mirror of https://github.com/wolfSSL/wolfssl.git
linuxkm/include.am: add linuxkm/patches/7.3/WOLFSSL_LINUXKM_HAVE_GET_RANDOM_CALLBACKS-7v3.patch;
linuxkm/lkcapi_glue.c and linuxkm/lkcapi_sha_glue.c: disable state invalidation mechanism on old FIPS (depends on wc_RNG_register_free_hook()); add missing WC_RNG_HAVE_POOL gate; add missing warning suppressions for linux/acpi.h (needed on old kernels); wolfssl/wolfcrypt/random.h and wolfssl/wolfcrypt/settings.h: use WC_RNG_WANT_DEBUG_STATS as the feature toggle, so that WC_RNG_DEBUG_STATS is the availability sensor.pull/11435/head
Daniel Pouzzner
parent
3fa61e2151
commit
6c067bb867
|
|
@ -35,4 +35,5 @@ EXTRA_DIST += m4/ax_linuxkm.m4 \
|
|||
linuxkm/patches/6.1.73/WOLFSSL_LINUXKM_HAVE_GET_RANDOM_CALLBACKS-6v1v73.patch \
|
||||
linuxkm/patches/6.12/WOLFSSL_LINUXKM_HAVE_GET_RANDOM_CALLBACKS-6v12.patch \
|
||||
linuxkm/patches/6.15/WOLFSSL_LINUXKM_HAVE_GET_RANDOM_CALLBACKS-6v15.patch \
|
||||
linuxkm/patches/7.0/WOLFSSL_LINUXKM_HAVE_GET_RANDOM_CALLBACKS-7v0.patch
|
||||
linuxkm/patches/7.0/WOLFSSL_LINUXKM_HAVE_GET_RANDOM_CALLBACKS-7v0.patch \
|
||||
linuxkm/patches/7.3/WOLFSSL_LINUXKM_HAVE_GET_RANDOM_CALLBACKS-7v3.patch
|
||||
|
|
|
|||
|
|
@ -296,7 +296,7 @@ static int linuxkm_lkcapi_sysfs_install(void) {
|
|||
return ret;
|
||||
}
|
||||
|
||||
#ifdef LINUXKM_LKCAPI_REGISTER_HASH_DRBG
|
||||
#ifdef WC_LINUXKM_HAVE_RNG_STATE_INVALIDATE_HANDLER
|
||||
ret = linuxkm_lkcapi_sysfs_install_node(&wc_linuxkm_rng_state_invalidate_attr,
|
||||
NULL);
|
||||
if (ret) {
|
||||
|
|
@ -306,13 +306,16 @@ static int linuxkm_lkcapi_sysfs_install(void) {
|
|||
NULL);
|
||||
return ret;
|
||||
}
|
||||
#endif
|
||||
#if defined(LINUXKM_LKCAPI_REGISTER_HASH_DRBG_DEFAULT) && \
|
||||
defined(WC_RNG_DEBUG_STATS)
|
||||
ret = linuxkm_lkcapi_sysfs_install_node(&wc_linuxkm_rng_stats_attr,
|
||||
NULL);
|
||||
if (ret) {
|
||||
#ifdef WC_LINUXKM_HAVE_RNG_STATE_INVALIDATE_HANDLER
|
||||
(void)linuxkm_lkcapi_sysfs_deinstall_node(&wc_linuxkm_rng_state_invalidate_attr,
|
||||
NULL);
|
||||
#endif
|
||||
(void)linuxkm_lkcapi_sysfs_deinstall_node(&deinstall_algs_attr,
|
||||
NULL);
|
||||
(void)linuxkm_lkcapi_sysfs_deinstall_node(&install_algs_attr,
|
||||
|
|
@ -320,7 +323,6 @@ static int linuxkm_lkcapi_sysfs_install(void) {
|
|||
return ret;
|
||||
}
|
||||
#endif
|
||||
#endif /* LINUXKM_LKCAPI_REGISTER_HASH_DRBG */
|
||||
installed_sysfs_LKCAPI_files = 1;
|
||||
}
|
||||
return 0;
|
||||
|
|
@ -329,7 +331,6 @@ static int linuxkm_lkcapi_sysfs_install(void) {
|
|||
static int linuxkm_lkcapi_sysfs_deinstall(void) {
|
||||
if (installed_sysfs_LKCAPI_files) {
|
||||
int ret;
|
||||
