From 09db3a64108ad6594c31d37d7d73e594775dd542 Mon Sep 17 00:00:00 2001 From: Daniel Pouzzner Date: Tue, 7 Jul 2026 00:15:54 -0500 Subject: [PATCH] linuxkm/linuxkm_wc_port.h: * set up WC_LINUXKM_HAVE_SELFTEST and WC_LINUXKM_HAVE_SELFTEST_FULL early. * replace the forced-downgrade from FIPS 186-5 to 186-4 for SHA-1 support, with a #error if configuration is incompatible. linuxkm/linuxkm_wc_port.h, linuxkm/lkcapi_glue.c, linuxkm/module_exports.c.template, linuxkm/module_hooks.c, wolfcrypt/src/random.c: consolidate into the warning-masked span of linuxkm_wc_port.h, the #includes for kernel headers linux/fips.h, linux/vmalloc.h, and linux/random.h. --- linuxkm/linuxkm_wc_port.h | 71 +++++++++++++++++-------------- linuxkm/lkcapi_glue.c | 52 ++++++++++++++++------ linuxkm/module_exports.c.template | 1 - linuxkm/module_hooks.c | 4 -- wolfcrypt/src/random.c | 4 -- 5 files changed, 79 insertions(+), 53 deletions(-) diff --git a/linuxkm/linuxkm_wc_port.h b/linuxkm/linuxkm_wc_port.h index 8b7b33c1f1..ca4ac90749 100644 --- a/linuxkm/linuxkm_wc_port.h +++ b/linuxkm/linuxkm_wc_port.h @@ -35,28 +35,43 @@ #error Unsupported kernel. #endif - #if defined(HAVE_FIPS) && defined(LINUXKM_LKCAPI_REGISTER_AESXTS) && defined(CONFIG_CRYPTO_MANAGER_EXTRA_TESTS) + #if LINUX_VERSION_CODE < KERNEL_VERSION(6, 16, 0) + #if defined(CONFIG_CRYPTO_MANAGER) && !defined(CONFIG_CRYPTO_MANAGER_DISABLE_TESTS) + #define WC_LINUXKM_HAVE_SELFTEST + #endif + #if defined(WC_LINUXKM_HAVE_SELFTEST) && defined(CONFIG_CRYPTO_MANAGER_EXTRA_TESTS) + #define WC_LINUXKM_HAVE_SELFTEST_FULL + #endif + #else + /* see Linux 698de822780f */ + #if defined(CONFIG_CRYPTO_MANAGER) && defined(CONFIG_CRYPTO_SELFTESTS) + #define WC_LINUXKM_HAVE_SELFTEST + #endif + /* see Linux ac90aad0e9 */ + #if defined(WC_LINUXKM_HAVE_SELFTEST) && defined(CONFIG_CRYPTO_SELFTESTS_FULL) + #define WC_LINUXKM_HAVE_SELFTEST_FULL + #endif + #endif + + #if defined(HAVE_FIPS) && defined(LINUXKM_LKCAPI_REGISTER_AESXTS) && defined(WC_LINUXKM_HAVE_SELFTEST_FULL) /* CONFIG_CRYPTO_MANAGER_EXTRA_TESTS expects AES-XTS-384 to work, even when CONFIG_CRYPTO_FIPS, but FIPS 140-3 only allows AES-XTS-256 and AES-XTS-512. */ - #error CONFIG_CRYPTO_MANAGER_EXTRA_TESTS is incompatible with FIPS wolfCrypt AES-XTS -- please reconfigure the target kernel to disable CONFIG_CRYPTO_MANAGER_EXTRA_TESTS. + #error CONFIG_CRYPTO_MANAGER_EXTRA_TESTS is incompatible with FIPS wolfCrypt AES-XTS -- please reconfigure the target kernel to disable CONFIG_CRYPTO_MANAGER_EXTRA_TESTS/CONFIG_CRYPTO_SELFTESTS_FULL. #endif /* The first vector set in /usr/src/linux/crypto/testmgr.h * ecdsa_nist_p192_tv_template[], ecdsa_nist_p256_tv_template[], and * ecdsa_nist_p384_tv_template[] use SHA-1 (even if CONFIG_CRYPTO_SHA1 is * disabled), and kernel module signatures frequently use SHA-1 until quite - * recently (dependent on CONFIG_CRYPTO_SHA1). If either is enabled, force - * downgrade to 186-4. + * recently. */ - #if defined(WC_FIPS_186_5_PLUS) && \ - (defined(CONFIG_CRYPTO_SHA1) || (defined(CONFIG_CRYPTO_MANAGER) && !defined(CONFIG_CRYPTO_MANAGER_DISABLE_TESTS))) && \ - (defined(LINUXKM_LKCAPI_REGISTER_ALL) || defined(LINUXKM_LKCAPI_REGISTER_ALL_KCONFIG) || defined(CONFIG_CRYPTO_ECDSA)) - #undef