Skip to content

Commit b6adf12

Browse files
JacobBarthelmehJacobBarthelmeh
authored
Merge pull request #9438 from douzzer/20251113-linuxkm-aarch64-fips-tweaks
20251113-linuxkm-aarch64-fips-tweaks
2 parents bea6bcb + 30487ad commit b6adf12

File tree

7 files changed

+303
-133
lines changed

7 files changed

+303
-133
lines changed

‎linuxkm/Kbuild‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,10 @@ ifeq "$(KERNEL_ARCH)" "aarch64"
4343
WOLFSSL_CFLAGS += -mno-outline-atomics
4444
else ifeq "$(KERNEL_ARCH)" "arm64"
4545
WOLFSSL_CFLAGS += -mno-outline-atomics
46+
else ifeq "$(KERNEL_ARCH)" "arm"
47+
# avoids R_ARM_THM_JUMP11 relocations, including a stubborn tail recursion
48+
# optimization from wc_sp_cmp to wc_sp_cmp_mag:
49+
WOLFSSL_CFLAGS += -fno-optimize-sibling-calls -Os
4650
endif
4751

4852
obj-m := libwolfssl.o
@@ -97,7 +101,7 @@ else
97101
WOLFSSL_CFLAGS_YES_VECTOR_INSNS := $(WOLFSSL_CFLAGS_NO_VECTOR_INSNS)
98102
endif
99103

100-
ccflags-y := $(WOLFSSL_CFLAGS) $(WOLFSSL_CFLAGS_NO_VECTOR_INSNS)
104+
ccflags-y = $(WOLFSSL_CFLAGS) $(WOLFSSL_CFLAGS_NO_VECTOR_INSNS)
101105

102106
ifeq "$(ENABLED_LINUXKM_PIE)" "yes"
103107
# note, we need -fno-stack-protector to avoid references to
@@ -127,6 +131,9 @@ ifeq "$(ENABLED_LINUXKM_PIE)" "yes"
127131

128132
OBJECT_FILES_NON_STANDARD := y
129133
endif
134+
ifeq "$(KERNEL_ARCH)" "arm"
135+
PIE_FLAGS += -fno-unwind-tables
136+
endif
130137
ifeq "$(KERNEL_ARCH)" "mips"
131138
PIE_FLAGS += -mabicalls
132139
endif
@@ -139,7 +146,7 @@ ifeq "$(ENABLED_LINUXKM_PIE)" "yes"
139146
endif
140147

141148
ifdef KERNEL_EXTRA_CFLAGS_REMOVE
142-
ccflags-remove-y += KERNEL_EXTRA_CFLAGS_REMOVE
149+
ccflags-remove-y += $(KERNEL_EXTRA_CFLAGS_REMOVE)
143150
endif
144151

145152
$(obj)/libwolfssl.mod.o: ccflags-y := $(PIE_SUPPORT_FLAGS)

‎linuxkm/Makefile‎

Lines changed: 174 additions & 62 deletions
Original file line numberDiff line numberDiff line change
@@ -73,17 +73,17 @@ OVERRIDE_PATHS :=
7373

7474
ifdef CC
7575
ifneq "$(CC)" "cc"
76-
OVERRIDE_PATHS := $(OVERRIDE_PATHS) 'CC=$(CC)'
76+
OVERRIDE_PATHS := $(OVERRIDE_PATHS) 'CC=$(CC)'
7777
endif
7878
endif
7979
ifdef AS
8080
ifneq "$(AS)" "as"
81-
OVERRIDE_PATHS := $(OVERRIDE_PATHS) 'AS=$(AS)'
81+
OVERRIDE_PATHS := $(OVERRIDE_PATHS) 'AS=$(AS)'
8282
endif
8383
endif
8484
ifdef LD
8585
ifneq "$(LD)" "ld"
86-
OVERRIDE_PATHS := $(OVERRIDE_PATHS) 'LD=$(LD)'
86+
OVERRIDE_PATHS := $(OVERRIDE_PATHS) 'LD=$(LD)'
8787
endif
8888
endif
8989

@@ -103,14 +103,39 @@ ifndef MAKE_TMPDIR
103103
MAKE_TMPDIR := $(TMPDIR)
104104
endif
105105

