Kbuild 8.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193
  1. # Linux kernel-native Makefile ("Kbuild") for libwolfssl.ko
  2. #
  3. # Copyright (C) 2006-2023 wolfSSL Inc.
  4. #
  5. # This file is part of wolfSSL.
  6. #
  7. # wolfSSL is free software; you can redistribute it and/or modify
  8. # it under the terms of the GNU General Public License as published by
  9. # the Free Software Foundation; either version 2 of the License, or
  10. # (at your option) any later version.
  11. #
  12. # wolfSSL is distributed in the hope that it will be useful,
  13. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  14. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  15. # GNU General Public License for more details.
  16. #
  17. # You should have received a copy of the GNU General Public License
  18. # along with this program; if not, write to the Free Software
  19. # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
  20. SHELL=/bin/bash
  21. ifeq "$(WOLFSSL_OBJ_FILES)" ""
  22. $(error $$WOLFSSL_OBJ_FILES is unset.)
  23. endif
  24. ifeq "$(WOLFSSL_CFLAGS)" ""
  25. $(error $$WOLFSSL_CFLAGS is unset.)
  26. endif
  27. WOLFSSL_CFLAGS += -ffreestanding -Wframe-larger-than=$(MAX_STACK_FRAME_SIZE) -isystem $(shell $(CC) -print-file-name=include)
  28. ifeq "$(KERNEL_ARCH)" "x86"
  29. WOLFSSL_CFLAGS += -mpreferred-stack-boundary=4
  30. else ifeq "$(KERNEL_ARCH)" "aarch64"
  31. WOLFSSL_CFLAGS += -mno-outline-atomics
  32. else ifeq "$(KERNEL_ARCH)" "arm64"
  33. WOLFSSL_CFLAGS += -mno-outline-atomics
  34. endif
  35. obj-m := libwolfssl.o
  36. WOLFSSL_OBJ_TARGETS := $(patsubst %, $(obj)/%, $(WOLFSSL_OBJ_FILES))
  37. ifeq "$(ENABLED_LINUXKM_PIE)" "yes"
  38. WOLFCRYPT_PIE_FILES := $(patsubst %, $(obj)/%, $(WOLFCRYPT_PIE_FILES))
  39. endif
  40. $(obj)/linuxkm/module_exports.o: $(WOLFSSL_OBJ_TARGETS)
  41. # this mechanism only works in kernel 5.x+ (fallback to hardcoded value)
  42. hostprogs := linuxkm/get_thread_size
  43. always-y := $(hostprogs)
  44. HOST_EXTRACFLAGS += $(NOSTDINC_FLAGS) $(LINUXINCLUDE) $(KBUILD_CFLAGS) -static -fno-omit-frame-pointer
  45. # "-mindirect-branch=keep -mfunction-return=keep" to avoid "undefined reference
  46. # to `__x86_return_thunk'" on CONFIG_RETHUNK kernels (5.19.0-rc7)
  47. ifeq "$(KERNEL_ARCH)" "x86"
  48. HOST_EXTRACFLAGS += -mindirect-branch=keep -mfunction-return=keep
  49. endif
  50. # this rule is needed to get build to succeed in 4.x (get_thread_size still doesn't get built)
  51. $(obj)/linuxkm/get_thread_size: $(src)/linuxkm/get_thread_size.c
  52. $(WOLFSSL_OBJ_TARGETS): | $(obj)/linuxkm/get_thread_size
  53. KERNEL_THREAD_STACK_SIZE=$(shell test -x $(obj)/linuxkm/get_thread_size && $(obj)/linuxkm/get_thread_size || echo 16384)
  54. MAX_STACK_FRAME_SIZE=$(shell echo $$(( $(KERNEL_THREAD_STACK_SIZE) / 4)))
  55. libwolfssl-y := $(WOLFSSL_OBJ_FILES) linuxkm/module_hooks.o linuxkm/module_exports.o
  56. WOLFSSL_CFLAGS_NO_VECTOR_INSNS := $(CFLAGS_SIMD_DISABLE) $(CFLAGS_FPU_DISABLE)
