MIRRORS/linux-imx
1
0
Fork 0
mirror of https://github.com/nxp-imx/linux-imx.git synced 2025-07-06 17:35:20 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

ANDROID: fips140: add/update module help text

Browse Source 
Add some help text for CONFIG_CRYPTO_FIPS140_MOD, add a comment for
CONFIG_CRYPTO_FIPS140, and update the file comment for fips140-module.c.
In particular, mention that the module also does self-tests, and that it
is also intended to meet NIAP requirements -- not just FIPS.

Bug: 153614920
Bug: 188620248
Change-Id: If2c316e54fba2c4594e70a14a5a8fa1dba3589a1
Signed-off-by: Eric Biggers <ebiggers@google.com>
This commit is contained in:
Eric Biggers 2021-07-08 14:46:47 -07:00 committed by Ard Biesheuvel
parent b7397e89db
commit 50661975be
2 changed files with 23 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
crypto/Kconfig
View File

@ -32,13 +32,26 @@ config CRYPTO_FIPS
certification. You should say no unless you know what
this is.
# CRYPTO_FIPS140 just enables the support in the kernel for loading fips140.ko.
# The module still needs to be built and loaded if you need FIPS 140 compliance.
config CRYPTO_FIPS140
def_bool y
depends on MODULES && ARM64 && ARM64_MODULE_PLTS
config CRYPTO_FIPS140_MOD
bool "Enable FIPS140 integrity self-checked loadable module"
bool "Enable FIPS 140 cryptographic module"
depends on LTO_CLANG && CRYPTO_FIPS140
help
This option enables building a loadable module fips140.ko, which
contains various crypto algorithms that are also built into vmlinux.
At load time, this module overrides the built-in implementations of
these algorithms with its implementations. It also runs self-tests on
these algorithms and verifies the integrity of its code and data. If
either of these steps fails, the kernel will panic.
This module is intended to be loaded at early boot time in order to
meet FIPS 140 and NIAP FPT_TST_EXT.1 requirements. It shouldn't be
used if you don't need to meet these requirements.
config CRYPTO_FIPS140_MOD_ERROR_INJECTION
bool "Support injecting failures into the FIPS 140 self-tests"

15
crypto/fips140-module.c
View File

@ -3,12 +3,15 @@
* Copyright 2021 Google LLC
* Author: Ard Biesheuvel <ardb@google.com>
*
* This file is the core of the fips140.ko, which carries a number of crypto
* algorithms and chaining mode templates that are also built into vmlinux.
* This modules performs a load time integrity check, as mandated by FIPS 140,
* and replaces registered crypto algorithms that appear on the FIPS 140 list
* with ones provided by this module. This meets the FIPS 140 requirements for
* a cryptographic software module.
* This file is the core of fips140.ko, which contains various crypto algorithms
* that are also built into vmlinux. At load time, this module overrides the
* built-in implementations of these algorithms with its implementations. It
* also runs self-tests on these algorithms and verifies the integrity of its
* code and data. If either of these steps fails, the kernel will panic.
*
* This module is intended to be loaded at early boot time in order to meet
* FIPS 140 and NIAP FPT_TST_EXT.1 requirements. It shouldn't be used if you
* don't need to meet these requirements.
*/
#include <linux/ctype.h>