From 3965993c6dae13bebde835fdd129eecd4a183475 Mon Sep 17 00:00:00 2001
From: Daniel Pouzzner <douzzer@wolfssl.com>
Date: Tue, 7 Jul 2026 00:19:11 -0500
Subject: [PATCH] wolfssl/wolfcrypt/types.h: in fallback definition of
 DISABLE_VECTOR_REGISTERS(), return NOT_COMPILED_IN rather than (-1), for
 clarity and traceability.

linuxkm/lkcapi_sha_glue.c: require defined(WOLFSSL_EXPERIMENTAL_SETTINGS) when defined(WOLFSSL_LINUXKM_USE_GET_RANDOM_KPROBES).
---
 .wolfssl_known_macro_extras |  1 +
 linuxkm/lkcapi_sha_glue.c   |  4 ++++
 wolfssl/wolfcrypt/types.h   | 10 +++++-----
 3 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/.wolfssl_known_macro_extras b/.wolfssl_known_macro_extras
index 79cf7f6eaf..31b7d4be79 100644
--- a/.wolfssl_known_macro_extras
+++ b/.wolfssl_known_macro_extras
@@ -137,6 +137,7 @@ CONFIG_MBEDTLS_CERTIFICATE_BUNDLE
 CONFIG_MBEDTLS_PSA_CRYPTO_C
 CONFIG_MIPS
 CONFIG_MODULE_SIG
+CONFIG_MODULE_SIG_SHA1
 CONFIG_NET_SOCKETS_SOCKOPT_TLS
 CONFIG_NEWLIB_LIBC
 CONFIG_NEWLIB_NANO_FORMAT
diff --git a/linuxkm/lkcapi_sha_glue.c b/linuxkm/lkcapi_sha_glue.c
index 33b91048ea..f7b275c4a6 100644
--- a/linuxkm/lkcapi_sha_glue.c
+++ b/linuxkm/lkcapi_sha_glue.c
@@ -1608,6 +1608,10 @@ static int wc_get_random_bytes_callbacks_installed = 0;
 
 #elif defined(WOLFSSL_LINUXKM_USE_GET_RANDOM_KPROBES)
 
+#ifndef WOLFSSL_EXPERIMENTAL_SETTINGS
+    #error WOLFSSL_LINUXKM_USE_GET_RANDOM_KPROBES requires WOLFSSL_EXPERIMENTAL_SETTINGS.
+#endif
+
 #ifndef CONFIG_KPROBES
     #error WOLFSSL_LINUXKM_USE_GET_RANDOM_KPROBES without CONFIG_KPROBES.
 #endif
diff --git a/wolfssl/wolfcrypt/types.h b/wolfssl/wolfcrypt/types.h
index cdbc989a36..c0bd1401ec 100644
--- a/wolfssl/wolfcrypt/types.h
+++ b/wolfssl/wolfcrypt/types.h
@@ -2332,14 +2332,14 @@ WOLFSSL_API word32 CheckRunTimeSettings(void);
 
 /* DISABLE_VECTOR_REGISTERS() and REENABLE_VECTOR_REGISTERS() are currently only
  * used by Linux kernel code.  If WC_HAVE_VECTOR_SPEEDUPS, we default
- * DISABLE_VECTOR_REGISTERS() to -1, to assure calling code is forced to handle
- * the failure.  But if the build disables vec regs globally, we can return 0
- * harmlessly.  The kernel build defines real calls for these in vectorized
- * builds, otherwise it uses these fallbacks.
+ * DISABLE_VECTOR_REGISTERS() to NOT_COMPILED_IN, to assure calling code is
+ * forced to handle the failure.  But if the build disables vec regs globally,
+ * we can return 0 harmlessly.  The kernel build defines real calls for these in
+ * vectorized builds, otherwise it uses these fallbacks.
  */
 #ifndef DISABLE_VECTOR_REGISTERS
     #ifdef WC_HAVE_VECTOR_SPEEDUPS
-        #define DISABLE_VECTOR_REGISTERS() (-1)
+        #define DISABLE_VECTOR_REGISTERS() NOT_COMPILED_IN
     #else
         #define DISABLE_VECTOR_REGISTERS() 0
     #endif