Skip to content

Commit 8b98f7f

Browse files
douzzerdouzzer
committed
linuxkm/: refactor wc_reloc_table_segments.reloc_tab_* as wc_reloc_table_segments.text_reloc_tab.* (using the new struct wc_reloc_table_fenceposts and WC_RELOC_TABLE_FENCEPOSTS_INITIALIZER), and add wc_reloc_table_segments.rodata_reloc_tab (allocated but not yet implemented).
1 parent d218d3f commit 8b98f7f

6 files changed

Lines changed: 89 additions & 69 deletions

File tree

‎linuxkm/Makefile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -163,7 +163,7 @@ GENERATE_RELOC_TAB := $(AWK) ' \
163163
print "\#include <wolfssl/wolfcrypt/libwolfssl_sources.h>"; \
164164
print "\#include <wolfssl/wolfcrypt/memory.h>"; \
165165
printf("%s\n ", \
166-
"WOLFSSL_LOCAL const struct wc_reloc_table_ent wc_linuxkm_pie_reloc_tab[] = { "); \
166+
"WOLFSSL_LOCAL const struct wc_reloc_table_ent wc_linuxkm_pie_text_reloc_tab[] = { "); \
167167
if ("SECTION_MAP" in ENVIRON) { \
168168
while (getline <ENVIRON["SECTION_MAP"] > 0) \
169169
section_map[$$1] = $$2; \
@@ -232,7 +232,7 @@ GENERATE_RELOC_TAB := $(AWK) ' \
232232
exit(1); \
233233
} \
234234
print " { .offset = ~0U, .dest_offset = ~0U, .dest_addend = 0, .dest_segment = WC_R_SEG_NONE, .reloc_type = WC_R_NONE } };"; \
235-
print "WOLFSSL_LOCAL const unsigned int wc_linuxkm_pie_reloc_tab_length = (unsigned int)(sizeof wc_linuxkm_pie_reloc_tab / sizeof wc_linuxkm_pie_reloc_tab[0]);"; \
235+
print "WOLFSSL_LOCAL const unsigned int wc_linuxkm_pie_text_reloc_tab_length = (unsigned int)(sizeof wc_linuxkm_pie_text_reloc_tab / sizeof wc_linuxkm_pie_text_reloc_tab[0]);"; \
236236
}'
237237

238238
ifeq "$(V)" "1"

‎linuxkm/linuxkm-fips-hash-wrapper.sh‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -48,15 +48,15 @@ fi
4848
# shellcheck disable=SC2016 # using $AWK instead of awk confuses shellcheck.
4949
readarray -t fenceposts < <(readelf --wide --sections --symbols "$mod_path" | "$AWK" '
5050
BEGIN {
51-
fips_fenceposts["wc_linuxkm_pie_reloc_tab"] = "reloc_tab_start";
52-
fips_fenceposts["wc_linuxkm_pie_reloc_tab_length"] = "reloc_tab_len_start";
51+
fips_fenceposts["wc_linuxkm_pie_text_reloc_tab"] = "text_reloc_tab.start";
52+
fips_fenceposts["wc_linuxkm_pie_text_reloc_tab_length"] = "text_reloc_tab.len_start";
5353
fips_fenceposts["verifyCore"] = "verifyCore_start";
5454
fips_fenceposts["wolfCrypt_FIPS_first"] = "fips_text_start";
5555
fips_fenceposts["wolfCrypt_FIPS_last"] = "fips_text_end";
5656
fips_fenceposts["wolfCrypt_FIPS_ro_start"] = "fips_rodata_start";
5757
fips_fenceposts["wolfCrypt_FIPS_ro_end"] = "fips_rodata_end";
58-
singleton_ends["wc_linuxkm_pie_reloc_tab"] = "reloc_tab_end";
59-
singleton_ends["wc_linuxkm_pie_reloc_tab_length"] = "reloc_tab_len_end";
58+
singleton_ends["wc_linuxkm_pie_text_reloc_tab"] = "text_reloc_tab.end";
59+
singleton_ends["wc_linuxkm_pie_text_reloc_tab_length"] = "text_reloc_tab.len_end";
6060
singleton_ends["verifyCore"] = "verifyCore_end";
6161
}
6262

