Skip to content

Commit 01986e9

Browse files
lealem47lealem47
committed
New wolfentropy.ko files
1 parent 5579609 commit 01986e9

3 files changed

Lines changed: 289 additions & 0 deletions

File tree

‎linuxkm/Kbuild.entropy‎

Lines changed: 129 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,129 @@
1+
# Linux kernel-native Makefile ("Kbuild") for wolfentropy.ko
2+
#
3+
# Builds the minimal wolfEntropy SP 800-90B entropy source kernel module.
4+
# Exports only wc_Entropy_Get(), wc_Entropy_GetRawEntropy(), and
5+
# wc_Entropy_OnDemandTest() -- no other wolfSSL symbols -- so it can be
6+
# loaded as an ESV-validated entropy source alongside a separately-built
7+
# FIPS libwolfssl.ko.
8+
#
9+
# Build flow:
10+
# ./configure --enable-linuxkm --enable-wolfentropy [KERNEL_ROOT=...]
11+
# make wolfentropy # produces wolfentropy.ko
12+
#
13+
# Usage at runtime:
14+
# modprobe wolfentropy # must load before libwolfssl.ko
15+
# modprobe libwolfssl
16+
#
17+
# When libwolfssl.ko is built with WC_LINUXKM_WOLFENTROPY_IN_GLUE_LAYER
18+
# (auto-set by linuxkm_wc_port.h when HAVE_FIPS + HAVE_ENTROPY_MEMUSE are
19+
# both present, or manually via KERNEL_EXTRA_CFLAGS), its module_init
20+
# registers wc_linuxkm_GenerateSeed_wolfEntropy as the DRBG seed callback.
21+
# That function calls wc_Entropy_Get(), exported from this module.
22+
# The kernel's module dependency resolution enforces load order automatically
23+
# because libwolfssl.ko has an unresolved reference to wc_Entropy_Get.
24+
#
25+
# Note for ARM platforms: if sha3_asm.S acceleration is enabled
26+
# (WOLFSSL_ARMASM / WOLFSSL_SP_ARM64_ASM), add
27+
# wolfcrypt/src/sha3_asm.o to WOLFENTROPY_OBJ_FILES.
28+
#
29+
# Copyright (C) 2006-2026 wolfSSL Inc.
30+
#
31+
# This file is part of wolfSSL.
32+
#
33+
# wolfSSL is free software; you can redistribute it and/or modify
34+
# it under the terms of the GNU General Public License as published by
35+
# the Free Software Foundation; either version 3 of the License, or
36+
# (at your option) any later version.
37+
#
38+
# wolfSSL is distributed in the hope that it will be useful,
39+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
40+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
41+
# GNU General Public License for more details.
42+
#
43+
# You should have received a copy of the GNU General Public License
44+
# along with this program; if not, write to the Free Software
45+
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
46+
47+
.ONESHELL:
48+
SHELL=bash
49+
50+
ifeq "$(KERNEL_ARCH)" "x86"
51+
KERNEL_ARCH_X86 := yes
52+
else ifeq "$(KERNEL_ARCH)" "x86_64"
53+
KERNEL_ARCH_X86 := yes
54+
else
55+
KERNEL_ARCH_X86 := no
56+
endif
57+
58+
ifeq "$(WOLFENTROPY_OBJ_FILES)" ""
59+