106-
GENERATE_RELOC_TAB := $(AWK) 'BEGIN { \
106+
GENERATE_SECTION_MAP := $(AWK) 'BEGIN { printf("") >ENVIRON["SECTION_MAP"]; } \
107+
{ \
108+
if ($$7 !~ "^[0-9]+$$") \
109+
next; \
110+
if ($$4 == "SECTION") { \
111+
sections[$$7] = $$8; \
112+
next; \
113+
} \
114+
if (($$4 == "NOTYPE") || ($$4 == "OBJECT") || ($$4 == "FUNC")) { \
115+
if (($$8 == "$$d") || ($$8 == "$$t")) \
116+
next; \
117+
if ($$7 in sections) { \
118+
if (sections[$$7] ~ "_wolfcrypt$$") \
119+
print $$8 "\t" sections[$$7] >>ENVIRON["SECTION_MAP"]; \
120+
} else \
121+
print $$8 " is in section " $$7 " with no name mapping." >"/dev/stderr";\
122+
} \
123+
}'
124+
125+
GENERATE_RELOC_TAB := $(AWK) ' \
126+
BEGIN { \
107127
n=0; \
108128
bad_relocs=0; \
109129
print "\#include <wolfssl/wolfcrypt/libwolfssl_sources.h>"; \
110130
printf("%s\n ", \
111-
"WOLFSSL_LOCAL const unsigned int wc_linuxkm_pie_reloc_tab[] = { "); \
131+
"WOLFSSL_LOCAL const unsigned int wc_linuxkm_pie_reloc_tab[] = { "); \
132+
if ("SECTION_MAP" in ENVIRON) { \
133+
while (getline <ENVIRON["SECTION_MAP"] > 0) \
134+
section_map[$$1] = $$2; \
135+
close(ENVIRON["SECTION_MAP"]); \
136+
} \
112137
} \
113-
/^Relocation section '\''\.rela\.text_wolfcrypt'\''/ { \
138+
/^Relocation section '\''\.rela?\.text_wolfcrypt'\''/ { \
114139
p=1; \
115140
next; \
116141
} \
@@ -119,19 +144,55 @@ GENERATE_RELOC_TAB := $(AWK) 'BEGIN { \
119144
} \
120145
/^0/ { \
121146
if (p) { \
122-
if ($$3 !~ "^(R_X86_64_PLT32|R_X86_64_PC32|R_AARCH64_.*)$$") { \
123-
print "Unexpected relocation type:\n" $$0 >"/dev/stderr"; \
124-
++bad_relocs; \
125-
} \
126-
printf("0x%s%s", \
127-
gensub("^0*","",1,$$1), \
128-
((++n%8) ? ", " : ",\n ")); \
147+
if ($$3 !~ "^(R_X86_64_PLT32|R_X86_64_PC32|R_AARCH64_.*|R_ARM.*)$$") { \
148+
print "Unexpected relocation type:\n" $$0 >"/dev/stderr"; \
149+
++bad_relocs; \
150+
} \
151+
if ($$5 in section_map) \
152+
section = section_map[$$5]; \
153+
else if ($$5 ~ "^\\.") \
154+
section = $$5; \
155+
else \
156+
section = ""; \
157+
if (section) { \
158+
switch (section) { \
159+
case ".text_wolfcrypt": \
160+
section_tag = 0; \
161+
break; \
162+
case ".rodata_wolfcrypt": \
163+
section_tag = 1; \
164+
break; \
165+
case ".data_wolfcrypt": \
166+
section_tag = 2; \
167+
break; \
168+
case ".bss_wolfcrypt": \
169+
section_tag = 3; \
170+
break; \
171+
default: \
172+
print "Unexpected section:\n" $$0 >"/dev/stderr"; \
173+
++bad_relocs; \
174+
section_tag = 4; \
175+
} \
176+
} else { \
177+
print "Unresolvable symbol reference for relocation:\n" $$0 >"/dev/stderr";\
178+
++bad_relocs; \
179+
section_tag = 4; \
180+
} \
181+
if (strtonum("0x" gensub("^0*","",1,$$1)) >= lshift(1, 29)) { \
182+
print "Relocation offset overflow:" >"/dev/stderr"; \
183+
print >"/dev/stderr"; \
184+
exit(1); \
185+
} \
186+
printf("0x%xU%s", \
187+
or(strtonum("0x" gensub("^0*","",1,$$1)), \
188+
lshift(section_tag, 29)), \
189+
((++n%8) ? ", " : ",\n ")); \
129190
} \
130191
} \
131192
END { \
132193
if (bad_relocs) { \
133-
print "Found " bad_relocs " unexpected relocations." >"/dev/stderr"; \
134-
exit(1); \
194+
print "Found " bad_relocs " unresolvable relocations." >"/dev/stderr"; \
195+
exit(1); \
135196
} \
136197
print "~0U };\nWOLFSSL_LOCAL const unsigned long wc_linuxkm_pie_reloc_tab_length = sizeof wc_linuxkm_pie_reloc_tab / sizeof wc_linuxkm_pie_reloc_tab[0];";\
137198
}'
@@ -140,88 +201,139 @@ ifeq "$(V)" "1"
140201
vflag := --verbose
141202
endif
142203

