Description of problem: It is currently not possible to boot into fips mode in Fedora 20. Boot ends up with kernel panic: arch/x86/kernel/smp.c:124 native_smp_send_reschedule+0x5d/0x60() [ 20.805320] Modules linked in: tcrypt(+) zlib wp512 twofish_generic twofish_x86_64_3way twofish_x86_64 twofish_common tea sha512_ssse3 sha512_generic sha256_ssse3 sha1_ssse3 serpent_sse2_x86_64 serpent_generic seed salsa20_generic salsa20_x86_64 rmd320 rmd256 rmd160 rmd128 michael_mic md4 khazad ghash_generic gcm fcrypt dm_crypt des_generic deflate cts crypto_null ccm cast6_generic cast_common camellia_generic camellia_x86_64 blowfish_generic blowfish_x86_64 blowfish_common arc4 ansi_cprng ata_generic pata_acpi radeon i2c_algo_bit drm_kms_helper ttm mptsas drm scsi_transport_sas mptscsih crc32c_intel i2c_core pata_jmicron mptbase [ 20.861999] CPU: 13 PID: 515 Comm: modprobe Tainted: G I 3.14.9-200.fc20.x86_64 #1 [ 20.870427] Hardware name: SGI.COM AltixXE270/X8DTN, BIOS 080015 05/28/2009 [ 20.877468] 0000000000000000 000000006310bdba ffff88023fd43d90 ffffffff816ef90e [ 20.884926] 0000000000000000 ffff88023fd43dc8 ffffffff8108a0fd 0000000000000000 [ 20.892382] ffff88013bc14640 000000000000000d 000000000000000d 000000000000e608 [ 20.899839] Call Trace: [ 20.902286] <IRQ> [<ffffffff816ef90e>] dump_stack+0x45/0x56 [ 20.908055] [<ffffffff8108a0fd>] warn_slowpath_common+0x7d/0xa0 [ 20.914063] [<ffffffff8108a22a>] warn_slowpath_null+0x1a/0x20 [ 20.919889] [<ffffffff8104407d>] native_smp_send_reschedule+0x5d/0x60 [ 20.926412] [<ffffffff810ccbf4>] trigger_load_balance+0x144/0x1b0 [ 20.932596] [<ffffffff810bdc57>] scheduler_tick+0x97/0xd0 [ 20.938084] [<ffffffff81098cd0>] update_process_times+0x60/0x70 [ 20.944095] [<ffffffff810f9f05>] tick_sched_handle.isra.15+0x25/0x60 [ 20.950534] [<ffffffff810f9f81>] tick_sched_timer+0x41/0x60 [ 20.956191] [<ffffffff810b12e4>] __run_hrtimer+0x74/0x1d0 [ 20.961679] [<ffffffff810f9f40>] ? tick_sched_handle.isra.15+0x60/0x60 [ 20.968295] [<ffffffff810b1b07>] hrtimer_interrupt+0x107/0x250 [ 20.974208] [<ffffffff81046e47>] local_apic_timer_interrupt+0x37/0x60 [ 20.980731] [<ffffffff81701f2f>] smp_apic_timer_interrupt+0x3f/0x60 [ 20.987086] [<ffffffff8170089d>] apic_timer_interrupt+0x6d/0x80 [ 20.993085] <EOI> [<ffffffff810d6622>] ? up+0x32/0x50 [ 20.998336] [<ffffffffa0080cfc>] ? drm_crtc_helper_set_config+0x69c/0x9e0 [drm_kms_helper] [ 21.006682] [<ffffffff816eb76e>] ? panic+0x1a3/0x1e7 [ 21.011729] [<ffffffff813149dc>] alg_test+0x38c/0x390 [ 21.016863] [<ffffffff81058150>] ? try_to_free_pmd_page+0x50/0x50 [ 21.023038] [<ffffffffa038ff5e>] do_test+0x18be/0x2e20 [tcrypt] [ 21.029039] [<ffffffffa0390a84>] do_test+0x23e4/0x2e20 [tcrypt] [ 21.035047] [<ffffffffa0378000>] ? 0xffffffffa0377fff [ 21.040182] [<ffffffffa0378069>] tcrypt_mod_init+0x69/0x1000 [tcrypt] [ 21.046711] [<ffffffffa0378000>] ? 