#ifdef LINUXKM_LKCAPI_REGISTER_HASH_DRBG
|
||||
#if defined(LINUXKM_LKCAPI_REGISTER_HASH_DRBG_DEFAULT) && \
|
||||
defined(WC_RNG_DEBUG_STATS)
|
||||
ret = linuxkm_lkcapi_sysfs_deinstall_node(&wc_linuxkm_rng_stats_attr,
|
||||
|
|
@ -337,6 +338,7 @@ static int linuxkm_lkcapi_sysfs_deinstall(void) {
|
|||
if (ret)
|
||||
return ret;
|
||||
#endif
|
||||
#ifdef WC_LINUXKM_HAVE_RNG_STATE_INVALIDATE_HANDLER
|
||||
/* removed first (LIFO), and in any case before RNG teardown can
|
||||
* begin: the store handler walks the registry and reaches the
|
||||
* daemon root. */
|
||||
|
|
@ -344,7 +346,7 @@ static int linuxkm_lkcapi_sysfs_deinstall(void) {
|
|||
NULL);
|
||||
if (ret)
|
||||
return ret;
|
||||
#endif /* LINUXKM_LKCAPI_REGISTER_HASH_DRBG */
|
||||
#endif
|
||||
ret = linuxkm_lkcapi_sysfs_deinstall_node(&install_algs_attr, NULL);
|
||||
if (ret)
|
||||
return ret;
|
||||
|
|
|
|||
|
|
@ -51,8 +51,20 @@
|
|||
|
||||
#ifdef LINUXKM_LKCAPI_REGISTER
|
||||
_Pragma("GCC diagnostic push");
|
||||
_Pragma("GCC diagnostic ignored \"-Wunused-parameter\"");
|
||||
_Pragma("GCC diagnostic ignored \"-Wpointer-arith\"");
|
||||
_Pragma("GCC diagnostic ignored \"-Wshadow\"");
|
||||
_Pragma("GCC diagnostic ignored \"-Wnested-externs\"");
|
||||
_Pragma("GCC diagnostic ignored \"-Wredundant-decls\"");
|
||||
_Pragma("GCC diagnostic ignored \"-Wsign-compare\"");
|
||||
_Pragma("GCC diagnostic ignored \"-Wpointer-sign\"");
|
||||
_Pragma("GCC diagnostic ignored \"-Wbad-function-cast\"");
|
||||
#ifndef __clang__
|
||||
_Pragma("GCC diagnostic ignored \"-Wdiscarded-qualifiers\"");
|
||||
#endif
|
||||
#if defined(__GNUC__) && (__GNUC__ >= 17)
|
||||
_Pragma("GCC diagnostic ignored \"-Wconstant-logical-operand\"");
|
||||
#endif
|
||||
#include <linux/acpi.h>
|
||||
#include <linux/io.h>
|
||||
_Pragma("GCC diagnostic pop");
|
||||
|
|
@ -2157,12 +2169,22 @@ static int linuxkm_affinity_unlock(void *arg) {
|
|||
#endif /* !WOLFSSL_USE_SAVE_VECTOR_REGISTERS */
|
||||
}
|
||||
|
||||
#define WC_LINUXKM_ENTROPY_DAEMON_MAGIC 0x6f77666c
|
||||
|
||||
#if !defined(HAVE_FIPS) || FIPS_VERSION3_GE(7,0,0)
|
||||
|
||||
#define WC_LINUXKM_HAVE_RNG_REGISTRY
|
||||
|
||||
/* Registry of every kernel-module RNG object needing state-invalidation
|
||||
* coverage: banks (default and tfm-private) and long-lived process-context
|
||||
* RBGC leaves from LKCAPI_INITRNG(). Atomic-born leaves are deliberately
|
||||
* excluded (see linuxkm_InitRng_DefaultRBGC()): the mutex is thereby never
|
||||
* taken from atomic context, so it can sleep, and the daemon's leaf pass
|
||||
* may gather entropy under it. */
|
||||
* may gather entropy under it.