$(error $$WOLFENTROPY_OBJ_FILES is unset.)
60+
endif
61+
62+
ifeq "$(WOLFENTROPY_CFLAGS)" ""
63+
$(error $$WOLFENTROPY_CFLAGS is unset.)
64+
endif
65+
66+
override WOLFENTROPY_CFLAGS += -ffreestanding -Wframe-larger-than=$(MAX_STACK_FRAME_SIZE) \
67+
-isystem $(shell $(CC) -print-file-name=include)
68+
69+
AARCH64_NO_OUTLINE_ATOMICS := $(shell { echo -e 'int f(void) {\n return 0;\n}\n' | \
70+
$(CC) -mno-outline-atomics -x c -c - -o /dev/null 2>/dev/null; } && \
71+
echo -mno-outline-atomics)
72+
73+
ifeq "$(KERNEL_ARCH)" "aarch64"
74+
override WOLFENTROPY_CFLAGS += $(AARCH64_NO_OUTLINE_ATOMICS)
75+
else ifeq "$(KERNEL_ARCH)" "arm64"
76+
override WOLFENTROPY_CFLAGS += $(AARCH64_NO_OUTLINE_ATOMICS)
77+
else ifeq "$(KERNEL_ARCH)" "arm"
78+
override WOLFENTROPY_CFLAGS += -fno-optimize-sibling-calls -Os
79+
endif
80+
81+
obj-m := wolfentropy.o
82+
83+
WOLFENTROPY_OBJ_TARGETS := $(patsubst %, $(obj)/%, $(WOLFENTROPY_OBJ_FILES))
84+
85+
# Stack-size detection: use the same host program as the main module build.
86+
ifndef KERNEL_THREAD_STACK_SIZE
87+
hostprogs := linuxkm/get_thread_size
88+
always-y := $(hostprogs)
89+
endif
90+
91+
HOST_EXTRACFLAGS += $(NOSTDINC_FLAGS) $(LINUXINCLUDE) $(KBUILD_CFLAGS) -static \
92+
-fno-omit-frame-pointer
93+
94+
ifeq "$(KERNEL_ARCH_X86)" "yes"
95+
HOST_EXTRACFLAGS += -mindirect-branch=keep -mfunction-return=keep
96+
endif
97+
98+
$(obj)/linuxkm/get_thread_size: $(src)/linuxkm/get_thread_size.c
99+
100+
ifndef KERNEL_THREAD_STACK_SIZE
101+
$(WOLFENTROPY_OBJ_TARGETS): | $(obj)/linuxkm/get_thread_size
102+
KERNEL_THREAD_STACK_SIZE=$(shell \
103+
test -x $(obj)/linuxkm/get_thread_size && \
104+
$(obj)/linuxkm/get_thread_size || echo 16384)
105+
endif
106+
MAX_STACK_FRAME_SIZE=$(shell echo $$(( $(KERNEL_THREAD_STACK_SIZE) / 4)))
107+
108+
wolfentropy-y := $(WOLFENTROPY_OBJ_FILES) \
109+
linuxkm/module_hooks_entropy.o \
110+
linuxkm/module_exports_entropy.o
111+
112+
# module_exports_entropy.c is a static file (not auto-generated from
113+
# readelf output). It exports only the three public wc_Entropy_* symbols.
114+
# All other symbols compiled into wolfentropy.ko remain unexported and
115+
# therefore private to this module, avoiding collisions with libwolfssl.ko.
116+
117+
ccflags-y = $(WOLFENTROPY_CFLAGS)
118+
asflags-y := $(WOLFSSL_ASFLAGS) $(ASFLAGS_FPUSIMD_DISABLE)
119+
120+
# Compile SHA3 without SIMD to keep the entropy conditioning path
121+
# free of vector-register save/restore overhead in the seed callback.
122+
$(obj)/wolfcrypt/src/sha3.o: ccflags-y := \
123+
$(WOLFENTROPY_CFLAGS) $(CFLAGS_SIMD_DISABLE) $(CFLAGS_FPU_DISABLE)
124+
125+
ifdef KERNEL_EXTRA_CFLAGS_REMOVE
126+
ccflags-remove-y += $(KERNEL_EXTRA_CFLAGS_REMOVE)
127+
endif
128+
129+
clean-files := linuxkm wolfcrypt