‎linuxkm/linuxkm-fips-hash.c‎

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -104,10 +104,10 @@ int main(int argc, char **argv)
104104
.val = FENCEPOST_OPT_FLAG | offsetof(typeof(seg_map), x) }
105105
FENCEPOST_OPT(text_start),
106106
FENCEPOST_OPT(text_end),
107-
FENCEPOST_OPT(reloc_tab_start),
108-
FENCEPOST_OPT(reloc_tab_end),
109-
FENCEPOST_OPT(reloc_tab_len_start),
110-
FENCEPOST_OPT(reloc_tab_len_end),
107+
FENCEPOST_OPT(text_reloc_tab.start),
108+
FENCEPOST_OPT(text_reloc_tab.end),
109+
FENCEPOST_OPT(text_reloc_tab.len_start),
110+
FENCEPOST_OPT(text_reloc_tab.len_end),
111111
FENCEPOST_OPT(fips_text_start),
112112
FENCEPOST_OPT(fips_text_end),
113113
FENCEPOST_OPT(rodata_start),
@@ -228,10 +228,10 @@ int main(int argc, char **argv)
228228

229229
if ((seg_map.text_start == ~0UL) ||
230230
(seg_map.text_end == ~0UL) ||
231-
(seg_map.reloc_tab_start == ~0UL) ||
232-
(seg_map.reloc_tab_end == ~0UL) ||
233-
(seg_map.reloc_tab_len_start == ~0UL) ||
234-
(seg_map.reloc_tab_len_end == ~0UL) ||
231+
(seg_map.text_reloc_tab.start == ~0UL) ||
232+
(seg_map.text_reloc_tab.end == ~0UL) ||
233+
(seg_map.text_reloc_tab.len_start == ~0UL) ||
234+
(seg_map.text_reloc_tab.len_end == ~0UL) ||
235235
(seg_map.fips_text_start == ~0UL) ||
236236
(seg_map.fips_text_end == ~0UL) ||
237237
(seg_map.rodata_start == ~0UL) ||
@@ -267,12 +267,12 @@ int main(int argc, char **argv)
267267
exit(1);
268268
}
269269

270-
if ((seg_map.reloc_tab_start >= seg_map.reloc_tab_end) ||
271-
(seg_map.reloc_tab_end >= (unsigned long)st.st_size) ||
272-
(seg_map.reloc_tab_len_start >= seg_map.reloc_tab_len_end) ||
273-
(seg_map.reloc_tab_len_end >= (unsigned long)st.st_size))
270+
if ((seg_map.text_reloc_tab.start >= seg_map.text_reloc_tab.end) ||
271+
(seg_map.text_reloc_tab.end >= (unsigned long)st.st_size) ||
272+
(seg_map.text_reloc_tab.len_start >= seg_map.text_reloc_tab.len_end) ||
273+
(seg_map.text_reloc_tab.len_end >= (unsigned long)st.st_size))
274274
{
275-
fprintf(stderr, "%s: supplied reloc_tab fencepost(s) are out of bounds "
275+
fprintf(stderr, "%s: supplied text_reloc_tab fencepost(s) are out of bounds "
276276
"for supplied module %s with length %lu.\n",
277277
progname, mod_path, (unsigned long)st.st_size);
278278
exit(1);
@@ -291,10 +291,10 @@ int main(int argc, char **argv)
291291
seg_map.start = (unsigned long)mod_map;
292292
seg_map.end = (unsigned long)mod_map + st.st_size;
293293

294-
seg_map.reloc_tab_start += (unsigned long)mod_map;
295-
seg_map.reloc_tab_end += (unsigned long)mod_map;
296-
seg_map.reloc_tab_len_start += (unsigned long)mod_map;
297-
seg_map.reloc_tab_len_end += (unsigned long)mod_map;
294+
seg_map.text_reloc_tab.start += (unsigned long)mod_map;
295+
seg_map.text_reloc_tab.end += (unsigned long)mod_map;
296+
seg_map.text_reloc_tab.len_start += (unsigned long)mod_map;
297+
seg_map.text_reloc_tab.len_end += (unsigned long)mod_map;
298298

