• Jarod Wilson's avatar
    crypto: tcrypt - Do not exit on success in fips mode · 4e033a6b
    Jarod Wilson authored
    At present, the tcrypt module always exits with an -EAGAIN upon
    successfully completing all the tests its been asked to run. In fips
    mode, integrity checking is done by running all self-tests from the
    initrd, and its much simpler to check the ret from modprobe for
    success than to scrape dmesg and/or /proc/crypto. Simply stay
    loaded, giving modprobe a retval of 0, if self-tests all pass and
    we're in fips mode.
    
    A side-effect of tracking success/failure for fips mode is that in
    non-fips mode, self-test failures will return the actual failure
    return codes, rather than always returning -EAGAIN, which seems more
    correct anyway.
    
    The tcrypt_test() portion of the patch is dependent on my earlier
    pair of patches that skip non-fips algs in fips mode, at least to
    achieve the fully intended behavior.
    
    Nb: testing this patch against the cryptodev tree revealed a test
    failure for sha384, which I have yet to look into...
    Signed-off-by: default avatarJarod Wilson <jarod@redhat.com>
    Acked-by: default avatarNeil Horman <nhorman@tuxdriver.com>
    Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
    4e033a6b
tcrypt.c 19.6 KB