moonjuice/kernel_arpi
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ANDROID: fips140: require 'm' to enable CRYPTO_FIPS140_MOD

Browse Source 
CONFIG_CRYPTO_FIPS140_MOD builds a loadable kernel module when set to
'y'.  That's very unusual, as it doesn't follow the convention of
loadable modules being 'm'.

I'm guessing that the reason that a bool was used instead of a tristate
is because this functionality is not supported built-in, so there are
only two allowed settings: disabled or modular.

However, there's actually a way to express that in the kconfig language:
a tristate that depends on 'm'.  Let's do it that way.

This also eliminates the need to explicitly depend on MODULES.

(Note: I decided to keep MOD in the name, since the word "module" in
"FIPS 140 cryptographic module" is a different meaning of "module", and
I didn't want to bother renaming CRYPTO_FIPS140_MOD_EVAL_TESTING too.)

Bug: 188620248
Change-Id: Ib195d64d68c23ca93dd244d9ac77255992870424
Signed-off-by: Eric Biggers <ebiggers@google.com>
This commit is contained in:
Eric Biggers
2023-01-06 05:07:18 +00:00
committed by Matthias Männich
parent d4966a8203
commit 6da26b8750
3 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
scripts/module.lds.S
View File

@@ -33,7 +33,7 @@ SECTIONS {
__patchable_function_entries : { *(__patchable_function_entries) }
#ifdef CONFIG_CRYPTO_FIPS140_MOD
#if IS_ENABLED(CONFIG_CRYPTO_FIPS140_MOD)
/*
* The FIPS140 module incorporates copies of builtin code, which gets
* integrity checked at module load time, and registered in a way that