diff --git a/scripts/module.lds.S b/scripts/module.lds.S index 3f43edef813c..8fc2c0e21fef 100644 --- a/scripts/module.lds.S +++ b/scripts/module.lds.S @@ -36,7 +36,36 @@ SECTIONS { __kcfi_traps : { KEEP(*(.kcfi_traps)) } #endif -#ifdef CONFIG_LTO_CLANG +#if IS_ENABLED(CONFIG_CRYPTO_FIPS140_MOD) + /* + * The FIPS140 module incorporates copies of builtin code, which gets + * integrity checked at module load time, and registered in a way that + * ensures that the integrity checked versions supersede the builtin + * ones. These objects are compiled as builtin code, and so their init + * hooks will be exported from the binary in the same way as builtin + * initcalls are, i.e., annotated with a level that defines the order + * in which the hooks are expected to be invoked. + */ +#define INIT_CALLS_LEVEL(level) \ + KEEP(*(.initcall##level##.init*)) \ + KEEP(*(.initcall##level##s.init*)) + + .initcalls : { + *(.initcalls._start) + INIT_CALLS_LEVEL(0) + INIT_CALLS_LEVEL(1) + INIT_CALLS_LEVEL(2) + INIT_CALLS_LEVEL(3) + INIT_CALLS_LEVEL(4) + INIT_CALLS_LEVEL(5) + INIT_CALLS_LEVEL(rootfs) + INIT_CALLS_LEVEL(6) + INIT_CALLS_LEVEL(7) + *(.initcalls._end) + } +#endif + +#if defined(CONFIG_LTO_CLANG) || defined(CONFIG_CRYPTO_FIPS140_MERGE_MOD_SECTIONS) /* * With CONFIG_LTO_CLANG, LLD always enables -fdata-sections and * -ffunction-sections, which increases the size of the final module. @@ -54,8 +83,17 @@ SECTIONS { } .rodata : { + *(.rodata.._start) *(.rodata .rodata.[0-9a-zA-Z_]*) *(.rodata..L*) + *(.rodata.._end) + } + + .text : { + *(.text.._start) + *(.text .text.[0-9a-zA-Z_]*) + *(.text.._end) + *(.text.._fips140_unchecked) } #else .data : {