CI fixes, oe timers made portable out of boundary, unified kernel and user space returns

Author: kaleb-himes

.gitignore

@@ -80,6 +80,7 @@ fipsv2.c
 ctaocrypt/benchmark/benchmark
 ctaocrypt/test/testctaocrypt
 wolfcrypt/benchmark/benchmark
+wolfcrypt/benchmark/fips_cast_bench
 wolfcrypt/test/testwolfcrypt
 examples/async/async_client
 examples/async/async_server

.wolfssl_known_macro_extras

@@ -71,6 +71,7 @@ CONFIG_ARCH_POSIX
 CONFIG_ARCH_TEGRA
 CONFIG_ARM
 CONFIG_ARM64
+CONFIG_ARM64_SME
 CONFIG_BOARD_NATIVE_POSIX
 CONFIG_BOARD_NATIVE_SIM
 CONFIG_COMPILER_OPTIMIZATION_DEFAULT
@@ -144,6 +145,7 @@ CONFIG_IDF_TARGET_ESP32S3
 CONFIG_IDF_TARGET_ESP8266
 CONFIG_IDF_TARGET_ESP8684
 CONFIG_KASAN
+CONFIG_KERNEL_MODE_NEON
 CONFIG_KMSAN
 CONFIG_KPROBES
 CONFIG_MAIN_TASK_STACK_SIZE
@@ -190,7 +192,6 @@ CONFIG_WOLFSSL_ASN_ALLOW_0_SERIAL
 CONFIG_WOLFSSL_CERTIFICATE_BUNDLE
 CONFIG_WOLFSSL_CERTIFICATE_BUNDLE_DEFAULT_NONE
 CONFIG_WOLFSSL_CHACHA_POLY
-CONFIG_WOLFSSL_CRYPTO_ONLY
 CONFIG_WOLFSSL_CURVE25519
 CONFIG_WOLFSSL_DTLS
 CONFIG_WOLFSSL_ECC
@@ -233,6 +234,7 @@ CONFIG_WOLFTPM
 CONFIG_WOLFTPM_EXAMPLE_NAME_ESPRESSIF
 CONFIG_X86
 CONFIG_X86_32
+CONFIG_X86_64
 CONV_WITH_DIV
 CPA_CY_API_VERSION_NUM_MAJOR
 CPA_CY_API_VERSION_NUM_MINOR
@@ -518,8 +520,6 @@ NO_TLSX_PSKKEM_PLAIN_ANNOUNCE
 NO_VAES_SUPPORT
 NO_VERIFY_OID
 NO_WC_DHGENERATEPUBLIC
-NO_WC_SHE_GETUID
-NO_WC_SHE_IMPORT_M123
 NO_WC_SHE_LOADKEY
 NO_WC_SSIZE_TYPE
 NO_WOLFSSL_ALLOC_ALIGN
@@ -735,7 +735,6 @@ WC_AESXTS_STREAM_NO_REQUEST_ACCOUNTING
 WC_AES_BS_WORD_SIZE
 WC_AES_GCM_ALLOW_NONSTANDARD_TAG_LENGTH
 WC_AES_GCM_DEC_AUTH_EARLY
-WC_ALLOW_ECC_ZERO_HASH
 WC_ASN_HASH_SHA256
 WC_ASN_RUNTIME_DATE_CHECK_CONTROL
 WC_ASYNC_ENABLE_ECC_KEYGEN
@@ -763,27 +762,32 @@ WC_BLINDING_NO_RNG_ACKNOWLEDGE_WEAKNESS
 WC_CACHE_RESISTANT_BASE64_TABLE
 WC_DISABLE_RADIX_ZERO_PAD
 WC_DRBG_BANKREF
-WC_FIPS_AESGCM_NO_SHORT_NONCES
-WC_FIPS_AESGCM_ONE_SHOT_EXT_IV_ALLOWED
 WC_FIPS_ED25519CTX_NOT_APPROVED
