[ciq-6.18.y] [FIPS] Multiple patches tested (30 commits)#1291

Merged

bmastbergen merged 30 commits into

ciq-6.18.yfrom

{jallison}_ciq-6.18.y

Jun 9, 2026

Commits on Jun 2, 2026

Commits on Jun 3, 2026

crypto: essiv - Zeroize keys on exit in essiv_aead_setkey()

jason-rodri
authored and
bmastbergen
committed
crypto: drbg - Align buffers to at least a cache line

kerneltoast
authored and
bmastbergen
committed
mm/gup: introduce pin_user_pages_fast_only()

kerneltoast
authored and
bmastbergen
committed
crypto: rng - Convert crypto_default_rng_refcnt into an unsigned int

kerneltoast
authored and
bmastbergen
committed
crypto: rng - Fix priority inversions due to mutex locks

kerneltoast
authored and
bmastbergen
committed
crypto: rng - Implement fast per-CPU DRBG instances

kerneltoast
authored and
bmastbergen
committed
lib/crypto: Add FIPS self-tests for SHA-1 and SHA-2

Eric Biggers
authored and
bmastbergen
committed
byteorder: Add le64_to_cpu_array() and cpu_to_le64_array()

Eric Biggers
authored and
bmastbergen
committed
lib/crypto: blake2b: Add BLAKE2b library functions

jallisonciq
authored and
bmastbergen
committed
btrfs: switch to library APIs for checksums

jallisonciq
authored and
bmastbergen
committed
crypto: testmgr - block Crypto API xxhash64 in FIPS mode

jallisonciq
authored and
bmastbergen
committed
When in fips mode, self-test errors must panic.

jallisonciq
authored and
bmastbergen
committed
When in fips mode, self-test errors must panic.

jallisonciq
authored and
bmastbergen
committed
Change CONFIG_CRYPTO_JITTERENTROPY_OSR from 1 to 3 in all configs.

jallisonciq
authored and
bmastbergen
committed
dh_compute_value misses the check SP800-56Arev3, 5.6.2.1.4 which is typically implemented after dh_is_pubkey_valid.

jallisonciq
authored and
bmastbergen
committed
In crypto_kdf108_ctr_generate() there is no minimum length check for the digest to be generated - it must be at least 112 bits.

jallisonciq
authored and
bmastbergen
committed
Add fips_approved flag to SHA1 and HMAC-SHA1 structs.

jallisonciq
authored and
bmastbergen
committed
Add fips_approved flag to SHA224 and HMAC-SHA224 structs.

jallisonciq
authored and
bmastbergen
committed
Add fips_approved flag to SHA256 and HMAC-SHA256 structs.

jallisonciq
authored and
bmastbergen
committed
Add fips_approved flag to SHA384 and HMAC-SHA384 structs.

jallisonciq
authored and
bmastbergen
committed
Add fips_approved flag to SHA512 and HMAC-SHA512 structs.

jallisonciq
authored and
bmastbergen
committed
Add fips_approved indicator to struct crypto_aes_ctx.

jallisonciq
authored and
bmastbergen
committed
Add CONFIG_CRYPTO_FIPS_CUSTOM_VERSION=y, CONFIG_CRYPTO_FIPS_VERSION="ciq.6.18.20260531"

jallisonciq
authored and
bmastbergen
committed
Unset CRYPTO_JITTERENTROPY_MEMSIZE_2, set CRYPTO_JITTERENTROPY_MEMSIZE_128.

jallisonciq
authored and
bmastbergen
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[ciq-6.18.y] [FIPS] Multiple patches tested (30 commits)#1291

[ciq-6.18.y] [FIPS] Multiple patches tested (30 commits)#1291
bmastbergen merged 30 commits into
ciq-6.18.yfrom
{jallison}_ciq-6.18.y

Commits on Jun 2, 2026

random: Add hook to override device reads and getrandom(2)

crypto: rng - Override drivers/char/random in FIPS mode

not upstream: Disable vdso getrandom when FIPS is enabled

crypto: ecdh - implement FIPS PCT

Commits on Jun 3, 2026

crypto: essiv - Zeroize keys on exit in essiv_aead_setkey()

crypto: drbg - Align buffers to at least a cache line

mm/gup: introduce pin_user_pages_fast_only()

crypto: rng - Convert crypto_default_rng_refcnt into an unsigned int

crypto: rng - Fix priority inversions due to mutex locks

crypto: rng - Implement fast per-CPU DRBG instances

lib/crypto: Add FIPS self-tests for SHA-1 and SHA-2

byteorder: Add le64_to_cpu_array() and cpu_to_le64_array()

lib/crypto: blake2b: Add BLAKE2b library functions

btrfs: switch to library APIs for checksums

crypto: testmgr - block Crypto API xxhash64 in FIPS mode

When in fips mode, self-test errors must panic.

When in fips mode, self-test errors must panic.

Change CONFIG_CRYPTO_JITTERENTROPY_OSR from 1 to 3 in all configs.

dh_compute_value misses the check SP800-56Arev3, 5.6.2.1.4 which is typically implemented after dh_is_pubkey_valid.

In crypto_kdf108_ctr_generate() there is no minimum length check for the digest to be generated - it must be at least 112 bits.

Add fips_approved flag to SHA1 and HMAC-SHA1 structs.

Add fips_approved flag to SHA224 and HMAC-SHA224 structs.

Add fips_approved flag to SHA256 and HMAC-SHA256 structs.

Add fips_approved flag to SHA384 and HMAC-SHA384 structs.

Add fips_approved flag to SHA512 and HMAC-SHA512 structs.

Add fips_approved indicator to struct crypto_aes_ctx.

Add CONFIG_CRYPTO_FIPS_CUSTOM_VERSION=y, CONFIG_CRYPTO_FIPS_VERSION="ciq.6.18.20260531"

Unset CRYPTO_JITTERENTROPY_MEMSIZE_2, set CRYPTO_JITTERENTROPY_MEMSIZE_128.

Commits on Jun 8, 2026

github actions: Add FIPS protected directory check for PRs

Restore CRYPTO_TFM_FIPS_COMPLIANCE flag as an indicator to differentiate between internal and external IV generation when AES-GCM