From 8e220d19590291b877dadf348920336a9602bf8f Mon Sep 17 00:00:00 2001 From: kaleb-himes Date: Wed, 2 Sep 2026 16:41:33 -0600 Subject: [PATCH] linuxkm: add PQ in-core sanity markers to the PIE redirect table --- linuxkm/linuxkm_wc_port.h | 42 +++++++++++++++++++++++++++++++++++++++ linuxkm/module_hooks.c | 31 +++++++++++++++++++++++++++++ 2 files changed, 73 insertions(+) diff --git a/linuxkm/linuxkm_wc_port.h b/linuxkm/linuxkm_wc_port.h index 051c37ed012..a65553b4b8e 100644 --- a/linuxkm/linuxkm_wc_port.h +++ b/linuxkm/linuxkm_wc_port.h @@ -1107,6 +1107,27 @@ extern int wolfCrypt_FIPS_SHA3_sanity(void); extern const unsigned int wolfCrypt_FIPS_sha3_ro_sanity[2]; #endif +/* PQ boundary members added in v7.0.0; see fips_test.c DoInCoreCheck. */ +#if defined(WOLFSSL_HAVE_MLKEM) && FIPS_VERSION3_GE(7,0,0) + extern int wolfCrypt_FIPS_MLKEM_sanity(void); + extern const unsigned int wolfCrypt_FIPS_mlkem_ro_sanity[2]; +#endif +#if defined(WOLFSSL_HAVE_MLDSA) && FIPS_VERSION3_GE(7,0,0) + extern int wolfCrypt_FIPS_MLDSA_sanity(void); + extern const unsigned int wolfCrypt_FIPS_mldsa_ro_sanity[2]; +#endif +#if defined(WOLFSSL_HAVE_SLHDSA) && FIPS_VERSION3_GE(7,0,0) + extern int wolfCrypt_FIPS_SLHDSA_sanity(void); + extern const unsigned int wolfCrypt_FIPS_slhdsa_ro_sanity[2]; +#endif +#if defined(WOLFSSL_HAVE_LMS) && FIPS_VERSION3_GE(7,0,0) + extern int wolfCrypt_FIPS_LMS_sanity(void); + extern const unsigned int wolfCrypt_FIPS_lms_ro_sanity[2]; +#endif +#if defined(WOLFSSL_HAVE_XMSS) && FIPS_VERSION3_GE(7,0,0) + extern int wolfCrypt_FIPS_XMSS_sanity(void); + extern const unsigned int wolfCrypt_FIPS_xmss_ro_sanity[2]; +#endif #ifndef WOLFSSL_FIPS_DEV_NO_POST extern int wolfCrypt_FIPS_FT_sanity(void); extern const unsigned int wolfCrypt_FIPS_ft_ro_sanity[2]; @@ -1445,6 +1466,27 @@ typeof(wolfCrypt_FIPS_SHA3_sanity) *wolfCrypt_FIPS_SHA3_sanity; typeof(wolfCrypt_FIPS_sha3_ro_sanity) *wolfCrypt_FIPS_sha3_ro_sanity; #endif +/* PQ boundary members added in v7.0.0; see fips_test.c DoInCoreCheck. */ +#if defined(WOLFSSL_HAVE_MLKEM) && FIPS_VERSION3_GE(7,0,0) + typeof(wolfCrypt_FIPS_MLKEM_sanity) *wolfCrypt_FIPS_MLKEM_sanity; + typeof(wolfCrypt_FIPS_mlkem_ro_sanity) *wolfCrypt_FIPS_mlkem_ro_sanity; +#endif +#if defined(WOLFSSL_HAVE_MLDSA) && FIPS_VERSION3_GE(7,0,0) + typeof(wolfCrypt_FIPS_MLDSA_sanity) *wolfCrypt_FIPS_MLDSA_sanity; + typeof(wolfCrypt_FIPS_mldsa_ro_sanity) *wolfCrypt_FIPS_mldsa_ro_sanity; +#endif +#if