|
||||
*
|
||||
* Not usable on old FIPS because the mechanism fundamentally depends on
|
||||
* wc_RNG_register_free_hook().
|
||||
*/
|
||||
struct linuxkm_rng_object {
|
||||
struct linuxkm_rng_object *prev, *next;
|
||||
int is_bank;
|
||||
|
|
@ -2259,8 +2281,6 @@ static void wc_linuxkm_rng_registry_add_bank(struct wc_rng_bank *bank)
|
|||
wc_linuxkm_rng_registry_link(obj);
|
||||
}
|
||||
|
||||
#define WC_LINUXKM_ENTROPY_DAEMON_MAGIC 0x6f77666c
|
||||
|
||||
/* platform announcement (VM fork/clone, resume from hibernation) that RNG
|
||||
* state assumptions no longer hold: invalidate the daemon's local root
|
||||
* directly (it is unleased by design), invalidate every bank instance,
|
||||
|
|
@ -2455,8 +2475,14 @@ static ssize_t wc_linuxkm_rng_state_invalidate_handler(struct kobject *kobj,
|
|||
static struct kobj_attribute wc_linuxkm_rng_state_invalidate_attr =
|
||||
__ATTR(rng_state_invalidate, 0220, NULL, wc_linuxkm_rng_state_invalidate_handler);
|
||||
|
||||
#define WC_LINUXKM_HAVE_RNG_STATE_INVALIDATE_HANDLER
|
||||
|
||||
#endif /* !HAVE_FIPS || FIPS_VERSION3_GE(7,0,0) */
|
||||
|
||||
#ifndef WC_LINUXKM_NO_ENTROPY_DAEMON
|
||||
|
||||
#ifdef WC_LINUXKM_HAVE_RNG_REGISTRY
|
||||
|
||||
#if defined(WC_LINUXKM_VMGENID_POLL) || \
|
||||
(defined(CONFIG_ACPI) && !IS_ENABLED(CONFIG_VMGENID))
|
||||
/* Without CONFIG_VMGENID, we can only detect VM fork events by polling.
|
||||
|
|
@ -2575,6 +2601,8 @@ static void wc_linuxkm_vmgenid_poll_teardown(
|
|||
}
|
||||
#endif /* CONFIG_ACPI && !CONFIG_VMGENID */
|
||||
|
||||
#endif /* WC_LINUXKM_HAVE_RNG_REGISTRY */
|
||||
|
||||
/* Entropy-banking daemon for the default rng bank: cycles the bank's
|
||||
* instances, keeping each DRBG's nextSeed aperture full so that
|
||||
* WC_RNG_BANK_FLAG_CONSUME_NEXT_SEED checkouts can perform credited
|
||||
|
|
@ -3090,8 +3118,10 @@ static int wc_linuxkm_rng_bank_init(struct wc_rng_bank *ctx)
|
|||
ret = -EINVAL;
|
||||
}
|
||||
|
||||
#ifdef WC_LINUXKM_HAVE_RNG_REGISTRY
|
||||
if (ret == 0)
|
||||
wc_linuxkm_rng_registry_add_bank(ctx);
|
||||
#endif
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
|
@ -3320,6 +3350,7 @@ WC_MAYBE_UNUSED static int linuxkm_InitRng_DefaultRBGC(WC_RNG* rng) {
|
|||
ret);
|
||||
ret = wc_InitRng(rng);
|
||||
}
|
||||
#ifdef WC_LINUXKM_HAVE_RNG_REGISTRY
|
||||
if (ret == 0) {
|
||||
/* Long-lived process-context leaves join the invalidation registry;
|
||||
* atomic-born leaves are excluded by rule (and are transient by
|
||||
|
|
@ -3327,6 +3358,7 @@ WC_MAYBE_UNUSED static int linuxkm_InitRng_DefaultRBGC(WC_RNG* rng) {
|
|||
if (can_sleep)
|
||||