299299
seg_map.verifyCore_start += (unsigned long)mod_map;
300300
seg_map.verifyCore_end += (unsigned long)mod_map;

‎linuxkm/linuxkm_memory.c‎

Lines changed: 26 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -140,8 +140,8 @@ ssize_t wc_reloc_normalize_text(
140140
size_t text_in_offset;
141141
const struct wc_reloc_table_ent *last_reloc; /* for error-checking order in reloc_tab[] */
142142
int n_text_r = 0, n_rodata_r = 0, n_rwdata_r = 0, n_bss_r = 0, n_other_r = 0, n_oob_r = 0;
143-
const struct wc_reloc_table_ent *reloc_tab = (const struct wc_reloc_table_ent *)seg_map->reloc_tab_start;
144-
const word32 reloc_tab_len = *(const word32 *)seg_map->reloc_tab_len_start;
143+
const struct wc_reloc_table_ent *reloc_tab = (const struct wc_reloc_table_ent *)seg_map->text_reloc_tab.start;
144+
const word32 reloc_tab_len = *(const word32 *)seg_map->text_reloc_tab.len_start;
145145

146146
if ((text_in_len == 0) ||
147147
((uintptr_t)text_in < seg_map->text_start) ||
@@ -553,16 +553,16 @@ int wc_fips_generate_hash(
553553

554554
#if defined(WC_SYM_RELOC_TABLES) || defined(WC_SYM_RELOC_TABLES_SUPPORT)
555555
if (seg_map->text_is_live) {
556-
if ((seg_map->reloc_tab_start == 0) ||
557-
(seg_map->reloc_tab_len_start == 0))
556+
if ((seg_map->text_reloc_tab.start == 0) ||
557+
(seg_map->text_reloc_tab.len_start == 0))
558558
{
559559
RELOC_DEBUG_PRINTF("assert failed.\n");
560560
return BAD_FUNC_ARG;
561561
}
562562
}
563563
else {
564-
if ((seg_map->reloc_tab_end == 0) ||
565-
(seg_map->reloc_tab_len_end == 0))
564+
if ((seg_map->text_reloc_tab.end == 0) ||
565+
(seg_map->text_reloc_tab.len_end == 0))
566566
{
567567
RELOC_DEBUG_PRINTF("assert failed.\n");
568568
return BAD_FUNC_ARG;
@@ -575,8 +575,8 @@ int wc_fips_generate_hash(
575575
(seg_map->fips_rodata_start >= seg_map->fips_rodata_end)
576576
#if defined(WC_SYM_RELOC_TABLES) || defined(WC_SYM_RELOC_TABLES_SUPPORT)
577577
||
578-
((seg_map->reloc_tab_end != 0) && (seg_map->reloc_tab_start >= seg_map->reloc_tab_end)) ||
579-
((seg_map->reloc_tab_len_end != 0) && (seg_map->reloc_tab_len_start >= seg_map->reloc_tab_len_end)) ||
578+
((seg_map->text_reloc_tab.end != 0) && (seg_map->text_reloc_tab.start >= seg_map->text_reloc_tab.end)) ||
579+
((seg_map->text_reloc_tab.len_end != 0) && (seg_map->text_reloc_tab.len_start >= seg_map->text_reloc_tab.len_end)) ||
580580
(seg_map->text_start >= seg_map->text_end) ||
581581
(seg_map->rodata_start >= seg_map->rodata_end) ||
582582
(seg_map->data_start >= seg_map->data_end) ||
@@ -594,8 +594,8 @@ int wc_fips_generate_hash(
594594
(seg_map->verifyCore_start < seg_map->start)
595595
#if defined(WC_SYM_RELOC_TABLES) || defined(WC_SYM_RELOC_TABLES_SUPPORT)
596596
||
597-
(seg_map->reloc_tab_start < seg_map->start) ||
598-
(seg_map->reloc_tab_len_start < seg_map->start) ||
597+
(seg_map->text_reloc_tab.start < seg_map->start) ||
598+
(seg_map->text_reloc_tab.len_start < seg_map->start) ||
599599
(seg_map->text_start < seg_map->start) ||
600600
(seg_map->rodata_start < seg_map->start) ||
601601
(seg_map->data_start < seg_map->start) ||
@@ -614,10 +614,10 @@ int wc_fips_generate_hash(
614614
(seg_map->verifyCore_end > seg_map->end)
615615
#if defined(WC_SYM_RELOC_TABLES) || defined(WC_SYM_RELOC_TABLES_SUPPORT)
616616
||
617-
((seg_map->reloc_tab_end != 0) &&
618-
(seg_map->reloc_tab_end > seg_map->end)) ||
619-
((seg_map->reloc_tab_len_end != 0) &&
620-
(seg_map->reloc_tab_len_end > seg_map->end)) ||
617+
((seg_map->text_reloc_tab.end != 0) &&
618+
(seg_map->text_reloc_tab.end > seg_map->end)) ||
619+
((seg_map->text_reloc_tab.len_end != 0) &&
620+
(seg_map->text_reloc_tab.len_end > seg_map->end)) ||
621621
(seg_map->text_end > seg_map->end) ||
622622
(seg_map->rodata_end > seg_map->end) ||
623623
(seg_map->data_end > seg_map->end) ||
@@ -631,15 +631,15 @@ int wc_fips_generate_hash(
631631
}
632632