‎linuxkm/module_exports_entropy.c‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
/* module_exports_entropy.c -- exported symbol list for wolfentropy.ko
2+
*
3+
* Exports ONLY the three public wolfEntropy API functions into the WOLFSSL
4+
* symbol namespace. Every other symbol compiled into wolfentropy.ko
5+
* (wolfCrypt_Init, wc_Sha3_*, wc_InitMutex, etc.) is deliberately NOT
6+
* exported, so loading wolfentropy.ko alongside libwolfssl.ko causes no
7+
* symbol collisions.
8+
*
9+
* Copyright (C) 2006-2026 wolfSSL Inc.
10+
*
11+
* This file is part of wolfSSL.
12+
*
13+
* wolfSSL is free software; you can redistribute it and/or modify
14+
* it under the terms of the GNU General Public License as published by
15+
* the Free Software Foundation; either version 3 of the License, or
16+
* (at your option) any later version.
17+
*
18+
* wolfSSL is distributed in the hope that it will be useful,
19+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
20+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
21+
* GNU General Public License for more details.
22+
*
23+
* You should have received a copy of the GNU General Public License
24+
* along with this program; if not, write to the Free Software
25+
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
26+
*/
27+
28+
#include <wolfssl/wolfcrypt/libwolfssl_sources.h>
29+
#include <wolfssl/wolfcrypt/wolfentropy.h>
30+
31+
#include <linux/version.h>
32+
33+
/* Compatibility shim: kernels before ~4.15 lack EXPORT_SYMBOL_NS_GPL. */
34+
#ifndef EXPORT_SYMBOL_NS
35+
#define EXPORT_SYMBOL_NS(sym, ns) EXPORT_SYMBOL(sym)
36+
#endif
37+
#ifndef EXPORT_SYMBOL_NS_GPL
38+
#define EXPORT_SYMBOL_NS_GPL(sym, ns) EXPORT_SYMBOL_GPL(sym)
39+
#endif
40+
41+
/* In Linux >= 6.13 the namespace argument to EXPORT_SYMBOL_NS_GPL must be a
42+
* quoted string; earlier kernels take a bare token. Handle both here so this
43+
* static file does not need a kernel-version-aware Kbuild recipe. */
44+
#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 13, 0)
45+
# define WOLFSSL_EXPORT_ENTROPY(sym) EXPORT_SYMBOL_NS_GPL(sym, "WOLFSSL")
46+
#else
47+
# define WOLFSSL_EXPORT_ENTROPY(sym) EXPORT_SYMBOL_NS_GPL(sym, WOLFSSL)
48+
#endif
49+
50+
#ifdef HAVE_ENTROPY_MEMUSE
51+
52+
/* Primary entropy output: called by wc_linuxkm_GenerateSeed_wolfEntropy()
53+
* in the FIPS module's glue layer (linuxkm/module_hooks.c). */
54+
WOLFSSL_EXPORT_ENTROPY(wc_Entropy_Get);
55+
56+
/* Raw entropy output for SP 800-90B assessment tooling. */
57+
WOLFSSL_EXPORT_ENTROPY(wc_Entropy_GetRawEntropy);
58+
59+
/* On-demand continuous health test (e.g. for POST). */
60+
WOLFSSL_EXPORT_ENTROPY(wc_Entropy_OnDemandTest);
61+
62+
#endif /* HAVE_ENTROPY_MEMUSE */

