_reloc_tab / sizeof wc_linuxkm_pie_reloc_tab[0];"; \
232+ print " { .offset = ~0U, .dest_offset = ~0U, .dest_addend = 0, . dest_segment = WC_R_SEG_NONE, .reloc_type = WC_R_NONE } };"; \
233+ print "WOLFSSL_LOCAL const unsigned int wc_linuxkm_pie_reloc_tab_length = (unsigned int)( sizeof wc_linuxkm_pie_reloc_tab / sizeof wc_linuxkm_pie_reloc_tab[0]) ;"; \
219234 }'
220235
221236ifeq "$(V ) " "1"
@@ -225,8 +240,8 @@ endif
225240# This rule is .PHONY because it doesn't actually build the module -- Kbuild
226241# does, and we always need to call Kbuild to enforce rebuild for dependencies
227242# and config changes.
228- .PHONY : libwolfssl .ko
229- libwolfssl .ko
243+ .PHONY : $( LIBWOLFSSL_NAME )
244+ $( LIBWOLFSSL_NAME )
230245 @set -e
231246 @[[ ' $(V)' == 1 ]] && { echo ' MODULE_TOP = "$(MODULE_TOP)"' ;
232247 echo ' SRC_TOP = "$(SRC_TOP)"' ;
303318endif
304319
305320.PHONY : module-update-fips-hash
306- module-update-fips-hash : libwolfssl .ko
321+ module-update-fips-hash : $( LIBWOLFSSL_NAME )
307322 @set -e
308323 @if test -z ' $(FIPS_HASH)' ; then echo ' $$FIPS_HASH is unset' >&2 ; exit 1; fi
309324 @if [[ ! ' $(FIPS_HASH)' =~ [0-9a-fA-F]{64} ]]; then echo ' $$FIPS_HASH is malformed' >&2 ; exit 1; fi
@@ -320,9 +335,65 @@ module-update-fips-hash: libwolfssl.ko
320335 if [[ ' $(FIPS_HASH)' == " $$ current_verifyCore" ; then echo ' Supplied FIPS_HASH matches existing verifyCore -- no update needed.' ; exit 0; fi ; \
321336 echo -n ' $(FIPS_HASH)' | dd bs=1 conv=notrunc of=" $<" $$ verifyCore_offset count=64 status=none && \
322337 echo " FIPS verifyCore updated successfully." && \
323- if [[ -f libwolfssl.ko.signed ]]; then $( MAKE) . libwolfssl.ko.signed; fi
338+ if [[ -f '$(LIBWOLFSSL_NAME).ko.signed' ]]; then $(MAKE) -C . '$(LIBWOLFSSL_NAME).ko.signed'; fi
339+
340+
341+ # linuxkm-fips-hash implements offline (no-load) FIPS hash calculation and graft-in.
342+ #
343+ # libwolfssl.so is built from the same sources as the kernel module, with the
344+ # same FIPS setting, then used with linuxkm-fips-hash to calculate and overwrite
345+ # the hash in libwolfssl.ko. Finally, the module is [re]signed.
346+ #
347+ # Note that libwolfssl.so has to be built from a hierarchy of symlinks, to avoid
348+ # depending on changes/config in the source directory. Also, aside from
349+ # FIPS_FLAVOR, inherited configuration settings in the environment are cleansed.
350+
351+ libwolfssl-user-build/src/.libs/libwolfssl.so :
352+ @set -e
353+ @$(RM ) -rf ' $(MODULE_TOP)/libwolfssl-user-build'
354+ @mkdir ' $(MODULE_TOP)/libwolfssl-user-build'
355+ @cd ' $(MODULE_TOP)/libwolfssl-user-build'
356+ @pushd ' $(SRC_TOP)' > /dev/null
357+ @echo -n ' Populating tree of symlinks...'
358+ @readarray -d ' ' < <( find examples src support tests testsuite wolfcrypt wolfssl configure * .in build-aux debian rpm scripts certs doc mcapi cmake linuxkm/* .[ch] \( -name options.h -o -name user_settings\* \) -prune -o \( ! -type d \) \( -name ' *.[chsSi]' ' *.in' \* .sh -o -path support/\* -o -path build-aux/\* -o -path debian/\* -o -path rpm/\* -o -path scripts/\* -o -path certs/\* -o -path doc/\* -o -path mcapi/\* -o -path cmake/\* \) -print0)
359+ @popd > /dev/null
360+ @for file in " $$ {srcfiles[@]}" ; do if [[ ! -e " $$ file" ; then mkdir -p " $$ (dirname " $$ file" )" && cp --no-dereference --symbolic-link --no-clobber ' $(SRC_TOP)' " $$ file" " $$ file" ; fi ; done
361+ @echo ' done.'