wc_linuxkm_rng_registry_add_rng(rng);
|
||||
}
|
||||
#endif
|
||||
return ret;
|
||||
}
|
||||
|
||||
|
|
@ -3365,7 +3397,9 @@ WC_MAYBE_UNUSED static int linuxkm_InitRng_DefaultRef(WC_RNG* rng) {
|
|||
#define WC_LINUXKM_DRBG_SMALL_LIMIT 8
|
||||
#endif
|
||||
|
||||
#ifdef WC_RNG_HAVE_POOL
|
||||
wc_static_assert(WC_LINUXKM_DRBG_SMALL_LIMIT <= WC_LINUXKM_RNG_POOL_SIZE);
|
||||
#endif
|
||||
|
||||
static int wc_linuxkm_drbg_generate(struct wc_rng_bank *ctx,
|
||||
const u8 *src, unsigned int slen,
|
||||
|
|
@ -4482,9 +4516,11 @@ static int wc_linuxkm_drbg_startup(void)
|
|||
pr_info("%s registered as systemwide default stdrng.\n", wc_linuxkm_drbg.base.cra_driver_name);
|
||||
pr_info("libwolfssl: to unload module, first echo 1 > /sys/module/libwolfssl/deinstall_algs\n");
|
||||
|
||||
#ifdef WC_LINUXKM_HAVE_RNG_REGISTRY
|
||||
/* stock-notifier invalidation coverage rides with the registered
|
||||
* DRBGs, patched and unpatched kernels alike. */
|
||||
wc_linuxkm_rng_notifiers_install();
|
||||
#endif
|
||||
|
||||
#ifdef LINUXKM_DRBG_GET_RANDOM_BYTES
|
||||
|
||||
|
|
@ -4579,10 +4615,12 @@ static int wc_linuxkm_drbg_cleanup(void) {
|
|||
*/
|
||||
int ret;
|
||||
|
||||
#ifdef WC_LINUXKM_HAVE_RNG_REGISTRY
|
||||
/* the notifier callbacks walk the RNG registry: uninstall them
|
||||
* before any of what they reference is dismantled. unregister
|
||||
* returns only after in-flight callbacks complete. */
|
||||
wc_linuxkm_rng_notifiers_uninstall();
|
||||
#endif
|
||||
|
||||
#ifdef LINUXKM_DRBG_GET_RANDOM_BYTES
|
||||
|
||||
|
|
|
|||
|
|
@ -459,6 +459,10 @@ enum wc_RngHealthState {
|
|||
#define WC_RNG_FLAG_BANKREF (1U << 2)
|
||||
#define WC_RNG_FLAG_RECOVER_AND_PROMOTE_FROM_NEXT_SEED (1U << 3)
|
||||
|
||||
#ifdef WC_RNG_WANT_DEBUG_STATS
|
||||
#define WC_RNG_DEBUG_STATS
|
||||
#endif
|
||||
|
||||
#ifdef WC_RNG_DEBUG_STATS
|
||||
#ifdef WORD64_AVAILABLE
|
||||
typedef word64 wc_rng_debug_counter_t;
|
||||
|
|
|
|||
|
|
@ -745,7 +745,6 @@ static WC_INLINE WC_MAYBE_UNUSED int wc_rng_bank_inst_lock_clear_extra(struct wc
|
|||
return 0;
|
||||
}
|
||||
|
||||
|
||||
#endif /* !WC_RNG_HAVE_LOCK */
|
||||
|
||||
#ifdef WC_RNG_DEBUG_STATS
|
||||
|
|
|
|||
|
|
@ -4662,8 +4662,8 @@
|
|||
#endif
|
||||
|
||||
#if defined(WC_VERBOSE_RNG) && defined(WOLFSSL_KERNEL_VERBOSE_DEBUG) && \
|
||||
!defined(WC_RNG_NO_DEBUG_STATS) && !defined(WC_RNG_DEBUG_STATS)
|
||||
#define WC_RNG_DEBUG_STATS
|
||||
!defined(WC_RNG_NO_DEBUG_STATS) && !defined(WC_RNG_WANT_DEBUG_STATS)
|
||||
#define WC_RNG_WANT_DEBUG_STATS
|
||||
#endif
|
||||
|
||||
#if WOLFSSL_GENERAL_ALIGNMENT < SIZEOF_LONG
|
||||
|
|
|
|||
Loading…
Reference in New Issue