204+
# This rule is .PHONY because it doesn't actually build the module -- Kbuild
205+
# does, and we always need to call Kbuild to enforce rebuild for dependencies
206+
# and config changes.
143207
.PHONY: libwolfssl.ko
144208
libwolfssl.ko:
145-
@function resolved_link_is_equal() { [[ -L "$$1" && ("$$(readlink -f "$$1")" == "$$(readlink -f "$$2")") ]] }
209+
@set -e
210+
@[[ '$(V)' == 1 ]] && { echo 'MODULE_TOP = "$(MODULE_TOP)"';
211+
echo 'SRC_TOP = "$(SRC_TOP)"';
212+
echo 'AM_CPPFLAGS = "$(AM_CPPFLAGS)"';
213+
echo 'CPPFLAGS = "$(CPPFLAGS)"';
214+
echo 'AM_CFLAGS = "$(AM_CFLAGS)"';
215+
echo 'CFLAGS = "$(CFLAGS)"';
216+
echo 'KERNEL_EXTRA_CFLAGS = "$(KERNEL_EXTRA_CFLAGS)"';
217+
echo 'FIPS_OPTEST = "$(FIPS_OPTEST)"';
218+
echo 'AM_CCASFLAGS = "$(AM_CCASFLAGS)"';
219+
echo 'CCASFLAGS = "$(CCASFLAGS)"';
220+
echo 'src_libwolfssl_la_OBJECTS = "$(src_libwolfssl_la_OBJECTS)"';
221+
echo 'ENABLED_CRYPT_TESTS = "$(ENABLED_CRYPT_TESTS)"';
222+
echo 'ENABLED_LINUXKM_LKCAPI_REGISTER = "$(ENABLED_LINUXKM_LKCAPI_REGISTER)"';
223+
echo 'ENABLED_LINUXKM_BENCHMARKS = "$(ENABLED_LINUXKM_BENCHMARKS)"';
224+
echo 'ENABLED_LINUXKM_PIE = "$(ENABLED_LINUXKM_PIE)"';
225+
echo 'host_triplet = "$(host_triplet)"';
226+
echo 'build_triplet = "$(build_triplet)"';
227+
echo 'CC = "$(CC)"';
228+
echo 'AS = "$(AS)"';
229+
echo 'LD = "$(LD)"';
230+
echo 'READELF = "$(READELF)"';
231+
echo 'AWK = "$(AWK)"';
232+
echo 'TMPDIR = "$(TMPDIR)"';
233+
echo 'MAKE_TMPDIR = "$(MAKE_TMPDIR)"';
234+
echo 'KERNEL_ROOT = "$(KERNEL_ROOT)"';
235+
echo 'obj = "$(obj)"';
236+
echo 'RM = "$(RM)"';
237+
echo 'KERNEL_ARCH = "$(KERNEL_ARCH)"';
238+
echo 'FIPS_HASH = "$(FIPS_HASH)"';
239+
echo 'MAKE = "$(MAKE)"';
240+
echo 'ENABLED_ASM = "$(ENABLED_ASM)"';
241+
echo 'CFLAGS_FPU_DISABLE = "$(CFLAGS_FPU_DISABLE)"';
242+
echo 'CFLAGS_FPU_ENABLE = "$(CFLAGS_FPU_ENABLE)"';
243+
echo 'CFLAGS_SIMD_DISABLE = "$(CFLAGS_SIMD_DISABLE)"';
244+
echo 'CFLAGS_SIMD_ENABLE = "$(CFLAGS_SIMD_ENABLE)"';
245+
echo 'CFLAGS_AUTO_VECTORIZE_DISABLE = "$(CFLAGS_AUTO_VECTORIZE_DISABLE)"';
246+
echo 'CFLAGS_AUTO_VECTORIZE_ENABLE = "$(CFLAGS_AUTO_VECTORIZE_ENABLE)"';
247+
echo 'ASFLAGS_FPU_DISABLE_SIMD_ENABLE = "$(ASFLAGS_FPU_DISABLE_SIMD_ENABLE)"';
248+
echo 'ASFLAGS_FPU_ENABLE_SIMD_DISABLE = "$(ASFLAGS_FPU_ENABLE_SIMD_DISABLE)"';
249+
