5 # Author : Rohit Kothari (r.kothari@samsung.com)
6 # Created on : 14 Feb 2014
7 # Modified on: 22 Jun 2015 by Jia Ma (jia.ma@samsung.com) /* To adapt to KASLR change */
8 # Modified on: 09 Jul 2015 by Wenbo Shen (wenbo.s@samsung.com) /* To reduce the hmac generation time */
9 # Copyright (c) Samsung Electronics 2014
11 # Given a vmlinux file and a System.map, this scripts finds bytes belonging to
12 # Kernel Crypto within vmlinux file.(Under section .text, .init.text, .exit.text and .rodata)
13 # After collecting all the bytes, it calculates a hmac(sha256) on those bytes.
14 # Generated hmac is put back into a crypto rodata variable within vmlinux file itself.
15 # This makes the build time hmac available at runtime, for integrity check.
17 # To find crypto bytes, this scripts heavily relies on output of arm-eabi-readelf.
18 # If the output of arm-eabi-readelf changes in future, this script might need changes.
20 # Pre-conditions : $READELF, $HOSTCC variables are set.
24 # Here we want to seperate the oneshot code from the repeated code
25 ################ the repeated code ####################
28 .
/kaslr_fips
$vmlinux_var $reloc_start_addr $reloc_end_addr $dynsym_addr $index $first_crypto_rodata $last_crypto_rodata $first_fmp_rodata $last_fmp_rodata $2
30 if [ $retval -ne 0 ]; then
31 echo "$0 : kaslr_fips : unable to patch the vmlinux"
40 if [ "$3" == "crypto" ]; then
41 fips_utils
=.
/fips_crypto_utils
42 hmac_offset
=`expr $crypto_hmac_offset_base + $((32*$index)) `
43 elif [ "$3" == "fmp" ]; then
44 fips_utils
=.
/fips_fmp_utils
45 hmac_offset
=`expr $fmp_hmac_offset_base + $((32*$index)) `
48 rm -f builtime_bytes.txt
#used for debugging
49 rm -f builtime_bytes.bin
#used for calculating hmac
52 echo "Created on : " $date_var > builtime_bytes.txt
55 #Using offsets_sizes.txt, dump crypto bytes from vmlinux file into builtime_bytes.bin
56 #Also gather printf's into builtime_bytes.txt, for debugging if required
58 $fips_utils -g $vmlinux_var $args builtime_bytes.bin
>> builtime_bytes.txt
60 if [ $retval -ne 0 ]; then
61 echo "$0 : $fips_utils : unable to gather $3 bytes from vmlinux"
64 echo "" >> builtime_bytes.txt
65 done < $offsets_sizes_file
68 if [[ ! -f builtime_bytes.bin
]]; then
69 echo "$0 : builtime_bytes.bin does not exist"
73 #file_size=`cat builtime_bytes.bin| wc -c`
75 # Make sure that file size of crypto_hmac.bin is as expected
76 #if [ $total_bytes -ne $file_size ]; then
77 #echo "$0: Bytes mismatch"
82 key
="The quick brown fox jumps over the lazy dog"
84 # Now, generate the hmac.
85 openssl dgst
-sha256 -hmac "$key" -binary -out crypto_hmac.bin builtime_bytes.bin
87 if [ $retval -ne 0 ]; then
88 echo "$0 : openssl dgst command returned error"
92 # Just, for debugging, print the same hmac on console
93 #openssl dgst -sha256 -hmac "$key" builtime_bytes.bin
95 if [[ ! -f crypto_hmac.bin
]]; then
96 echo "$0 : crypto_hmac.bin does not exist"
100 file_size
=`cat crypto_hmac.bin| wc -c`
102 # hmac(sha256) produces 32 bytes of hmac
103 if [ $file_size -ne 32 ]; then
104 echo "$0: Unexpected size of Hash file : " $file_size
108 # Now that we have the hmac, update this hmac into an rodata "builtime_crypto_hmac" varialble
110 # This variable has a place holder 32 bytes that will be over-written with generated hmac.
111 # This way, this build time hmac, will be available as a read-only variable at run-time.
113 if [[ $hmac_offset -le 0 ]]; then echo "$0 : hmac_offset invalid"; exit 1; fi
115 # This does the actual update of hmac into vmlinux file, at given offset
116 $fips_utils -u $vmlinux_var crypto_hmac.bin
$hmac_offset
118 if [ $retval -ne 0 ]; then
119 echo "$0 : fips_crypto_utils : unable to update hmac in vmlinux"
123 rm -f crypto_hmac.bin
124 rm -f builtime_bytes.txt
125 rm -f builtime_bytes.bin
128 ################ the kaslr patch oneshot code ####################
129 # 1st parameter is the array, 2nd is the output file name
137 #Addresses retrieved must be a valid hex
140 #Total bytes of all crypto sections scanned. Used later for error checking
143 # For each type of Section :
144 # first_addr = Address of first_crypto_text, first_crypto_rodata, etc.