WC_FIPS_186_5_PLUS - #ifdef WC_FIPS_186_5 - #undef WC_FIPS_186_5 - #else - #error Unknown and incompatible FIPS 186 is enabled. - #endif - #define WC_FIPS_186_4 + #if (defined(WC_LINUXKM_HAVE_SELFTEST) || defined(CONFIG_MODULE_SIG_SHA1)) && \ + (((defined(WC_MIN_DIGEST_SIZE_FOR_VERIFY) && (WC_MIN_DIGEST_SIZE_FOR_VERIFY > 20)) || \ + (defined(NO_SHA) && !defined(WC_MIN_DIGEST_SIZE_FOR_VERIFY)))) && \ + defined(HAVE_ECC) && \ + (defined(LINUXKM_LKCAPI_REGISTER_ALL) || \ + defined(LINUXKM_LKCAPI_REGISTER_ECDSA) || \ + (defined(LINUXKM_LKCAPI_REGISTER_ALL_KCONFIG) && defined(CONFIG_CRYPTO_ECDSA))) + #error Target kernel requires SHA-1 signature verification support. #endif #ifdef HAVE_CONFIG_H @@ -427,24 +442,7 @@ #include #include - - #if LINUX_VERSION_CODE < KERNEL_VERSION(6, 16, 0) - #if defined(CONFIG_CRYPTO_MANAGER) && !defined(CONFIG_CRYPTO_MANAGER_DISABLE_TESTS) - #define WC_LINUXKM_HAVE_SELFTEST - #endif - #if defined(WC_LINUXKM_HAVE_SELFTEST) && defined(CONFIG_CRYPTO_MANAGER_EXTRA_TESTS) - #define WC_LINUXKM_HAVE_SELFTEST_FULL - #endif - #else - /* see Linux 698de822780f */ - #if defined(CONFIG_CRYPTO_MANAGER) && defined(CONFIG_CRYPTO_SELFTESTS) - #define WC_LINUXKM_HAVE_SELFTEST - #endif - /* see Linux ac90aad0e9 */ - #if defined(WC_LINUXKM_HAVE_SELFTEST) && defined(CONFIG_CRYPTO_SELFTESTS_FULL) - #define WC_LINUXKM_HAVE_SELFTEST_FULL - #endif - #endif + #include /* Kernel non-FIPS self-test ("testmgr") has a KAT with all-zeros keys. */ #if defined(WC_LINUXKM_HAVE_SELFTEST) && !defined(HAVE_FIPS) @@ -655,6 +653,12 @@ #include #endif #include + #ifndef WC_CONTAINERIZE_THIS + /* for struct vm_struct and related -- used by + * wc_linuxkm_malloc_usable_size(). + */ + #include + #endif #include #if __has_include() /* for task_stack_page() */ @@ -823,6 +827,9 @@ #error WOLFSSL_USE_SAVE_VECTOR_REGISTERS is set for an unimplemented architecture. #endif /* WOLFSSL_USE_SAVE_VECTOR_REGISTERS */ + /* This pop must appear here, no later, so that conditional suppressions + * below continue after inclusion. + */ _Pragma("GCC diagnostic pop"); #define PTR_ERR(x) ((int)PTR_ERR(x)) diff --git a/linuxkm/lkcapi_glue.c b/linuxkm/lkcapi_glue.c index a3c0044938..a145770a4f 100644 --- a/linuxkm/lkcapi_glue.c +++ b/linuxkm/lkcapi_glue.c @@ -40,7 +40,6 @@ #if defined(CONFIG_CRYPTO_FIPS) != defined(HAVE_FIPS) #error CONFIG_CRYPTO_MANAGER requires that CONFIG_CRYPTO_FIPS match HAVE_FIPS. #endif - #include #endif /* need misc.c for ForceZero(). */ @@ -553,7 +552,24 @@ static int linuxkm_lkcapi_register(void) #endif #ifdef LINUXKM_LKCAPI_REGISTER_ECDSA - #if (LINUX_VERSION_CODE < KERNEL_VERSION(6, 3, 0)) && \ + #if defined(LINUXKM_ECDSA_SIG_ALG) + /* linux 6.13+: the ecdsa-nist-pN algs are struct sig_alg. */ + #if defined(LINUXKM_ECC192) + REGISTER_ALG(ecdsa_nist_p192, sig, + linuxkm_test_ecdsa_nist_p192); + #endif /* LINUXKM_ECC192 */ + + REGISTER_ALG(ecdsa_nist_p256, sig, + linuxkm_test_ecdsa_nist_p256); + + REGISTER_ALG(ecdsa_nist_p384, sig, + linuxkm_test_ecdsa_nist_p384); + + #if defined(HAVE_ECC521) + REGISTER_ALG(ecdsa_nist_p521, sig, + linuxkm_test_ecdsa_nist_p521); + #endif /* HAVE_ECC521 */ + #elif (LINUX_VERSION_CODE < KERNEL_VERSION(6, 3, 0)) && \ defined(HAVE_FIPS) && defined(CONFIG_CRYPTO_FIPS) && \ defined(WC_LINUXKM_HAVE_SELFTEST) /* @@ -575,7 +591,7 @@ static int linuxkm_lkcapi_register(void) REGISTER_ALG_OPTIONAL(ecdsa_nist_p521, akcipher, linuxkm_test_ecdsa_nist_p521); #endif /* HAVE_ECC521 */ - #else + #else /* kernel 6.3-6.12 */ #if defined(LINUXKM_ECC192) REGISTER_ALG(ecdsa_nist_p192, akcipher, linuxkm_test_ecdsa_nist_p192); @@ -591,7 +607,7 @@ static int linuxkm_lkcapi_register(void) REGISTER_ALG(ecdsa_nist_p521, akcipher, linuxkm_test_ecdsa_nist_p521); #endif /* HAVE_ECC521 */ - #endif /* if linux < 6.3 && HAVE_FIPS && etc.. */ + #endif /* kernel 6.3-6.12 */ #if (LINUX_VERSION_CODE < KERNEL_VERSION(6, 3, 0)) && \ defined(HAVE_FIPS) && defined(CONFIG_CRYPTO_FIPS) && \ @@ -917,14 +933,26 @@ static int linuxkm_lkcapi_unregister(void) #endif #ifdef LINUXKM_LKCAPI_REGISTER_ECDSA - #if defined(LINUXKM_ECC192) - UNREGISTER_ALG(ecdsa_nist_p192, akcipher); - #endif /* LINUXKM_ECC192 */ - UNREGISTER_ALG(ecdsa_nist_p256, akcipher); - UNREGISTER_ALG(ecdsa_nist_p384, akcipher); - #if defined(HAVE_ECC521) - UNREGISTER_ALG(ecdsa_nist_p521, akcipher); - #endif /* HAVE_ECC521 */ + #if defined(LINUXKM_ECDSA_SIG_ALG) + /* linux 6.13+: the ecdsa-nist-pN algs are struct sig_alg. */ + #if defined(LINUXKM_ECC192) + UNREGISTER_ALG(ecdsa_nist_p192, sig); + #endif /* LINUXKM_ECC192 */ + UNREGISTER_ALG(ecdsa_nist_p256, sig); + UNREGISTER_ALG(ecdsa_nist_p384, sig); + #if defined(HAVE_ECC521) + UNREGISTER_ALG(ecdsa_nist_p521, sig); + #endif /* HAVE_ECC521 */ + #else /* !LINUXKM_ECDSA_SIG_ALG */ + #if defined(LINUXKM_ECC192) + UNREGISTER_ALG(ecdsa_nist_p192, akcipher); + #endif /* LINUXKM_ECC192 */ + UNREGISTER_ALG(ecdsa_nist_p256, akcipher); + UNREGISTER_ALG(ecdsa_nist_p384, akcipher); + #if defined(HAVE_ECC521) + UNREGISTER_ALG(ecdsa_nist_p521, akcipher); + #endif /* HAVE_ECC521 */ + #endif /* !LINUXKM_ECDSA_SIG_ALG */ #endif /* LINUXKM_LKCAPI_REGISTER_ECDSA */ #ifdef LINUXKM_LKCAPI_REGISTER_ECDH diff --git a/linuxkm/module_exports.c.template b/linuxkm/module_exports.c.template index 8209c6277f..f3583184ed 100644 --- a/linuxkm/module_exports.c.template +++ b/linuxkm/module_exports.c.template @@ -32,7 +32,6 @@ #endif #ifndef NO_CRYPT_TEST #include -#include #endif #ifndef EXPORT_SYMBOL_NS diff --git a/linuxkm/module_hooks.c b/linuxkm/module_hooks.c index 55fc70e0a7..52d6fb0d0a 100644 --- a/linuxkm/module_hooks.c +++ b/linuxkm/module_hooks.c @@ -1316,10 +1316,6 @@ void *wc_linuxkm_realloc(void *ptr, size_t newsize) return kvrealloc(ptr, WC_LINUXKM_ROUND_UP_P_OF_2(newsize), (wc_linuxkm_can_block() ? GFP_KERNEL : GFP_ATOMIC)); } -#ifdef CONFIG_HAVE_KPROBES -#include -#endif - size_t wc_linuxkm_malloc_usable_size(void *ptr) { if ((ptr == NULL) || is_vmalloc_addr(ptr)) { diff --git a/wolfcrypt/src/random.c b/wolfcrypt/src/random.c index eb51965024..b535f91eb1 100644 --- a/wolfcrypt/src/random.c +++ b/wolfcrypt/src/random.c @@ -4915,10 +4915,6 @@ int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz) #elif defined(WOLFSSL_LINUXKM) - #ifndef LINUXKM_LKCAPI_REGISTER_HASH_DRBG_DEFAULT - #include - #endif - int wc_GenerateSeed(OS_Seed* os, byte* output, word32 sz) { (void)os;