moonjuice/kernel_arpi
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ANDROID: fips140: require 'm' to enable CRYPTO_FIPS140_MOD

Browse Source 
CONFIG_CRYPTO_FIPS140_MOD builds a loadable kernel module when set to
'y'.  That's very unusual, as it doesn't follow the convention of
loadable modules being 'm'.

I'm guessing that the reason that a bool was used instead of a tristate
is because this functionality is not supported built-in, so there are
only two allowed settings: disabled or modular.

However, there's actually a way to express that in the kconfig language:
a tristate that depends on 'm'.  Let's do it that way.

This also eliminates the need to explicitly depend on MODULES.

(Note: I decided to keep MOD in the name, since the word "module" in
"FIPS 140 cryptographic module" is a different meaning of "module", and
I didn't want to bother renaming CRYPTO_FIPS140_MOD_EVAL_TESTING too.)

Bug: 188620248
Change-Id: Ib195d64d68c23ca93dd244d9ac77255992870424
Signed-off-by: Eric Biggers <ebiggers@google.com>
This commit is contained in:
Eric Biggers
2023-01-06 05:07:18 +00:00
committed by Matthias Männich
parent d4966a8203
commit 6da26b8750
3 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
arch/arm64/configs/fips140_gki.fragment
View File

@@ -1,2 +1,2 @@
CONFIG_CRYPTO_FIPS140_MOD=y CONFIG_CRYPTO_FIPS140_MOD=m
# CONFIG_MODULE_SIG_ALL is not set # CONFIG_MODULE_SIG_ALL is not set

5
crypto/Kconfig
View File

@@ -34,8 +34,9 @@ config CRYPTO_FIPS
this is. this is.
config CRYPTO_FIPS140_MOD config CRYPTO_FIPS140_MOD
bool "Enable FIPS 140 cryptographic module" tristate "Enable FIPS 140 cryptographic module"
depends on MODULES && ARM64 && ARM64_MODULE_PLTS && LTO_CLANG depends on ARM64 && ARM64_MODULE_PLTS && LTO_CLANG
depends on m
help help
This option enables building a loadable module fips140.ko, which This option enables building a loadable module fips140.ko, which
contains various crypto algorithms that are also built into vmlinux. contains various crypto algorithms that are also built into vmlinux.

2
scripts/module.lds.S
View File

@@ -33,7 +33,7 @@ SECTIONS {
__patchable_function_entries : { *(__patchable_function_entries) } __patchable_function_entries : { *(__patchable_function_entries) }
#ifdef CONFIG_CRYPTO_FIPS140_MOD #if IS_ENABLED(CONFIG_CRYPTO_FIPS140_MOD)
/* /*
* The FIPS140 module incorporates copies of builtin code, which gets * The FIPS140 module incorporates copies of builtin code, which gets
* integrity checked at module load time, and registered in a way that * integrity checked at module load time, and registered in a way that