On Monday 11 May 2009 10:06:32 Jarod Wilson wrote: > At present, the tcrypt module always exits with an -EAGAIN upon > successfully completing all the tests its been asked to run. There > are cases where it would be much simpler to verify all tests passed > if tcrypt simply stayed loaded (i.e. returned 0). Specifically, in > fips mode, all self-tests need to be run from the initrd, and its > much simpler to check the ret from modprobe for success than to > scrape dmesg. To make this doable, I've simply added a module param > to allow this behavior, leaving the default behavior more or less > the same as before, although now we're tracking all success/failure > rets as well. I've been reminded that a self-test failure in fips mode means an immediate panic, so modprobe never sees the ret in that case, but if the module load failed for other reasons, a non-zero return value from modprobe is possible w/o traversing the code paths that trigger a self-test failure panic. For one, if the tcrypt module were to go missing for some reason, modprobe would have a non-zero ret, and the initrd would need to handle panicking the system. Would there be any objections to dropping the noexit parameter entirely and just making its behavior the default? It would make all users regardless of fips mode notice failures more readily. -- Jarod Wilson jarod@xxxxxxxxxx -- To unsubscribe from this list: send the line "unsubscribe linux-crypto" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
