lkml.org 
[lkml]   [2014]   [Oct]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[PATCH 9/9] Disable ccm and ccm4309 in fips mod
NX CCM has not support to keys larger than 128 neither our hardware.
In cases where a system is running in fips mode enabled a tcrypt test will
crash the system in a kernel panic call.
This patch disable, for now, CCM's algorithms in fips mode to avoid this.

Signed-off-by: Leonidas S. Barbosa <leosilva@linux.vnet.ibm.com>
---
drivers/crypto/nx/nx.c | 32 ++++++++++++++++++++++----------
1 files changed, 22 insertions(+), 10 deletions(-)

diff --git a/drivers/crypto/nx/nx.c b/drivers/crypto/nx/nx.c
index aa8c38d..a32239c 100644
--- a/drivers/crypto/nx/nx.c
+++ b/drivers/crypto/nx/nx.c
@@ -35,6 +35,7 @@
#include <linux/of.h>
#include <asm/hvcall.h>
#include <asm/vio.h>
+#include <linux/fips.h>

#include "nx_csbcpb.h"
#include "nx.h"
@@ -566,13 +567,15 @@ static int nx_register_algs(void)
if (rc)
goto out_unreg_gcm;

- rc = crypto_register_alg(&nx_ccm_aes_alg);
- if (rc)
- goto out_unreg_gcm4106;
+ if (!fips_enabled) {
+ rc = crypto_register_alg(&nx_ccm_aes_alg);
+ if (rc)
+ goto out_unreg_gcm4106;

- rc = crypto_register_alg(&nx_ccm4309_aes_alg);
- if (rc)
- goto out_unreg_ccm;
+ rc = crypto_register_alg(&nx_ccm4309_aes_alg);
+ if (rc)
+ goto out_unreg_ccm;
+ }

rc = crypto_register_shash(&nx_shash_sha256_alg);
if (rc)
@@ -593,9 +596,11 @@ out_unreg_s512:
out_unreg_s256:
crypto_unregister_shash(&nx_shash_sha256_alg);
out_unreg_ccm4309:
- crypto_unregister_alg(&nx_ccm4309_aes_alg);
+ if (!fips_enabled)
+ crypto_unregister_alg(&nx_ccm4309_aes_alg);
out_unreg_ccm:
- crypto_unregister_alg(&nx_ccm_aes_alg);
+ if (fips_enabled)
+ crypto_unregister_alg(&nx_ccm_aes_alg);
out_unreg_gcm4106:
crypto_unregister_alg(&nx_gcm4106_aes_alg);
out_unreg_gcm:
@@ -746,8 +751,15 @@ static int nx_remove(struct vio_dev *viodev)
if (nx_driver.of.status == NX_OKAY) {
NX_DEBUGFS_FINI(&nx_driver);

- crypto_unregister_alg(&nx_ccm_aes_alg);
- crypto_unregister_alg(&nx_ccm4309_aes_alg);
+ /* CCM algorithm has not support to keys larger than 128
+ * however tcrypt test uses key larger than. If a system
+ * runs with fips enabled it'll crash. For now we need to
+ * disable this two algorithms in fips mode.
+ */
+ if (!fips_enabled) {
+ crypto_unregister_alg(&nx_ccm_aes_alg);
+ crypto_unregister_alg(&nx_ccm4309_aes_alg);
+ }
crypto_unregister_alg(&nx_gcm_aes_alg);
crypto_unregister_alg(&nx_gcm4106_aes_alg);
crypto_unregister_alg(&nx_ctr_aes_alg);
--
1.7.1


\
 
 \ /
  Last update: 2014-10-28 19:21    [W:0.039 / U:1.088 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site