362+ @echo ' __attribute__ ((visibility("default"))) extern const char coreKey[];' > user_settings.h
363+ @echo > user_settings_asm.h
364+ @echo -n ' Configuring libwolfssl.so...'
365+ @unset WOLFSSL_CFLAGS WOLFCRYPT_PIE_FILES ASFLAGS_FPUSIMD_ENABLE ASFLAGS_FPU_DISABLE_SIMD_ENABLE src_libwolfssl_la_OBJECTS WOLFSSL_ASFLAGS AM_CFLAGS WOLFSSL_OBJ_FILES ENABLED_LINUXKM_LKCAPI_REGISTER EXTRA_LDFLAGS CC LD
366+ @./configure $(QFLAG ) $(VFLAG ) --disable-jobserver --enable-cryptonly --enable-fips=" $$ FIPS_FLAVOR" ' -DWC_SYM_RELOC_TABLES_SUPPORT -DWOLFCRYPT_FIPS_CORE_DYNAMIC_HASH_VALUE -DWOLFSSL_USER_SETTINGS -DWOLFSSL_USER_SETTINGS_ASM'
367+ @echo ' done.'
368+ @echo -n ' Compiling and linking libwolfssl.so...'
369+ +$(MAKE ) $(QFLAG ) > /dev/null
370+ @echo ' done.'
371+ @echo -n ' Fixing FIPS hash...'
372+ @userhash=$$(wolfcrypt/test/testwolfcrypt 2>&1 | sed -n -E 's/^hash = (.+ ) $$ /\1 /p' )
373+ @if [[ -z " $$ userhash" ; then echo ' FIPS hash not found!' >&2 ; exit 1; fi
374+ @find wolfcrypt/src -name ' *fips_test*o'
375+ +$(MAKE ) $(QFLAG ) EXTRA_CFLAGS=-DWOLFCRYPT_FIPS_CORE_HASH_VALUE=" $$ userhash"
376+ @echo ' done.'
377+
378+ linuxkm-fips-hash : libwolfssl-user-build/src/.libs/libwolfssl.so linuxkm-fips-hash.c
379+ @set -e
380+ @echo -n ' Compiling linuxkm-fips-hash...'
381+ # note direct invocation of cc -- we are compiling for the build host, not the target host.
382+ @cc -Wall -Wextra -O2 -I'$(MODULE_TOP)/libwolfssl-user-build' -o linuxkm-fips-hash linuxkm/linuxkm-fips-hash.c -L '$(MODULE_TOP)/libwolfssl-user-build/src/.libs' -Wl,-rpath-link='$(MODULE_TOP)/libwolfssl-user-build/src/.libs' -Wl,-rpath='$(MODULE_TOP)/libwolfssl-user-build/src/.libs' -lwolfssl
383+ @echo ' done.'
384+
385+ .PHONY : module-with-matching-fips-hash
386+ module-with-matching-fips-hash : $(LIBWOLFSSL_NAME ) .ko linuxkm-fips-hash
387+ @set -e
388+ @./linuxkm-fips-hash-wrapper.sh " $<" $(QFLAG ) $(VFLAG )
389+ +$(MAKE ) $(QFLAG ) -C . ' $(LIBWOLFSSL_NAME).ko.signed'
390+
391+ .PHONY : module-with-matching-fips-hash-no-sign
392+ module-with-matching-fips-hash-no-sign : $(LIBWOLFSSL_NAME ) .ko linuxkm-fips-hash
393+ @set -e
394+ @./linuxkm-fips-hash-wrapper.sh " $<"
324395
325- libwolfssl .ko.signedlibwolfssl .ko
396+ $( LIBWOLFSSL_NAME ) $( LIBWOLFSSL_NAME )
326397ifdef FORCE_NO_MODULE_SIG
327398 @echo 'Skipping module signature operation because FORCE_NO_MODULE_SIG.'
328399else
@@ -371,6 +442,8 @@ clean:
371442 $(RM ) -rf ' $(MODULE_TOP)/linuxkm'
372443 $(RM ) -rf ' $(MODULE_TOP)/wolfcrypt'
373444 $(RM ) -rf ' $(MODULE_TOP)/src'
445+ $(RM ) -rf ' $(MODULE_TOP)/libwolfssl-user-build'
446+ $(RM ) -f ' $(MODULE_TOP)/linuxkm-fips-hash'
374447
375448.PHONY : check
376449check :
0 commit comments