echo 'ASFLAGS_FPUSIMD_DISABLE = "$(ASFLAGS_FPUSIMD_DISABLE)"';
250+
echo 'ASFLAGS_FPUSIMD_ENABLE = "$(ASFLAGS_FPUSIMD_ENABLE)"'; }
251+
@function resolved_link_is_equal() { [[ -L "$$1" && "$$(readlink -f "$$1")" == "$$(readlink -f "$$2")" ]]; }
146252
@if test -z '$(KERNEL_ROOT)'; then echo '$$KERNEL_ROOT is unset' >&2; exit 1; fi
147253
@if test -z '$(AM_CFLAGS)$(CFLAGS)'; then echo '$$AM_CFLAGS and $$CFLAGS are both unset.' >&2; exit 1; fi
148254
@if test -z '$(src_libwolfssl_la_OBJECTS)'; then echo '$$src_libwolfssl_la_OBJECTS is unset.' >&2; exit 1; fi
149-
# after commit 9a0ebe5011 (6.10), sources must be in $(obj). work around this by making links to all needed sources:
255+
# after commit 9a0ebe5011 (6.10), sources must be in $(obj). work around this by making links to all needed sources:
150256
@mkdir -p '$(MODULE_TOP)/linuxkm'
151257
@resolved_link_is_equal '$(MODULE_TOP)/linuxkm/module_hooks.c' '$(MODULE_TOP)/module_hooks.c' || cp $(vflag) --no-dereference --symbolic-link --no-clobber '$(MODULE_TOP)'/*.[ch] '$(MODULE_TOP)/linuxkm/'
152258
@resolved_link_is_equal '$(MODULE_TOP)/wolfcrypt/src/wc_port.c' '$(SRC_TOP)/wolfcrypt/src/wc_port.c' || cp $(vflag) --no-dereference --symbolic-link --no-clobber --recursive '$(SRC_TOP)/wolfcrypt' '$(MODULE_TOP)/'
153259
@resolved_link_is_equal '$(MODULE_TOP)/src/wolfio.c' '$(SRC_TOP)/src/wolfio.c' || cp $(vflag) --no-dereference --symbolic-link --no-clobber --recursive '$(SRC_TOP)/src' '$(MODULE_TOP)/'
154260
ifeq "$(FIPS_OPTEST)" "1"
155-
@resolved_link_is_equal '$(MODULE_TOP)/linuxkm/optest-140-3/linuxkm_optest_wrapper.c' '$(SRC_TOP)/../fips/optest-140-3/linuxkm_optest_wrapper.c' || cp $(vflag) --no-dereference --symbolic-link --no-clobber --recursive '$(SRC_TOP)/../fips/optest-140-3' '$(MODULE_TOP)/linuxkm'
261+
@resolved_link_is_equal '$(MODULE_TOP)/linuxkm/optest-140-3/linuxkm_optest_wrapper.c' '$(SRC_TOP)/../fips/optest-140-3/linuxkm_optest_wrapper.c' || cp $(vflag) --no-dereference --symbolic-link --no-clobber --recursive '$(SRC_TOP)/../fips/optest-140-3' '$(MODULE_TOP)/linuxkm/'
156262
endif
157263
ifeq "$(ENABLED_LINUXKM_PIE)" "yes"
158264
@[[ -f '$(MODULE_TOP)/linuxkm/wc_linuxkm_pie_reloc_tab.c' && ! -L '$(MODULE_TOP)/linuxkm/wc_linuxkm_pie_reloc_tab.c' ]] || \
159265
