Skip to content

20260807-linuxkm-ed-pqc-glue #11180

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
douzzer wants to merge 11 commits into
base: master
Choose a base branch
from
Open

20260807-linuxkm-ed-pqc-glue #11180

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
4303fd1
src/pk_ec.c: fix identicalInnerCondition in wolfSSL_ECDH_compute_key().
douzzer Aug 14, 2026
8fde502
wolfcrypt/src/ecc.c: fix identicalInnerCondition in _ecc_import_x963_…
douzzer Aug 14, 2026
371283b
wolfcrypt/src/md5.c: fix MSAN-detected unaligned access in Transform().
douzzer Aug 14, 2026
9ef9f2e
wolfcrypt/benchmark/benchmark.c: smallstack refactor of bench_chacha2…
douzzer Aug 14, 2026
560761b
wolfssl/openssl/hmac.h: add missing !OPENSSL_COEXIST gate around #def…
douzzer Aug 14, 2026
7e91791
wolfssl/wolfcrypt/memory.h: add configuration consistency asserts aro…
douzzer Aug 14, 2026
4f8add9
wolfcrypt/src/error.c, wolfssl/wolfcrypt/error-crypt.h:
douzzer Aug 14, 2026
fc0a48c
linuxkm/lkcapi_ecdh_glue.c: implement ecdh-nist-p521 driver.
douzzer Aug 14, 2026
7882a29
linuxkm/x86_vector_register_glue.c, wolfcrypt/src/wc_port.c, linuxkm/…
douzzer Aug 14, 2026
8f4ea44
linuxkm/module_hooks.c:
douzzer Aug 14, 2026
292b200
linuxkm/lkcapi_aes_glue.c: implement WC_LINUXKM_{GCM,XTS}_SVR_BATCH, …
douzzer Aug 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .wolfssl_known_macro_extras
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,6 +90,7 @@ CONFIG_CRYPTO_FIPS
CONFIG_CRYPTO_GCM
CONFIG_CRYPTO_HMAC
CONFIG_CRYPTO_MANAGER
CONFIG_CRYPTO_MLDSA
CONFIG_CRYPTO_RSA
CONFIG_CRYPTO_SELFTESTS
CONFIG_CRYPTO_SELFTESTS_FULL
Expand Down Expand Up @@ -387,6 +388,8 @@ LIBWOLFSSL_VERSION_GIT_ORIGIN
LIBWOLFSSL_VERSION_GIT_SHORT_HASH
LIBWOLFSSL_VERSION_GIT_TAG
LINUXKM_DONT_FORCE_FIPS_ENABLED
LINUXKM_LKCAPI_DONT_REGISTER_ED25519
LINUXKM_LKCAPI_DONT_REGISTER_ED448
LINUXKM_LKCAPI_PRIORITY_ALLOW_MASKING
LINUX_CYCLE_COUNT
LINUX_RUSAGE_UTIME
Expand Down
14 changes: 14 additions & 0 deletions configure.ac
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11945,6 +11945,13 @@ then
AM_CFLAGS="$AM_CFLAGS -DLINUXKM_LKCAPI_REGISTER_RSA -DWC_RSA_NO_PADDING" ;;
'dh') AM_CFLAGS="$AM_CFLAGS -DLINUXKM_LKCAPI_REGISTER_DH -DWOLFSSL_DH_EXTRA"
;;
'ed') AM_CFLAGS="$AM_CFLAGS -DLINUXKM_LKCAPI_REGISTER_ED" ;;
'mldsa') AM_CFLAGS="$AM_CFLAGS -DLINUXKM_LKCAPI_REGISTER_MLDSA" ;;
'mlkem') AM_CFLAGS="$AM_CFLAGS -DLINUXKM_LKCAPI_REGISTER_MLKEM" ;;
'slhdsa') AM_CFLAGS="$AM_CFLAGS -DLINUXKM_LKCAPI_REGISTER_SLHDSA" ;;
'lms') AM_CFLAGS="$AM_CFLAGS -DLINUXKM_LKCAPI_REGISTER_LMS" ;;
'xmss') AM_CFLAGS="$AM_CFLAGS -DLINUXKM_LKCAPI_REGISTER_XMSS" ;;

