Bug 217293

Randy Dunlap <rdunlap@infradead.org> writes:

Hi sephora,

On 4/3/23 07:29, Kernel.org Bugbot wrote:
> o6irnndpcv7 writes via Kernel.org Bugzilla:
> 
> Hello and good day!
> 
> I think I found a missing dependency.
> In case of setting CONFIG_FIPS_SIGNATURE_SELFTEST, CONFIG_CRYPTO_SHA256 also
> needs to be set. But not as module.
> Failing to do so results in an early kernel panic during boot. 

Please tell us what the kernel panic message is.

> 
> Tested on linux-6.1.12-gentoo and linux-6.1.19-gentoo.
> 

Have you tested this on a mainline kernel, without gentoo patches?

Does gentoo add any patches in this area?

Thanks.

> 
> Thanks,
>   sephora
> 
> View: https://bugzilla.kernel.org/show_bug.cgi?id=217293#c0
> You can reply to this message to join the discussion.

(via https://msgid.link/92be7194-b02b-5380-7d33-9bd44e6aaf88@infradead.org)

Hi Randy!

(In reply to Bugbot from comment #1)
> Randy Dunlap <rdunlap@infradead.org> writes:
>
> Please tell us what the kernel panic message is.
> 

There is no message. I'm sorry.
I just get a black screen.

I'm using EFI to boot my machine. And I can get some output if I enable 'earlycon=efifb' via CMDLINE. 

The output stops at:
Console: colour dummy device 80x25
printk: console [tty0] enabled
printk: bootconsole [efifb0] disabled

At this point the machine freezes. No error message.

And when I set:
CONFIG_PANIC_ON_OOPS=y
CONFIG_PANIC_ON_OOPS_VALUE=1
CONFIG_PANIC_TIMEOUT=-1

That gives me a reboot loop.

> 
> Have you tested this on a mainline kernel, without gentoo patches?
> 
> Does gentoo add any patches in this area?
>

Unfortunately I don't know if Gentoo is adding any patches that may affect this.

But I can confirm that the problem persists while using vanilla-sources for kernel 6.2.9.

Thanks,
   sephora

> 
> Thanks.

Randy Dunlap <rdunlap@infradead.org> replies to comment #2:

On 4/3/23 13:04, Kernel.org Bugbot wrote:
> o6irnndpcv7 writes via Kernel.org Bugzilla:
> 
> Hi Randy!
> 
> (In reply to Bugbot from comment #1)
>> Randy Dunlap <rdunlap@infradead.org> writes:
>>
>> Please tell us what the kernel panic message is.
>>
> 
> There is no message. I'm sorry.
> I just get a black screen.
> 
> I'm using EFI to boot my machine. And I can get some output if I enable
> 'earlycon=efifb' via CMDLINE. 
> 
> The output stops at:
> Console: colour dummy device 80x25
> printk: console [tty0] enabled
> printk: bootconsole [efifb0] disabled
> 
> At this point the machine freezes. No error message.
> 
> And when I set:
> CONFIG_PANIC_ON_OOPS=y
> CONFIG_PANIC_ON_OOPS_VALUE=1
> CONFIG_PANIC_TIMEOUT=-1
> 
> That gives me a reboot loop.
> 
>>
>> Have you tested this on a mainline kernel, without gentoo patches?
>>
>> Does gentoo add any patches in this area?
>>
> 
> Unfortunately I don't know if Gentoo is adding any patches that may affect
> this.
> 
> But I can confirm that the problem persists while using vanilla-sources for
> kernel 6.2.9.

Please put your kernel .config file on the bugzilla entry.

What makes you think that this is related to FIPS_SIGNATURE_SELFTEST?

thanks.

(via https://msgid.link/1d7e238b-7e8f-9ce0-1ecb-68e2b80b6d92@infradead.org)

Randy Dunlap <rdunlap@infradead.org> replies to comment #3:

Hi again,

On 4/3/23 13:19, Randy Dunlap wrote:
> 
> 
> On 4/3/23 13:04, Kernel.org Bugbot wrote:
>> o6irnndpcv7 writes via Kernel.org Bugzilla:
>>
>> Hi Randy!
>>
>> (In reply to Bugbot from comment #1)
>>> Randy Dunlap <rdunlap@infradead.org> writes:
>>>
>>> Please tell us what the kernel panic message is.
>>>
>>
>> There is no message. I'm sorry.
>> I just get a black screen.
>>
>> I'm using EFI to boot my machine. And I can get some output if I enable
>> 'earlycon=efifb' via CMDLINE. 
>>
>> The output stops at:
>> Console: colour dummy device 80x25
>> printk: console [tty0] enabled
>> printk: bootconsole [efifb0] disabled
>>
>> At this point the machine freezes. No error message.
>>

I can reproduce this or at least something very similar to it, but it
doesn't matter if FIPS_SIGNATURE_SELFTEST is set or not.


>> And when I set:
>> CONFIG_PANIC_ON_OOPS=y
>> CONFIG_PANIC_ON_OOPS_VALUE=1
>> CONFIG_PANIC_TIMEOUT=-1
>>
>> That gives me a reboot loop.
>>
>>>
>>> Have you tested this on a mainline kernel, without gentoo patches?
>>>
>>> Does gentoo add any patches in this area?
>>>
>>
>> Unfortunately I don't know if Gentoo is adding any patches that may affect
>> this.
>>
>> But I can confirm that the problem persists while using vanilla-sources for
>> kernel 6.2.9.
> 
> Please put your kernel .config file on the bugzilla entry.

I'll test with your .config file...

> What makes you think that this is related to FIPS_SIGNATURE_SELFTEST?

and still that question...

(via https://msgid.link/1c880cd5-b3f1-46b9-fc66-f7743e068c7a@infradead.org)

Created attachment 304083 [details]
Kernel config for 6.2.9

This is a kernel config for 6.2.9, with:

# CONFIG_FIPS_SIGNATURE_SELFTEST is not set
# CONFIG_CRYPTO_SHA256 is not set

Hi Randy!

I submitted an example config. 
That config works fine for me, until I set: 

CONFIG_FIPS_SIGNATURE_SELFTEST=y

And it starts working well again if I set:

CONFIG_FIPS_SIGNATURE_SELFTEST=y
CONFIG_CRYPTO_SHA256=y

That's why I think it is related to FIPS_SIGNATURE_SELFTEST.


Thanks,
  sephora

Randy Dunlap <rdunlap@infradead.org> replies to comment #6:

[adding linux-crypto and dhowells]


On 4/3/23 23:17, Kernel.org Bugbot wrote:
> o6irnndpcv7 writes via Kernel.org Bugzilla:
> 
> Hi Randy!
> 
> I submitted an example config. 
> That config works fine for me, until I set: 
> 
> CONFIG_FIPS_SIGNATURE_SELFTEST=y
> 
> And it starts working well again if I set:
> 
> CONFIG_FIPS_SIGNATURE_SELFTEST=y
> CONFIG_CRYPTO_SHA256=y
> 
> That's why I think it is related to FIPS_SIGNATURE_SELFTEST.
> 
> 
> Thanks,
>   sephora
> 
> View: https://bugzilla.kernel.org/show_bug.cgi?id=217293#c6
> You can reply to this message to join the discussion.

I'm not making any progress on this bug, so asking others for help.


Is there anything in the FIPS_SIGNATURE_SELFTEST code (selftest.c)
or code that it calls that requires CRYPTO_SHA256?

(via https://msgid.link/15521c65-1501-9394-8845-4d4ef983e6b6@infradead.org)