Skip to content

Commit 4fda088

Browse files
douzzerdouzzer
committed
globally rename WC_PIE_RELOC_TABLES to WC_SYM_RELOC_TABLES;
globally replace defined(__PIE__) with defined(WC_CONTAINERIZE_THIS) to decouple containerization from -fPIE; configure.ac: * add --enable-kernel-reloc-tables as an alias for --enable-linuxkm-pie; * always activate ENABLED_ENTROPY_MEMUSE_DEFAULT when KERNEL_MODE_DEFAULTS and not RDSEED/RDRAND, regardless of FIPS presence/version; linuxkm/Kbuild: * add -DWC_CONTAINERIZE_THIS to PIE_FLAGS; * add support for NO_PIE_FLAG, which inhibits -fPIE on ENABLED_LINUXKM_PIE builds, and adds -DWC_NO_PIE_FLAG to PIE_FLAGS; linuxkm/linuxkm_wc_port.h: add setup for WC_LINUXKM_WOLFENTROPY_IN_GLUE_LAYER; linuxkm/module_hooks.c: add wc_linuxkm_GenerateSeed_wolfEntropy().
1 parent 0afbc1e commit 4fda088

8 files changed

Lines changed: 91 additions & 52 deletions

File tree

‎configure.ac‎

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -704,14 +704,19 @@ AC_ARG_ENABLE([benchmark],
704704

705705
# Remainder of Linux kernel module options, continued from earlier:
706706

707+
ENABLED_LINUXKM_PIE=$ENABLED_FIPS
708+
707709
AC_ARG_ENABLE([linuxkm-pie],
708710
[AS_HELP_STRING([--enable-linuxkm-pie],[Enable relocatable object build of Linux kernel module (default: disabled)])],
709-
[ENABLED_LINUXKM_PIE=$enableval],
710-
[ENABLED_LINUXKM_PIE=$ENABLED_FIPS]
711-
)
711+
[ENABLED_LINUXKM_PIE=$enableval])
712+
713+
AC_ARG_ENABLE([kernel-reloc-tables],
714+
[AS_HELP_STRING([--enable-kernel-reloc-tables],[Enable containerized object build of wolfCrypt module in kernel build (default: disabled)])],
715+
[ENABLED_LINUXKM_PIE=$enableval])
716+
712717
if test "$ENABLED_LINUXKM" = "yes" && test "$ENABLED_LINUXKM_PIE" = "yes"
713718
then
714-
AM_CFLAGS="$AM_CFLAGS -DWC_PIE_RELOC_TABLES"
719+
AM_CFLAGS="$AM_CFLAGS -DWC_SYM_RELOC_TABLES"
715720
fi
716721
AC_SUBST([ENABLED_LINUXKM_PIE])
717722

@@ -5820,8 +5825,7 @@ AC_ARG_ENABLE([pwdbased],
58205825
if test "$KERNEL_MODE_DEFAULTS" = "yes" && \
58215826
test "$ENABLED_AMDRDSEED" != "yes" && \
58225827
test "$ENABLED_INTELRDRAND" != "yes" && \
5823-
test "$ENABLED_INTELRDSEED" != "yes" && \
5824-
(test "$ENABLED_FIPS" = "no" || test "$HAVE_FIPS_VERSION" -ge 6)
5828+
test "$ENABLED_INTELRDSEED" != "yes"
58255829
then
58265830
ENABLED_ENTROPY_MEMUSE_DEFAULT=yes
58275831
else

