20260720-linuxkm-CMAC-native

.github/workflows/codespell.yml

@@ -31,4 +31,4 @@ jobs:
           # The exclude_file contains lines of code that should be ignored. This is useful for individual lines which have non-words that can safely be ignored.
         exclude_file: '.codespellexcludelines'
           # To skip files entirely from being processed, add it to the following list:
-        skip: '*.cproject,*.csr,*.der,*.mtpj,*.pem,*.vcxproj,.git,*.launch,*.scfg,*.revoked,./examples/asn1/dumpasn1.cfg,./examples/asn1/oid_names.h'
+        skip: '*.cproject,*.csr,*.der,*.mtpj,*.pem,*.vcxproj,.git,*.launch,*.scfg,*.revoked,./examples/asn1/dumpasn1.cfg,./examples/asn1/oid_names.h,*.bin'

.wolfssl_known_macro_extras

@@ -75,6 +75,7 @@ CONFIG_COMPILER_OPTIMIZATION_SIZE
 CONFIG_CRYPTO_AES
 CONFIG_CRYPTO_CBC
 CONFIG_CRYPTO_CCM
+CONFIG_CRYPTO_CMAC
 CONFIG_CRYPTO_CTR
 CONFIG_CRYPTO_DH
 CONFIG_CRYPTO_DH_RFC7919_GROUPS
@@ -291,6 +292,7 @@ HASH_DIGEST
 HASH_DataType_8b
 HASH_IMR_DCIE
 HASH_IMR_DINIE
+HASH_MAX_STATESIZE
 HAVE_AESGCM_DECRYPT
 HAVE_BYTEREVERSE64
 HAVE_CERTIFICATE_STATUS_V2
@@ -744,6 +746,7 @@ WC_RSA_NONBLOCK_TIME
 WC_RSA_NO_FERMAT_CHECK
 WC_RTL8735B_NO_DERIVE_CACHE
 WC_RWLOCK_OPS_INLINE
+WC_SHA2_SMALL_STACK
 WC_SHE_SW_DEFAULT
 WC_SKIP_INCLUDED_C_FILES
 WC_SLHDSA_KERNEL_ASM

configure.ac

@@ -7374,9 +7374,9 @@ AS_CASE([$FIPS_VERSION],
                (test "$FIPS_VERSION" != "lean-aesgcm-dev" || test "$enable_sha384" != "yes")],
             [enable_sha384="no"; ENABLED_SHA384="no"; AM_CFLAGS="$AM_CFLAGS -UWOLFSSL_SHA384 -UWOLFSSL_SHA384"])
 
-        AS_IF([test "$ENABLED_SHA512" != "no" &&
-               (test "$FIPS_VERSION" != "lean-aesgcm-dev" || test "$enable_sha512" != "yes")],
-            [enable_sha512="no"; ENABLED_SHA512="no"; ENABLED_SHA512_DRBG="no"; AM_CFLAGS="$AM_CFLAGS -UWOLFSSL_SHA512 -UWOLFSSL_SHA384"])
+        AS_IF([test "$ENABLED_SHA512" = "no" &&
+               (test "$FIPS_VERSION" != "lean-aesgcm-dev" || test "$enable_sha512" != "no")],
+            [enable_sha512="yes"; ENABLED_SHA512="yes"; ENABLED_SHA512_DRBG="yes"; AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SHA512 -DWOLFSSL_SHA384"])
 