0xffffffffa0377fff [ 21.051844] [<ffffffff8100216a>] do_one_initcall+0xfa/0x1b0 [ 21.057498] [<ffffffff8105a8f3>] ? set_memory_nx+0x43/0x50 [ 21.063064] [<ffffffff811059a7>] load_module+0x1e37/0x25d0 [ 21.068633] [<ffffffff81101030>] ? store_uevent+0x70/0x70 [ 21.074111] [<ffffffff811ef440>] ? kernel_read+0x50/0x80 [ 21.079506] [<ffffffff811062f6>] SyS_finit_module+0xa6/0xd0 [ 21.085160] [<ffffffff816ffc29>] system_call_fastpath+0x16/0x1b [ 21.091158] ---[ end trace 6160cd14bb4c7a2f ]--- Version-Release number of selected component (if applicable): kernel-3.11.10-301.fc20 dracut-034-64.git20131205.fc20 How reproducible: 100% Steps to Reproduce: 1. yum install dracut-fips 2. dracut -v -f * watch for possibly "missing commands" in the output and install necessary packages 3. add fips=1 boot=<boot_dev> the grug2 kernel parameters * ie. into /boot/grub2/grub.cfg * <boot_dev> <=> mount | grep boot | awk '{print $1}' 4. reboot Actual results: Kernel panic above. Expected results: Correct boot with 1 in /proc/sys/crypto/fips_enabled afterwards. Additional info: I am opening this bug to dracut, since it might be cause by dracut-fips issues, feel free to change component (to kernel) or let me know and I will do it.
Do you have the full dmesg output of this boot? The oops here shows the machine already hit an issue before this. Does this work with the 3.15.y kernel update?
not sure if it is the same issue but this is what I get: Welcome to Fedora 20 (Heisenbug) dracut-037-11.git20140402.fc20 (Initramfs)! [ 0.965850] systemd[1]: No hostname configured. [ 0.966366] systemd[1]: Set hostname to <localhost>. [ 0.966950] systemd[1]: Initializing machine ID from KVM UUID. [ 0.967995] random: systemd urandom read with 4 bits of entropy available [ 0.987669] systemd[1]: Expecting device dev-mapper-fedora\x2droot.device... Expecting device dev-mapper-fedora\x2droot.device... [ 0.989470] systemd[1]: Starting -.slice. [ OK ] Created slice -.slice. [ 0.990952] systemd[1]: Created slice -.slice. [ 0.991456] systemd[1]: Starting System Slice. [ OK ] Created slice System Slice. [ 0.992867] systemd[1]: Created slice System Slice. [ 0.993418] systemd[1]: Starting Slices. [ OK ] Reached target Slices. [ 0.994766] systemd[1]: Reached target Slices. [ 0.995294] systemd[1]: Starting Timers. [ OK ] Reached target Timers. [ 0.996597] systemd[1]: Reached target Timers. [ 0.997119] systemd[1]: Starting udev Kernel Socket. [ OK ] Listening on udev Kernel Socket. [ 0.998608] systemd[1]: Listening on udev Kernel Socket. [ 0.999237] systemd[1]: Starting udev Control Socket. [ OK ] Listening on udev Control Socket. [ 1.000744] systemd[1]: Listening on udev Control Socket. [ 1.001370] systemd[1]: Starting Encrypted Volumes. [ OK ] Reached target Encrypted Volumes. [ 1.002817] systemd[1]: Reached target Encrypted Volumes. [ 1.003447] systemd[1]: Starting Journal Socket. [ OK ] Listening on Journal Socket. [ 1.004916] systemd[1]: Listening on Journal Socket. [ 1.005740] systemd[1]: Starting dracut cmdline hook... Starting dracut cmdline hook... [ 1.007393] systemd[1]: Starting Create list of required static device nodes for the current kernel... Starting Create list of required static device nodes...rrent kernel... [ 1.009756] systemd[1]: Started Load Kernel