‎linuxkm/Kbuild‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -106,7 +106,13 @@ ccflags-y = $(WOLFSSL_CFLAGS) $(WOLFSSL_CFLAGS_NO_VECTOR_INSNS)
106106
ifeq "$(ENABLED_LINUXKM_PIE)" "yes"
107107
# note, we need -fno-stack-protector to avoid references to
108108
# "__stack_chk_fail" from the wolfCrypt container.
109-
PIE_FLAGS := -fPIE -fno-stack-protector -fno-toplevel-reorder
109+
PIE_FLAGS := -DWC_CONTAINERIZE_THIS -fno-stack-protector -fno-toplevel-reorder
110+
# some targets can't handle -fpie. E.g. ARM32 on kernel <=5.10 has no handling for R_ARM_REL32.
111+
ifdef NO_PIE_FLAG
112+
PIE_FLAGS += -DWC_NO_PIE_FLAG
113+
else
114+
PIE_FLAGS += -fPIE
115+
endif
110116
# the kernel sanitizers generate external references to
111117
# __ubsan_handle_out_of_bounds(), __ubsan_handle_shift_out_of_bounds(), etc.
112118
KASAN_SANITIZE := n

‎linuxkm/linuxkm_memory.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@
2121

2222
/* included by wolfcrypt/src/memory.c */
2323

24-
#if defined(__PIE__) && defined(CONFIG_FORTIFY_SOURCE)
24+
#if defined(WC_SYM_RELOC_TABLES) && defined(CONFIG_FORTIFY_SOURCE)
2525
/* needed because FORTIFY_SOURCE inline implementations call fortify_panic(). */
2626
void __my_fortify_panic(const char *name) {
2727
pr_emerg("__my_fortify_panic in %s\n", name);

‎linuxkm/linuxkm_wc_port.h‎

Lines changed: 35 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -178,12 +178,21 @@
178178
#endif
179179
#endif
180180

181-
#if defined(HAVE_HASHDRBG) && defined(HAVE_FIPS) && FIPS_VERSION3_LT(6, 0, 0) && \
181+
#if defined(HAVE_HASHDRBG) && defined(HAVE_FIPS) && \
182+
defined(HAVE_ENTROPY_MEMUSE) && \
183+
!defined(WC_LINUXKM_WOLFENTROPY_IN_GLUE_LAYER)
184+
#define WC_LINUXKM_WOLFENTROPY_IN_GLUE_LAYER
185+
#elif defined(HAVE_HASHDRBG) && defined(HAVE_FIPS) && \
182186
(defined(HAVE_INTEL_RDSEED) || defined(HAVE_AMD_RDSEED)) && \
187+
!defined(HAVE_ENTROPY_MEMUSE) && \
183188
!defined(WC_LINUXKM_RDSEED_IN_GLUE_LAYER)
184189
#define WC_LINUXKM_RDSEED_IN_GLUE_LAYER
185190
#endif
186-
#ifdef WC_LINUXKM_RDSEED_IN_GLUE_LAYER
191+
#if defined(WC_LINUXKM_WOLFENTROPY_IN_GLUE_LAYER)
192+
struct OS_Seed;
193+
extern int wc_linuxkm_GenerateSeed_wolfEntropy(struct OS_Seed* os, unsigned char* output, unsigned int sz);
194+
#define WC_GENERATE_SEED_DEFAULT wc_linuxkm_GenerateSeed_wolfEntropy
195+
#elif defined(WC_LINUXKM_RDSEED_IN_GLUE_LAYER)
187196
struct OS_Seed;
188197
extern int wc_linuxkm_GenerateSeed_IntelRD(struct OS_Seed* os, unsigned char* output, unsigned int sz);
189198
#define WC_GENERATE_SEED_DEFAULT wc_linuxkm_GenerateSeed_IntelRD
@@ -208,7 +217,7 @@
208217
#endif
209218
#endif
210219

211-
#if defined(CONFIG_MIPS) && defined(WC_PIE_RELOC_TABLES)
220+
#if defined(CONFIG_MIPS) && defined(WC_SYM_RELOC_TABLES)
212221
/* __ZBOOT__ disables some unhelpful macros around the mem*() funcs in
213222
* legacy arch/mips/include/asm/string.h
214223
*/
@@ -255,7 +264,7 @@
255264

