From 2742be5903724a4db0fe1df2624bba18311c0f5f Mon Sep 17 00:00:00 2001 From: Eric Biggers Date: Thu, 8 Jul 2021 14:46:46 -0700 Subject: [PATCH] ANDROID: fips140: define fips_enabled to 1 to enable FIPS behavior In fips140.ko, enable the behavior that the upstream fips_enabled flag controls, such as the XTS weak key check which apparently is required. Note that some of this behavior, such as the DRBG continuity check, is allegedly not required. But to ensure we don't miss anything that was already handled upstream, it seems best to define fips_enabled to 1. We can still disable anything that turns out to be problematic. Bug: 153614920 Bug: 188620248 Change-Id: Idcded9e69e7d7cdf7f2937009af209857b0c08e2 Signed-off-by: Eric Biggers --- include/linux/fips.h | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/include/linux/fips.h b/include/linux/fips.h index c6961e932fef..83f5d6f7c62d 100644 --- a/include/linux/fips.h +++ b/include/linux/fips.h @@ -2,7 +2,15 @@ #ifndef _FIPS_H #define _FIPS_H -#ifdef CONFIG_CRYPTO_FIPS +#ifdef BUILD_FIPS140_KO +/* + * In fips140.ko, enable the behavior that the upstream fips_enabled flag + * controls, such as the XTS weak key check. + */ +#define fips_enabled 1 +#define CONFIG_CRYPTO_FIPS 1 + +#elif defined(CONFIG_CRYPTO_FIPS) extern int fips_enabled; extern struct atomic_notifier_head fips_fail_notif_chain;