{ $(RM) -f '$(MODULE_TOP)/linuxkm/wc_linuxkm_pie_reloc_tab.c' && $(GENERATE_RELOC_TAB) < /dev/null > '$(MODULE_TOP)/linuxkm/wc_linuxkm_pie_reloc_tab.c'; }
160-
@$(eval RELOC_TMP := $(shell mktemp "$(MAKE_TMPDIR)/wc_linuxkm_pie_reloc_tab.c.XXXXXX"))
161-
@if [[ -f libwolfssl.ko ]]; then touch -r libwolfssl.ko '$(RELOC_TMP)'; fi
266+
@RELOC_TMP=$$(mktemp "$(MAKE_TMPDIR)/wc_linuxkm_pie_reloc_tab.c.XXXXXX")
267+
@trap 'rm "$$RELOC_TMP"' EXIT
268+
@if [[ -f "$@" ]]; then touch -r "$@" "$$RELOC_TMP"; fi
162269
+$(MAKE) ARCH='$(KERNEL_ARCH)' $(OVERRIDE_PATHS) $(CROSS_COMPILE) -C '$(KERNEL_ROOT)' M='$(MODULE_TOP)' $(KBUILD_EXTRA_FLAGS) CC_FLAGS_FTRACE=
163270
# if the above make didn't build a fresh libwolfssl.ko, then the module is already up to date and we leave it untouched, assuring stability for purposes of module-update-fips-hash.
164-
@if [[ ! libwolfssl.ko -nt '$(RELOC_TMP)' ]]; then rm '$(RELOC_TMP)'; echo ' Module already up-to-date.'; exit 0; fi
165-
@$(READELF) --wide -r libwolfssl.ko | $(GENERATE_RELOC_TAB) >| '$(MODULE_TOP)/linuxkm/wc_linuxkm_pie_reloc_tab.c'
271+
@if [[ ! "$@" -nt "$$RELOC_TMP" ]]; then echo ' Module already up-to-date.'; exit 0; fi
272+
@SECTION_MAP=$$(mktemp)
273+
@trap 'rm "$$SECTION_MAP"' EXIT
274+
@export SECTION_MAP
275+
@$(READELF) --wide --symbols "$@" | $(GENERATE_SECTION_MAP)
276+
@$(READELF) --wide --relocs "$@" | $(GENERATE_RELOC_TAB) >| '$(MODULE_TOP)/linuxkm/wc_linuxkm_pie_reloc_tab.c'
166277
+$(MAKE) ARCH='$(KERNEL_ARCH)' $(OVERRIDE_PATHS) $(CROSS_COMPILE) -C '$(KERNEL_ROOT)' M='$(MODULE_TOP)' $(KBUILD_EXTRA_FLAGS) CC_FLAGS_FTRACE=
167-
@$(READELF) --wide -r libwolfssl.ko | $(GENERATE_RELOC_TAB) >| '$(RELOC_TMP)'
168-
@if diff '$(MODULE_TOP)/linuxkm/wc_linuxkm_pie_reloc_tab.c' '$(RELOC_TMP)'; then echo " Relocation table is stable."; else echo "PIE failed: relocation table is unstable." 1>&2; rm '$(RELOC_TMP)'; exit 1; fi
169-
@rm '$(RELOC_TMP)'
278+
@$(READELF) --wide --relocs "$@" | $(GENERATE_RELOC_TAB) >| "$$RELOC_TMP"
279+
@if diff '$(MODULE_TOP)/linuxkm/wc_linuxkm_pie_reloc_tab.c' "$$RELOC_TMP"; then echo " Relocation table is stable."; else echo "PIE failed: relocation table is unstable." 1>&2; exit 1; fi
170280
else
171281
+$(MAKE) ARCH='$(KERNEL_ARCH)' $(OVERRIDE_PATHS) $(CROSS_COMPILE) -C '$(KERNEL_ROOT)' M='$(MODULE_TOP)' $(KBUILD_EXTRA_FLAGS)
172282
endif
173283