633633
#if defined(WC_SYM_RELOC_TABLES) || defined(WC_SYM_RELOC_TABLES_SUPPORT)
634-
if ((seg_map->reloc_tab_len_end != 0) &&
635-
(seg_map->reloc_tab_len_end - seg_map->reloc_tab_len_start != sizeof(word32)))
634+
if ((seg_map->text_reloc_tab.len_end != 0) &&
635+
(seg_map->text_reloc_tab.len_end - seg_map->text_reloc_tab.len_start != sizeof(word32)))
636636
{
637637
RELOC_DEBUG_PRINTF("assert failed.\n");
638638
return BAD_FUNC_ARG;
639639
}
640-
else if (seg_map->reloc_tab_len_start & (sizeof(word32) - 1)) {
641-
/* fprintf(stderr, "%s: seg_map->reloc_tab_len_start isn't properly aligned: 0x%llx.\n", progname, (
642-
unsigned long long)seg_map->reloc_tab_len_start); */
640+
else if (seg_map->text_reloc_tab.len_start & (sizeof(word32) - 1)) {
641+
/* fprintf(stderr, "%s: seg_map->text_reloc_tab.len_start isn't properly aligned: 0x%llx.\n", progname, (
642+
unsigned long long)seg_map->text_reloc_tab.len_start); */
643643
RELOC_DEBUG_PRINTF("assert failed.\n");
644644
return BAD_ALIGN_E;
645645
}
@@ -649,8 +649,8 @@ int wc_fips_generate_hash(
649649
* a nonsense byte-swapped value, or the final reloc_tab ent has
650650
* nonsense flags.
651651
*/
652-
word32 reloc_tab_len = *(const word32 *)seg_map->reloc_tab_len_start;
653-
const struct wc_reloc_table_ent *reloc_tab = (const struct wc_reloc_table_ent *)seg_map->reloc_tab_start;
652+
word32 reloc_tab_len = *(const word32 *)seg_map->text_reloc_tab.len_start;
653+
const struct wc_reloc_table_ent *reloc_tab = (const struct wc_reloc_table_ent *)seg_map->text_reloc_tab.start;
654654
if (reloc_tab_len == 0) {
655655
RELOC_DEBUG_PRINTF("assert failed.\n");
656656
return BAD_FUNC_ARG;
@@ -667,14 +667,14 @@ int wc_fips_generate_hash(
667667
RELOC_DEBUG_PRINTF("assert failed.\n");
668668
return BAD_FUNC_ARG;
669669
}
670-
else if ((seg_map->reloc_tab_end != 0) &&
671-
(seg_map->reloc_tab_end - seg_map->reloc_tab_start != sizeof(struct wc_reloc_table_ent) * *(const word32 *)seg_map->reloc_tab_len_start))
670+
else if ((seg_map->text_reloc_tab.end != 0) &&
671+
(seg_map->text_reloc_tab.end - seg_map->text_reloc_tab.start != sizeof(struct wc_reloc_table_ent) * *(const word32 *)seg_map->text_reloc_tab.len_start))
672672
{
673673
/*
674-
fprintf(stderr, "%s: wc_linuxkm_pie_reloc_tab_length from module (%u) is inconsistent with actual reloc_tab size %llu.\n",
674+
fprintf(stderr, "%s: wc_linuxkm_pie_text_reloc_tab_length from module (%u) is inconsistent with actual text_reloc_tab size %llu.\n",
675675
progname,
676-
*(const word32 *)seg_map->reloc_tab_len_start,
677-
(unsigned long long)(seg_map->reloc_tab_end - seg_map->reloc_tab_start));
676+
*(const word32 *)seg_map->text_reloc_tab.len_start,
677+
(unsigned long long)(seg_map->text_reloc_tab.end - seg_map->text_reloc_tab.start));
678678
*/
679679
RELOC_DEBUG_PRINTF("assert failed.\n");
680680
return BAD_FUNC_ARG;

