Skip to content

20260904-linuxkm-misc #11382

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
douzzer wants to merge 9 commits into
base: master
Choose a base branch
from
+465 −70
Open

20260904-linuxkm-misc #11382

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
8e7426a
linuxkm/linuxkm_wc_port.h:
douzzer Aug 14, 2026
925b401
linuxkm/module_hooks.c:
douzzer Aug 14, 2026
88556e0
linuxkm/module_hooks.c: when DEBUG_VECTOR_REGISTER_ACCESS_FUZZING or …
douzzer Aug 17, 2026
6c3f63e
linuxkm/module_hooks.c: implement /sys/module/libwolfssl/FIPS_optest_…
douzzer Aug 18, 2026
f47a3f2
linuxkm/module_hooks.c: in wolfssl_init(), when WOLFSSL_AESNI but not…
douzzer Aug 20, 2026
d3e6d17
linuxkm/module_hooks.c and wolfcrypt/src/rng_bank.c: fixes for extern…
douzzer Aug 21, 2026
a0d0d7c
linuxkm/linuxkm-fips-hash.c: in hmac_update_cb(), use wc_HmacUpdate()…
douzzer Sep 4, 2026
3e03408
linuxkm/lkcapi_glue.c: tolerate !HAVE_FIPS with CONFIG_CRYPTO_FIPS, w…
douzzer Sep 4, 2026
2c52057
linuxkm/module_hooks.c:
douzzer Sep 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion linuxkm/linuxkm-fips-hash.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,7 @@ static int hmac_setkey_cb(Hmac *hmac, const byte *key, word32 key_len) {
}

static int hmac_update_cb(Hmac *hmac, const byte *in, word32 in_len) {
return wc_HmacUpdate_fips(hmac, in, in_len);
return wc_HmacUpdate(hmac, in, in_len);
}

static int hmac_final_cb(Hmac *hmac, byte *out, word32 out_sz) {
Expand Down
82 changes: 55 additions & 27 deletions linuxkm/linuxkm_wc_port.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@
#include <linux/version.h>
#include <linux/kconfig.h>

#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 16, 0)
#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 16, 0) && !defined(WC_DEBUG_FORCE_KERNEL_SETTINGS)
#error Unsupported kernel.
#endif

Expand All @@ -53,7 +53,8 @@
#endif
#endif

#if defined(HAVE_FIPS) && defined(LINUXKM_LKCAPI_REGISTER_AESXTS) && defined(WC_LINUX_CONFIG_SELFTESTS_FULL)
#if defined(HAVE_FIPS) && defined(LINUXKM_LKCAPI_REGISTER_AESXTS) && defined(WC_LINUX_CONFIG_SELFTESTS_FULL) && \
!defined(WC_DEBUG_FORCE_KERNEL_SETTINGS)
/* CONFIG_CRYPTO_MANAGER_EXTRA_TESTS expects AES-XTS-384 to work, even when CONFIG_CRYPTO_FIPS, but FIPS 140-3 only allows AES-XTS-256 and AES-XTS-512. */
#error CONFIG_CRYPTO_MANAGER_EXTRA_TESTS is incompatible with FIPS wolfCrypt AES-XTS -- please reconfigure the target kernel to disable CONFIG_CRYPTO_MANAGER_EXTRA_TESTS/CONFIG_CRYPTO_SELFTESTS_FULL.
#endif
Expand All @@ -70,7 +71,8 @@
defined(HAVE_ECC) && \
(defined(LINUXKM_LKCAPI_REGISTER_ALL) || \
defined(LINUXKM_LKCAPI_REGISTER_ECDSA) || \
(defined(LINUXKM_LKCAPI_REGISTER_ALL_KCONFIG) && defined(CONFIG_CRYPTO_ECDSA)))
(defined(LINUXKM_LKCAPI_REGISTER_ALL_KCONFIG) && defined(CONFIG_CRYPTO_ECDSA))) && \
!defined(WC_DEBUG_FORCE_KERNEL_SETTINGS)
#error Target kernel requires SHA-1 signature verification support.
#endif