         # SHA512-224 and SHA512-256 are SHA-2 algorithms not in our FIPS algorithm list
         AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_NOSHA512_224 -DWOLFSSL_NOSHA512_256"
@@ -11633,6 +11633,8 @@ then
         'ofb(aes)') test "$ENABLED_AESOFB" != "no" || AC_MSG_ERROR([linuxkm-lkcapi-register ${lkcapi_alg}: AES-OFB implementation not enabled.])
                     AM_CFLAGS="$AM_CFLAGS -DLINUXKM_LKCAPI_REGISTER_AESOFB" ;;
         'ecb(aes)') AM_CFLAGS="$AM_CFLAGS -DLINUXKM_LKCAPI_REGISTER_AESECB -DHAVE_AES_ECB" ;;
+        'cmac(aes)') test "$ENABLED_CMAC" != "no" || AC_MSG_ERROR([linuxkm-lkcapi-register ${lkcapi_alg}: AES-CMAC implementation not enabled.])
+                     AM_CFLAGS="$AM_CFLAGS -DLINUXKM_LKCAPI_REGISTER_AESCMAC -DHAVE_AES_ECB" ;;
         'all-aes') test "$ENABLED_AES" != "no" || AC_MSG_ERROR([linuxkm-lkcapi-register ${lkcapi_alg}: AES is disabled.])
                     AM_CFLAGS="$AM_CFLAGS -DLINUXKM_LKCAPI_REGISTER_AES_ALL" ;;
         'sha1')     test "$ENABLED_SHA" != "no" || AC_MSG_ERROR([linuxkm-lkcapi-register ${lkcapi_alg}: SHA-1 implementation not enabled.])
@@ -11676,6 +11678,7 @@ then
         '-ctr(aes)') AM_CFLAGS="$AM_CFLAGS -DLINUXKM_LKCAPI_DONT_REGISTER_AESCTR" ;;
         '-ofb(aes)') AM_CFLAGS="$AM_CFLAGS -DLINUXKM_LKCAPI_DONT_REGISTER_AESOFB" ;;
         '-ecb(aes)') AM_CFLAGS="$AM_CFLAGS -DLINUXKM_LKCAPI_DONT_REGISTER_AESECB" ;;
+        '-cmac(aes)') AM_CFLAGS="$AM_CFLAGS -DLINUXKM_LKCAPI_DONT_REGISTER_AESCMAC" ;;
         '-all-aes') AM_CFLAGS="$AM_CFLAGS -DLINUXKM_LKCAPI_DONT_REGISTER_AES_ALL" ;;
         '-sha1')     AM_CFLAGS="$AM_CFLAGS -DLINUXKM_LKCAPI_DONT_REGISTER_SHA1" ;;
         '-sha2')     AM_CFLAGS="$AM_CFLAGS -DLINUXKM_LKCAPI_DONT_REGISTER_SHA2" ;;

linuxkm/linuxkm_wc_port.h

@@ -37,23 +37,23 @@
 
     #if LINUX_VERSION_CODE < KERNEL_VERSION(6, 16, 0)
         #if defined(CONFIG_CRYPTO_MANAGER) && !defined(CONFIG_CRYPTO_MANAGER_DISABLE_TESTS)
-            #define WC_LINUXKM_HAVE_SELFTEST
+            #define WC_LINUX_CONFIG_SELFTESTS
         #endif
-        #if defined(WC_LINUXKM_HAVE_SELFTEST) && defined(CONFIG_CRYPTO_MANAGER_EXTRA_TESTS)
-            #define WC_LINUXKM_HAVE_SELFTEST_FULL
+        #if defined(WC_LINUX_CONFIG_SELFTESTS) && defined(CONFIG_CRYPTO_MANAGER_EXTRA_TESTS)
+            #define WC_LINUX_CONFIG_SELFTESTS_FULL
         #endif
     #else
         /* see Linux 698de822780f */
         #if defined(CONFIG_CRYPTO_MANAGER) && defined(CONFIG_CRYPTO_SELFTESTS)
-            #define WC_LINUXKM_HAVE_SELFTEST
+            #define WC_LINUX_CONFIG_SELFTESTS
         #endif
         /* see Linux ac90aad0e9 */
-        #if defined(WC_LINUXKM_HAVE_SELFTEST) && defined(CONFIG_CRYPTO_SELFTESTS_FULL)
-            #define WC_LINUXKM_HAVE_SELFTEST_FULL
+        #if defined(WC_LINUX_CONFIG_SELFTESTS) && defined(CONFIG_CRYPTO_SELFTESTS_FULL)
+            #define WC_LINUX_CONFIG_SELFTESTS_FULL
         #endif
     #endif
 
