When CONFIG_DEBUG_INFO_BTF_MODULES=y, there are two problems for the standalone crypto kernel module.
First, it requires a make dependency `.ko: vmlinux` because it takes vmlinux as input to generate BTF info for the module, and inserts such info into the `.ko` module binary as a dedicated ELF section. This can cause an unwanted circular make rule dependency `fips140.ko:vmlinux` because fips140.ko is already embedded into vmlinux. To address this issue, we reuse the same script to explicitly generate fips140.ko's BTF info in the vmlinux generation process to avoid the circular make dependency. We link vmlinux first, then use it to generate fips140.ko's BTF info, and then embed the fips140.ko and its BTF info back with vmlinux by re-linking. Since the fips140.ko's BTF info is embedded as data only into vmlinux, the BTF info generated using the first linked vmlinux will be the same as if using the latest vmlinux. Second, CONFIG_DEBUG_INFO_BTF_MODULES=y will insert BTF info into fips140.ko binary, which means the previously generated module signature on "fips140.ko" binary becomes invalid, thus needing regeneration. To avoid this issue, we don't re-insert module's BTF info into fips140.ko binary (as normally done), but keep such info as a separate file, and embed into vmlinux as separate ELF section. By doing this, the fips140.ko binary remains unchanged while its latest up-to-date BTF info is available to kernel. Signed-off-by: Jay Wang <[email protected]> --- arch/arm64/kernel/vmlinux.lds.S | 8 ++++++++ arch/x86/kernel/vmlinux.lds.S | 8 ++++++++ crypto/fips140/Makefile | 2 +- crypto/fips140/fips140-loader.c | 12 ++++++++++++ kernel/bpf/btf.c | 20 ++++++++++++++++++++ kernel/module/main.c | 27 +++++++++++++++++++++++++++ scripts/Makefile.vmlinux | 28 ++++++++++++++++++++++++++++ scripts/link-vmlinux.sh | 3 +++ 8 files changed, 107 insertions(+), 1 deletion(-) diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S index 8d7905b9207ef..53acbe87b4539 100644 --- a/arch/arm64/kernel/vmlinux.lds.S +++ b/arch/arm64/kernel/vmlinux.lds.S @@ -215,6 +215,14 @@ SECTIONS KEEP(*(.fips140_digest)) _binary_fips140_hmac_end = .; } +#ifdef CONFIG_DEBUG_INFO_BTF_MODULES + .fips140_btf : { + . = ALIGN(8); + __start_fips140_btf = .; + KEEP(*(.fips140_btf)) + __stop_fips140_btf = .; + } +#endif #endif HYPERVISOR_RODATA_SECTIONS diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S index 392d209082427..d06ac39f931bd 100644 --- a/arch/x86/kernel/vmlinux.lds.S +++ b/arch/x86/kernel/vmlinux.lds.S @@ -185,6 +185,14 @@ SECTIONS KEEP(*(.fips140_digest)) _binary_fips140_hmac_end = .; } +#ifdef CONFIG_DEBUG_INFO_BTF_MODULES + .fips140_btf : AT(ADDR(.fips140_btf) - LOAD_OFFSET) { + . = ALIGN(8); + __start_fips140_btf = .; + KEEP(*(.fips140_btf)) + __stop_fips140_btf = .; + } +#endif #endif /* Data */ diff --git a/crypto/fips140/Makefile b/crypto/fips140/Makefile index db61f1113d686..a4973c48dbe43 100644 --- a/crypto/fips140/Makefile +++ b/crypto/fips140/Makefile @@ -7,4 +7,4 @@ obj-y += fips140-loader.o CFLAGS_fips140-fn-redirect.o += -I$(obj) CFLAGS_fips140-module.o += -DFIPS140_CORE -clean-files:= .fips140.order .fips140.symvers .fips140-fn-redirect.h .fips140.exported .fips140.hmac \ No newline at end of file +clean-files:= .fips140.order .fips140.symvers .fips140-fn-redirect.h .fips140.exported .fips140.hmac .fips140.ko.btf \ No newline at end of file diff --git a/crypto/fips140/fips140-loader.c b/crypto/fips140/fips140-loader.c index d2eb14f406d6e..9665ddb26e2d1 100644 --- a/crypto/fips140/fips140-loader.c +++ b/crypto/fips140/fips140-loader.c @@ -26,6 +26,13 @@ EXPORT_SYMBOL_GPL(_binary_crypto_hmac_start); const u8 *_binary_crypto_hmac_end; EXPORT_SYMBOL_GPL(_binary_crypto_hmac_end); +#ifdef CONFIG_DEBUG_INFO_BTF_MODULES +extern const u8 __start_fips140_btf[]; +extern const u8 __stop_fips140_btf[]; +const u8 *__start_crypto_btf; +const u8 *__stop_crypto_btf; +#endif + /* Function to load crypto module from memory */ extern int load_crypto_module_mem(const char *mem, size_t size); @@ -35,6 +42,11 @@ static void load_prepare(void) _binary_crypto_ko_end = _binary_fips140_ko_end; _binary_crypto_hmac_start = _binary_fips140_hmac_start; _binary_crypto_hmac_end = _binary_fips140_hmac_end; + +#ifdef CONFIG_DEBUG_INFO_BTF_MODULES + __start_crypto_btf = __start_fips140_btf; + __stop_crypto_btf = __stop_fips140_btf; +#endif } static int fips_loader_init(void) diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c index a62d785812076..b59155e7e3403 100644 --- a/kernel/bpf/btf.c +++ b/kernel/bpf/btf.c @@ -8474,6 +8474,26 @@ static int __init btf_module_init(void) return 0; } +#if defined(CONFIG_CRYPTO_FIPS140_EXTMOD) && defined(CONFIG_DEBUG_INFO_BTF_MODULES) +/* Handle deferred BTF registration for FIPS140 loaded before btf_kobj exists */ +struct module *fips140_deferred_mod = NULL; + +static int __init register_deferred_fips140_btf(void) +{ + if (fips140_deferred_mod && btf_kobj) { + /* Manually trigger BTF registration for FIPS140 */ + btf_module_notify(NULL, MODULE_STATE_COMING, fips140_deferred_mod); + fips140_deferred_mod = NULL; + pr_info("FIPS140 BTF registration completed\n"); + } else { + pr_info("FIPS140 BTF registration skipped: deferred_mod=%p, btf_kobj=%p\n", + fips140_deferred_mod, btf_kobj); + } + return 0; +} +late_initcall(register_deferred_fips140_btf); +#endif + fs_initcall(btf_module_init); #endif /* CONFIG_DEBUG_INFO_BTF_MODULES */ diff --git a/kernel/module/main.c b/kernel/module/main.c index 69949069dc5f5..a0a7880408701 100644 --- a/kernel/module/main.c +++ b/kernel/module/main.c @@ -2715,6 +2715,23 @@ static int find_module_sections(struct module *mod, struct load_info *info) mod->btf_data = any_section_objs(info, ".BTF", 1, &mod->btf_data_size); mod->btf_base_data = any_section_objs(info, ".BTF.base", 1, &mod->btf_base_data_size); + +#ifdef CONFIG_CRYPTO_FIPS140_EXTMOD + /* Inject embedded BTF for FIPS140 module */ + if (!mod->btf_data && (info->flags & MODULE_INIT_CRYPTO_FROM_MEM)) { + extern u8 *__start_crypto_btf; + extern u8 *__stop_crypto_btf; + size_t btf_size = __stop_crypto_btf - __start_crypto_btf; + + pr_info("FIPS140: Attempting BTF injection, btf_size=%zu\n", btf_size); + + if (btf_size > 0) { + mod->btf_data = __start_crypto_btf; + mod->btf_data_size = btf_size; + pr_info("FIPS140: Injected embedded BTF data, size %zu\n", btf_size); + } + } +#endif #endif #ifdef CONFIG_JUMP_LABEL mod->jump_entries = section_objs(info, "__jump_table", @@ -3403,6 +3420,16 @@ static int prepare_coming_module(struct module *mod) err = blocking_notifier_call_chain_robust(&module_notify_list, MODULE_STATE_COMING, MODULE_STATE_GOING, mod); err = notifier_to_errno(err); +#if defined(CONFIG_CRYPTO_FIPS140_EXTMOD) && defined(CONFIG_DEBUG_INFO_BTF_MODULES) + /* Since fips140 module is loaded too early when BTF subsystem is not ready, + * record this module for later BTF registration processing */ + if (!strcmp(mod->name, "fips140")) { + pr_info("FIPS140 BTF MODULE_STATE_COMING: processing BTF registration\n"); + extern struct module *fips140_deferred_mod; + fips140_deferred_mod = mod; /* Store for later reference */ + } +#endif + if (err) klp_module_going(mod); diff --git a/scripts/Makefile.vmlinux b/scripts/Makefile.vmlinux index 93b382e08892d..b30d65f8b6b3d 100644 --- a/scripts/Makefile.vmlinux +++ b/scripts/Makefile.vmlinux @@ -62,10 +62,38 @@ endif ARCH_POSTLINK := $(wildcard $(srctree)/arch/$(SRCARCH)/Makefile.postlink) +fips140_build = . +ifeq ($(CONFIG_CRYPTO_FIPS140_EXTMOD_SOURCE),y) +fips140_build = fips140_build +endif + # Final link of vmlinux with optional arch pass after final link cmd_link_vmlinux = \ $< "$(LD)" "$(KBUILD_LDFLAGS)" "$(LDFLAGS_vmlinux)" "$@"; \ $(if $(ARCH_POSTLINK), $(MAKE) -f $(ARCH_POSTLINK) $@, true) +ifdef CONFIG_CRYPTO_FIPS140_EXTMOD +ifdef CONFIG_DEBUG_INFO_BTF_MODULES + cmd_link_vmlinux += ; \ + cp $(fips140_build)/crypto/fips140/fips140.ko crypto/fips140/fips140.ko.tmp; \ + LLVM_OBJCOPY="$(OBJCOPY)" $(PAHOLE) -J $(PAHOLE_FLAGS) $(MODULE_PAHOLE_FLAGS) --btf_base $@ crypto/fips140/fips140.ko.tmp; \ + $(RESOLVE_BTFIDS) -b $@ crypto/fips140/fips140.ko.tmp; \ + $(OBJCOPY) --dump-section=.BTF=crypto/fips140/.fips140.ko.btf crypto/fips140/fips140.ko.tmp; \ + cp crypto/fips140/.fips140.ko.btf crypto/fips140/.fips140.ko.btf.first; \ + rm -f crypto/fips140/fips140.ko.tmp; \ + $(LD) -r -b binary -o crypto/fips140/fips140_btf.o crypto/fips140/.fips140.ko.btf; \ + $(OBJCOPY) --rename-section .data=.fips140_btf crypto/fips140/fips140_btf.o; \ + rm -f $@; \ + FIPS140_BTF_RELINK=1 $< "$(LD)" "$(KBUILD_LDFLAGS)" "$(LDFLAGS_vmlinux)" "$@"; \ + cp $(fips140_build)/crypto/fips140/fips140.ko crypto/fips140/fips140.ko.tmp2; \ + LLVM_OBJCOPY="$(OBJCOPY)" $(PAHOLE) -J $(PAHOLE_FLAGS) $(MODULE_PAHOLE_FLAGS) --btf_base $@ crypto/fips140/fips140.ko.tmp2; \ + $(RESOLVE_BTFIDS) -b $@ crypto/fips140/fips140.ko.tmp2; \ + $(OBJCOPY) --dump-section=.BTF=crypto/fips140/.fips140.ko.btf.second crypto/fips140/fips140.ko.tmp2; \ + rm -f crypto/fips140/fips140.ko.tmp2; \ + diff crypto/fips140/.fips140.ko.btf.first crypto/fips140/.fips140.ko.btf.second >/dev/null || echo "Module BTF differs"; \ + rm -f crypto/fips140/.fips140.ko.btf.first crypto/fips140/.fips140.ko.btf.second; \ + $(if $(ARCH_POSTLINK), $(MAKE) -f $(ARCH_POSTLINK) $@, true) +endif +endif ifdef CONFIG_CRYPTO_FIPS140_EXTMOD fips140-deps := crypto/fips140/fips140-embedded.o crypto/fips140/fips140-digest.o diff --git a/scripts/link-vmlinux.sh b/scripts/link-vmlinux.sh index e5f0eef865f78..de40d6bb3a93d 100755 --- a/scripts/link-vmlinux.sh +++ b/scripts/link-vmlinux.sh @@ -78,6 +78,9 @@ vmlinux_link() if is_enabled CONFIG_CRYPTO_FIPS140_EXTMOD; then objs="${objs} crypto/fips140/fips140-embedded.o crypto/fips140/fips140-digest.o" + if is_enabled CONFIG_DEBUG_INFO_BTF_MODULES && [ -n "${FIPS140_BTF_RELINK}" ] && [ -f crypto/fips140/fips140_btf.o ]; then + objs="${objs} crypto/fips140/fips140_btf.o" + fi fi objs="${objs} init/version-timestamp.o" -- 2.47.3