Expand Down Expand Up @@ -125,7 +127,7 @@
* also needed to suppress inclusion of stdlib.h in
* wolfssl/wolfcrypt/types.h.
*/
#define XATOI(s) ({ \
#define XATOI(s) __extension__ ({ \
long long _xatoi_res = 0; \
int _xatoi_ret = kstrtoll(s, 10, &_xatoi_res); \
if (_xatoi_ret != 0) { \
Expand Down Expand Up @@ -212,7 +214,7 @@
WOLFSSL_API int wc_linuxkm_sig_ignore_end(void);
WOLFSSL_API int wc_linuxkm_check_for_intr_signals(void);
#ifndef WC_LINUXKM_MAX_NS_WITHOUT_YIELD
#define WC_LINUXKM_MAX_NS_WITHOUT_YIELD 1000000000
#define WC_LINUXKM_MAX_NS_WITHOUT_YIELD (25 * 1000 * 1000)
#endif
WOLFSSL_API void wc_linuxkm_relax_long_loop(void);

Expand Down Expand Up @@ -833,12 +835,25 @@
#endif
#endif
#ifndef CAN_SAVE_VECTOR_REGISTERS
#define CAN_SAVE_VECTOR_REGISTERS() wc_can_save_vector_registers_x86()
#if defined(DEBUG_VECTOR_REGISTER_ACCESS_ALWAYS_OFF)
#define CAN_SAVE_VECTOR_REGISTERS() 0
#elif defined(DEBUG_VECTOR_REGISTER_ACCESS_ALWAYS_ON)
#define CAN_SAVE_VECTOR_REGISTERS() 1
#else
#define CAN_SAVE_VECTOR_REGISTERS() wc_can_save_vector_registers_x86()
#endif
#endif

#if defined(DEBUG_VECTOR_REGISTER_ACCESS_ALWAYS_ON) && \

@wolfSSL-Fenrir-bot wolfSSL-Fenrir-bot Sep 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Mutual-exclusion #error for DEBUG_VECTOR_REGISTER_ACCESS_ALWAYS_ON/_OFF was dropped · Logic errors

The guard rejecting DEBUG_VECTOR_REGISTER_ACCESS_ALWAYS_ON together with _ALWAYS_OFF was overwritten by the new LKCAPI check and has no replacement anywhere in the tree. Defining both now builds silently with contradictory semantics: CAN_SAVE_VECTOR_REGISTERS() resolves to 0 (line 838, OFF first) while SAVE_VECTOR_REGISTERS/SAVE_VECTOR_REGISTERS2/DISABLE_VECTOR_REGISTERS resolve to the ALWAYS_ON variants that really save and pr_err on every disable.

Fix: Restore an #error for DEBUG_VECTOR_REGISTER_ACCESS_ALWAYS_ON and _ALWAYS_OFF both being defined, alongside the two new checks.

defined(DEBUG_VECTOR_REGISTER_ACCESS_ALWAYS_OFF)
#error Conflicting settings for DEBUG_VECTOR_REGISTER_ACCESS_ALWAYS_foo
defined(LINUXKM_LKCAPI_REGISTER) && \
!defined(WC_DEBUG_FORCE_KERNEL_SETTINGS)
#error DEBUG_VECTOR_REGISTER_ACCESS_ALWAYS_ON is incompatible with LINUXKM_LKCAPI_REGISTER.
#endif

#if defined(DEBUG_VECTOR_REGISTER_ACCESS_ALWAYS_OFF) && \
defined(WOLFSSL_LINUXKM_BENCHMARKS) && \
!defined(WC_DEBUG_FORCE_KERNEL_SETTINGS)
#error DEBUG_VECTOR_REGISTER_ACCESS_ALWAYS_OFF is incompatible with WOLFSSL_LINUXKM_BENCHMARKS.
#endif

