[OS-BUILD PATCHv3 0/2] [redhat] Embed crypto algos, modes and templates needed in the FIPS mode

[Vladis Dronov (via Email Bridge)]

From: Vladis Dronov on gitlab.com
Merge Request: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1125

```
Currently a number of FIPS-allowed algorithms are built as modules or
are
not enabled in Fedora and ARK. This can result in a panic while booting
in the FIPS mode. Fix this by embedding the FIPS-allowed algorithms,
modes
and templates into a kernel, the same way as CTC, CBC and other
algorithms
already do.

The below is a detailed description of a current state and changes
suggested
in this patchset in a readable form:

$ git grep CRYPTO_SHA3
common/generic/CONFIG_CRYPTO_SHA3:CONFIG_CRYPTO_SHA3=m          ###
should be =y

$ git grep CRYPTO_RSA
fedora/generic/CONFIG_CRYPTO_RSA:CONFIG_CRYPTO_RSA=y            ###
unify, set =y

$ git grep CRYPTO_NULL
fedora/generic/CONFIG_CRYPTO_NULL:CONFIG_CRYPTO_NULL=y          ###
should be common

$ git grep -e
'CRYPTO_(ECB|CBC|CTR|XTS|GCM|CCM|AUTH|HMAC|CMAC|OFB|CTS)'
   ark/generic/CONFIG_CRYPTO_XTS:CONFIG_CRYPTO_XTS=m            ###
unify, set to =y
fedora/generic/CONFIG_CRYPTO_XTS:CONFIG_CRYPTO_XTS=y            ###
unify, set to =y
common/generic/CONFIG_CRYPTO_CCM:CONFIG_CRYPTO_CCM=m            ### set
to =y
common/generic/CONFIG_CRYPTO_AUTHENC:CONFIG_CRYPTO_AUTHENC=m    ### set
to =y
common/generic/CONFIG_CRYPTO_CMAC:CONFIG_CRYPTO_CMAC=m          ### set
to =y
common/generic/CONFIG_CRYPTO_OFB:CONFIG_CRYPTO_OFB=m            ### set
to =y

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1947240
Signed-off-by: Vladis Dronov 
```

[OS-BUILD PATCHv3 1/2] Embed crypto algos, modes and templates needed in the FIPS mode

[Vladis Dronov (via Email Bridge)]

From: Vladis Dronov

Embed crypto algos, modes and templates needed in the FIPS mode

Currently a number of FIPS-allowed algorithms are built as modules or are
not enabled in Fedora and ARK. This can result in a panic while booting
in the FIPS mode. Fix this by embedding the FIPS-allowed algorithms, modes
and templates into a kernel, the same way as CTC, CBC and other algorithms
already do.

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1947240
Signed-off-by: Vladis Dronov

diff a/redhat/configs/ark/generic/CONFIG_CRYPTO_XTS b/redhat/configs/ark/generic/CONFIG_CRYPTO_XTS
--- a/redhat/configs/ark/generic/CONFIG_CRYPTO_XTS
+++ /dev/null
@@ -1 +0,0 @@
-CONFIG_CRYPTO_XTS=m
diff a/redhat/configs/common/generic/CONFIG_CRYPTO_AUTHENC b/redhat/configs/common/generic/CONFIG_CRYPTO_AUTHENC
--- a/redhat/configs/common/generic/CONFIG_CRYPTO_AUTHENC
+++ b/redhat/configs/common/generic/CONFIG_CRYPTO_AUTHENC
@@ -1 +1 @@
-CONFIG_CRYPTO_AUTHENC=m
+CONFIG_CRYPTO_AUTHENC=y
diff a/redhat/configs/common/generic/CONFIG_CRYPTO_CCM b/redhat/configs/common/generic/CONFIG_CRYPTO_CCM
--- a/redhat/configs/common/generic/CONFIG_CRYPTO_CCM
+++ b/redhat/configs/common/generic/CONFIG_CRYPTO_CCM
@@ -1 +1 @@
-CONFIG_CRYPTO_CCM=m
+CONFIG_CRYPTO_CCM=y
diff a/redhat/configs/common/generic/CONFIG_CRYPTO_CMAC b/redhat/configs/common/generic/CONFIG_CRYPTO_CMAC
--- a/redhat/configs/common/generic/CONFIG_CRYPTO_CMAC
+++ b/redhat/configs/common/generic/CONFIG_CRYPTO_CMAC
@@ -1 +1 @@
-CONFIG_CRYPTO_CMAC=m
+CONFIG_CRYPTO_CMAC=y
diff a/redhat/configs/fedora/generic/CONFIG_CRYPTO_NULL b/redhat/configs/common/generic/CONFIG_CRYPTO_NULL
--- a/redhat/configs/fedora/generic/CONFIG_CRYPTO_NULL
+++ b/redhat/configs/common/generic/CONFIG_CRYPTO_NULL
diff a/redhat/configs/common/generic/CONFIG_CRYPTO_OFB b/redhat/configs/common/generic/CONFIG_CRYPTO_OFB
--- a/redhat/configs/common/generic/CONFIG_CRYPTO_OFB
+++ b/redhat/configs/common/generic/CONFIG_CRYPTO_OFB
@@ -1 +1 @@
-CONFIG_CRYPTO_OFB=m
+CONFIG_CRYPTO_OFB=y
diff a/redhat/configs/fedora/generic/CONFIG_CRYPTO_RSA b/redhat/configs/common/generic/CONFIG_CRYPTO_RSA
--- a/redhat/configs/fedora/generic/CONFIG_CRYPTO_RSA
+++ b/redhat/configs/common/generic/CONFIG_CRYPTO_RSA
diff a/redhat/configs/common/generic/CONFIG_CRYPTO_SHA3 b/redhat/configs/common/generic/CONFIG_CRYPTO_SHA3
--- a/redhat/configs/common/generic/CONFIG_CRYPTO_SHA3
+++ b/redhat/configs/common/generic/CONFIG_CRYPTO_SHA3
@@ -1 +1 @@
-CONFIG_CRYPTO_SHA3=m
+CONFIG_CRYPTO_SHA3=y
diff a/redhat/configs/fedora/generic/CONFIG_CRYPTO_XTS b/redhat/configs/common/generic/CONFIG_CRYPTO_XTS
--- a/redhat/configs/fedora/generic/CONFIG_CRYPTO_XTS
+++ b/redhat/configs/common/generic/CONFIG_CRYPTO_XTS