256265
#if defined(CONFIG_FORTIFY_SOURCE) && \
257266
!defined(WC_FORCE_LINUXKM_FORTIFY_SOURCE) && \
258-
(defined(WC_PIE_RELOC_TABLES) || \
267+
(defined(WC_SYM_RELOC_TABLES) || \
259268
(LINUX_VERSION_CODE < KERNEL_VERSION(5, 18, 0)))
260269
/* fortify-source causes all sorts of awkward problems for the PIE
261270
* build, up to and including stubborn external references and multiple
@@ -272,7 +281,7 @@
272281
#error WC_FORCE_LINUXKM_FORTIFY_SOURCE without CONFIG_FORTIFY_SOURCE.
273282
#endif
274283

275-
#if defined(__PIE__) && defined(CONFIG_ARM64)
284+
#if defined(WC_CONTAINERIZE_THIS) && defined(CONFIG_ARM64)
276285
#define alt_cb_patch_nops my__alt_cb_patch_nops
277286
#define queued_spin_lock_slowpath my__queued_spin_lock_slowpath
278287
#endif
@@ -281,7 +290,7 @@
281290
#include <linux/ctype.h>
282291

283292
#if defined(CONFIG_FORTIFY_SOURCE) || defined(DEBUG_LINUXKM_FORTIFY_OVERLAY)
284-
#ifdef __PIE__
293+
#ifdef WC_CONTAINERIZE_THIS
285294
/* the inline definitions in fortify-string.h use non-inline
286295
* fortify_panic().
287296
*/
@@ -412,7 +421,7 @@
412421

413422
#endif /* !CONFIG_FORTIFY_SOURCE */
414423

415-
#ifndef __PIE__
424+
#ifndef WC_CONTAINERIZE_THIS
416425
#include <linux/init.h>
417426
#include <linux/module.h>
418427
#include <linux/delay.h>
@@ -426,7 +435,7 @@
426435
* mm.h. however, mm.h brings in static, but not inline, pmd_to_page(),
427436
* with direct references to global vmem variables.
428437
*/
429-
#ifdef __PIE__
438+
#ifdef WC_CONTAINERIZE_THIS
430439
#include <linux/mm_types.h>
431440
#if USE_SPLIT_PMD_PTLOCKS
432441
static __always_inline struct page *pmd_to_page(pmd_t *pmd);
@@ -435,7 +444,7 @@
435444
#include <linux/mm.h>
436445
#endif
437446

438-
#ifndef __PIE__
447+
#ifndef WC_CONTAINERIZE_THIS
439448
#include <linux/kthread.h>
440449
#include <linux/net.h>
441450
#endif
@@ -450,7 +459,7 @@
450459
#endif
451460
#include <linux/random.h>
452461

453-
#if !defined(__PIE__) && defined(CONFIG_HAVE_KPROBES)
462+
#if !defined(WC_CONTAINERIZE_THIS) && defined(CONFIG_HAVE_KPROBES)
454463
#include <linux/kprobes.h>
455464
#endif
456465

@@ -483,7 +492,7 @@
483492
#define LINUXKM_LKCAPI_REGISTER_HASH_DRBG_DEFAULT
484493
#endif
485494

486-
#ifndef __PIE__
495+
#ifndef WC_CONTAINERIZE_THIS
487496
#include <linux/crypto.h>
488497
#include <linux/scatterlist.h>
489498
#include <crypto/scatterwalk.h>
@@ -513,7 +522,7 @@
513522
}
514523
#endif
515524
#define WC_LKM_REFCOUNT_TO_INT(refcount) wc_lkm_refcount_to_int(&(refcount))
516-
#endif /* !__PIE__ */
525+
#endif /* !WC_CONTAINERIZE_THIS */
517526
#endif /* LINUXKM_LKCAPI_REGISTER */
518527

519528
/* benchmarks.c uses floating point math, so needs a working
@@ -730,11 +739,11 @@
730739