#ifndef SAVE_VECTOR_REGISTERS
Expand Down Expand Up @@ -879,7 +894,7 @@
#endif
#ifndef SAVE_VECTOR_REGISTERS2
#if defined(DEBUG_VECTOR_REGISTER_ACCESS_ALWAYS_ON)
#define SAVE_VECTOR_REGISTERS2() \
#define SAVE_VECTOR_REGISTERS2() __extension__ \
({ \
int _svr_ret = wc_save_vector_registers_x86(WC_SVR_FLAG_NONE); \
if (_svr_ret != 0) { \
Expand All @@ -890,7 +905,10 @@
_svr_ret; \
})
#elif defined(DEBUG_VECTOR_REGISTER_ACCESS_ALWAYS_OFF)
#define SAVE_VECTOR_REGISTERS2() WC_ACCEL_INHIBIT_E
#define SAVE_VECTOR_REGISTERS2() __extension__ ({ \
WC_RELAX_LONG_LOOP(); \
WC_ACCEL_INHIBIT_E; \
})
#elif defined(DEBUG_VECTOR_REGISTER_ACCESS_FUZZING)
#define SAVE_VECTOR_REGISTERS2() wc_save_vector_registers_x86(WC_SVR_FLAG_FUZZ)
#else
Expand All @@ -907,7 +925,7 @@
* DEBUG_VECTOR_REGISTER_ACCESS_ALWAYS_ON build -- ERROR if any
* calls occur.
*/
#define DISABLE_VECTOR_REGISTERS() \
#define DISABLE_VECTOR_REGISTERS() __extension__ \
({ \
pr_err("ERROR: DISABLE_VECTOR_REGISTERS() with DEBUG_VECTOR_REGISTER_ACCESS_ALWAYS_ON " \
"in %s at %s L %d\n", __func__, __FILE__, __LINE__); \
Expand All @@ -923,7 +941,10 @@
#endif

#ifndef SAVE_VECTOR_REGISTERS_MAYBE_INHIBIT
#ifdef DEBUG_VECTOR_REGISTER_ACCESS_FUZZING
#if (defined(DEBUG_VECTOR_REGISTER_ACCESS_ALWAYS_ON) || \
defined(DEBUG_VECTOR_REGISTER_ACCESS_ALWAYS_OFF))
#define SAVE_VECTOR_REGISTERS_MAYBE_INHIBIT() SAVE_VECTOR_REGISTERS2()
#elif defined(DEBUG_VECTOR_REGISTER_ACCESS_FUZZING)
#define SAVE_VECTOR_REGISTERS_MAYBE_INHIBIT() wc_save_vector_registers_x86(WC_SVR_FLAG_FUZZ | WC_SVR_FLAG_MAYBE_INHIBIT)
#else
#define SAVE_VECTOR_REGISTERS_MAYBE_INHIBIT() wc_save_vector_registers_x86(WC_SVR_FLAG_MAYBE_INHIBIT)
Expand Down Expand Up @@ -969,7 +990,14 @@
#define RESTORE_VECTOR_REGISTERS() restore_vector_registers_arm()
#endif

#elif defined(WOLFSSL_USE_SAVE_VECTOR_REGISTERS)
#elif (defined(WOLFSSL_USE_SAVE_VECTOR_REGISTERS) && \
(!defined(SAVE_VECTOR_REGISTERS) || \
!defined(SAVE_VECTOR_REGISTERS2) || \
!defined(RESTORE_VECTOR_REGISTERS) || \
!defined(DISABLE_VECTOR_REGISTERS) || \
!defined(REENABLE_VECTOR_REGISTERS) || \
!defined(SAVE_VECTOR_REGISTERS_MAYBE_INHIBIT) || \
!defined(RESTORE_VECTOR_REGISTERS_MAYBE_INHIBITED)))
#error WOLFSSL_USE_SAVE_VECTOR_REGISTERS is set for an unimplemented architecture.
#endif /* WOLFSSL_USE_SAVE_VECTOR_REGISTERS */