‎linuxkm/linuxkm_memory.h‎

Lines changed: 33 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -80,13 +80,25 @@ struct __attribute__((packed)) wc_reloc_table_ent {
8080

8181
/* full ELF fencepost representation, to allow wc_reloc_normalize_text() */
8282

83+
struct wc_reloc_table_fenceposts {
84+
unsigned long start;
85+
unsigned long end;
86+
unsigned long len_start;
87+
unsigned long len_end;
88+
};
89+
90+
#define WC_RELOC_TABLE_FENCEPOSTS_INITIALIZER { \
91+
.start = ~0UL, \
92+
.end = ~0UL, \
93+
.len_start = ~0UL, \
94+
.len_end = ~0UL \
95+
}
96+
8397
struct wc_reloc_table_segments {
8498
unsigned long start;
8599
unsigned long end;
86-
unsigned long reloc_tab_start;
87-
unsigned long reloc_tab_end;
88-
unsigned long reloc_tab_len_start;
89-
unsigned long reloc_tab_len_end;
100+
struct wc_reloc_table_fenceposts text_reloc_tab;
101+
struct wc_reloc_table_fenceposts rodata_reloc_tab;
90102
unsigned long text_start;
91103
unsigned long text_end;
92104
#ifdef HAVE_FIPS
@@ -113,10 +125,8 @@ struct wc_reloc_table_segments {
113125
#define WC_RELOC_TABLE_SEGMENTS_INITIALIZER { \
114126
.start = ~0UL, \
115127
.end = ~0UL, \
116-
.reloc_tab_start = ~0UL, \
117-
.reloc_tab_end = ~0UL, \
118-
.reloc_tab_len_start = ~0UL, \
119-
.reloc_tab_len_end = ~0UL, \
128+
.text_reloc_tab = WC_RELOC_TABLE_FENCEPOSTS_INITIALIZER, \
129+
.rodata_reloc_tab = WC_RELOC_TABLE_FENCEPOSTS_INITIALIZER, \
120130
.text_start = ~0UL, \
121131
.text_end = ~0UL, \
122132
.fips_text_start = ~0UL, \
@@ -139,10 +149,8 @@ struct wc_reloc_table_segments {
139149
#define WC_RELOC_TABLE_SEGMENTS_INITIALIZER { \
140150
.start = ~0UL, \
141151
.end = ~0UL, \
142-
.reloc_tab_start = ~0UL, \
143-
.reloc_tab_end = ~0UL, \
144-
.reloc_tab_len_start = ~0UL, \
145-
.reloc_tab_len_end = ~0UL, \
152+
.text_reloc_tab = WC_RELOC_TABLE_FENCEPOSTS_INITIALIZER, \
153+
.rodata_reloc_tab = WC_RELOC_TABLE_FENCEPOSTS_INITIALIZER, \
146154
.text_start = ~0UL, \
147155
.text_end = ~0UL, \
148156
.rodata_start = ~0UL, \
@@ -200,8 +208,12 @@ struct wc_reloc_counts {
200208