731740
#endif /* !WOLFCRYPT_ONLY && !NO_CERTS */
732741

733-
#if defined(__PIE__) && !defined(WC_PIE_RELOC_TABLES)
734-
#error "compiling -fPIE requires PIE relocation tables."
742+
#if defined(WC_CONTAINERIZE_THIS) && !defined(WC_SYM_RELOC_TABLES)
743+
#error "compiling -DWC_CONTAINERIZE_THIS requires relocation tables."
735744
#endif
736745

737-
#ifdef WC_PIE_RELOC_TABLES
746+
#ifdef WC_SYM_RELOC_TABLES
738747

739748
#ifndef WOLFSSL_TEXT_SEGMENT_CANONICALIZER
740749
#define WOLFSSL_TEXT_SEGMENT_CANONICALIZER(text_in, text_in_len, text_out, cur_index_p) \
@@ -759,6 +768,7 @@
759768
__wc_rwdata_end[],
760769
__wc_bss_start[],
761770
__wc_bss_end[];
771+
762772
extern const unsigned int wc_linuxkm_pie_reloc_tab[];
763773
extern const unsigned long wc_linuxkm_pie_reloc_tab_length;
764774
extern ssize_t wc_linuxkm_normalize_relocations(
@@ -1013,7 +1023,7 @@
10131023
#endif
10141024

10151025
#ifdef CONFIG_ARM64
1016-
#ifdef __PIE__
1026+
#ifdef WC_CONTAINERIZE_THIS
10171027
/* alt_cb_patch_nops and queued_spin_lock_slowpath are defined early
10181028
* to allow shimming in system headers, but now we need the native
10191029
* ones.
@@ -1088,7 +1098,7 @@
10881098
#error no WC_PIE_INDIRECT_SYM method defined.
10891099
#endif
10901100

1091-
#ifdef __PIE__
1101+
#ifdef WC_CONTAINERIZE_THIS
10921102

10931103
#define wc_linuxkm_normalize_relocations \
10941104
WC_PIE_INDIRECT_SYM(wc_linuxkm_normalize_relocations)
@@ -1237,8 +1247,8 @@
12371247
#endif
12381248

12391249
/* per linux/ctype.h, tolower() and toupper() are macros bound to static inlines
1240-
* that use macros that bring in the _ctype global. for __PIE__, this needs to
1241-
* be masked out.
1250+
* that use macros that bring in the _ctype global. for WC_CONTAINERIZE_THIS,
1251+
* this needs to be masked out.
12421252
*/
12431253
#undef tolower
12441254
#undef toupper
@@ -1296,9 +1306,9 @@
12961306
#define wc_linuxkm_check_for_intr_signals WC_PIE_INDIRECT_SYM(wc_linuxkm_check_for_intr_signals)
12971307
#define wc_linuxkm_relax_long_loop WC_PIE_INDIRECT_SYM(wc_linuxkm_relax_long_loop)
12981308

1299-
#endif /* __PIE__ */
1309+
#endif /* WC_CONTAINERIZE_THIS */
13001310

1301-
#endif /* WC_PIE_RELOC_TABLES */
1311+
#endif /* WC_SYM_RELOC_TABLES */
13021312

13031313
/* remove this multifariously conflicting macro, picked up from
13041314
* Linux arch/<arch>/include/asm/current.h.
@@ -1456,23 +1466,23 @@
14561466
return 0;
14571467
}
14581468

1459-
#ifdef __PIE__
1460-
/* wc_lkm_LockMutex() can't be used inline in __PIE__ objects, due to
1469+
#ifdef WC_CONTAINERIZE_THIS
1470+
/* wc_lkm_LockMutex() can't be used inline in WC_CONTAINERIZE_THIS objects, due to
14611471
* direct access to pv_ops.
14621472
*/
14631473
static __must_check __always_inline int wc_LockMutex(wolfSSL_Mutex *m)
14641474
{
14651475
return WC_PIE_INDIRECT_SYM(wc_lkm_LockMutex)(m);
14661476
}
14671477

1468-
#else /* !__PIE__ */
1478+
#else /* !WC_CONTAINERIZE_THIS */
14691479

14701480
static __must_check __always_inline int wc_LockMutex(wolfSSL_Mutex *m)
14711481
{
14721482
return wc_lkm_LockMutex(m);
14731483
}
14741484