# disable options
'-cbc(aes)') AM_CFLAGS="$AM_CFLAGS -DLINUXKM_LKCAPI_DONT_REGISTER_AESCBC" ;;
'-cfb(aes)') AM_CFLAGS="$AM_CFLAGS -DLINUXKM_LKCAPI_DONT_REGISTER_AESCFB" ;;
Expand Down Expand Up @@ -11974,6 +11981,13 @@ then
'-ecdh') AM_CFLAGS="$AM_CFLAGS -DLINUXKM_LKCAPI_DONT_REGISTER_ECDH" ;;
'-rsa') AM_CFLAGS="$AM_CFLAGS -DLINUXKM_LKCAPI_DONT_REGISTER_RSA" ;;
'-dh') AM_CFLAGS="$AM_CFLAGS -DLINUXKM_LKCAPI_DONT_REGISTER_DH" ;;
'-ed') AM_CFLAGS="$AM_CFLAGS -DLINUXKM_LKCAPI_DONT_REGISTER_ED" ;;
'-mldsa') AM_CFLAGS="$AM_CFLAGS -DLINUXKM_LKCAPI_DONT_REGISTER_MLDSA" ;;
'-mlkem') AM_CFLAGS="$AM_CFLAGS -DLINUXKM_LKCAPI_DONT_REGISTER_MLKEM" ;;
'-slhdsa') AM_CFLAGS="$AM_CFLAGS -DLINUXKM_LKCAPI_DONT_REGISTER_SLHDSA" ;;
'-lms') AM_CFLAGS="$AM_CFLAGS -DLINUXKM_LKCAPI_DONT_REGISTER_LMS" ;;
'-xmss') AM_CFLAGS="$AM_CFLAGS -DLINUXKM_LKCAPI_DONT_REGISTER_XMSS" ;;

*) AC_MSG_ERROR([Unsupported LKCAPI algorithm "$lkcapi_alg".]) ;;
esac
done
Expand Down
6 changes: 6 additions & 0 deletions linuxkm/include.am
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,12 @@ EXTRA_DIST += m4/ax_linuxkm.m4 \
linuxkm/lkcapi_ecdsa_glue.c \
linuxkm/lkcapi_ecdh_glue.c \
linuxkm/lkcapi_rsa_glue.c \
linuxkm/lkcapi_ed_glue.c \
linuxkm/lkcapi_lms_glue.c \
linuxkm/lkcapi_mldsa_glue.c \
linuxkm/lkcapi_mlkem_glue.c \
linuxkm/lkcapi_slhdsa_glue.c \
linuxkm/lkcapi_xmss_glue.c \
linuxkm/wolfcrypt.lds \
linuxkm/patches/5.10.17/WOLFSSL_LINUXKM_HAVE_GET_RANDOM_CALLBACKS-5v10v17.patch \
linuxkm/patches/5.10.236/WOLFSSL_LINUXKM_HAVE_GET_RANDOM_CALLBACKS-5v10v236.patch \
Expand Down
96 changes: 63 additions & 33 deletions linuxkm/linuxkm_wc_port.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@
#include <linux/version.h>
#include <linux/kconfig.h>

#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 16, 0)
#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 16, 0) && !defined(WC_DEBUG_FORCE_KERNEL_SETTINGS)
#error Unsupported kernel.
#endif

