Commit 254da9ba authored by Ard Biesheuvel's avatar Ard Biesheuvel Committed by Ard Biesheuvel
Browse files

ANDROID: arm64: module: preserve RELA sections for FIPS140 integrity selfcheck



The FIPS 140-2 integrity check compares the runtime code with a digest
that was created at build time. Given that the module's placement in
virtual memory is an a priori unknown, we cannot account for this at
build time, and so we need to do so at runtime instead.

In order to revert the code to the build time state, we need to know
which changes the module loader applied to it. These changes are based
on the RELA ELF section that describes the changes that the module
loader must apply, and so to unapply these changes, we need to preserve
the RELA section when loading the module.

So add a special case for a module called 'fips140' in the module
loader, and copy the RELA sections applying to .text and .rodata to a
temporary buffer that the fips140.ko init code can access.

Bug: 153614920
Bug: 188620248
Change-Id: I97d69053c6657b104a3a9ea10af78a53ce52c6e5
Signed-off-by: default avatarArd Biesheuvel <ardb@google.com>
parent 15f0fc91
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment