android_kernel_samsung_sm8650/crypto/fips140-defs.h

59 lines
2.6 KiB
C
Raw Normal View History

ANDROID: fips140: add kernel crypto module To meet FIPS 140 requirements, add support for building a kernel module "fips140.ko" that contains various cryptographic algorithms built from existing kernel source files. At load time, the module checks its own integrity and self-tests its algorithms, then registers the algorithms with the crypto API to supersede the original algorithms provided by the kernel itself. [ebiggers: this commit originated from "ANDROID: crypto: fips140 - perform load time integrity check", but I've folded many later commits into it to make forward porting easier. See below] Original commits: android12-5.10: 6be141eb36fe ("ANDROID: crypto: fips140 - perform load time integrity check") 868be244bbed ("ANDROID: inject correct HMAC digest into fips140.ko at build time") 091338cb398e ("ANDROID: fips140: add missing static keyword to fips140_init()") c799c6644b52 ("ANDROID: fips140: adjust some log messages") 92de53472e68 ("ANDROID: fips140: log already-live algorithms") 0af06624eadc ("ANDROID: fips140: check for errors from initcalls") 634445a640a4 ("ANDROID: fips140: fix deadlock in unregister_existing_fips140_algos()") e886dd4c339e ("ANDROID: fips140: unregister existing DRBG algorithms") b7397e89db29 ("ANDROID: fips140: add power-up cryptographic self-tests") 50661975be74 ("ANDROID: fips140: add/update module help text") b397a0387cb2 ("ANDROID: fips140: test all implementations") 17ccefe14021 ("ANDROID: fips140: use full 16-byte IV") 1be58af0776a ("ANDROID: fips140: remove non-prediction-resistant DRBG test") 2b5843ae2d90 ("ANDROID: fips140: add AES-CBC-CTS") 2ee56aad318c ("ANDROID: fips140: add AES-CMAC") 960ebb2b565b ("ANDROID: fips140: add jitterentropy to fips140 module") e5b14396f9d2 ("ANDROID: fips140: take into account AES-GCM not being approvable") 52b70d491bd4 ("ANDROID: fips140: use FIPS140_CFLAGS when compiling fips140-selftests.c") 6b995f5a5403 ("ANDROID: fips140: preserve RELA sections without relying on the module loader") e45108ecff64 ("ANDROID: fips140: block crypto operations until tests complete") ecf9341134d1 ("ANDROID: fips140: remove in-place updating of live algorithms") 482b0323cf29 ("ANDROID: fips140: zeroize temporary values from integrity check") 64d769e53f20 ("ANDROID: fips140: add service indicators") 8d7f609cdaa4 ("ANDROID: fips140: add name and version, and a function to retrieve them") 6b7c37f6c449 ("ANDROID: fips140: use UTS_RELEASE as FIPS version") 903e97a0ca6d ("ANDROID: fips140: refactor evaluation testing support") 97fb2104fe22 ("ANDROID: fips140: add support for injecting integrity error") 109f31ac23f5 ("ANDROID: fips140: add userspace interface for evaluation testing") android14-5.15: 84572a0c7981 ("ANDROID: fips140: split dump-section+add-section into 2 ops") b0f8873811d4 ("ANDROID: kleaf: convert fips140 to kleaf") 2535deae8069 ("ANDROID: GKI: Source GKI_BUILD_CONFIG_FRAGMENT after setting all variables") 685a2ade28bb ("ANDROID: fips140: add crypto_memneq() back to the module") 320dfca58a3d ("ANDROID: fips140: fix in-tree builds") d4966a820397 ("ANDROID: fips140: remove CONFIG_CRYPTO_FIPS140 option") 6da26b8750f5 ("ANDROID: fips140: require 'm' to enable CRYPTO_FIPS140_MOD") bfcfcce3803b ("ANDROID: fips140: unapply ABS32 relocations generated by KCFI") 63f46b45dda2 ("ANDROID: fips140: eliminate crypto-fips.a build step") ae4ca7a09bb6 ("ANDROID: fips140: allow building without LTO") Bug: 153614920 Bug: 188620248 Test: tested that the module builds and can be loaded on raven. Change-Id: I3fde49dbc3d16b149b072a27ba5b4c6219015c94 Signed-off-by: Ard Biesheuvel <ardb@google.com> Signed-off-by: Eric Biggers <ebiggers@google.com>
2021-03-23 18:54:38 +09:00
/* SPDX-License-Identifier: GPL-2.0-only */
/*
* Copyright 2021 Google LLC
*
* This file is automatically included by all files built into fips140.ko, via
* the "-include" compiler flag.
*/
/*
* fips140.ko is built from various unmodified or minimally modified kernel
* source files, many of which are normally meant to be buildable into different
* modules themselves. That results in conflicting instances of module_init()
* and related macros such as MODULE_LICENSE().
*
* To solve that, we undefine MODULE to trick the kernel headers into thinking
* the code is being compiled as built-in. That causes module_init() and
* related macros to be expanded as they would be for built-in code; e.g.,
* module_init() adds the function to the .initcalls section of the binary.
*
* The .c files that contain the real module_init, module license, and module
* parameters for fips140.ko are then responsible for redefining MODULE. The
* real module_init executes all initcalls that were collected into .initcalls.