Expand All @@ -53,7 +53,8 @@
#endif
#endif

#if defined(HAVE_FIPS) && defined(LINUXKM_LKCAPI_REGISTER_AESXTS) && defined(WC_LINUX_CONFIG_SELFTESTS_FULL)
#if defined(HAVE_FIPS) && defined(LINUXKM_LKCAPI_REGISTER_AESXTS) && defined(WC_LINUX_CONFIG_SELFTESTS_FULL) && \
!defined(WC_DEBUG_FORCE_KERNEL_SETTINGS)
/* CONFIG_CRYPTO_MANAGER_EXTRA_TESTS expects AES-XTS-384 to work, even when CONFIG_CRYPTO_FIPS, but FIPS 140-3 only allows AES-XTS-256 and AES-XTS-512. */
#error CONFIG_CRYPTO_MANAGER_EXTRA_TESTS is incompatible with FIPS wolfCrypt AES-XTS -- please reconfigure the target kernel to disable CONFIG_CRYPTO_MANAGER_EXTRA_TESTS/CONFIG_CRYPTO_SELFTESTS_FULL.
#endif
Expand All @@ -70,7 +71,8 @@
defined(HAVE_ECC) && \
(defined(LINUXKM_LKCAPI_REGISTER_ALL) || \
defined(LINUXKM_LKCAPI_REGISTER_ECDSA) || \
(defined(LINUXKM_LKCAPI_REGISTER_ALL_KCONFIG) && defined(CONFIG_CRYPTO_ECDSA)))
(defined(LINUXKM_LKCAPI_REGISTER_ALL_KCONFIG) && defined(CONFIG_CRYPTO_ECDSA))) && \
!defined(WC_DEBUG_FORCE_KERNEL_SETTINGS)
#error Target kernel requires SHA-1 signature verification support.
#endif

Expand Down Expand Up @@ -125,7 +127,7 @@
* also needed to suppress inclusion of stdlib.h in
* wolfssl/wolfcrypt/types.h.
*/
#define XATOI(s) ({ \
#define XATOI(s) __extension__ ({ \
long long _xatoi_res = 0; \
int _xatoi_ret = kstrtoll(s, 10, &_xatoi_res); \
if (_xatoi_ret != 0) { \
Expand Down Expand Up @@ -212,7 +214,7 @@
WOLFSSL_API int wc_linuxkm_sig_ignore_end(void);
WOLFSSL_API int wc_linuxkm_check_for_intr_signals(void);
#ifndef WC_LINUXKM_MAX_NS_WITHOUT_YIELD
#define WC_LINUXKM_MAX_NS_WITHOUT_YIELD 1000000000
#define WC_LINUXKM_MAX_NS_WITHOUT_YIELD (25 * 1000 * 1000)
#endif
WOLFSSL_API void wc_linuxkm_relax_long_loop(void);

Expand Down Expand Up @@ -740,8 +742,10 @@
#if defined(WOLFSSL_USE_SAVE_VECTOR_REGISTERS) && \
defined(CONFIG_X86)

extern __must_check int allocate_wolfcrypt_linuxkm_fpu_states(void);
extern void free_wolfcrypt_linuxkm_fpu_states(void);
extern __must_check int wc_linuxkm_allocate_svr_states(void);
extern void wc_linuxkm_free_svr_states(void);
WOLFSSL_API void wc_svr_disallowed_count_reset(void);
WOLFSSL_API __must_check unsigned long long int wc_svr_disallowed_count_current(void);
WOLFSSL_API __must_check int wc_can_save_vector_registers_x86(void);
WOLFSSL_API __must_check int wc_save_vector_registers_x86(enum wc_svr_flags flags);
WOLFSSL_API void wc_restore_vector_registers_x86(enum wc_svr_flags flags);
Expand All @@ -760,12 +764,25 @@
#endif
#endif
#ifndef CAN_SAVE_VECTOR_REGISTERS
#define CAN_SAVE_VECTOR_REGISTERS() wc_can_save_vector_registers_x86()
#if defined(DEBUG_VECTOR_REGISTER_ACCESS_ALWAYS_OFF)
#define CAN_SAVE_VECTOR_REGISTERS() 0
#elif defined(DEBUG_VECTOR_REGISTER_ACCESS_ALWAYS_ON)
#define CAN_SAVE_VECTOR_REGISTERS() 1
#else
#define CAN_SAVE_VECTOR_REGISTERS() wc_can_save_vector_registers_x86()
#endif
#endif

#if defined(DEBUG_VECTOR_REGISTER_ACCESS_ALWAYS_ON) && \
defined(DEBUG_VECTOR_REGISTER_ACCESS_ALWAYS_OFF)
#error Conflicting settings for DEBUG_VECTOR_REGISTER_ACCESS_ALWAYS_foo
defined(LINUXKM_LKCAPI_REGISTER) && \
!defined(WC_DEBUG_FORCE_KERNEL_SETTINGS)
#error DEBUG_VECTOR_REGISTER_ACCESS_ALWAYS_ON is incompatible with LINUXKM_LKCAPI_REGISTER.
#endif

