The generated wc_falcon_fpr_x86_64_asm.S implements the fpr seam with SSE2
scalar double math (mulsd/divsd/sqrtsd/ucomisd on xmm; no x87), so its object
needs the vector instructions enabled in the assembler -- the same
ASFLAGS_FPU_DISABLE_SIMD_ENABLE the other vectorized _asm.o files use -- plus
OBJECT_FILES_NON_STANDARD for objtool. Run-time FPU state is handled by the
SAVE_VECTOR_REGISTERS2() wrapping added in falcon.c. The C file falcon.o needs
no rule: the kernel module uses the asm (or emulated) fpr backend, where
falcon.c is integer-only, exactly as the ML-KEM/ML-DSA C poly files do.
linuxkm/lkcapi_aes_glue.c and linuxkm/lkcapi_sha_glue.c: add CMAC and SHA-3 to algs warned for incompatibility with kernels <5.6;
linuxkm/lkcapi_aes_glue.c, wolfcrypt/src/aes.c, wolfcrypt/src/memory.c, and wolfssl/wolfcrypt/memory.h: fix WC_DEBUG_CIPHER_LIFECYCLE in kernel mode (km_AesGet() and km_AesCmacMaterialize()), add WARN_UNUSED_RESULT to wc_debug_CipherLifecycle*(), and fix an unchecked wc_debug_CipherLifecycleFree() in wc_AesFree();
linuxkm/lkcapi_aes_glue.c: fix unsafe wc_CmacFree() call in km_AesCmacSetKey();
linuxkm/lkcapi_sha_glue.c: in km_hmac_export(), avoid unlocked access to snapshot->desc_id (possible UAF under extreme pressure).
* Revert earlier changes adding WC_SHA256_W_SIZE and WC_SHA512_W_SIZE.
* Add WC_SHA2_NO_SMALL_STACK to allow the W work buffer to move back onto the
stack.
* In wolfssl/wolfcrypt/settings.h, define WC_SHA2_NO_SMALL_STACK by default when
WOLFSSL_KERNEL_MODE, and add a clause to #undef WOLFSSL_SMALL_STACK when
building the SHA-2 implementations.
linuxkm/lkcapi_sha_glue.c:
* Refactor out superfluous struct km_sha_state.
* Clean up some macro dynamics.
* Add static asserts on HASH_MAX_STATESIZE to WC_LINUXKM_SHA1_IMPLEMENT() and
WC_LINUXKM_SHA2_IMPLEMENT().
* Eliminate pointer from export blob, replacing it with a TFM-specific random cookie and per-desc serial ID.
* Fixes kernel address disclosure risk, handle forgery risk, cross-TFM confusion risk, and heap pointer reuse risk.
for clarity, rename internal macros WC_LINUXKM_HAVE_SELFTEST and WC_LINUXKM_HAVE_SELFTEST_FULL to WC_LINUX_CONFIG_SELFTESTS and WC_LINUX_CONFIG_SELFTESTS_FULL respectively.
* add to struct km_sha_hmac_pstate members desc_list_lock, desc_list, export_list, and export_list_len;
* add struct km_sha_hmac_export_state;
* add km_hmac_alloc_tstate(), km_hmac_export(), km_hmac_import(), km_hmac_test_export_import();
* and update km_hmac_*() and WC_LINUXKM_HMAC_IMPLEMENT(() to implement.
adding km_sha3_init_tfm(), km_sha3_exit_tfm(), km_sha3_alloc_tstate(), and
km_sha3_free_tstate(), implementing garbage collection of abandoned shash_desc
objects at .exit_tfm.
* separate WC_LINUXKM_SHA_IMPLEMENT() into WC_LINUXKM_SHA1_IMPLEMENT() (no fixes
needed) and WC_LINUXKM_SHA2_IMPLEMENT() (with associated new helpers
WC_LINUXKM_SHA2_FREE_W(), WC_LINUXKM_SHA2_DECL_W(), WC_LINUXKM_SHA2_PUSH_W(),
and WC_LINUXKM_SHA2_POP_W(), that move .W to a stack buffer).
* Reimplement SHA-2 one-shot digest callback to use only direct wolfCrypt calls
rather than proxy to other callbacks.
linuxkm/lkcapi_aes_glue.c: zero the ephemeral ivOut in AesGcmCrypt_1().
wolfcrypt/src/port/kcapi/kcapi_aes.c: tighten the test on the return value from kcapi_aead_decrypt().
* set up WC_LINUXKM_HAVE_SELFTEST and WC_LINUXKM_HAVE_SELFTEST_FULL early.