1475-
#endif /* !__PIE__ */
1485+
#endif /* !WC_CONTAINERIZE_THIS */
14761486

14771487
static __always_inline int wc_UnLockMutex(wolfSSL_Mutex* m)
14781488
{

‎linuxkm/module_hooks.c‎

Lines changed: 24 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,7 @@ static int libwolfssl_cleanup(void) {
9292
extern char verifyCore[WC_SHA256_DIGEST_SIZE*2 + 1];
9393
#endif
9494

95-
#ifdef WC_PIE_RELOC_TABLES
95+
#ifdef WC_SYM_RELOC_TABLES
9696

9797
#ifdef DEBUG_LINUXKM_PIE_SUPPORT
9898

@@ -116,17 +116,17 @@ static int total_text_r = 0, total_rodata_r = 0, total_rwdata_r = 0,
116116

117117
#endif /* DEBUG_LINUXKM_PIE_SUPPORT */
118118

119-
#ifdef WC_PIE_RELOC_TABLES
119+
#ifdef WC_SYM_RELOC_TABLES
120120
extern struct wolfssl_linuxkm_pie_redirect_table wolfssl_linuxkm_pie_redirect_table;
121121
static int set_up_wolfssl_linuxkm_pie_redirect_table(void);
122-
#endif /* WC_PIE_RELOC_TABLES */
122+
#endif /* WC_SYM_RELOC_TABLES */
123123

124124
#ifdef HAVE_FIPS
125125
extern const unsigned int wolfCrypt_FIPS_ro_start[];
126126
extern const unsigned int wolfCrypt_FIPS_ro_end[];
127127
#endif
128128

129-
#endif /* WC_PIE_RELOC_TABLES */
129+
#endif /* WC_SYM_RELOC_TABLES */
130130

131131
#ifdef HAVE_FIPS
132132
static void lkmFipsCb(int ok, int err, const char* hash)
@@ -301,8 +301,17 @@ void wc_linuxkm_relax_long_loop(void) {
301301
#endif
302302
}
303303

304-
/* backported wc_GenerateSeed_IntelRD() for FIPS v5. */
305-
#ifdef WC_LINUXKM_RDSEED_IN_GLUE_LAYER
304+
#if defined(WC_LINUXKM_WOLFENTROPY_IN_GLUE_LAYER)
305+
306+
int wc_linuxkm_GenerateSeed_wolfEntropy(OS_Seed* os, byte* output, word32 sz)
307+
{
308+
(void)os;
309+
return wc_Entropy_Get(MAX_ENTROPY_BITS, output, sz);
310+
}
311+
312+
#elif defined(WC_LINUXKM_RDSEED_IN_GLUE_LAYER)
313+
314+
/* backported wc_GenerateSeed_IntelRD() for FIPS v5, before breakout of wolfentropy.c. */
306315

307316
#include <wolfssl/wolfcrypt/cpuid.h>
308317
#include <wolfssl/wolfcrypt/random.h>
@@ -497,13 +506,13 @@ static int wolfssl_init(void)
497506

498507
#endif /* HAVE_FIPS */
499508

500-
#ifdef WC_PIE_RELOC_TABLES
509+
#ifdef WC_SYM_RELOC_TABLES
501510
ret = set_up_wolfssl_linuxkm_pie_redirect_table();
502511
if (ret < 0)
503512
return ret;
504513
#endif
505514

506-
#if defined(HAVE_FIPS) && defined(WC_PIE_RELOC_TABLES)
515+
#if defined(HAVE_FIPS) && defined(WC_SYM_RELOC_TABLES)
507516
if (((uintptr_t)__wc_text_start > (uintptr_t)wolfCrypt_FIPS_first) ||
508517
((uintptr_t)__wc_text_end < (uintptr_t)wolfCrypt_FIPS_last) ||
509518
((uintptr_t)__wc_rodata_start > (uintptr_t)wolfCrypt_FIPS_ro_start) ||
@@ -514,7 +523,7 @@ static int wolfssl_init(void)
514523
}
515524
#endif
516525