Modules. [ 1.010366] systemd[1]: Starting Apply Kernel Variables... Starting Apply Kernel Variables... [ 1.011955] systemd[1]: Starting Sockets. [ OK ] Reached target Sockets. [ 1.018558] systemd[1]: Reached target Sockets. [ 1.019109] systemd[1]: Starting Setup Virtual Console... Starting Setup Virtual Console... [ 1.023271] systemd[1]: Starting Journal Service... Starting Journal Service... [ OK ] Started Journal Service. [ 1.029030] systemd[1]: Started Journal Service. [ OK ] Reached target Swap. [ OK ] Reached target Local File Systems. [ OK ] Started Create list of required static device nodes ...current kernel. [ OK ] Started Apply Kernel Variables. [ OK ] Started Setup Virtual Console. Starting Create static device nodes in /dev... [ OK ] Started Create static device nodes in /dev. [ 1.107061] usb 1-1: new high-speed USB device number 2 using xhci_hcd [ OK ] Started dracut cmdline hook. Starting dracut pre-udev hook... [ 1.141603] RPC: Registered named UNIX socket transport module. [ 1.142294] RPC: Registered udp transport module. [ 1.142801] RPC: Registered tcp transport module. [ 1.143317] RPC: Registered tcp NFSv4.1 backchannel transport module. [ OK ] Started dracut pre-udev hook. Starting udev Kernel Device Manager... [ 1.199854] systemd-udevd[251]: starting version 208 [ OK ] Started udev Kernel Device Manager. Starting dracut pre-trigger hook... [ 1.220391] usb 1-1: New USB device found, idVendor=0627, idProduct=0001 [ 1.221184] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=5 [ 1.221937] usb 1-1: Product: QEMU USB Tablet [ 1.222411] usb 1-1: Manufacturer: QEMU [ 1.222853] usb 1-1: SerialNumber: 42 [ 1.223890] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:04.0/usb1/1-1/1-1:1.0/0003:0627:0001.0001/input/input4 [ 1.225190] hid-generic 0003:0627:0001.0001: input,hidraw0: USB HID v0.01 Pointer [QEMU QEMU USB Tablet] on usb-0000:00:04.0-1/input0 [ 1.247906] 8139cp: 8139cp: 10/100 PCI Ethernet driver v1.3 (Mar 22, 2004) [ 1.249974] ACPI: PCI Interrupt Link [LNKA] enabled at IRQ 10 [ 1.257836] ACPI: PCI Interrupt Link [LNKC] enabled at IRQ 11 [ 1.260869] 8139cp 0000:00:03.0 eth0: RTL-8139C+ at 0xffffc90000394000, 52:54:00:1e:38:bb, IRQ 11 [ 1.269832] 8139too: 8139too Fast Ethernet driver 0.9.28 [ 1.276633] [drm] Initialized drm 1.1.0 20060810 [ 1.291512] vda: vda1 vda2 [ 1.297115] [drm] Found bochs VGA, ID 0xb0c0. [ 1.297615] [drm] Framebuffer size 16384 kB @ 0xfd000000, mmio @ 0xfebd4000. [ 1.302690] systemd-udevd[263]: renamed network interface eth0 to ens3 [ 1.304038] [TTM] Zone kernel: Available graphics memory: 1025182 kiB [ 1.304745] [TTM] Initializing pool allocator [ 1.305256] [TTM] Initializing DMA pool allocator [ 1.309513] fbcon: bochsdrmfb (fb0) is primary device [ 1.315535] Console: switching to colour frame buffer device 128x48 [ 1.318264] bochs-drm 0000:00:02.0: fb0: bochsdrmfb frame buffer device [ 1.318956] bochs-drm 0000:00:02.0: registered panic notifier [ 1.320442] [drm] Initialized bochs-drm 1.0.0 20130925 for 0000:00:02.0 on minor 0 [ 1.330072] usb 1-2: new full-speed USB