#if defined(DEBUG_VECTOR_REGISTER_ACCESS_ALWAYS_OFF) && \
defined(WOLFSSL_LINUXKM_BENCHMARKS) && \
!defined(WC_DEBUG_FORCE_KERNEL_SETTINGS)
#error DEBUG_VECTOR_REGISTER_ACCESS_ALWAYS_OFF is incompatible with WOLFSSL_LINUXKM_BENCHMARKS.
#endif

#ifndef SAVE_VECTOR_REGISTERS
Expand Down Expand Up @@ -806,7 +823,7 @@
#endif
#ifndef SAVE_VECTOR_REGISTERS2
#if defined(DEBUG_VECTOR_REGISTER_ACCESS_ALWAYS_ON)
#define SAVE_VECTOR_REGISTERS2() \
#define SAVE_VECTOR_REGISTERS2() __extension__ \
({ \
int _svr_ret = wc_save_vector_registers_x86(WC_SVR_FLAG_NONE); \
if (_svr_ret != 0) { \
Expand All @@ -817,7 +834,10 @@
_svr_ret; \
})
#elif defined(DEBUG_VECTOR_REGISTER_ACCESS_ALWAYS_OFF)
#define SAVE_VECTOR_REGISTERS2() WC_ACCEL_INHIBIT_E
#define SAVE_VECTOR_REGISTERS2() __extension__ ({ \
WC_RELAX_LONG_LOOP(); \
WC_ACCEL_INHIBIT_E; \
})
#elif defined(DEBUG_VECTOR_REGISTER_ACCESS_FUZZING)
#define SAVE_VECTOR_REGISTERS2() wc_save_vector_registers_x86(WC_SVR_FLAG_FUZZ)
#else
Expand All @@ -834,7 +854,7 @@
* DEBUG_VECTOR_REGISTER_ACCESS_ALWAYS_ON build -- ERROR if any
* calls occur.
*/
#define DISABLE_VECTOR_REGISTERS() \
#define DISABLE_VECTOR_REGISTERS() __extension__ \
({ \
pr_err("ERROR: DISABLE_VECTOR_REGISTERS() with DEBUG_VECTOR_REGISTER_ACCESS_ALWAYS_ON " \
"in %s at %s L %d\n", __func__, __FILE__, __LINE__); \
Expand All @@ -850,7 +870,10 @@
#endif

#ifndef SAVE_VECTOR_REGISTERS_MAYBE_INHIBIT
#ifdef DEBUG_VECTOR_REGISTER_ACCESS_FUZZING
#if (defined(DEBUG_VECTOR_REGISTER_ACCESS_ALWAYS_ON) || \
defined(DEBUG_VECTOR_REGISTER_ACCESS_ALWAYS_OFF))
#define SAVE_VECTOR_REGISTERS_MAYBE_INHIBIT() SAVE_VECTOR_REGISTERS2()
#elif defined(DEBUG_VECTOR_REGISTER_ACCESS_FUZZING)
#define SAVE_VECTOR_REGISTERS_MAYBE_INHIBIT() wc_save_vector_registers_x86(WC_SVR_FLAG_FUZZ | WC_SVR_FLAG_MAYBE_INHIBIT)
#else
#define SAVE_VECTOR_REGISTERS_MAYBE_INHIBIT() wc_save_vector_registers_x86(WC_SVR_FLAG_MAYBE_INHIBIT)
Expand Down Expand Up @@ -896,7 +919,14 @@
#define RESTORE_VECTOR_REGISTERS() restore_vector_registers_arm()
#endif