* replace the forced-downgrade from FIPS 186-5 to 186-4 for SHA-1 support, with a #error if configuration is incompatible.
linuxkm/linuxkm_wc_port.h, linuxkm/lkcapi_glue.c, linuxkm/module_exports.c.template, linuxkm/module_hooks.c, wolfcrypt/src/random.c: consolidate into the warning-masked span of linuxkm_wc_port.h, the #includes for kernel headers linux/fips.h, linux/vmalloc.h, and linux/random.h.
linuxkm/linuxkm_wc_port.h: strcpy() takes 2 args.
wolfcrypt/src/aes.c: add VECTOR_REGISTERS_PUSH2() and use it to free tmp in smallstack path if the push fails.
* when including kernel headers with gcc-17+, ignore -Wconstant-logical-operand.
* when CONFIG_KMSAN, explicitly map memcpy(), memset(), memmove(), strcpy(),
strncpy(), and strncat(), to clang builtins, to get proper __msan
interception.
* genericize WC_SANITIZE_DISABLE() and WC_SANITIZE_ENABLE() to cover both KASAN
and KMSAN, and use the generic macros in wc_linuxkm_stack_hwm_prepare() and
wc_linuxkm_stack_hwm_measure_rel().
linuxkm/: when logging PTR_ERR(), cast it to int, and use "%d" as the format. Globally, `#define PTR_ERR(x) ((int)PTR_ERR(x))` in linuxkm_wc_port.h to fix clang warnings on kernel headers.
linuxkm/lkcapi_aes_glue.c: add casts in linuxkm_test_aesgcm() to mollify clang.
linuxkm/linuxkm_wc_port.h, linuxkm/module_hooks.c:
* add __clang__ compat code to allow including clang stdatomic.h while masking out kernel-incompatible __CLANG_STDINT_H.
* add clang-specific suppressions for kernel headers (-Wshorten-64-to-32, -Wframe-address).
linuxkm/lkcapi_sha_glue.c:
* in wc__get_random_bytes(), add bounds-checking for len.
* in wc_extract_crng_user(), fix type conflicts.
wolfssl/wolfcrypt/wc_port.h and wolfssl/wolfcrypt/types.h:
* move the old-FIPS compatibility mapping from INLINE to WC_INLINE from types.h to wc_port.h.
* activate stdatomic.h for clang kernel module builds.
linuxkm/Kbuild:
* add clang-specific flags.
* add gcc gate around gcc-specific flags.
* allow override value for MAX_STACK_FRAME_SIZE.
wolfcrypt/src/asn.c: add casts in GetFormattedTime_ex() to mollify clang build of linuxkm.
linuxkm/linuxkm_memory.c: use packed-struct intermediates rather than memcpy()s for wc_get_unaligned() and wc_put_unaligned().
linuxkm/linuxkm_wc_port.h: on old FIPS, retrofit nonnull attribute to GHASH() arg 1, so that it unconditionally writes out the hash.
wolfcrypt/src/aes.c and wolfssl/wolfcrypt/aes.h: in GHASH(), add nonnull attribute to arg 1, and remove runtime nullness check for arg 1 in the implementations.
Support AES-XTS AVX512/VAES
Support AES-GCM AVX512/VAES
Support AES-ECB/CBC/CTR AVX512/VAES/AVX1/AES-NI.
Remove code from aes_asm.S/aes_asm.asm
Add CPU defines for AVX512 and VAES
Updated ASM files with new defines for AVX512.
Added support for printing out the new CPU Id flags in benchmark.
Added new files to Windows projects.
aes.c: Supports ECB/CBC/CTR in assembly. Supports calling AVX512/VAES assembly.
* in USE_WINDOWS_API wc_GenerateSeed(), recognize HAVE_AMD_RDSEED, and properly enforce FORCE_FAILURE_RDSEED when CPU support is missing;
* in WOLFSSL_LINUXKM wc_GenerateSeed(), initialize ret to RNG_FAILURE_E, and properly enforce FORCE_FAILURE_RDSEED when CPU support is missing;
* in WOLFSSL_BSDKM wc_GenerateSeed(), properly enforce FORCE_FAILURE_RDSEED when CPU support is missing;
fix F-3291: Copy-paste error in linuxkm_test_aesgcm error message uses WOLFKM_AESCBC_DRIVER
fix F-1431: AES-GCM RFC4106 SetKey Uses memcpy Instead of XMEMCPY for Nonce Copy
(note, for F-1431, changed all relevant memset() and memcpy() calls in linuxkm/ to XMEMSET() and XMEMCPY() respectively.)
in AesGcmCrypt_1() and AesCcmCrypt_1(), check for overflow on assoclen+cryptlen in both encrypt and decrypt modes;
in linuxkm_test_kpp_driver(), return MEMORY_E, not -ENOMEM;
in km_direct_rsa_dec(), only update req->dst_len for -EOVERFLOW, not for -EINVAL.
Daniele Lacamera
Daniel Pouzzner
philljjandGitHub
Sean Parkinson