device number 3 using xhci_hcd [ 1.342793] EXT4-fs (vda1): mounted filesystem with ordered data mode. Opts: (null) [ 1.352515] alg: self-tests for ansi_cprng (stdrng) passed [ 1.353210] alg: No test for fips(ansi_cprng) (fips_ansi_cprng) [ 1.361413] AVX or AES-NI instructions are not detected. [ 1.362334] dracut-pre-trigger[252]: modprobe: ERROR: could not insert 'camellia_aesni_avx_x86_64': No such device [ 1.364821] AVX or AES-NI instructions are not detected. [ 1.365560] dracut-pre-trigger[252]: modprobe: ERROR: could not insert 'camellia_aesni_avx2': No such device [ 1.371875] AVX instructions are not detected. [ 1.372604] dracut-pre-trigger[252]: modprobe: ERROR: could not insert 'cast6_avx_x86_64': No such device [ 1.378158] dracut-pre-trigger[252]: modprobe: ERROR: could not insert 'crc32c_intel': No such device [ 1.391289] alg: self-tests for deflate-generic (deflate) passed [ 1.393557] alg: self-tests for des-generic (des) passed [ 1.394231] alg: self-tests for des3_ede-generic (des3_ede) passed [ 1.402600] alg: self-tests for ghash-generic (ghash) passed [ 1.421624] AVX instructions are not detected. [ 1.422381] dracut-pre-trigger[252]: modprobe: ERROR: could not insert 'serpent_avx_x86_64': No such device [ 1.425047] AVX instructions are not detected. [ 1.425667] dracut-pre-trigger[252]: modprobe: ERROR: could not insert 'serpent_avx2': No such device [ 1.428616] sha1_ssse3: Neither AVX nor AVX2 nor SSSE3 is available/usable. [ 1.429567] dracut-pre-trigger[252]: modprobe: ERROR: could not insert 'sha1_ssse3': No such device [ 1.443272] usb 1-2: New USB device found, idVendor=0627, idProduct=0001 [ 1.444001] usb 1-2: New USB device strings: Mfr=1, Product=2, SerialNumber=5 [ 1.444781] usb 1-2: Product: QEMU USB Mouse [ 1.445242] usb 1-2: Manufacturer: QEMU [ 1.445656] usb 1-2: SerialNumber: 42 [ 1.446714] usb 1-2: ep 0x81 - rounding interval to 64 microframes, ep desc says 80 microframes [ 1.448810] input: QEMU QEMU USB Mouse as /devices/pci0000:00/0000:00:04.0/usb1/1-2/1-2:1.0/0003:0627:0001.0002/input/input5 [ 1.450905] hid-generic 0003:0627:0001.0002: input,hidraw1: USB HID v0.01 Mouse [QEMU QEMU USB Mouse] on usb-0000:00:04.0-2/input0 [ 1.471540] sha256_ssse3: Neither AVX nor SSSE3 is available/usable. [ 1.472839] dracut-pre-trigger[252]: modprobe: ERROR: could not insert 'sha256_ssse3': No such device [ 1.503243] sha256_ssse3: Neither AVX nor SSSE3 is available/usable. [ 1.504530] dracut-pre-trigger[252]: modprobe: ERROR: could not insert 'sha256_ssse3': No such device [ 1.536603] alg: self-tests for sha512-generic (sha512) passed [ 1.537713] alg: self-tests for sha384-generic (sha384) passed [ 1.539722] sha512_ssse3: Neither AVX nor SSSE3 is available/usable. [ 1.541104] dracut-pre-trigger[252]: modprobe: ERROR: could not insert 'sha512_ssse3': No such device [ 1.544640] sha512_ssse3: Neither AVX nor SSSE3 is available/usable. [ 1.545982] dracut-pre-trigger[252]: modprobe: ERROR: could not insert 'sha512_ssse3': No such device [ 1.554487] AVX instructions are not detected. [ 1.555536] dracut-pre-trigger[252]: modprobe: ERROR: could not insert 'twofish_avx_x86_64': No such device [ 1.557514] usb 1-3: new high-speed USB device number 4 using xhci_hcd [ 1.565467] alg: self-tests for zlib-generic (zlib) passed [ 1.569361] alg: self-tests for sha1 (sha1) passed [ 1.571249] alg: self-tests for ecb(des-generic) (ecb(des)) passed [ 1.572479] alg: self-tests for ecb(des) (ecb(des)) passed [ 1.574595] alg: self-tests for ecb(des3_ede-generic) (ecb(des3_ede)) passed [ 1.576230] alg: self-tests for ecb(des3_ede) (ecb(des3_ede)) passed [ 1.579355] alg: self-tests for cbc(des3_ede-generic) (cbc(des3_ede)) passed [ 1.580952] alg: self-tests for cbc(des3_ede) (cbc(des3_ede)) passed [ 1.582104] alg: self-tests for sha256 (sha256) passed [ 1.583933] alg: self-tests for ecb(aes-asm) (ecb(aes)) passed [ 1.585075] alg: self-tests for ecb(aes) (ecb(aes)) passed [ 1.587777] alg: self-tests for cbc(aes-asm) (cbc(aes)) passed [ 1.588868] alg: self-tests for cbc(aes) (cbc(aes)) passed [ 1.591755] alg: self-tests for xts(aes-asm) (xts(aes)) passed [ 1.592992] alg: self-tests for xts(aes) (xts(aes)) passed [ 1.595803] alg: self-tests for ctr(aes-asm) (ctr(aes)) passed [ 1.596969] alg: self-tests for ctr(aes) (ctr(aes)) passed [ 1.599733] alg: self-tests for rfc3686(ctr(aes-asm)) (rfc3686(ctr(aes))) passed [ 1.601179] alg: self-tests for rfc3686(ctr(aes)) (rfc3686(ctr(aes))) passed [ 1.602491] alg: self-tests for sha384 (sha384) passed [ 1.603433] alg: self-tests for sha512 (sha512) passed [ 1.604414] alg: self-tests for deflate (deflate) passed [ 1.605407] alg: self-tests for crc32c (crc32c) passed [ 1.606349] alg: self-tests for sha224 (sha224) passed [ 1.608290] alg: self-tests for gcm_base(ctr(aes-asm),ghash-generic) (gcm(aes)) passed [ 1.609911] alg: self-tests for gcm(aes) (gcm(aes)) passed [ 1.610871] alg: self-tests for lzo (lzo) passed [ 1.612730] alg: self-tests for ccm_base(ctr(aes-asm),aes-asm) (ccm(aes)) passed [ 1.614189] alg: self-tests for ccm(aes) (ccm(aes)) passed [ 1.615228] alg: self-tests for zlib (zlib) passed [ 1.617882] alg: self-tests for rfc4309(ccm_base(ctr(aes-asm),aes-asm)) (rfc4309(ccm(aes))) passed [ 1.619626] alg: self-tests for rfc4309(ccm(aes)) (rfc4309(ccm(aes))) passed [ 1.620980] alg: self-tests for ghash (ghash) passed [ 1.621886] alg: self-tests for crct10dif (crct10dif) passed [ 1.623816] alg: self-tests for hmac(sha1-generic) (hmac(sha1)) passed [ 1.625059] alg: self-tests for hmac(sha1) (hmac(sha1)) passed [ 1.627073] alg: self-tests for hmac(sha256-generic) (hmac(sha256)) passed [ 1.628408] alg: self-tests for hmac(sha256) (hmac(sha256)) passed [ 1.630432] alg: self-tests for hmac(sha384-generic) (hmac(sha384)) passed [ 1.631739] alg: self-tests for hmac(sha384) (hmac(sha384)) passed [ 1.633880] alg: self-tests for hmac(sha512-generic) (hmac(sha512)) passed [ 1.635193] alg: self-tests for hmac(sha512) (hmac(sha512)) passed [ 1.637207] alg: self-tests for hmac(sha224-generic) (hmac(sha224)) passed [ 1.638505] alg: self-tests for hmac(sha224) (hmac(sha224)) passed [ 1.641799] alg: self-tests