2db9143a1b
To meet FIPS 140 requirements, add support for building a kernel module "fips140.ko" that contains various cryptographic algorithms built from existing kernel source files. At load time, the module checks its own integrity and self-tests its algorithms, then registers the algorithms with the crypto API to supersede the original algorithms provided by the kernel itself. [ebiggers: this commit originated from "ANDROID: crypto: fips140 - perform load time integrity check", but I've folded many later commits into it to make forward porting easier. See below] Original commits from android12-5.10: *6be141eb36("ANDROID: crypto: fips140 - perform load time integrity check") *868be244bb("ANDROID: inject correct HMAC digest into fips140.ko at build time") *091338cb39("ANDROID: fips140: add missing static keyword to fips140_init()") *c799c6644b("ANDROID: fips140: adjust some log messages") *92de53472e("ANDROID: fips140: log already-live algorithms") *0af06624ea("ANDROID: fips140: check for errors from initcalls") *634445a640("ANDROID: fips140: fix deadlock in unregister_existing_fips140_algos()") *e886dd4c33("ANDROID: fips140: unregister existing DRBG algorithms") *b7397e89db("ANDROID: fips140: add power-up cryptographic self-tests") *50661975be("ANDROID: fips140: add/update module help text") *b397a0387c("ANDROID: fips140: test all implementations") *17ccefe140("ANDROID: fips140: use full 16-byte IV") *1be58af077("ANDROID: fips140: remove non-prediction-resistant DRBG test") *2b5843ae2d("ANDROID: fips140: add AES-CBC-CTS") *2ee56aad31("ANDROID: fips140: add AES-CMAC") *960ebb2b56("ANDROID: fips140: add jitterentropy to fips140 module") *e5b14396f9("ANDROID: fips140: take into account AES-GCM not being approvable") *52b70d491b("ANDROID: fips140: use FIPS140_CFLAGS when compiling fips140-selftests.c") *6b995f5a54("ANDROID: fips140: preserve RELA sections without relying on the module loader") *e45108ecff("ANDROID: fips140: block crypto operations until tests complete") *ecf9341134("ANDROID: fips140: remove in-place updating of live algorithms") *482b0323cf("ANDROID: fips140: zeroize temporary values from integrity check") *64d769e53f("ANDROID: fips140: add service indicators") *8d7f609cda("ANDROID: fips140: add name and version, and a function to retrieve them") *6b7c37f6c4("ANDROID: fips140: use UTS_RELEASE as FIPS version") *903e97a0ca("ANDROID: fips140: refactor evaluation testing support") *97fb2104fe("ANDROID: fips140: add support for injecting integrity error") *109f31ac23("ANDROID: fips140: add userspace interface for evaluation testing") Bug: 153614920 Bug: 188620248 Test: tested that the module builds and can be loaded on raven. Change-Id: I3fde49dbc3d16b149b072a27ba5b4c6219015c94 Signed-off-by: Ard Biesheuvel <ardb@google.com> Signed-off-by: Eric Biggers <ebiggers@google.com>
53 lines
1.8 KiB
Plaintext
53 lines
1.8 KiB
Plaintext
# SPDX-License-Identifier: GPL-2.0-only
|
|
#
|
|
# Create a separate FIPS archive that duplicates the modules that are relevant
|
|
# for FIPS 140 certification as builtin objects
|
|
#
|
|
|
|
sha1-ce-y := sha1-ce-glue.o sha1-ce-core.o
|
|
sha2-ce-y := sha2-ce-glue.o sha2-ce-core.o
|
|
sha512-ce-y := sha512-ce-glue.o sha512-ce-core.o
|
|
ghash-ce-y := ghash-ce-glue.o ghash-ce-core.o
|
|
aes-ce-cipher-y := aes-ce-core.o aes-ce-glue.o
|
|
aes-ce-blk-y := aes-glue-ce.o aes-ce.o
|
|
aes-neon-blk-y := aes-glue-neon.o aes-neon.o
|
|
sha256-arm64-y := sha256-glue.o sha256-core.o
|
|
sha512-arm64-y := sha512-glue.o sha512-core.o
|
|
aes-arm64-y := aes-cipher-core.o aes-cipher-glue.o
|
|
aes-neon-bs-y := aes-neonbs-core.o aes-neonbs-glue.o
|
|
|
|
crypto-arm64-fips-src := $(srctree)/arch/arm64/crypto/
|
|
crypto-arm64-fips-modules := sha1-ce.o sha2-ce.o sha512-ce.o ghash-ce.o \
|
|
aes-ce-cipher.o aes-ce-blk.o aes-neon-blk.o \
|
|
sha256-arm64.o sha512-arm64.o aes-arm64.o \
|
|
aes-neon-bs.o
|
|
|
|
crypto-fips-objs += $(foreach o,$(crypto-arm64-fips-modules),$($(o:.o=-y):.o=-fips-arch.o))
|
|
|
|
CFLAGS_aes-glue-ce-fips-arch.o := -DUSE_V8_CRYPTO_EXTENSIONS
|
|
|
|
$(obj)/aes-glue-%-fips-arch.o: KBUILD_CFLAGS += $(FIPS140_CFLAGS)
|
|
$(obj)/aes-glue-%-fips-arch.o: $(crypto-arm64-fips-src)/aes-glue.c FORCE
|
|
$(call if_changed_rule,cc_o_c)
|
|
|
|
$(obj)/%-fips-arch.o: KBUILD_CFLAGS += $(FIPS140_CFLAGS)
|
|
$(obj)/%-fips-arch.o: $(crypto-arm64-fips-src)/%.c FORCE
|
|
$(call if_changed_rule,cc_o_c)
|
|
|
|
$(obj)/%-fips-arch.o: $(crypto-arm64-fips-src)/%.S FORCE
|
|
$(call if_changed_rule,as_o_S)
|
|
|
|
quiet_cmd_perlasm = PERLASM $@
|
|
cmd_perlasm = $(PERL) $(<) void $(@)
|
|
|
|
$(obj)/%-core.S: $(crypto-arm64-fips-src)/%-armv8.pl
|
|
$(call cmd,perlasm)
|
|
|
|
$(obj)/sha256-core.S: $(crypto-arm64-fips-src)/sha512-armv8.pl
|
|
$(call cmd,perlasm)
|
|
|
|
clean-files += sha256-core.S sha512-core.S
|
|
|
|
$(obj)/%-fips-arch.o: $(obj)/%.S FORCE
|
|
$(call if_changed_rule,as_o_S)
|