 WC_FIPS_RSA_VERIFY_MIN_2048
 WC_FLAG_DONT_USE_AESNI
 WC_FORCE_LINUXKM_FORTIFY_SOURCE
+WC_GRB_MEASURE
 WC_HASH_CUSTOM_MAX_BLOCK_SIZE
 WC_HASH_CUSTOM_MAX_DIGEST_SIZE
 WC_HASH_CUSTOM_MIN_DIGEST_SIZE
+WC_HAVE_FIPS_INDICATOR
 WC_INIT_ERROR_WHEN_CONTENDED
+WC_LINUXKM_NO_NESTED_VECTOR_SAVE
 WC_LINUXKM_NO_USE_HEAP_WRAPPERS
+WC_LINUXKM_SVR_ASSERT_PINNED
+WC_LINUXKM_SVR_COUNT_NESTED
+WC_LINUXKM_SVR_SELFTEST_D16_ONLY_CONTROL
+WC_LINUXKM_SVR_SELFTEST_FPSIMD_ONLY_CONTROL
+WC_LINUXKM_SVR_SELFTEST_NEGATIVE_CONTROL
+WC_LINUXKM_SVR_SLOT_RECLAIM
 WC_MLDSA_NO_ASM
 WC_MLKEM_KERNEL_ASM
 WC_NO_ASYNC_SLEEP
 WC_NO_RNG_SIMPLE
 WC_NO_STATIC_ASSERT
 WC_NO_VERBOSE_RNG
 WC_PKCS11_FIND_WITH_ID_ONLY
-WC_PKCS12_PBKDF_USING_MP_API
 WC_PROTECT_ENCRYPTED_MEM
-WC_PUF_HELPER_COMPACT
 WC_PUF_SHA3
 WC_RNG_BANK_NO_DEFAULT_SUPPORT
 WC_RNG_BLOCKING
@@ -792,7 +796,8 @@ WC_RSA_NO_FERMAT_CHECK
 WC_RTL8735B_NO_DERIVE_CACHE
 WC_RWLOCK_OPS_INLINE
 WC_SHA2_SMALL_STACK
-WC_SHE_SW_DEFAULT
+WC_SHA3_NO_ARM_BASE_BLOCK
+WC_SHA3_NO_PPC64_BASE_BLOCK
 WC_SKIP_INCLUDED_C_FILES
 WC_SLHDSA_KERNEL_ASM
 WC_SLHDSA_NO_ASM
@@ -804,7 +809,6 @@ WC_STM32_RNG_DIAG
 WC_STM32_RNG_NO_NIST_INIT
 WC_STM32_SAES_DIAG
 WC_STRICT_SIG
-WC_USE_PIE_FENCEPOSTS_FOR_FIPS
 WC_WANT_FLAG_DONT_USE_VECTOR_OPS
 WIFIESPAT
 WIFI_101
@@ -834,10 +838,8 @@ WOLFSSL_ALLOW_TLS_SHA1
 WOLFSSL_ALTERNATIVE_DOWNGRADE
 WOLFSSL_ALT_NAMES_NO_REV
 WOLFSSL_ARM32_BUILD
-WOLFSSL_ARM32_PRIVILEGE_MODE
 WOLFSSL_ARMASM_NEON_NO_TABLE_LOOKUP
 WOLFSSL_ARM_ARCH_NEON_64BIT
-WOLFSSL_ASCON_UNROLL
 WOLFSSL_ASN_EXTRA
 WOLFSSL_ASN_TEMPLATE_TYPE_CHECK
 WOLFSSL_ATECC508
@@ -861,13 +863,10 @@ WOLFSSL_CAAM_NO_BLACK_KEY
 WOLFSSL_CALLBACKS
 WOLFSSL_CHACHA20_AVX512_ALWAYS
 WOLFSSL_CHACHA20_AVX512_NEVER
-WOLFSSL_CHACHA20_POLY1305_FUSED
 WOLFSSL_CHACHA20_POLY1305_FUSED_ALWAYS
-WOLFSSL_CHACHA20_POLY1305_FUSED_IFMA
 WOLFSSL_CHACHA20_POLY1305_FUSED_IFMA_ALWAYS
 WOLFSSL_CHACHA20_POLY1305_FUSED_IFMA_NEVER
 WOLFSSL_CHACHA20_POLY1305_FUSED_NEVER
-WOLFSSL_CHACHA20_POLY1305_SHORT
