ANDROID: inject correct HMAC digest into fips140.ko at build time
Inject the HMAC digest into the fips140.ko module once it has been
built. This involves a post-link step, so we need to use a special
Makefile that is wired up in the right way, and includes the special
handling only for fips140.ko in particular.
Bug: 153614920
Bug: 188620248
Change-Id: Ic66086a05fa997850ca15dedbbc14fc73f6f0da6
Signed-off-by: Ard Biesheuvel <ardb@google.com>
diff --git a/arch/arm64/Makefile.postlink b/arch/arm64/Makefile.postlink
new file mode 100644
index 0000000..d3ea68f
--- /dev/null
+++ b/arch/arm64/Makefile.postlink
@@ -0,0 +1,31 @@
+# SPDX-License-Identifier: GPL-2.0
+
+PHONY := __archpost
+__archpost:
+
+-include include/config/auto.conf
+include scripts/Kbuild.include
+
+CMD_FIPS140_GEN_HMAC = crypto/fips140_gen_hmac
+quiet_cmd_gen_hmac = HMAC $@
+ cmd_gen_hmac = $(CMD_FIPS140_GEN_HMAC) $@
+
+# `@true` prevents complaints when there is nothing to be done
+
+vmlinux: FORCE
+ @true
+
+$(objtree)/crypto/fips140.ko: FORCE
+ $(call cmd,gen_hmac)
+
+%.ko: FORCE
+ @true
+
+clean:
+ @true
+
+PHONY += FORCE clean
+
+FORCE:
+
+.PHONY: $(PHONY)