#elif defined(WOLFSSL_USE_SAVE_VECTOR_REGISTERS)
#elif (defined(WOLFSSL_USE_SAVE_VECTOR_REGISTERS) && \
(!defined(SAVE_VECTOR_REGISTERS) || \
!defined(SAVE_VECTOR_REGISTERS2) || \
!defined(RESTORE_VECTOR_REGISTERS) || \
!defined(DISABLE_VECTOR_REGISTERS) || \
!defined(REENABLE_VECTOR_REGISTERS) || \
!defined(SAVE_VECTOR_REGISTERS_MAYBE_INHIBIT) || \
!defined(RESTORE_VECTOR_REGISTERS_MAYBE_INHIBITED)))
#error WOLFSSL_USE_SAVE_VECTOR_REGISTERS is set for an unimplemented architecture.
#endif /* WOLFSSL_USE_SAVE_VECTOR_REGISTERS */

Expand Down Expand Up @@ -1247,12 +1277,12 @@
#ifdef WOLFSSL_USE_SAVE_VECTOR_REGISTERS

#ifdef CONFIG_X86
typeof(allocate_wolfcrypt_linuxkm_fpu_states) *allocate_wolfcrypt_linuxkm_fpu_states;
typeof(wc_linuxkm_allocate_svr_states) *wc_linuxkm_allocate_svr_states;
typeof(wc_can_save_vector_registers_x86) *wc_can_save_vector_registers_x86;
typeof(free_wolfcrypt_linuxkm_fpu_states) *free_wolfcrypt_linuxkm_fpu_states;
typeof(wc_linuxkm_free_svr_states) *wc_linuxkm_free_svr_states;
typeof(wc_restore_vector_registers_x86) *wc_restore_vector_registers_x86;
typeof(wc_save_vector_registers_x86) *wc_save_vector_registers_x86;
#else /* !CONFIG_X86 */
#elif !defined(WC_DEBUG_FORCE_KERNEL_SETTINGS) /* !CONFIG_X86 */
#error WOLFSSL_USE_SAVE_VECTOR_REGISTERS is set for an unimplemented architecture.
#endif /* arch */

Expand Down Expand Up @@ -1606,12 +1636,12 @@
#define get_current WC_PIE_INDIRECT_SYM(get_current)

#if defined(WOLFSSL_USE_SAVE_VECTOR_REGISTERS) && defined(CONFIG_X86)
#define allocate_wolfcrypt_linuxkm_fpu_states WC_PIE_INDIRECT_SYM(allocate_wolfcrypt_linuxkm_fpu_states)
#define wc_linuxkm_allocate_svr_states WC_PIE_INDIRECT_SYM(wc_linuxkm_allocate_svr_states)
#define wc_can_save_vector_registers_x86 WC_PIE_INDIRECT_SYM(wc_can_save_vector_registers_x86)
#define free_wolfcrypt_linuxkm_fpu_states WC_PIE_INDIRECT_SYM(free_wolfcrypt_linuxkm_fpu_states)
#define wc_linuxkm_free_svr_states WC_PIE_INDIRECT_SYM(wc_linuxkm_free_svr_states)
#define wc_restore_vector_registers_x86 WC_PIE_INDIRECT_SYM(wc_restore_vector_registers_x86)
#define wc_save_vector_registers_x86 WC_PIE_INDIRECT_SYM(wc_save_vector_registers_x86)
#elif defined(WOLFSSL_USE_SAVE_VECTOR_REGISTERS)
#elif defined(WOLFSSL_USE_SAVE_VECTOR_REGISTERS) && !defined(WC_DEBUG_FORCE_KERNEL_SETTINGS)
#error WOLFSSL_USE_SAVE_VECTOR_REGISTERS is set for an unimplemented architecture.
#endif /* WOLFSSL_USE_SAVE_VECTOR_REGISTERS */

Expand Down Expand Up @@ -1737,10 +1767,10 @@

#if defined(WOLFSSL_KERNEL_STACK_DEBUG) || defined(WC_LINUXKM_STACK_DEBUG)