 WOLFSSL_CHECK_DESKEY
 WOLFSSL_CHIBIOS
 WOLFSSL_CLANG_TIDY
@@ -878,11 +877,7 @@ WOLFSSL_DEBUG_TRACE_ERROR_CODES_SUPPORT
 WOLFSSL_DILITHIUM_VERIFY_SMALLEST_MEM
 WOLFSSL_DISABLE_EARLY_SANITY_CHECKS
 WOLFSSL_DRBG_SHA256
-WOLFSSL_DTLS13_ECHO_LEGACY_SESSION_ID
-WOLFSSL_DTLS13_NO_HRR_ON_RESUME
 WOLFSSL_DTLS_DISALLOW_FUTURE
-WOLFSSL_DTLS_NO_HVR_ON_RESUME
-WOLFSSL_DTLS_RECORDS_CAN_SPAN_DATAGRAMS
 WOLFSSL_DTLS_RESEND_ONLY_TIMEOUT
 WOLFSSL_DUMP_MEMIO_STREAM
 WOLFSSL_DUP_CERTPOL
@@ -893,15 +888,13 @@ WOLFSSL_ECC_NO_SMALL_STACK
 WOLFSSL_ECC_SIGALG_PARAMS_NULL_ALLOWED
 WOLFSSL_ECDSA_MATCH_HASH
 WOLFSSL_ECDSA_SET_K_ONE_LOOP
-WOLFSSL_ECIES_STATIC_GCM_NONCE
 WOLFSSL_EC_POINT_CMP_JACOBIAN
 WOLFSSL_ED448_NO_LARGE_CODE
 WOLFSSL_EDDSA_CHECK_PRIV_ON_SIGN
 WOLFSSL_ESPWROOM32
 WOLFSSL_EVP_PRINT
 WOLFSSL_EXPORT_INT
 WOLFSSL_EXPORT_SPC_SZ
-WOLFSSL_EXTRA
 WOLFSSL_FALCON_NO_NTT_DSP
 WOLFSSL_FALCON_SIGN_STATS
 WOLFSSL_FORCE_OCSP_NONCE_CHECK
@@ -930,7 +923,6 @@ WOLFSSL_IMX6_CAAM_RNG
 WOLFSSL_IMXRT_DCP
 WOLFSSL_ISOTP
 WOLFSSL_KEEP_HOST_HEADER_PROBES
-WOLFSSL_KEIL
 WOLFSSL_KEIL_NET
 WOLFSSL_KYBER_NO_DECAPSULATE
 WOLFSSL_KYBER_NO_ENCAPSULATE
@@ -954,14 +946,12 @@ WOLFSSL_MLKEM_ASM_TEST
 WOLFSSL_MLKEM_INVNTT_UNROLL
 WOLFSSL_MLKEM_NO_MALLOC
 WOLFSSL_MLKEM_NTT_UNROLL
-WOLFSSL_ML_KEM_USE_OLD_IDS
 WOLFSSL_MONT_RED_CT
 WOLFSSL_MP_COND_COPY
 WOLFSSL_MP_INVMOD_CONSTANT_TIME
 WOLFSSL_MULTICIRCULATE_ALTNAMELIST
 WOLFSSL_NETX_DUO
 WOLFSSL_NEW_PRIME_CHECK
-WOLFSSL_NONBLOCK_OCSP
 WOLFSSL_NOSHA3_384
 WOLFSSL_NOT_WINDOWS_API
 WOLFSSL_NO_AES_KEY_SET_CHECK
@@ -971,7 +961,6 @@ WOLFSSL_NO_CHACHA20_POLY1305_FUSED_IFMA
 WOLFSSL_NO_CHACHA20_POLY1305_SHORT
 WOLFSSL_NO_CHACHA20_POLY1305_SMALL_ASM
 WOLFSSL_NO_CLIENT_CERT_ERROR
-WOLFSSL_NO_COPY_CERT
 WOLFSSL_NO_COPY_KEY
 WOLFSSL_NO_CRL_DATE_CHECK
 WOLFSSL_NO_CRL_NEXT_DATE
@@ -983,7 +972,6 @@ WOLFSSL_NO_DER_TO_PEM
 WOLFSSL_NO_DH186
 WOLFSSL_NO_DILITHIUM_LEGACY_GATES
 WOLFSSL_NO_DILITHIUM_LEGACY_NAMES
-WOLFSSL_NO_DTLS_SIZE_CHECK