174284
.PHONY: module-update-fips-hash
175285
module-update-fips-hash: libwolfssl.ko
176-
@if test -z '$(FIPS_HASH)'; then echo ' $$FIPS_HASH is unset' >&2; exit 1; fi
286+
@set -e
287+
@if test -z '$(FIPS_HASH)'; then echo ' $$FIPS_HASH is unset' >&2; exit 1; fi
177288
@if [[ ! '$(FIPS_HASH)' =~ [0-9a-fA-F]{64} ]]; then echo ' $$FIPS_HASH is malformed' >&2; exit 1; fi
178-
@readarray -t rodata_segment < <($(READELF) --wide --sections libwolfssl.ko | \
289+
@readarray -t rodata_segment < <($(READELF) --wide --sections "$<" | \
179290
sed -E -n 's/^[[:space:]]*\[[[:space:]]*([0-9]+)\][[:space:]]+\.rodata_wolfcrypt[[:space:]]+PROGBITS[[:space:]]+[0-9a-fA-F]+[[:space:]]+([0-9a-fA-F]+)[[:space:]].*$$/\1\n\2/p'); \
180291
if [[ $${#rodata_segment[@]} != 2 ]]; then echo ' unexpected rodata_segment.' >&2; exit 1; fi; \
181-
readarray -t verifyCore_attrs < <($(READELF) --wide --symbols libwolfssl.ko | \
292+
readarray -t verifyCore_attrs < <($(READELF) --wide --symbols "$<" | \
182293
sed -E -n 's/^[[:space:]]*[0-9]+: ([0-9a-fA-F]+)[[:space:]]+([0-9]+)[[:space:]]+OBJECT[[:space:]]+[A-Z]+[[:space:]]+[A-Z]+[[:space:]]+'"$${rodata_segment[0]}"'[[:space:]]+verifyCore$$/\1\n\2/p'); \
183294
if [[ $${#verifyCore_attrs[@]} != 2 ]]; then echo ' unexpected verifyCore_attrs.' >&2; exit 1; fi; \
184-
if [[ "$${verifyCore_attrs[1]}" != "65" ]]; then echo " verifyCore has unexpected length $${verifyCore_attrs[1]}." >&2; exit 1; fi; \
295+
if [[ "$${verifyCore_attrs[1]}" != "65" ]]; then echo " verifyCore has unexpected length $${verifyCore_attrs[1]}." >&2; exit 1; fi; \
185296
verifyCore_offset=$$((0x$${rodata_segment[1]} + 0x$${verifyCore_attrs[0]})); \
186-
current_verifyCore=$$(dd bs=1 if=libwolfssl.ko skip=$$verifyCore_offset count=64 status=none); \
297+
current_verifyCore=$$(dd bs=1 if="$<" skip=$$verifyCore_offset count=64 status=none); \
187298
if [[ ! "$$current_verifyCore" =~ [0-9a-fA-F]{64} ]]; then echo " verifyCore at offset $$verifyCore_offset has unexpected value." >&2; exit 1; fi; \
188-
if [[ '$(FIPS_HASH)' == "$$current_verifyCore" ]]; then echo ' Supplied FIPS_HASH matches existing verifyCore -- no update needed.'; exit 0; fi; \
189-
echo -n '$(FIPS_HASH)' | dd bs=1 conv=notrunc of=libwolfssl.ko seek=$$verifyCore_offset count=64 status=none && \
190-
echo " FIPS verifyCore updated successfully." && \
299+
if [[ '$(FIPS_HASH)' == "$$current_verifyCore" ]]; then echo ' Supplied FIPS_HASH matches existing verifyCore -- no update needed.'; exit 0; fi; \
300+
echo -n '$(FIPS_HASH)' | dd bs=1 conv=notrunc of="$<" seek=$$verifyCore_offset count=64 status=none && \
301+
echo " FIPS verifyCore updated successfully." && \
191302
if [[ -f libwolfssl.ko.signed ]]; then $(MAKE) -C . libwolfssl.ko.signed; fi
192303