517-
#if defined(WC_PIE_RELOC_TABLES) && defined(DEBUG_LINUXKM_PIE_SUPPORT)
526+
#if defined(WC_SYM_RELOC_TABLES) && defined(DEBUG_LINUXKM_PIE_SUPPORT)
518527

519528
#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 4, 0)
520529
/* see linux commit ac3b432839 */
@@ -599,7 +608,7 @@ static int wolfssl_init(void)
599608
total_text_r, total_rodata_r, total_rwdata_r, total_bss_r, total_other_r);
600609
}
601610

602-
#endif /* WC_PIE_RELOC_TABLES && DEBUG_LINUXKM_PIE_SUPPORT */
611+
#endif /* WC_SYM_RELOC_TABLES && DEBUG_LINUXKM_PIE_SUPPORT */
603612

604613
#ifdef HAVE_FIPS
605614
ret = wolfCrypt_SetCb_fips(lkmFipsCb);
@@ -608,7 +617,7 @@ static int wolfssl_init(void)
608617
return -ECANCELED;
609618
}
610619

611-
#if defined(WC_PIE_RELOC_TABLES) && defined(DEBUG_LINUXKM_PIE_SUPPORT)
620+
#if defined(WC_SYM_RELOC_TABLES) && defined(DEBUG_LINUXKM_PIE_SUPPORT)
612621
total_text_r = total_rodata_r = total_rwdata_r = total_bss_r =
613622
total_other_r = 0;
614623
#endif
@@ -620,7 +629,7 @@ static int wolfssl_init(void)
620629
else
621630
pr_err("ERROR: WC_SIG_IGNORE_BEGIN() failed.\n");
622631

623-
#if defined(WC_PIE_RELOC_TABLES) && defined(DEBUG_LINUXKM_PIE_SUPPORT)
632+
#if defined(WC_SYM_RELOC_TABLES) && defined(DEBUG_LINUXKM_PIE_SUPPORT)
624633
pr_info("FIPS-bounded relocation normalizations: text=%d, rodata=%d, rwdata=%d, bss=%d, other=%d\n",
625634
total_text_r, total_rodata_r, total_rwdata_r, total_bss_r, total_other_r);
626635
#endif
@@ -865,7 +874,7 @@ MODULE_AUTHOR("https://www.wolfssl.com/");
865874
MODULE_DESCRIPTION("libwolfssl cryptographic and protocol facilities");
866875
MODULE_VERSION(LIBWOLFSSL_VERSION_STRING);
867876

868-
#ifdef WC_PIE_RELOC_TABLES
877+
#ifdef WC_SYM_RELOC_TABLES
869878

870879
#define WC_TEXT_TAG (0x0 << 29)
871880
#define WC_RODATA_TAG (0x1U << 29)
@@ -1508,7 +1517,7 @@ static int set_up_wolfssl_linuxkm_pie_redirect_table(void) {
15081517
return 0;
15091518
}
15101519

1511-
#endif /* WC_PIE_RELOC_TABLES */
1520+
#endif /* WC_SYM_RELOC_TABLES */
15121521

15131522
#if defined(HAVE_FIPS) && defined(WOLFCRYPT_FIPS_CORE_DYNAMIC_HASH_VALUE)
15141523

@@ -1643,7 +1652,7 @@ static int updateFipsHash(void)
16431652
goto out;
16441653
}
16451654

1646-
#if defined(WOLFSSL_LINUXKM) && defined(WC_PIE_RELOC_TABLES)
1655+
#if defined(WOLFSSL_LINUXKM) && defined(WC_SYM_RELOC_TABLES)
16471656
{
16481657
ssize_t cur_reloc_index = -1;
16491658
const byte *text_p = (const byte *)first;

0 commit comments

Comments
 (0)