 WOLFSSL_NO_ECDHX_SHARED_ZERO_CHECK
 WOLFSSL_NO_ETM_ALERT
 WOLFSSL_NO_FENCE
@@ -1013,7 +1001,6 @@ WOLFSSL_NRF51_AES
 WOLFSSL_NXP_CASPER_ECC_MUL2ADD
 WOLFSSL_NXP_CASPER_ECC_MULMOD
 WOLFSSL_NXP_LPC55S6X
-WOLFSSL_OCSP_SCREEN_RESPONDER
 WOLFSSL_OLDTLS_AEAD_CIPHERSUITES
 WOLFSSL_OLD_SET_CURVES_LIST
 WOLFSSL_OLD_TIMINGPADVERIFY
@@ -1024,7 +1011,6 @@ WOLFSSL_PASSTHRU_ERR
 WOLFSSL_PB
 WOLFSSL_PEER_ADDRESS_CHANGES
 WOLFSSL_PKCS11_RW_TOKENS
-WOLFSSL_POLY1305_AVX512
 WOLFSSL_POLY1305_AVX512_ALWAYS
 WOLFSSL_POLY1305_AVX512_NEVER
 WOLFSSL_POLY1305_IFMA_ALWAYS
@@ -1050,7 +1036,6 @@ WOLFSSL_RENESAS_RZN2L
 WOLFSSL_RENESAS_TLS
 WOLFSSL_RENESAS_TSIP_IAREWRX
 WOLFSSL_REQUIRE_TCA
-WOLFSSL_RISCV_ASM_INLINE
 WOLFSSL_RISCV_ASM_NO_UNALIGNED
 WOLFSSL_RNG_USE_FULL_SEED
 WOLFSSL_RSA_CHECK_D_ON_DECRYPT
@@ -1081,7 +1066,6 @@ WOLFSSL_SILABS_TRNG
 WOLFSSL_SLHDSA_FULL_HASH
 WOLFSSL_SLHDSA_NO_VERIFY_ONLY
 WOLFSSL_SNIFFER_NO_RECOVERY
-WOLFSSL_SP_ARM32_UDIV
 WOLFSSL_SP_FAST_NCT_EXPTMOD
 WOLFSSL_SP_INT_SQR_VOLATILE
 WOLFSSL_SSLKEYLOGFILE_USE_ENV
@@ -1109,7 +1093,6 @@ WOLFSSL_TINY_TLS13_NO_DEFAULT_CURVE
 WOLFSSL_TI_CURRTIME
 WOLFSSL_TLS13_DRAFT
 WOLFSSL_TLS13_IGNORE_AEAD_LIMITS
-WOLFSSL_TLS13_IGNORE_PT_ALERT_ON_ENC
 WOLFSSL_TLS13_SHA512
 WOLFSSL_TLS13_TICKET_BEFORE_FINISHED
 WOLFSSL_TLSX_PQC_MLKEM_STORE_PRIV_KEY
@@ -1143,11 +1126,6 @@ WOLFSSL_X509_KEY_GEN
 WOLFSSL_X509_PEM
 WOLFSSL_X509_STORE_ALLOW_NON_CA_INTERMEDIATE
 WOLFSSL_X509_STORE_CERTS
-WOLFSSL_X509_TINY
-WOLFSSL_X509_TINY_AKI
-WOLFSSL_X509_TINY_NAME_CONSTRAINTS
-WOLFSSL_X509_TINY_POLICIES
-WOLFSSL_X509_TINY_SKI
 WOLFSSL_X509_TRUSTED_CERTIFICATE_CALLBACK
 WOLFSSL_X509_VERIFY_ONLY
 WOLFSSL_XFREE_NO_NULLNESS_CHECK
@@ -1156,11 +1134,9 @@ WOLFSSL_XILINX_PATCH
 WOLFSSL_XIL_MSG_NO_SLEEP
 WOLFSSL_ZEPHYR
 WOLF_ALLOW_BUILTIN
-WOLF_CRYPTO_CB_ASYNC_POLL
 WOLF_CRYPTO_CB_CMD
 WOLF_CRYPTO_CB_ONLY_FALCON
 WOLF_CRYPTO_DEV
-WOLF_CRYPT_FIPS_H
 WOLF_NO_TRAILING_ENUM_COMMAS
 WindowsCE
 XASU_DISABLE_CACHE