201209
#if defined(WC_SYM_RELOC_TABLES) || defined(WC_SYM_RELOC_TABLES_SUPPORT)
202210

211+
#ifndef WOLFSSL_SEGMENT_CANONICALIZER_BUFSIZ
212+
#define WOLFSSL_SEGMENT_CANONICALIZER_BUFSIZ 8192
213+
#endif
214+
203215
#ifndef WOLFSSL_TEXT_SEGMENT_CANONICALIZER_BUFSIZ
204-
#define WOLFSSL_TEXT_SEGMENT_CANONICALIZER_BUFSIZ 8192
216+
#define WOLFSSL_TEXT_SEGMENT_CANONICALIZER_BUFSIZ WOLFSSL_SEGMENT_CANONICALIZER_BUFSIZ
205217
#endif
206218

207219
WOLFSSL_API ssize_t wc_reloc_normalize_text(
@@ -212,6 +224,14 @@ WOLFSSL_API ssize_t wc_reloc_normalize_text(
212224
const struct wc_reloc_table_segments *seg_map,
213225
struct wc_reloc_counts *reloc_counts);
214226

227+
WOLFSSL_API ssize_t wc_reloc_normalize_rodata(
228+
const byte *rodata_in,
229+
size_t rodata_in_len,
230+
byte *rodata_out,
231+
ssize_t *cur_index_p,
232+
const struct wc_reloc_table_segments *seg_map,
233+
struct wc_reloc_counts *reloc_counts);
234+
215235
#endif /* WC_SYM_RELOC_TABLES || WC_SYM_RELOC_TABLES_SUPPORT */
216236

217237
#ifdef HAVE_FIPS

‎linuxkm/module_hooks.c‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -621,7 +621,7 @@ static int wolfssl_init(void)
621621
#ifdef HAVE_FIPS
622622
/* The compiled-in verifycore must be the right length, else the module
623623
* geometry will change when the correct value is passed in, destabilizing
624-
* wc_linuxkm_pie_reloc_tab. It also must be the right length for the
624+
* wc_linuxkm_pie_text_reloc_tab. It also must be the right length for the
625625
* module-update-fips-hash recipe (in-place overwrite) to work, and for
626626
* updateFipsHash() (WOLFCRYPT_FIPS_CORE_DYNAMIC_HASH_VALUE) to be safe from
627627
* overruns.
@@ -1118,17 +1118,17 @@ MODULE_VERSION(LIBWOLFSSL_VERSION_STRING);
11181118

11191119
#ifdef WC_SYM_RELOC_TABLES
11201120

1121-
extern const struct wc_reloc_table_ent wc_linuxkm_pie_reloc_tab[];
1122-
extern const unsigned int wc_linuxkm_pie_reloc_tab_length;
1121+
extern const struct wc_reloc_table_ent wc_linuxkm_pie_text_reloc_tab[];
1122+
extern const unsigned int wc_linuxkm_pie_text_reloc_tab_length;
11231123

11241124
static const struct wc_reloc_table_segments seg_map = {
11251125
.start = 0, .end = 0,
11261126
.text_start = (size_t)(uintptr_t)__wc_text_start,
11271127
.text_end = (size_t)(uintptr_t)__wc_text_end,
1128-
.reloc_tab_start = (size_t)(uintptr_t)wc_linuxkm_pie_reloc_tab,
1129-
.reloc_tab_end = 0,
1130-
.reloc_tab_len_start = (size_t)(uintptr_t)&wc_linuxkm_pie_reloc_tab_length,
1131-
.reloc_tab_len_end = 0,
1128+
.text_reloc_tab.start = (size_t)(uintptr_t)wc_linuxkm_pie_text_reloc_tab,
1129+
.text_reloc_tab.end = 0,
1130+
.text_reloc_tab.len_start = (size_t)(uintptr_t)&wc_linuxkm_pie_text_reloc_tab_length,
1131+
.text_reloc_tab.len_end = 0,
11321132
#ifdef HAVE_FIPS
11331133
#ifdef WC_USE_PIE_FENCEPOSTS_FOR_FIPS
11341134
.fips_text_start = (size_t)(uintptr_t)__wc_text_start,

0 commit comments

Comments
 (0)