  57. ifeq "$(ENABLED_ASM)" "yes"
  58. WOLFSSL_CFLAGS_YES_VECTOR_INSNS := $(CFLAGS_SIMD_ENABLE) $(CFLAGS_FPU_DISABLE) $(CFLAGS_AUTO_VECTORIZE_DISABLE)
  59. else
  60. WOLFSSL_CFLAGS_YES_VECTOR_INSNS := $(WOLFSSL_CFLAGS_NO_VECTOR_INSNS)
  61. endif
  62. ccflags-y := $(WOLFSSL_CFLAGS) $(WOLFSSL_CFLAGS_NO_VECTOR_INSNS)
  63. $(obj)/libwolfssl.mod.o: ccflags-y :=
  64. $(obj)/wolfcrypt/test/test.o: ccflags-y += -DNO_MAIN_DRIVER
  65. $(obj)/wolfcrypt/src/aes.o: ccflags-y = $(WOLFSSL_CFLAGS) $(WOLFSSL_CFLAGS_YES_VECTOR_INSNS)
  66. ifeq "$(ENABLED_LINUXKM_PIE)" "yes"
  67. PIE_FLAGS := -fPIE -fno-stack-protector -fno-toplevel-reorder
  68. PIE_SUPPORT_FLAGS := -DUSE_WOLFSSL_LINUXKM_PIE_REDIRECT_TABLE
  69. ifeq "$(KERNEL_ARCH)" "x86"
  70. PIE_FLAGS += -mcmodel=small -mindirect-branch=keep -mfunction-return=keep
  71. endif
  72. ifeq "$(KERNEL_ARCH)" "mips"
  73. PIE_FLAGS += -mabicalls
  74. endif
  75. $(WOLFCRYPT_PIE_FILES): ccflags-y += $(PIE_SUPPORT_FLAGS) $(PIE_FLAGS)
  76. $(WOLFCRYPT_PIE_FILES): ccflags-remove-y += -pg
  77. # disabling retpoline generation leads to profuse warnings without this:
  78. $(WOLFCRYPT_PIE_FILES): OBJECT_FILES_NON_STANDARD := y
  79. $(obj)/linuxkm/module_hooks.o: ccflags-y += $(PIE_SUPPORT_FLAGS)
  80. endif
  81. $(obj)/wolfcrypt/benchmark/benchmark.o: ccflags-y = $(WOLFSSL_CFLAGS) $(CFLAGS_FPU_ENABLE) $(CFLAGS_SIMD_ENABLE) $(PIE_SUPPORT_FLAGS) -DNO_MAIN_FUNCTION
  82. $(obj)/wolfcrypt/benchmark/benchmark.o: asflags-y = $(WOLFSSL_ASFLAGS) $(ASFLAGS_FPU_ENABLE_SIMD_DISABLE)
  83. asflags-y := $(WOLFSSL_ASFLAGS) $(ASFLAGS_FPUSIMD_DISABLE)
  84. # vectorized implementations that are kernel-safe are listed here.
  85. # these are known kernel-compatible, but they still irritate objtool.
  86. $(obj)/wolfcrypt/src/aes_asm.o: asflags-y = $(WOLFSSL_ASFLAGS) $(ASFLAGS_FPU_DISABLE_SIMD_ENABLE)
  87. $(obj)/wolfcrypt/src/aes_asm.o: OBJECT_FILES_NON_STANDARD := y
  88. $(obj)/wolfcrypt/src/aes_gcm_asm.o: asflags-y = $(WOLFSSL_ASFLAGS) $(ASFLAGS_FPU_DISABLE_SIMD_ENABLE)
  89. $(obj)/wolfcrypt/src/aes_gcm_asm.o: OBJECT_FILES_NON_STANDARD := y
  90. $(obj)/wolfcrypt/src/aes_xts_asm.o: asflags-y = $(WOLFSSL_ASFLAGS) $(ASFLAGS_FPU_DISABLE_SIMD_ENABLE)
  91. $(obj)/wolfcrypt/src/aes_xts_asm.o: OBJECT_FILES_NON_STANDARD := y
  92. $(obj)/wolfcrypt/src/sp_x86_64_asm.o: asflags-y = $(WOLFSSL_ASFLAGS) $(ASFLAGS_FPU_DISABLE_SIMD_ENABLE)
  93. $(obj)/wolfcrypt/src/sp_x86_64_asm.o: OBJECT_FILES_NON_STANDARD := y
  94. $(obj)/wolfcrypt/src/sha256_asm.o: asflags-y = $(WOLFSSL_ASFLAGS) $(ASFLAGS_FPU_DISABLE_SIMD_ENABLE)
  95. $(obj)/wolfcrypt/src/sha256_asm.o: OBJECT_FILES_NON_STANDARD := y
  96. $(obj)/wolfcrypt/src/sha512_asm.o: asflags-y = $(WOLFSSL_ASFLAGS) $(ASFLAGS_FPU_DISABLE_SIMD_ENABLE)
  97. $(obj)/wolfcrypt/src/sha512_asm.o: OBJECT_FILES_NON_STANDARD := y
  98. $(obj)/wolfcrypt/src/sha3_asm.o: asflags-y = $(WOLFSSL_ASFLAGS) $(ASFLAGS_FPU_DISABLE_SIMD_ENABLE)
  99. $(obj)/wolfcrypt/src/sha3_asm.o: OBJECT_FILES_NON_STANDARD := y
  100. $(obj)/wolfcrypt/src/chacha_asm.o: asflags-y = $(WOLFSSL_ASFLAGS) $(ASFLAGS_FPU_DISABLE_SIMD_ENABLE)
  101. $(obj)/wolfcrypt/src/chacha_asm.o: OBJECT_FILES_NON_STANDARD := y
  102. $(obj)/wolfcrypt/src/poly1305_asm.o: asflags-y = $(WOLFSSL_ASFLAGS) $(ASFLAGS_FPU_DISABLE_SIMD_ENABLE)
  103. $(obj)/wolfcrypt/src/poly1305_asm.o: OBJECT_FILES_NON_STANDARD := y
  104. ifeq "$(ENABLED_LINUXKM_PIE)" "yes"
  105. rename-pie-text-and-data-sections: $(WOLFSSL_OBJ_TARGETS)
  106. ifndef NM
  107. NM := nm
  108. endif
  109. ifndef READELF
  110. READELF := readelf
  111. endif
  112. ifndef OBJCOPY
  113. OBJCOPY := objcopy
  114. endif
  115. .PHONY: rename-pie-text-and-data-sections
  116. rename-pie-text-and-data-sections:
  117. ifneq "$(quiet)" "silent_"
  118. @echo -n ' Checking wolfCrypt for unresolved symbols and forbidden relocations... '
  119. endif
  120. @cd "$(obj)" || exit $$?; \
  121. $(LD) -relocatable -o wolfcrypt_test_link.o $(WOLFCRYPT_PIE_FILES) || exit $$?; \
  122. undefined=$$($(NM) --undefined-only wolfcrypt_test_link.o) || exit $$?; \
  123. GOT_relocs=$$($(READELF) --relocs --wide wolfcrypt_test_link.o | egrep '^[^ ]+ +[^ ]+ +[^ ]*GOT[^ ]* ') || [ $$? = 1 ] || exit 2; \
  124. rm wolfcrypt_test_link.o; \
  125. if [ -n "$$undefined" ]; then \
  126. echo "wolfCrypt container has unresolved symbols:" 1>&2; \
  127. echo "$$undefined" 1>&2; \
  128. exit 1; \
  129. fi; \
  130. if [ -n "$$GOT_relocs" ]; then \
  131. echo "wolfCrypt container has GOT relocations (non-local function address used as operand?):" 1>&2; \
  132. echo "$$GOT_relocs" 1>&2; \
  133. exit 1; \
  134. fi
  135. ifneq "$(quiet)" "silent_"
  136. @echo 'OK.'
  137. endif
  138. @cd "$(obj)" || exit $$?; \
  139. for file in $(WOLFCRYPT_PIE_FILES); do \
  140. $(OBJCOPY) --rename-section .text=.text.wolfcrypt --rename-section .data=.data.wolfcrypt --rename-section .rodata=.rodata.wolfcrypt "$$file" || exit $$?; \
  141. done
  142. ifneq "$(quiet)" "silent_"
  143. @echo ' wolfCrypt .{text,data,rodata} sections containerized to .{text,data,rodata}.wolfcrypt'
  144. endif
  145. $(src)/linuxkm/module_exports.c: rename-pie-text-and-data-sections
  146. endif
  147. # auto-generate the exported symbol list, leveraging the WOLFSSL_API visibility tags.
  148. # exclude symbols that don't match wc_* or wolf*.
  149. $(src)/linuxkm/module_exports.c: $(src)/linuxkm/module_exports.c.template $(WOLFSSL_OBJ_TARGETS)
  150. @cp $< $@
  151. @readelf --symbols --wide $(WOLFSSL_OBJ_TARGETS) | \
  152. awk '/^ *[0-9]+: / { \
  153. if ($$8 !~ /^(wc_|wolf|WOLF|TLSX_)/){next;} \
  154. if (($$4 == "FUNC") && ($$5 == "GLOBAL") && ($$6 == "DEFAULT")) { \
  155. print "EXPORT_SYMBOL_NS_GPL(" $$8 ", WOLFSSL);"; \
  156. } \
  157. }' >> $@
  158. @echo -e '#ifndef NO_CRYPT_TEST\nEXPORT_SYMBOL_NS_GPL(wolfcrypt_test, WOLFSSL);\n#endif' >> $@
  159. clean-files := module_exports.c linuxkm src wolfcrypt/src wolfcrypt/test wolfcrypt