193304
libwolfssl.ko.signed: libwolfssl.ko
194305
ifdef FORCE_NO_MODULE_SIG
195306
@echo 'Skipping module signature operation because FORCE_NO_MODULE_SIG.'
196307
else
197-
@cd '$(KERNEL_ROOT)' || exit $$?; \
198-
while read configline; do \
199-
case "$$configline" in \
200-
CONFIG_MODULE_SIG*=*) \
201-
declare "$${configline%=*}"="$${configline#*=}" \
202-
;; \
203-
esac; \
204-
done < .config || exit $$?; \
205-
if [[ "$${CONFIG_MODULE_SIG}" = "y" && -n "$${CONFIG_MODULE_SIG_KEY}" && \
206-
-n "$${CONFIG_MODULE_SIG_HASH}" && ( ! -f '$(MODULE_TOP)/$@' || \
207-
'$(MODULE_TOP)/$<' -nt '$(MODULE_TOP)/$@' ) ]]; then \
208-
CONFIG_MODULE_SIG_KEY="$${CONFIG_MODULE_SIG_KEY#\"}"; \
209-
CONFIG_MODULE_SIG_KEY="$${CONFIG_MODULE_SIG_KEY%\"}"; \
210-
CONFIG_MODULE_SIG_HASH="$${CONFIG_MODULE_SIG_HASH#\"}"; \
211-
CONFIG_MODULE_SIG_HASH="$${CONFIG_MODULE_SIG_HASH%\"}"; \
212-
cp -p '$(MODULE_TOP)/$<' '$(MODULE_TOP)/$@' || exit $$?; \
213-
./scripts/sign-file "$${CONFIG_MODULE_SIG_HASH}" \
214-
"$${CONFIG_MODULE_SIG_KEY}" \
215-
"$${CONFIG_MODULE_SIG_KEY/%.pem/.x509}" \
216-
'$(MODULE_TOP)/$@'; \
217-
sign_file_exitval=$$?; \
218-
if [[ $$sign_file_exitval != 0 ]]; then \
219-
$(RM) -f '$(MODULE_TOP)/$@'; \
220-
exit $$sign_file_exitval; \
221-
fi; \
222-
if [[ "$(quiet)" != "silent_" ]]; then \
223-
echo " Module $@ signed by $${CONFIG_MODULE_SIG_KEY}."; \
224-
fi \
308+
@set -e
309+
@cd '$(KERNEL_ROOT)'
310+
while read configline; do
311+
case "$$configline" in
312+
CONFIG_MODULE_SIG*=*)
313+
declare "$${configline%=*}"="$${configline#*=}"
314+
;;
315+
esac
316+
done < .config
317+
if [[ "$${CONFIG_MODULE_SIG}" = "y" && -n "$${CONFIG_MODULE_SIG_KEY}" && \
318+
-n "$${CONFIG_MODULE_SIG_HASH}" && ( ! -f '$(MODULE_TOP)/$@' || \
319+
'$(MODULE_TOP)/$<' -nt '$(MODULE_TOP)/$@' ) ]]; then
320+
CONFIG_MODULE_SIG_KEY="$${CONFIG_MODULE_SIG_KEY#\"}"
321+
CONFIG_MODULE_SIG_KEY="$${CONFIG_MODULE_SIG_KEY%\"}"
322+
CONFIG_MODULE_SIG_HASH="$${CONFIG_MODULE_SIG_HASH#\"}"
323+
CONFIG_MODULE_SIG_HASH="$${CONFIG_MODULE_SIG_HASH%\"}"
324+
cp -p '$(MODULE_TOP)/$<' '$(MODULE_TOP)/$@' || exit $$?
325+
./scripts/sign-file "$${CONFIG_MODULE_SIG_HASH}" \
326+
"$${CONFIG_MODULE_SIG_KEY}" \
327+
"$${CONFIG_MODULE_SIG_KEY/%.pem/.x509}" \
328+
'$(MODULE_TOP)/$@'
329+
sign_file_exitval=$$?
330+
if [[ $$sign_file_exitval != 0 ]]; then
331+
$(RM) -f '$(MODULE_TOP)/$@'
332+
exit $$sign_file_exitval
333+
fi
334+
if [[ "$(quiet)" != "silent_" ]]; then
335+
echo " Module $@ signed by $${CONFIG_MODULE_SIG_KEY}."
336+
fi
225337
fi
226338
endif
227339

@@ -234,10 +346,10 @@ install modules_install:
234346
# note, must supply $(MODULE_TOP) as the src value for clean so that Kbuild is included, else
235347
# the top Makefile (which is not for the kernel build) would be included here.
236348
clean:
349+
+$(MAKE) -C $(KERNEL_ROOT) M=$(MODULE_TOP) src=$(MODULE_TOP) clean
237350
$(RM) -rf '$(MODULE_TOP)/linuxkm'
238351
$(RM) -rf '$(MODULE_TOP)/wolfcrypt'
239352
$(RM) -rf '$(MODULE_TOP)/src'
240-
+$(MAKE) -C $(KERNEL_ROOT) M=$(MODULE_TOP) src=$(MODULE_TOP) clean
241353

242354
.PHONY: check
243355
check:

0 commit comments

Comments
 (0)