for ansi_cprng (ansi_cprng) passed [ 1.645116] alg: self-tests for authenc(hmac(sha1-generic),cbc(aes-asm)) (authenc(hmac(sha1),cbc(aes))) passed [ 1.647050] alg: self-tests for authenc(hmac(sha1),cbc(aes)) (authenc(hmac(sha1),cbc(aes))) passed [ 1.650986] alg: aead: Failed to load transform for authenc(hmac(md5),ecb(cipher_null)): -2 [ 1.652433] Kernel panic - not syncing: authenc(hmac(md5),ecb(cipher_null)): authenc(hmac(md5),ecb(cipher_null)) alg self test failed in fips mode! [ 1.652433] [ 1.653418] CPU: 0 PID: 429 Comm: modprobe Not tainted 3.15.7-200.fc20.x86_64 #1 [ 1.653418] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 1.653418] 0000000000000000 000000008de8365e ffff88003496bb90 ffffffff816ef92e [ 1.653418] ffffffff81a47988 ffff88003496bc10 ffffffff816eb4a3 ffff880000000018 [ 1.653418] ffff88003496bc20 ffff88003496bbc0 000000008de8365e ffffffffa0225940 [ 1.653418] Call Trace: [ 1.653418] [<ffffffff816ef92e>] dump_stack+0x45/0x56 [ 1.653418] [<ffffffff816eb4a3>] panic+0xd8/0x1fc [ 1.653418] [<ffffffff8130e80c>] alg_test+0x38c/0x390 [ 1.653418] [<ffffffff81057050>] ? clflush_cache_range+0x40/0x40 [ 1.653418] [<ffffffffa02244c9>] do_test+0x2e29/0x2e84 [tcrypt] [ 1.653418] [<ffffffffa0222c2c>] do_test+0x158c/0x2e84 [tcrypt] [ 1.653418] [<ffffffffa022b000>] ? 0xffffffffa022afff [ 1.653418] [<ffffffffa022b069>] tcrypt_mod_init+0x69/0x1000 [tcrypt] [ 1.653418] [<ffffffffa022b000>] ? 0xffffffffa022afff [ 1.653418] [<ffffffff8100216a>] do_one_initcall+0xfa/0x1b0 [ 1.653418] [<ffffffff81059873>] ? set_memory_nx+0x43/0x50 [ 1.653418] [<ffffffff81104082>] load_module+0x1d92/0x25e0 [ 1.653418] [<ffffffff810ffda0>] ? store_uevent+0x70/0x70 [ 1.653418] [<ffffffff811ec5d0>] ? kernel_read+0x50/0x80 [ 1.653418] [<ffffffff81104a86>] SyS_finit_module+0xa6/0xd0 [ 1.653418] [<ffffffff816ff969>] system_call_fastpath+0x16/0x1b [ 1.653418] Kernel Offset: 0x0 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffff9fffffff) [ 1.653418] drm_kms_helper: panic occurred, switching back to text console [ 1.653418] ---[ end Kernel panic - not syncing: authenc(hmac(md5),ecb(cipher_null)): authenc(hmac(md5),ecb(cipher_null)) alg self test failed in fips mode!
If I'm understanding this correctly, it looks like the crypto_null module cannot be loaded, which probably means it isn't in the initramfs. Can you provide the output of 'lsinitrd <initramfs file>' as a plaintext attachment? There is no regular FIPS testing in Fedora that I'm aware of, so it isn't surprising things are broken.
This bug is being closed with INSUFFICIENT_DATA as there has not been a response in over 3 weeks. If you are still experiencing this issue, please reopen and attach the relevant data from the latest kernel you are running and any data that might have been requested previously.
Add _fipsmodules authenc and authencesn to /lib/dracut/modules.d/01fips/module-setup.sh to solve this issue.
(In reply to Burt Silverman from comment #5) > Add _fipsmodules authenc and authencesn to > /lib/dracut/modules.d/01fips/module-setup.sh to solve this issue. thanks