From 87149fe5a659811cccae6dc8a34ec15f249a1eea Mon Sep 17 00:00:00 2001 From: Daniel Pouzzner Date: Fri, 24 Jul 2026 09:58:01 -0500 Subject: [PATCH] linuxkm/: rename enabled_fips to enabled_kernel_fips_enabled, and fix gating on its declaration (add dependency on defined(CONFIG_CRYPTO_FIPS)); use FIPS_NOT_ALLOWED_E rather than NOT_COMPILED_IN to signal FIPS-forbidden keysizes from linuxkm_test_ecdh_nist_driver() and linuxkm_test_ecdsa_nist_driver() to REGISTER_ALG_OPTIONAL(). --- linuxkm/lkcapi_ecdh_glue.c | 2 +- linuxkm/lkcapi_ecdsa_glue.c | 2 +- linuxkm/lkcapi_glue.c | 14 +++++++------- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/linuxkm/lkcapi_ecdh_glue.c b/linuxkm/lkcapi_ecdh_glue.c index 1445bb1776..78f485221a 100644 --- a/linuxkm/lkcapi_ecdh_glue.c +++ b/linuxkm/lkcapi_ecdh_glue.c @@ -913,7 +913,7 @@ static int linuxkm_test_ecdh_nist_driver(const char * driver, if ((PTR_ERR(tfm) == -ENOENT) && fips_enabled) { pr_info("info: skipping unsupported kpp algorithm %s: %d\n", driver, (int)PTR_ERR(tfm)); - test_rc = NOT_COMPILED_IN; + test_rc = FIPS_NOT_ALLOWED_E; } else #endif diff --git a/linuxkm/lkcapi_ecdsa_glue.c b/linuxkm/lkcapi_ecdsa_glue.c index 68639ac14b..c32b5e8a54 100644 --- a/linuxkm/lkcapi_ecdsa_glue.c +++ b/linuxkm/lkcapi_ecdsa_glue.c @@ -1186,7 +1186,7 @@ static int linuxkm_test_ecdsa_nist_driver(const char * driver, if ((PTR_ERR(tfm) == -ENOENT) && fips_enabled) { pr_info("info: skipping unsupported akcipher algorithm %s: %d\n", driver, (int)PTR_ERR(tfm)); - test_rc = NOT_COMPILED_IN; + test_rc = FIPS_NOT_ALLOWED_E; } else #endif diff --git a/linuxkm/lkcapi_glue.c b/linuxkm/lkcapi_glue.c index fc24bc4d44..1fbaf973d1 100644 --- a/linuxkm/lkcapi_glue.c +++ b/linuxkm/lkcapi_glue.c @@ -224,8 +224,8 @@ static wolfSSL_Atomic_Int linuxkm_lkcapi_registering_now = WOLFSSL_ATOMIC_INITIA static int linuxkm_lkcapi_register(void); static int linuxkm_lkcapi_unregister(void); -#if defined(HAVE_FIPS) && defined(WC_LINUX_CONFIG_SELFTESTS) -static int enabled_fips = 0; +#if defined(HAVE_FIPS) && defined(CONFIG_CRYPTO_FIPS) && defined(WC_LINUX_CONFIG_SELFTESTS) +static int enabled_kernel_fips_enabled = 0; #endif static ssize_t install_algs_handler(struct kobject *kobj, struct kobj_attribute *attr, @@ -268,9 +268,9 @@ static ssize_t deinstall_algs_handler(struct kobject *kobj, struct kobj_attribut return ret; #if defined(HAVE_FIPS) && defined(CONFIG_CRYPTO_FIPS) && defined(WC_LINUX_CONFIG_SELFTESTS) - if (enabled_fips) { + if (enabled_kernel_fips_enabled) { pr_info("wolfCrypt: restoring fips_enabled to off.\n"); - enabled_fips = fips_enabled = 0; + enabled_kernel_fips_enabled = fips_enabled = 0; } #endif @@ -355,7 +355,7 @@ static int linuxkm_lkcapi_register(void) * test vectors and fuzzing from the CRYPTO_MANAGER. */ pr_info("wolfCrypt: changing fips_enabled from 0 to 1 for FIPS module.\n"); - enabled_fips = fips_enabled = 1; + enabled_kernel_fips_enabled = fips_enabled = 1; } #endif @@ -401,7 +401,7 @@ static int linuxkm_lkcapi_register(void) if (! alg ## _loaded) { \ ret = (crypto_register_ ## alg_class)(&(alg)); \ if (ret) { \ - if (fips_enabled && (ret == WC_NO_ERR_TRACE(NOT_COMPILED_IN))) { \ + if (ret == WC_NO_ERR_TRACE(FIPS_NOT_ALLOWED_E)) { \ pr_info("wolfCrypt: skipping FIPS-incompatible alg %s.\n", \ (alg).base.cra_driver_name); \ } \ @@ -415,7 +415,7 @@ static int linuxkm_lkcapi_register(void) } else { \ ret = (tester()); \ if (ret) { \ - if (fips_enabled && (ret == WC_NO_ERR_TRACE(NOT_COMPILED_IN))) { \ + if (ret == WC_NO_ERR_TRACE(FIPS_NOT_ALLOWED_E)) { \ pr_info("wolfCrypt: skipping FIPS-incompatible alg %s.\n", \ (alg).base.cra_driver_name); \ } \