#ifndef CONFIG_THREAD_INFO_IN_TASK
#if !defined(CONFIG_THREAD_INFO_IN_TASK) && !defined(WC_DEBUG_FORCE_KERNEL_SETTINGS)
#error WC_LINUXKM_STACK_DEBUG requires CONFIG_THREAD_INFO_IN_TASK
#endif
#ifdef CONFIG_STACK_GROWSUP
#if defined(CONFIG_STACK_GROWSUP) && !defined(WC_DEBUG_FORCE_KERNEL_SETTINGS)
#error WC_LINUXKM_STACK_DEBUG requires !CONFIG_STACK_GROWSUP
#endif

Expand Down Expand Up @@ -1960,7 +1990,7 @@
#ifndef REENABLE_VECTOR_REGISTERS
#define REENABLE_VECTOR_REGISTERS() wc_restore_vector_registers_x86(WC_SVR_FLAG_INHIBIT)
#endif
#else /* !CONFIG_X86 */
#elif !defined(WC_DEBUG_FORCE_KERNEL_SETTINGS) /* !CONFIG_X86 */
#error WOLFSSL_USE_SAVE_VECTOR_REGISTERS is set for an unimplemented architecture.
#endif /* !CONFIG_X86 */
#endif /* WOLFSSL_USE_SAVE_VECTOR_REGISTERS */
Expand All @@ -1984,7 +2014,7 @@
#ifdef WOLFSSL_LINUXKM_USE_MUTEXES
#define WC_MUTEX_OPS_INLINE

#ifdef LINUXKM_LKCAPI_REGISTER
#if defined(LINUXKM_LKCAPI_REGISTER) && !defined(WC_DEBUG_FORCE_KERNEL_SETTINGS)
/* must use spin locks when registering implementations with the
* kernel, because mutexes are forbidden when calling with nonzero
* irq_count().
Expand Down Expand Up @@ -2196,23 +2226,23 @@
#endif

#ifdef WOLFSSL_TRACK_MEMORY
#define XMALLOC(s, h, t) ({(void)(h); (void)(t); wolfSSL_Malloc(s);})
#define XMALLOC(s, h, t) __extension__ ({(void)(h); (void)(t); wolfSSL_Malloc(s);})
#ifdef WOLFSSL_XFREE_NO_NULLNESS_CHECK
#define XFREE(p, h, t) ({(void)(h); (void)(t); wolfSSL_Free(p);})
#define XFREE(p, h, t) __extension__ ({(void)(h); (void)(t); wolfSSL_Free(p);})
#else
#define XFREE(p, h, t) ({void* _xp; (void)(h); _xp = (p); if(_xp) wolfSSL_Free(_xp);})
#define XFREE(p, h, t) __extension__ ({void* _xp; (void)(h); _xp = (p); if(_xp) wolfSSL_Free(_xp);})
#endif
#define XREALLOC(p, n, h, t) ({(void)(h); (void)(t); wolfSSL_Realloc(p, n);})
#define XREALLOC(p, n, h, t) __extension__ ({(void)(h); (void)(t); wolfSSL_Realloc(p, n);})
#else
#if !defined(XMALLOC_USER) && !defined(XMALLOC_OVERRIDE)
#define XMALLOC(s, h, t) ({(void)(h); (void)(t); malloc(s);})
#define XMALLOC(s, h, t) __extension__ ({(void)(h); (void)(t); malloc(s);})
#ifdef WOLFSSL_XFREE_NO_NULLNESS_CHECK
#define XFREE(p, h, t) ({(void)(h); (void)(t); free(p);})
#define XFREE(p, h, t) __extension__ ({(void)(h); (void)(t); free(p);})
#else
#define XFREE(p, h, t) ({void* _xp; (void)(h); (void)(t); _xp = (p); if(_xp) free(_xp);})
#define XFREE(p, h, t) __extension__ ({void* _xp; (void)(h); (void)(t); _xp = (p); if(_xp) free(_xp);})
#endif
#if defined(USE_KVREALLOC) || !defined(USE_KVMALLOC)
#define XREALLOC(p, n, h, t) ({(void)(h); (void)(t); realloc(p, n);})
#define XREALLOC(p, n, h, t) __extension__ ({(void)(h); (void)(t); realloc(p, n);})
#endif
#endif /* !XMALLOC_USER && !XMALLOC_OVERRIDE */
#endif
Expand Down
Loading
Loading