ANDROID: fips140: add kernel crypto module To meet FIPS 140 requirements, add support for building a kernel module "fips140.ko" that contains various cryptographic algorithms built from existing kernel source files. At load time, the module checks its own integrity and self-tests its algorithms, then registers the algorithms with the crypto API to supersede the original algorithms provided by the kernel itself. [ebiggers: this commit originated from "ANDROID: crypto: fips140 - perform load time integrity check", but I've folded many later commits into it to make forward porting easier. See below] Original commits: android12-5.10: 6be141eb36fe ("ANDROID: crypto: fips140 - perform load time integrity check") 868be244bbed ("ANDROID: inject correct HMAC digest into fips140.ko at build time") 091338cb398e ("ANDROID: fips140: add missing static keyword to fips140_init()") c799c6644b52 ("ANDROID: fips140: adjust some log messages") 92de53472e68 ("ANDROID: fips140: log already-live algorithms") 0af06624eadc ("ANDROID: fips140: check for errors from initcalls") 634445a640a4 ("ANDROID: fips140: fix deadlock in unregister_existing_fips140_algos()") e886dd4c339e ("ANDROID: fips140: unregister existing DRBG algorithms") b7397e89db29 ("ANDROID: fips140: add power-up cryptographic self-tests") 50661975be74 ("ANDROID: fips140: add/update module help text") b397a0387cb2 ("ANDROID: fips140: test all implementations") 17ccefe14021 ("ANDROID: fips140: use full 16-byte IV") 1be58af0776a ("ANDROID: fips140: remove non-prediction-resistant DRBG test") 2b5843ae2d90 ("ANDROID: fips140: add AES-CBC-CTS") 2ee56aad318c ("ANDROID: fips140: add AES-CMAC") 960ebb2b565b ("ANDROID: fips140: add jitterentropy to fips140 module") e5b14396f9d2 ("ANDROID: fips140: take into account AES-GCM not being approvable") 52b70d491bd4 ("ANDROID: fips140: use FIPS140_CFLAGS when compiling fips140-selftests.c") 6b995f5a5403 ("ANDROID: fips140: preserve RELA sections without relying on the module loader") e45108ecff64 ("ANDROID: fips140: block crypto operations until tests complete") ecf9341134d1 ("ANDROID: fips140: remove in-place updating of live algorithms") 482b0323cf29 ("ANDROID: fips140: zeroize temporary values from integrity check") 64d769e53f20 ("ANDROID: fips140: add service indicators") 8d7f609cdaa4 ("ANDROID: fips140: add name and version, and a function to retrieve them") 6b7c37f6c449 ("ANDROID: fips140: use UTS_RELEASE as FIPS version") 903e97a0ca6d ("ANDROID: fips140: refactor evaluation testing support") 97fb2104fe22 ("ANDROID: fips140: add support for injecting integrity error") 109f31ac23f5 ("ANDROID: fips140: add userspace interface for evaluation testing") android14-5.15: 84572a0c7981 ("ANDROID: fips140: split dump-section+add-section into 2 ops") b0f8873811d4 ("ANDROID: kleaf: convert fips140 to kleaf") 2535deae8069 ("ANDROID: GKI: Source GKI_BUILD_CONFIG_FRAGMENT after setting all variables") 685a2ade28bb ("ANDROID: fips140: add crypto_memneq() back to the module") 320dfca58a3d ("ANDROID: fips140: fix in-tree builds") d4966a820397 ("ANDROID: fips140: remove CONFIG_CRYPTO_FIPS140 option") 6da26b8750f5 ("ANDROID: fips140: require 'm' to enable CRYPTO_FIPS140_MOD") bfcfcce3803b ("ANDROID: fips140: unapply ABS32 relocations generated by KCFI") 63f46b45dda2 ("ANDROID: fips140: eliminate crypto-fips.a build step") ae4ca7a09bb6 ("ANDROID: fips140: allow building without LTO") Bug: 153614920 Bug: 188620248 Test: tested that the module builds and can be loaded on raven. Change-Id: I3fde49dbc3d16b149b072a27ba5b4c6219015c94 Signed-off-by: Ard Biesheuvel <ardb@google.com> Signed-off-by: Eric Biggers <ebiggers@google.com>
2021-03-23 18:54:38 +09:00
*/
#undef MODULE
/*
* Defining KBUILD_MODFILE is also required, since the kernel headers expect it
* to be defined when code that can be a module is compiled as built-in.
*/
#define KBUILD_MODFILE "crypto/fips140"
/*
* Disable symbol exports by default. fips140.ko includes various files that
* use EXPORT_SYMBOL*(), but it's unwanted to export any symbols from fips140.ko
* except where explicitly needed for FIPS certification reasons.
*/
#define __DISABLE_EXPORTS
/*
* Redirect all calls to algorithm registration functions to the wrapper
* functions defined within the module.
*/
#define aead_register_instance fips140_aead_register_instance
#define ahash_register_instance fips140_ahash_register_instance
#define crypto_register_aead fips140_crypto_register_aead
#define crypto_register_aeads fips140_crypto_register_aeads
#define crypto_register_ahash fips140_crypto_register_ahash
#define crypto_register_ahashes fips140_crypto_register_ahashes
#define crypto_register_alg fips140_crypto_register_alg
#define crypto_register_algs fips140_crypto_register_algs
#define crypto_register_rng fips140_crypto_register_rng
#define crypto_register_rngs fips140_crypto_register_rngs
#define crypto_register_shash fips140_crypto_register_shash
#define crypto_register_shashes fips140_crypto_register_shashes
#define crypto_register_skcipher fips140_crypto_register_skcipher
#define crypto_register_skciphers fips140_crypto_register_skciphers
#define shash_register_instance fips140_shash_register_instance
#define skcipher_register_instance fips140_skcipher_register_instance