145 # last_addr = Address of last_crypto_text, last_crypto_rodata etc.
146 # start_addr = Starting Address of a section within vmlinux
147 # offset = Offset in vmlinux file where the section begins
148 # file_offset = Offset in vmlinux file where the crypto bytes begins.
149 # size = size of crypto bytes.
151 # Output is offsets_sizes.txt, of the format
152 # Section Name crypto_bytes_offset crypto_bytes_size
153 # (in decimal) (in decimal)
154 # .text 2531072 114576
155 # .rodata 9289648 55388
158 for i
in "${array[@]}"; do
160 var1
=var2
=var3
=var4
=var5
=""
161 first_addr
=last_addr
=start_addr
=offset
=file_offset
=size
=""
163 #This loop creates var1, var2 etc and set them to individual strings of a row in array
169 first_addr
=`cat $system_map_var|grep -w $var2|awk '{print $1}'`
170 if [[ ! $first_addr =~
$reg ]]; then echo "$0 : first_addr invalid"; exit 1; fi
172 last_addr
=`cat $system_map_var|grep -w $var3|awk '{print $1}'`
173 if [[ ! $last_addr =~
$reg ]]; then echo "$0 : last_addr invalid"; exit 1; fi
175 start_addr
=`cat vmlinux.elf |grep -w "$var1 "|grep PROGBITS|awk '{print '$var4'}'`
176 if [[ ! $start_addr =~
$reg ]]; then echo "$0 : start_addr invalid"; exit 1; fi
178 offset
=`cat vmlinux.elf |grep -w "$var1 "|grep PROGBITS|awk '{print '$var5'}'`
179 if [[ ! $offset =~
$reg ]]; then echo "$0 : offset invalid"; exit 1; fi
181 if [[ $
((16#$first_addr)) -lt $((16#$start_addr)) ]]; then echo "$0 : first_addr < start_addr"; exit 1; fi
183 if [[ $
((16#$last_addr)) -le $((16#$first_addr)) ]]; then echo "$0 : last_addr <= first_addr"; exit 1; fi
185 file_offset
=`expr $((16#$offset)) + $((16#$first_addr)) - $((16#$start_addr))`
186 if [[ $file_offset -le 0 ]]; then echo "$0 : file_offset invalid"; exit 1; fi
188 size
=`expr $((16#$last_addr)) - $((16#$first_addr))`
189 if [[ $size -le 0 ]]; then echo "$0 : crypto section size invalid"; exit 1; fi
191 echo "$var1 " $file_offset " " $size >> $outfile
193 #let "total_bytes += `expr $((16#$last_addr)) - $((16#$first_addr))`"
196 if [[ ! -f $outfile ]]; then
197 echo "$0 : offset_sizes.txt does not exist"
205 first_addr
=`cat $system_map_var|grep -w $1|awk '{print $1}' `
206 if [[ ! $first_addr =~
$reg ]]; then echo "$0 : first_addr of hmac variable invalid"; exit 1; fi
208 start_addr
=`cat vmlinux.elf |grep -w $2|grep PROGBITS|awk '{print $5}' `
209 if [[ ! $start_addr =~
$reg ]]; then echo "$0 : start_addr of .rodata invalid"; exit 1; fi
211 offset
=`cat vmlinux.elf |grep -w $2|grep PROGBITS| awk '{print $6}' `
212 if [[ ! $offset =~
$reg ]]; then echo "$0 : offset of .rodata invalid"; exit 1; fi
214 if [[ $
((16#$first_addr)) -le $((16#$start_addr)) ]]; then echo "$0 : hmac var first_addr <= start_addr"; exit 1; fi
216 if [ "$1" == "builtime_crypto_hmac" ]; then
217 crypto_hmac_offset_base
=`expr $((16#$offset)) + $((16#$first_addr)) - $((16#$start_addr)) `
218 elif [ "$1" == "builtime_fmp_hmac" ]; then
219 fmp_hmac_offset_base
=`expr $((16#$offset)) + $((16#$first_addr)) - $((16#$start_addr)) `
223 ################ Start Here ################
227 if test $# -ne 2; then
228 echo "Usage: $0 vmlinux System.map"
235 if [[ -z "$vmlinux_var" ||
-z "$system_map_var" ||
-z "$READELF" ||
-z "$HOSTCC" ]]; then
236 echo "$0 : variables not set"
240 if [[ ! -f $vmlinux_var ||