Expand Down Expand Up @@ -1325,7 +1353,7 @@
typeof(wc_linuxkm_free_svr_states) *wc_linuxkm_free_svr_states;
typeof(wc_restore_vector_registers_x86) *wc_restore_vector_registers_x86;
typeof(wc_save_vector_registers_x86) *wc_save_vector_registers_x86;
#else /* !CONFIG_X86 */
#elif !defined(WC_DEBUG_FORCE_KERNEL_SETTINGS) /* !CONFIG_X86 */
#error WOLFSSL_USE_SAVE_VECTOR_REGISTERS is set for an unimplemented architecture.
#endif /* arch */

Expand Down Expand Up @@ -1684,7 +1712,7 @@
#define wc_linuxkm_free_svr_states WC_PIE_INDIRECT_SYM(wc_linuxkm_free_svr_states)
#define wc_restore_vector_registers_x86 WC_PIE_INDIRECT_SYM(wc_restore_vector_registers_x86)
#define wc_save_vector_registers_x86 WC_PIE_INDIRECT_SYM(wc_save_vector_registers_x86)
#elif defined(WOLFSSL_USE_SAVE_VECTOR_REGISTERS)
#elif defined(WOLFSSL_USE_SAVE_VECTOR_REGISTERS) && !defined(WC_DEBUG_FORCE_KERNEL_SETTINGS)
#error WOLFSSL_USE_SAVE_VECTOR_REGISTERS is set for an unimplemented architecture.
#endif /* WOLFSSL_USE_SAVE_VECTOR_REGISTERS */

Expand Down Expand Up @@ -1810,10 +1838,10 @@

#if defined(WOLFSSL_KERNEL_STACK_DEBUG) || defined(WC_LINUXKM_STACK_DEBUG)

#ifndef CONFIG_THREAD_INFO_IN_TASK
#if !defined(CONFIG_THREAD_INFO_IN_TASK) && !defined(WC_DEBUG_FORCE_KERNEL_SETTINGS)
#error WC_LINUXKM_STACK_DEBUG requires CONFIG_THREAD_INFO_IN_TASK
#endif
#ifdef CONFIG_STACK_GROWSUP
#if defined(CONFIG_STACK_GROWSUP) && !defined(WC_DEBUG_FORCE_KERNEL_SETTINGS)
#error WC_LINUXKM_STACK_DEBUG requires !CONFIG_STACK_GROWSUP
#endif

Expand Down Expand Up @@ -2035,7 +2063,7 @@
#ifndef REENABLE_VECTOR_REGISTERS
#define REENABLE_VECTOR_REGISTERS() wc_restore_vector_registers_x86(WC_SVR_FLAG_INHIBIT)
#endif
#else /* !CONFIG_X86 */
#elif !defined(WC_DEBUG_FORCE_KERNEL_SETTINGS) /* !CONFIG_X86 */
#error WOLFSSL_USE_SAVE_VECTOR_REGISTERS is set for an unimplemented architecture.
#endif /* !CONFIG_X86 */
#endif /* WOLFSSL_USE_SAVE_VECTOR_REGISTERS */
Expand All @@ -2059,7 +2087,7 @@
#ifdef WOLFSSL_LINUXKM_USE_MUTEXES
#define WC_MUTEX_OPS_INLINE

#ifdef LINUXKM_LKCAPI_REGISTER
#if defined(LINUXKM_LKCAPI_REGISTER) && !defined(WC_DEBUG_FORCE_KERNEL_SETTINGS)
/* must use spin locks when registering implementations with the
* kernel, because mutexes are forbidden when calling with nonzero
* irq_count().
Expand Down Expand Up @@ -2271,23 +2299,23 @@
#endif