-    #if defined(HAVE_FIPS) && defined(LINUXKM_LKCAPI_REGISTER_AESXTS) && defined(WC_LINUXKM_HAVE_SELFTEST_FULL)
+    #if defined(HAVE_FIPS) && defined(LINUXKM_LKCAPI_REGISTER_AESXTS) && defined(WC_LINUX_CONFIG_SELFTESTS_FULL)
         /* CONFIG_CRYPTO_MANAGER_EXTRA_TESTS expects AES-XTS-384 to work, even when CONFIG_CRYPTO_FIPS, but FIPS 140-3 only allows AES-XTS-256 and AES-XTS-512. */
         #error CONFIG_CRYPTO_MANAGER_EXTRA_TESTS is incompatible with FIPS wolfCrypt AES-XTS -- please reconfigure the target kernel to disable CONFIG_CRYPTO_MANAGER_EXTRA_TESTS/CONFIG_CRYPTO_SELFTESTS_FULL.
     #endif
@@ -64,7 +64,7 @@
      * disabled), and kernel module signatures frequently use SHA-1 until quite
      * recently.
      */
-    #if (defined(WC_LINUXKM_HAVE_SELFTEST) || defined(CONFIG_MODULE_SIG_SHA1)) && \
+    #if (defined(WC_LINUX_CONFIG_SELFTESTS) || defined(CONFIG_MODULE_SIG_SHA1)) && \
         (((defined(WC_MIN_DIGEST_SIZE_FOR_VERIFY) && (WC_MIN_DIGEST_SIZE_FOR_VERIFY > 20)) || \
          (defined(NO_SHA) && !defined(WC_MIN_DIGEST_SIZE_FOR_VERIFY)))) && \
         defined(HAVE_ECC) && \
@@ -445,7 +445,7 @@
     #include <linux/fips.h>
 
     /* Kernel non-FIPS self-test ("testmgr") has a KAT with all-zeros keys. */
-    #if defined(WC_LINUXKM_HAVE_SELFTEST) && !defined(HAVE_FIPS)
+    #if defined(WC_LINUX_CONFIG_SELFTESTS) && !defined(HAVE_FIPS)
         #define WC_AES_XTS_ALLOW_DUPLICATE_KEYS
     #endif
 
@@ -1962,9 +1962,28 @@
         typedef struct wolfSSL_Mutex {
             spinlock_t lock;
             unsigned long irq_flags;
+        #ifdef WOLFSSL_LINUXKM_VERBOSE_DEBUG
+            unsigned int magic;
+        #endif
         } wolfSSL_Mutex;
 
-        #define WOLFSSL_MUTEX_INITIALIZER(lockname) { .lock =__SPIN_LOCK_UNLOCKED(lockname), .irq_flags = 0 }
+        #ifdef WOLFSSL_LINUXKM_VERBOSE_DEBUG
+            #define WC_LINUXKM_SPINLOCK_MAGIC 1702166717U
+
+            #define WOLFSSL_MUTEX_INITIALIZER(lockname) { \
+               .lock =__SPIN_LOCK_UNLOCKED(lockname),     \
+               .irq_flags = 0,                            \
+               .magic = WC_LINUXKM_SPINLOCK_MAGIC         \
+            }
+
+        #else
+
+            #define WOLFSSL_MUTEX_INITIALIZER(lockname) { \
+               .lock =__SPIN_LOCK_UNLOCKED(lockname),     \
+               .irq_flags = 0                             \
+            }
+
+        #endif
 
         static __always_inline int wc_InitMutex(wolfSSL_Mutex* m)
         {
@@ -1975,12 +1994,24 @@
             spin_lock_init(&m->lock);
         #endif
             m->irq_flags = 0;
+        #ifdef WOLFSSL_LINUXKM_VERBOSE_DEBUG
+            m->magic = WC_LINUXKM_SPINLOCK_MAGIC;
+        #endif
 
             return 0;
         }
 
         static __always_inline int wc_FreeMutex(wolfSSL_Mutex* m)
         {
+        #ifdef CONFIG_DEBUG_SPINLOCK
+            /* clear raw_spinlock.magic, but without drilling through the
+             * abstraction barrier.
+             */
+            memset(&m->lock, 0, sizeof m->lock);
+        #endif
+        #ifdef WOLFSSL_LINUXKM_VERBOSE_DEBUG
+            m->magic = 0;
+        #endif
             (void)m;
             return 0;
         }
@@ -2005,6 +2036,10 @@
 
         static __always_inline int wc_UnLockMutex(wolfSSL_Mutex* m)
         {
+        #ifdef WOLFSSL_LINUXKM_VERBOSE_DEBUG
+            if ((m == NULL) || (m->magic != WC_LINUXKM_SPINLOCK_MAGIC))
+                return -1;
+        #endif
             spin_unlock_irqrestore(&m->lock, m->irq_flags);
             return 0;
         }