! -f $system_map_var ]]; then
241 echo "$0 : files does not exist"
246 $READELF -S $vmlinux_var > vmlinux.elf
249 if [ $retval -ne 0 ]; then
250 echo "$0 : $READELF returned error"
254 #start patching vmlinux with static patcher, temporary put it here
256 $HOSTCC -o kaslr_fips
$srctree/scripts
/kaslr_fips.c
258 if [ $retval -ne 0 ]; then
259 echo "$0 : $HOSTCC returned error"
263 rm -f fips_crypto_utils
264 $HOSTCC -o fips_crypto_utils
$srctree/scripts
/fips_crypto_utils.c
266 if [ $retval -ne 0 ]; then
267 echo "$0 : $HOSTCC returned error"
272 $HOSTCC -o fips_fmp_utils
$srctree/scripts
/fips_fmp_utils.c
274 if [ $retval -ne 0 ]; then
275 echo "$0 : $HOSTCC returned error"
280 var1
=`cat $system_map_var|grep -w $var|awk '{print $1}'`
282 var2
=`cat $system_map_var|grep -w $var|awk '{print $1}'`
284 var3
=`cat $system_map_var|grep -w $var|awk '{print $1}'`
286 var
="first_crypto_rodata"
287 var4
=`cat $system_map_var|grep -w $var|awk '{print $1}'`
288 var
="last_crypto_rodata"
289 var5
=`cat $system_map_var|grep -w $var|awk '{print $1}'`
291 var
="first_fmp_rodata"
292 var6
=`cat $system_map_var|grep -w $var|awk '{print $1}'`
293 var
="last_fmp_rodata"
294 var7
=`cat $system_map_var|grep -w $var|awk '{print $1}'`
296 reloc_start_addr
=`expr $((16#$var1))`
297 reloc_end_addr
=`expr $((16#$var2))`
298 dynsym_addr
=`expr $((16#$var3))`
299 first_crypto_rodata
=`expr $((16#$var4))`
300 last_crypto_rodata
=`expr $((16#$var5))`
301 first_fmp_rodata
=`expr $((16#$var6))`
302 last_fmp_rodata
=`expr $((16#$var7))`
304 ################# CRYPTO #######################
305 # FOR GENERIC CRYPTO FILES #awk fields to cut
306 fips_crypto
[0]=".text first_crypto_text last_crypto_text \$5 \$6"
307 fips_crypto
[1]=".rodata first_crypto_rodata last_crypto_rodata \$5 \$6"
308 fips_crypto
[2]=".init.text first_crypto_init last_crypto_init \$4 \$5"
310 # # FOR ASM CRYPTO FILES
311 fips_crypto
[3]=".text first_crypto_asm_text last_crypto_asm_text \$5 \$6"
312 fips_crypto
[4]=".rodata first_crypto_asm_rodata last_crypto_asm_rodata \$5 \$6"
313 fips_crypto
[5]=".init.text first_crypto_asm_init last_crypto_asm_init \$4 \$5"
315 offsets_sizes_crypto
="offsets_sizes_crypto.txt"
316 offsets_sizes_gen fips_crypto
$offsets_sizes_crypto
318 #find hmac_offset in vmlinux for updating
319 cal_hmac_offset builtime_crypto_hmac .rodata
322 ################# FMP #######################
323 fips_fmp
[0]=".text first_fmp_text last_fmp_text \$5 \$6"
324 fips_fmp
[1]=".rodata first_fmp_rodata last_fmp_rodata \$5 \$6"
325 fips_fmp
[2]=".init.text first_fmp_init last_fmp_init \$4 \$5"
327 offsets_sizes_fmp
="offsets_sizes_fmp.txt"
328 offsets_sizes_gen fips_fmp
$offsets_sizes_fmp
330 #find hmac_offset in vmlinux for updating
331 cal_hmac_offset builtime_fmp_hmac .rodata
333 rodata_va_addr
=`cat vmlinux.elf|grep -w '.rodata'|awk '{print $5}'`
334 rodata_file_addr
=`cat vmlinux.elf|grep -w '.rodata'|awk '{print $6}'`
335 va_to_file
=`expr $((16#$rodata_va_addr)) - $((16#$rodata_file_addr))`
340 kaslr_patch
$index $va_to_file
341 hmac_patch
$index $offsets_sizes_crypto crypto
342 hmac_patch
$index $offsets_sizes_fmp fmp
346 rm -f fips_crypto_utils
351 ELAPSED_TIME
=$
(($SECONDS - $START_TIME))
352 echo ">>>>> Time used for generated all hashes is $(($ELAPSED_TIME)) sec"