1*4882a593Smuzhiyun# SPDX-License-Identifier: GPL-2.0 2*4882a593Smuzhiyun 3*4882a593Smuzhiyun# 4*4882a593Smuzhiyun# This file is included by the generic Kbuild makefile to permit the 5*4882a593Smuzhiyun# architecture to perform postlink actions on vmlinux and any .ko module file. 6*4882a593Smuzhiyun# In this case, we only need it for fips140.ko, which needs some postprocessing 7*4882a593Smuzhiyun# for the integrity check mandated by FIPS. This involves making copies of the 8*4882a593Smuzhiyun# relocation sections so that the module will have access to them at 9*4882a593Smuzhiyun# initialization time, and calculating and injecting a HMAC digest into the 10*4882a593Smuzhiyun# module. All other targets are NOPs. 11*4882a593Smuzhiyun# 12*4882a593Smuzhiyun 13*4882a593SmuzhiyunPHONY := __archpost 14*4882a593Smuzhiyun__archpost: 15*4882a593Smuzhiyun 16*4882a593Smuzhiyun-include include/config/auto.conf 17*4882a593Smuzhiyuninclude scripts/Kbuild.include 18*4882a593Smuzhiyun 19*4882a593SmuzhiyunCMD_FIPS140_GEN_HMAC = crypto/fips140_gen_hmac 20*4882a593Smuzhiyunquiet_cmd_gen_hmac = HMAC $@ 21*4882a593Smuzhiyun cmd_gen_hmac = $(OBJCOPY) $@ \ 22*4882a593Smuzhiyun --dump-section=$(shell $(READELF) -SW $@|grep -Eo '\.rela\.text\S*')=$@.rela.text \ 23*4882a593Smuzhiyun --dump-section=$(shell $(READELF) -SW $@|grep -Eo '\.rela\.rodata\S*')=$@.rela.rodata \ 24*4882a593Smuzhiyun --add-section=.init.rela.text=$@.rela.text \ 25*4882a593Smuzhiyun --add-section=.init.rela.rodata=$@.rela.rodata \ 26*4882a593Smuzhiyun --set-section-flags=.init.rela.text=alloc,readonly \ 27*4882a593Smuzhiyun --set-section-flags=.init.rela.rodata=alloc,readonly && \ 28*4882a593Smuzhiyun $(CMD_FIPS140_GEN_HMAC) $@ 29*4882a593Smuzhiyun 30*4882a593Smuzhiyun# `@true` prevents complaints when there is nothing to be done 31*4882a593Smuzhiyun 32*4882a593Smuzhiyunvmlinux: FORCE 33*4882a593Smuzhiyun @true 34*4882a593Smuzhiyun 35*4882a593Smuzhiyun$(objtree)/crypto/fips140.ko: FORCE 36*4882a593Smuzhiyun $(call cmd,gen_hmac) 37*4882a593Smuzhiyun 38*4882a593Smuzhiyun%.ko: FORCE 39*4882a593Smuzhiyun @true 40*4882a593Smuzhiyun 41*4882a593Smuzhiyunclean: 42*4882a593Smuzhiyun rm -f $(objtree)/crypto/fips140.ko.rela.* 43*4882a593Smuzhiyun 44*4882a593SmuzhiyunPHONY += FORCE clean 45*4882a593Smuzhiyun 46*4882a593SmuzhiyunFORCE: 47*4882a593Smuzhiyun 48*4882a593Smuzhiyun.PHONY: $(PHONY) 49