--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1125

[OS-BUILD PATCHv3 2/2] Revert s390x/zfcpdump part of a9d179c40281 and ecbfddd98621

[Vladis Dronov (via Email Bridge)]

From: Vladis Dronov

Revert s390x/zfcpdump part of a9d179c40281 and ecbfddd98621

Signed-off-by: Vladis Dronov

diff a/redhat/configs/ark/generic/s390x/zfcpdump/CONFIG_CRYPTO_CHACHA20 b/redhat/configs/ark/generic/s390x/zfcpdump/CONFIG_CRYPTO_CHACHA20
--- /dev/null
+++ b/redhat/configs/ark/generic/s390x/zfcpdump/CONFIG_CRYPTO_CHACHA20
@@ -0,0 +1 @@
+CONFIG_CRYPTO_CHACHA20=y
diff a/redhat/configs/ark/generic/s390x/zfcpdump/CONFIG_CRYPTO_CHACHA20POLY1305 b/redhat/configs/ark/generic/s390x/zfcpdump/CONFIG_CRYPTO_CHACHA20POLY1305
--- /dev/null
+++ b/redhat/configs/ark/generic/s390x/zfcpdump/CONFIG_CRYPTO_CHACHA20POLY1305
@@ -0,0 +1 @@
+CONFIG_CRYPTO_CHACHA20POLY1305=y
diff a/redhat/configs/ark/generic/s390x/zfcpdump/CONFIG_CRYPTO_CTS b/redhat/configs/ark/generic/s390x/zfcpdump/CONFIG_CRYPTO_CTS
--- /dev/null
+++ b/redhat/configs/ark/generic/s390x/zfcpdump/CONFIG_CRYPTO_CTS
@@ -0,0 +1 @@
+CONFIG_CRYPTO_CTS=y
diff a/redhat/configs/ark/generic/s390x/zfcpdump/CONFIG_CRYPTO_POLY1305 b/redhat/configs/ark/generic/s390x/zfcpdump/CONFIG_CRYPTO_POLY1305
--- /dev/null
+++ b/redhat/configs/ark/generic/s390x/zfcpdump/CONFIG_CRYPTO_POLY1305
@@ -0,0 +1 @@
+CONFIG_CRYPTO_POLY1305=y

--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1125

[Herbert Xu (via Email Bridge)]

From: Herbert Xu on gitlab.com
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1125#note_5794766...

Looks good to me.

Acked-by: Herbert Xu

[Simo Sorce (via Email Bridge)]

From: Simo Sorce on gitlab.com
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1125#note_5795911...

LGTM for fixing boot issues in FIPS mode.

Acked-by: Simo Sorce

[Simo Sorce (via Email Bridge)]

From: Simo Sorce on gitlab.com
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1125#note_5795928...

LGTM for fixing boot issues in FIPS mode.

Acked-by: Simo Sorce [e-mail]

(Let's see if the bot is happy now)

[Vladis Dronov (via Email Bridge)]

From: Vladis Dronov on gitlab.com
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1125#note_5819766...

just a follow up for posterity - a brew build with this patchset
boots in a FIPS mode, i.e. the main issue is fixed:
https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=36926814