#ifdef WOLFSSL_TRACK_MEMORY
#define XMALLOC(s, h, t) ({(void)(h); (void)(t); wolfSSL_Malloc(s);})
#define XMALLOC(s, h, t) __extension__ ({(void)(h); (void)(t); wolfSSL_Malloc(s);})
#ifdef WOLFSSL_XFREE_NO_NULLNESS_CHECK
#define XFREE(p, h, t) ({(void)(h); (void)(t); wolfSSL_Free(p);})
#define XFREE(p, h, t) __extension__ ({(void)(h); (void)(t); wolfSSL_Free(p);})
#else
#define XFREE(p, h, t) ({void* _xp; (void)(h); _xp = (p); if(_xp) wolfSSL_Free(_xp);})
#define XFREE(p, h, t) __extension__ ({void* _xp; (void)(h); _xp = (p); if(_xp) wolfSSL_Free(_xp);})
#endif
#define XREALLOC(p, n, h, t) ({(void)(h); (void)(t); wolfSSL_Realloc(p, n);})
#define XREALLOC(p, n, h, t) __extension__ ({(void)(h); (void)(t); wolfSSL_Realloc(p, n);})
#else
#if !defined(XMALLOC_USER) && !defined(XMALLOC_OVERRIDE)
#define XMALLOC(s, h, t) ({(void)(h); (void)(t); malloc(s);})
#define XMALLOC(s, h, t) __extension__ ({(void)(h); (void)(t); malloc(s);})
#ifdef WOLFSSL_XFREE_NO_NULLNESS_CHECK
#define XFREE(p, h, t) ({(void)(h); (void)(t); free(p);})
#define XFREE(p, h, t) __extension__ ({(void)(h); (void)(t); free(p);})
#else
#define XFREE(p, h, t) ({void* _xp; (void)(h); (void)(t); _xp = (p); if(_xp) free(_xp);})
#define XFREE(p, h, t) __extension__ ({void* _xp; (void)(h); (void)(t); _xp = (p); if(_xp) free(_xp);})
#endif
#if defined(USE_KVREALLOC) || !defined(USE_KVMALLOC)
#define XREALLOC(p, n, h, t) ({(void)(h); (void)(t); realloc(p, n);})
#define XREALLOC(p, n, h, t) __extension__ ({(void)(h); (void)(t); realloc(p, n);})
#endif
#endif /* !XMALLOC_USER && !XMALLOC_OVERRIDE */
#endif
Expand Down
15 changes: 9 additions & 6 deletions linuxkm/lkcapi_glue.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,12 +37,8 @@
* "fips_enabled" is only available in CONFIG_CRYPTO_FIPS kernels (otherwise
* it's a macro hardcoding it to literal 0).
*/
#if defined(CONFIG_CRYPTO_FIPS) != defined(HAVE_FIPS)
#ifdef HAVE_FIPS
#error CONFIG_CRYPTO_MANAGER requires that CONFIG_CRYPTO_FIPS match HAVE_FIPS (CONFIG_CRYPTO_FIPS unset).
#else
#error CONFIG_CRYPTO_MANAGER requires that CONFIG_CRYPTO_FIPS match HAVE_FIPS (HAVE_FIPS unset).
#endif
#if defined(HAVE_FIPS) && !defined(CONFIG_CRYPTO_FIPS)
#error wolfCrypt HAVE_FIPS with kernel CONFIG_CRYPTO_MANAGER requires kernel CONFIG_CRYPTO_FIPS.
#endif
#endif

Expand Down Expand Up @@ -326,6 +322,13 @@ static int linuxkm_lkcapi_register(void)
int seen_err = 0;
int current_linuxkm_lkcapi_registering_now = 0;

#if defined(CONFIG_CRYPTO_FIPS) && !defined(HAVE_FIPS)
if (fips_enabled) {
pr_err("ERROR: can't load non-FIPS wolfCrypt module into fips_enabled kernel.\n");
return -ECANCELED;
}
#endif

if (! wolfSSL_Atomic_Int_CompareExchange(
&linuxkm_lkcapi_registering_now,
&current_linuxkm_lkcapi_registering_now,
Expand Down
Loading
Loading