configure.ac

@@ -8195,7 +8195,20 @@ AS_CASE([$ENABLED_SELFTEST],
     ],
     ["no"],[SELFTEST_VERSION="none"],
     [
-        # selftest v1 (wolfCrypt 3.14.2)
+        # selftest v1 (wolfCrypt 3.14.2).  A BARE --enable-selftest LANDS HERE
+        # AND MUST KEEP LANDING HERE.  The flavor that passes the bare flag is
+        # netbsd-selftest (FIPS_OPTION=cavp-selftest), and its WOLFCRYPT_FILES
+        # overlays the v3.14.2 headers -- hmac.h, rsa.h, ecc.h and friends --
+        # over the current tree.  Those headers ARE the v1 API: v3.14.2
+        # hmac.h:89 declares WC_SHA3_224_BLOCK_SIZE as an enum constant and
+        # derives WC_HMAC_BLOCK_SIZE from it, v3.14.2 rsa.h:186 declares the
+        # six-argument wc_RsaPSS_CheckPadding_ex, and v3.14.2 ecc.h has no
+        # wc_ecc_set_rng at all.  Selecting v2 for the bare flag makes sha3.h
+        # define WC_SHA3_*_BLOCK_SIZE as macros, which collide with that enum,
+        # and makes test.c take its seven-argument and wc_ecc_set_rng arms
+        # against headers that offer neither -- measured: bare flag with the
+        # overlay fails to build, --enable-selftest=v1 with the same overlay
+        # builds clean.  --enable-selftest=v2 still selects v2 explicitly.
         ENABLED_SELFTEST="yes"
         SELFTEST_VERSION="v1"
     ])

linuxkm/linuxkm_wc_port.h

@@ -846,7 +846,8 @@
      * BLK_STS_IOERR; -EBUSY is retryable.  Defined outside the vector-register
      * block below: the LKCAPI glue calls it whether or not SVR is compiled, and
      * inside that block a no-armasm build fails with an implicit declaration. */
-    #define wc_lkm_errno(e) (((e) == WC_ACCEL_INHIBIT_E) ? -EBUSY : -EINVAL)
+    #define wc_lkm_errno(e) \
+        (((e) == WC_NO_ERR_TRACE(WC_ACCEL_INHIBIT_E)) ? -EBUSY : -EINVAL)
 
