20260904-linuxkm-misc

[douzzer]

linuxkm/linuxkm_wc_port.h:

• reduce WC_LINUXKM_MAX_NS_WITHOUT_YIELD from 1 second to 25 ms for better kernel citizenship.
• add WC_DEBUG_FORCE_KERNEL_SETTINGS for inhibiting #errors on unsupported configurations.
• add __extension__ annotation to macros that need it.
• add wc_svr_disallowed_count_reset() and wc_svr_disallowed_count_current().
• fix CAN_SAVE_VECTOR_REGISTERS() to honor DEBUG_VECTOR_REGISTER_ACCESS_ALWAYS_{ON,OFF}.
• add WC_RELAX_LONG_LOOP() to DEBUG_VECTOR_REGISTER_ACCESS_ALWAYS_OFF variant of SAVE_VECTOR_REGISTERS2().
• allow for fully user-supplied SAVE_VECTOR_REGISTERS() and friends.

linuxkm/module_hooks.c:

• add WOLFSSL_DEBUG_TRACE_ERROR_CODES coverage for all system error codes used by module_hooks.c and its includes.
• implement double-run wolfCrypt_IntegrityTest_fips() and wc_RunAllCast_fips() in WC_C_DYNAMIC_FALLBACK configurations, once with acceleration on (leveraging fallback instrumentation to fail the module if any fallbacks occur), and once with it forced off using DISABLE_VECTOR_REGISTERS().

linuxkm/module_hooks.c: when DEBUG_VECTOR_REGISTER_ACCESS_FUZZING or DEBUG_VECTOR_REGISTER_ACCESS_ALWAYS_ON, inhibit DISABLE_VECTOR_REGISTERS() exercises and auditing of wc_svr_disallowed_count_current().

linuxkm/module_hooks.c: implement /sys/module/libwolfssl/FIPS_optest_run_code_audit_accel and /sys/module/libwolfssl/FIPS_optest_run_code_audit_c.

linuxkm/module_hooks.c: in wolfssl_init(), when WOLFSSL_AESNI but not USE_INTEL_SPEEDUP, don't expect wc_svr_disallowed_count_current() to increase for wolfCrypt_IntegrityTest_fips() (no AES in it).

linuxkm/module_hooks.c and wolfcrypt/src/rng_bank.c: fixes for external review of FIPS_OPTEST/LKCAPI coexistence and affinity lock error handling.

in FIPS_optest_trig_handler(), implement assiduous (atomic-based) mutual exclusion with LKCAPI registration.

in wc_rng_bank_checkout(), propagate INTERRUPTED_E from bank->affinity_lock_cb rather than swallowing it -- caller-requested interruption must abort checkout, consistent with the WC_CHECK_FOR_INTR_SIGNALS() handling in the same loop; other affinity lock errors continue to be tolerated (affinity is advisory).

linuxkm/linuxkm-fips-hash.c: in hmac_update_cb(), use wc_HmacUpdate(), not wc_HmacUpdate_fips(), for compatibility with dev-no-post.

linuxkm/lkcapi_glue.c: tolerate !HAVE_FIPS with CONFIG_CRYPTO_FIPS, with a runtime check that kernel fips_enabled is zero.

linuxkm/module_hooks.c:

• add libwolfssl_inited flag variable and use it for proper error-path cleanup;

• call wc_linuxkm_allocate_svr_states() and wc_linuxkm_free_svr_states() explicitly in FIPS builds (avoid atomic-context synchronous call to wc_linuxkm_allocate_svr_states() via fipEntry());

• add missing WOLFSSL_FIPS_DEV_NO_POST gates;

• in wc_lkm_LockMutex(), return BUSY_E immediately if in_nmi().

tested with

wolfssl-multi-test.sh ...
check-source-text
quantum-safe-wolfssl-all-crypto-only-intelasm-sp-asm-fips-dev-linuxkm-next-clang-tidy
quantum-safe-wolfssl-all-crypto-only-intelasm-sp-asm-sp-linuxkm-6.12-insmod
quantum-safe-wolfssl-all-crypto-only-intelasm-sp-asm-fips-dev-linuxkm-next-insmod
linuxkm-6.15-all-cryptonly-quantum-safe-allintelasm-LKCAPI-insmod-crypto-fuzzer-kmemleak
linuxkm-6.15-all-cryptonly-quantum-safe-allintelasm-LKCAPI-insmod-crypto-fuzzer-ksan
linuxkm-fips-dev-insmod-wolfguard-cust-kernel-3

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11382

Scan targets checked: linuxkm-bugs, linuxkm-src, wolfcrypt-bugs, wolfcrypt-rs-bugs, wolfcrypt-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

[wolfSSL-Fenrir-bot]

Mutual-exclusion #error for DEBUG_VECTOR_REGISTER_ACCESS_ALWAYS_ON/_OFF was dropped · Logic errors

The guard rejecting DEBUG_VECTOR_REGISTER_ACCESS_ALWAYS_ON together with _ALWAYS_OFF was overwritten by the new LKCAPI check and has no replacement anywhere in the tree. Defining both now builds silently with contradictory semantics: CAN_SAVE_VECTOR_REGISTERS() resolves to 0 (line 838, OFF first) while SAVE_VECTOR_REGISTERS/SAVE_VECTOR_REGISTERS2/DISABLE_VECTOR_REGISTERS resolve to the ALWAYS_ON variants that really save and pr_err on every disable.

Fix: Restore an #error for DEBUG_VECTOR_REGISTER_ACCESS_ALWAYS_ON and _ALWAYS_OFF both being defined, alongside the two new checks.

[wolfSSL-Fenrir-bot]

New FIPS optest audit nodes dispatch on attr, which is not the kobj_attribute for /sys/module attributes · Cryptographic correctness

Attributes on THIS_MODULE->mkobj.kobj are dispatched by module_attr_store(), which invokes the store callback as store(attribute, mk, buf, len), so the handler's second parameter holds &THIS_MODULE->mkobj, not the kobj_attribute. Every attr == &FIPS_optest_trig_audit_*_attr test is therefore always false: FIPS_optest_run_code_audit_c never calls DISABLE_VECTOR_REGISTERS() and FIPS_optest_run_code_audit_accel never checks wc_svr_disallowed_count_current(), yet both return success.

Fix: Give each of the three sysfs nodes its own thin store handler that passes an explicit mode argument to a shared worker instead of comparing attr.

[github-actions]

MemBrowse Memory Report

linuxkm-pie

• Data: __patchable_function_entries +8 B (+0.0%, 26,992 B)

linuxkm-standard

• Data: __patchable_function_entries +8 B (+0.0%, 49,784 B)
  No memory changes detected for:
• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• stm32-sim-stm32h753