defined(WOLFSSL_HAVE_SLHDSA) && FIPS_VERSION3_GE(7,0,0) + typeof(wolfCrypt_FIPS_SLHDSA_sanity) *wolfCrypt_FIPS_SLHDSA_sanity; + typeof(wolfCrypt_FIPS_slhdsa_ro_sanity) *wolfCrypt_FIPS_slhdsa_ro_sanity; +#endif +#if defined(WOLFSSL_HAVE_LMS) && FIPS_VERSION3_GE(7,0,0) + typeof(wolfCrypt_FIPS_LMS_sanity) *wolfCrypt_FIPS_LMS_sanity; + typeof(wolfCrypt_FIPS_lms_ro_sanity) *wolfCrypt_FIPS_lms_ro_sanity; +#endif +#if defined(WOLFSSL_HAVE_XMSS) && FIPS_VERSION3_GE(7,0,0) + typeof(wolfCrypt_FIPS_XMSS_sanity) *wolfCrypt_FIPS_XMSS_sanity; + typeof(wolfCrypt_FIPS_xmss_ro_sanity) *wolfCrypt_FIPS_xmss_ro_sanity; +#endif #ifndef WOLFSSL_FIPS_DEV_NO_POST typeof(wolfCrypt_FIPS_FT_sanity) *wolfCrypt_FIPS_FT_sanity; typeof(wolfCrypt_FIPS_ft_ro_sanity) *wolfCrypt_FIPS_ft_ro_sanity; diff --git a/linuxkm/module_hooks.c b/linuxkm/module_hooks.c index ae44c2ef9c1..4d112311d89 100644 --- a/linuxkm/module_hooks.c +++ b/linuxkm/module_hooks.c @@ -1981,6 +1981,37 @@ static int set_up_wolfssl_linuxkm_pie_redirect_table(void) { wolfssl_linuxkm_pie_redirect_table.wolfCrypt_FIPS_sha3_ro_sanity = &wolfCrypt_FIPS_sha3_ro_sanity; #endif +/* PQ boundary members added in v7.0.0; see fips_test.c DoInCoreCheck. */ +#if defined(WOLFSSL_HAVE_MLKEM) && FIPS_VERSION3_GE(7,0,0) + wolfssl_linuxkm_pie_redirect_table.wolfCrypt_FIPS_MLKEM_sanity = + wolfCrypt_FIPS_MLKEM_sanity; + wolfssl_linuxkm_pie_redirect_table.wolfCrypt_FIPS_mlkem_ro_sanity = + &wolfCrypt_FIPS_mlkem_ro_sanity; +#endif +#if defined(WOLFSSL_HAVE_MLDSA) && FIPS_VERSION3_GE(7,0,0) + wolfssl_linuxkm_pie_redirect_table.wolfCrypt_FIPS_MLDSA_sanity = + wolfCrypt_FIPS_MLDSA_sanity; + wolfssl_linuxkm_pie_redirect_table.wolfCrypt_FIPS_mldsa_ro_sanity = + &wolfCrypt_FIPS_mldsa_ro_sanity; +#endif +#if defined(WOLFSSL_HAVE_SLHDSA) && FIPS_VERSION3_GE(7,0,0) + wolfssl_linuxkm_pie_redirect_table.wolfCrypt_FIPS_SLHDSA_sanity = + wolfCrypt_FIPS_SLHDSA_sanity; + wolfssl_linuxkm_pie_redirect_table.wolfCrypt_FIPS_slhdsa_ro_sanity = + &wolfCrypt_FIPS_slhdsa_ro_sanity; +#endif +#if defined(WOLFSSL_HAVE_LMS) && FIPS_VERSION3_GE(7,0,0) + wolfssl_linuxkm_pie_redirect_table.wolfCrypt_FIPS_LMS_sanity = + wolfCrypt_FIPS_LMS_sanity; + wolfssl_linuxkm_pie_redirect_table.wolfCrypt_FIPS_lms_ro_sanity = + &wolfCrypt_FIPS_lms_ro_sanity; +#endif +#if defined(WOLFSSL_HAVE_XMSS) && FIPS_VERSION3_GE(7,0,0) + wolfssl_linuxkm_pie_redirect_table.wolfCrypt_FIPS_XMSS_sanity = + wolfCrypt_FIPS_XMSS_sanity; + wolfssl_linuxkm_pie_redirect_table.wolfCrypt_FIPS_xmss_ro_sanity = + &wolfCrypt_FIPS_xmss_ro_sanity; +#endif #ifndef WOLFSSL_FIPS_DEV_NO_POST wolfssl_linuxkm_pie_redirect_table.wolfCrypt_FIPS_FT_sanity =