     /* x86 and ARM/ARM64 share the arch-neutral tracker in
      * x86_vector_register_glue.c, which keeps wc_*_x86 names on all arches. */

linuxkm/lkcapi_sha_glue.c

@@ -1926,7 +1926,7 @@ WC_MAYBE_UNUSED static int km_hmac_init(struct shash_desc *desc) {
         /* A transient vector-register refusal is retryable and must NOT latch
          * the desc failed -- drop the tstate so a retry re-allocates, and
          * report -EBUSY.  Any other error is a real failure and still latches. */
-        if (ret != WC_ACCEL_INHIBIT_E)
+        if (ret != WC_NO_ERR_TRACE(WC_ACCEL_INHIBIT_E))
             s_ctx->failed = 1;
         km_hmac_free_tstate(desc);
         return wc_lkm_errno(ret);

src/include.am

@@ -1421,6 +1421,14 @@ src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/fips.c \
 # fips last file
 src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/wolfcrypt_last.c
 
+# OUTSIDE the FIPS module boundary, on purpose: listed after wolfcrypt_last.c so
+# its .text falls beyond wolfCrypt_FIPS_last() and the in-core integrity hash
+# does not cover it.  Lets a new platform's counter read be added without
+# changing a byte inside the boundary.  See wolfcrypt/src/oe_timers.c.
+if BUILD_MEMUSE
+src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/oe_timers.c
+endif
+
 endif !BUILD_FIPS_NO_POST
 
 endif BUILD_FIPS_V7_PLUS

src/internal.c

@@ -6385,9 +6385,15 @@ int EccSharedSecret(WOLFSSL* ssl, ecc_key* priv_key, ecc_key* pub_key,
     else
 #endif
     {
+/* Skipped for FIPS v2 and for selftest v1, whose APIs lack wc_ecc_set_rng().
+ * It must NOT be skipped for selftest v2, which exports it: under
+ * ECC_TIMING_RESISTANT wc_ecc_shared_secret() requires a blinding RNG
+ * (ecc.c: "if (private_key->rng == NULL) err = MISSING_RNG_E"), so skipping
+ * the setter fails every ECDHE handshake with -236 instead of degrading. */
 #if defined(ECC_TIMING_RESISTANT) && (!defined(HAVE_FIPS) || \
     !defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION != 2)) && \
-    !defined(HAVE_SELFTEST)
+    (!defined(HAVE_SELFTEST) || (defined(HAVE_SELFTEST_VERSION) && \
+                                 (HAVE_SELFTEST_VERSION >= 2)))
         ret = wc_ecc_set_rng(priv_key, ssl->rng);
         if (ret == 0)
 #endif

src/sniffer.c

@@ -2830,7 +2830,8 @@ static int SetupKeys(const byte* input, int* sslBytes, SnifferSession* session,
         }
         #if defined(ECC_TIMING_RESISTANT) && (!defined(HAVE_FIPS) || \
             (!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION != 2))) && \
-            !defined(HAVE_SELFTEST)
+    (!defined(HAVE_SELFTEST) || (defined(HAVE_SELFTEST_VERSION) && \
+                                 (HAVE_SELFTEST_VERSION >= 2)))
             if (ret == 0) {
                 ret = wc_ecc_set_rng(&args->key->priv.ecc,
                     session->sslServer->rng);

tests/api/test_aes.c

@@ -4295,7 +4295,11 @@ int test_wc_AesGcmNonStdNonce(void)
         XMEMSET(&enc, 0, sizeof(enc));
         ExpectIntEQ(wc_AesInit(&enc, NULL, INVALID_DEVID), 0);
         ExpectIntEQ(wc_AesGcmSetKey(&enc, key_z, sizeof(key_z)), 0);
-#ifdef HAVE_SELFTEST
+    /* selftest v1 accepted a zero-length IV; v2 uses the wolfCrypt AES-GCM
+     * implementation, which rejects it with BAD_FUNC_ARG like every other
+     * build, so only v1 takes the accept arm. */
+#if defined(HAVE_SELFTEST) && (!defined(HAVE_SELFTEST_VERSION) || \
+                               (HAVE_SELFTEST_VERSION < 2))
         ExpectIntEQ(wc_AesGcmEncrypt(&enc, ct, pt_z, sizeof(pt_z),
             NULL, 0, tag, sizeof(tag), NULL, 0), 0);
 #else