‎linuxkm/module_hooks_entropy.c‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
/* module_hooks_entropy.c -- Linux kernel module init/exit for wolfentropy.ko
2+
*
3+
* This module provides the wolfEntropy SP 800-90B entropy source for use by
4+
* a separately-installed wolfSSL FIPS kernel module (libwolfssl.ko).
5+
*
6+
* It initialises the wolfEntropy jitter-based entropy collector at load time
7+
* and tears it down at unload time. It exports wc_Entropy_Get(),
8+
* wc_Entropy_GetRawEntropy(), and wc_Entropy_OnDemandTest() so that a FIPS
9+
* libwolfssl.ko can call wc_Entropy_Get() through the seed callback
10+
* registered via wc_SetSeed_Cb().
11+
*
12+
* Load order: wolfentropy.ko must be loaded BEFORE libwolfssl.ko. The
13+
* kernel's module dependency resolution enforces this automatically when
14+
* libwolfssl.ko carries an unresolved reference to wc_Entropy_Get.
15+
*
16+
* On the FIPS module side (libwolfssl.ko built from a FIPS source tree):
17+
* linuxkm_wc_port.h defines WC_LINUXKM_WOLFENTROPY_IN_GLUE_LAYER when
18+
* HAVE_FIPS + HAVE_ENTROPY_MEMUSE are both set. Alternatively, pass
19+
* KERNEL_EXTRA_CFLAGS="-DWC_LINUXKM_WOLFENTROPY_IN_GLUE_LAYER" when
20+
* building the FIPS module without HAVE_ENTROPY_MEMUSE, and add
21+
* MODULE_IMPORT_NS(WOLFSSL) to its module_hooks.c so the kernel accepts
22+
* the wc_Entropy_Get symbol import.
23+
*
24+
* Copyright (C) 2006-2026 wolfSSL Inc.
25+
*
26+
* This file is part of wolfSSL.
27+
*
28+
* wolfSSL is free software; you can redistribute it and/or modify
29+
* it under the terms of the GNU General Public License as published by
30+
* the Free Software Foundation; either version 3 of the License, or
31+
* (at your option) any later version.
32+
*
33+
* wolfSSL is distributed in the hope that it will be useful,
34+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
35+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
36+
* GNU General Public License for more details.
37+
*
38+
* You should have received a copy of the GNU General Public License
39+
* along with this program; if not, write to the Free Software
40+
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
41+
*/
42+
43+
#include <wolfssl/wolfcrypt/libwolfssl_sources.h>
44+
#include <wolfssl/wolfcrypt/wolfentropy.h>
45+
#include <wolfssl/version.h>
46+
47+
#include <linux/module.h>
48+
#include <linux/init.h>
49+
#include <linux/kernel.h>
50+
51+
#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 0, 0)
52+
static int __init wolfentropy_init(void)
53+
#else
54+
static int wolfentropy_init(void)
55+
#endif
56+
{
57+
int ret;
58+
59+
ret = Entropy_Init();
60+
if (ret != 0) {
61+
pr_err("wolfentropy: Entropy_Init() failed with return code %d.\n",
62+
ret);
63+
return -ECANCELED;
64+
}
65+
66+
pr_info("wolfentropy: wolfEntropy SP 800-90B entropy source loaded "
67+
"(wolfSSL " LIBWOLFSSL_VERSION_STRING ").\n");
68+
return 0;
69+
}
70+
71+
#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 0, 0)
72+
static void __exit wolfentropy_exit(void)
73+
#else
74+
static void wolfentropy_exit(void)
75+
#endif
76+
{
77+
Entropy_Final();
78+
pr_info("wolfentropy: wolfEntropy entropy source unloaded.\n");
79+
}
80+
81+
module_init(wolfentropy_init);
82+
module_exit(wolfentropy_exit);
83+
84+
/* wc_port.c calls wc_ecc_fp_init() / wc_ecc_fp_free() from wolfCrypt_Init()
85+
* and wolfCrypt_Cleanup(). wolfentropy.ko never calls either of those, so
86+
* these references are dead code, but modpost still requires the symbols to
87+
* be resolvable within the module. Provide minimal no-op stubs here.
88+
*/
89+
#if defined(HAVE_ECC) && defined(FP_ECC)
90+
#include <wolfssl/wolfcrypt/ecc.h>
91+
void wc_ecc_fp_init(void) {}
92+
void wc_ecc_fp_free(void) {}
93+
#endif
94+
95+
MODULE_LICENSE("GPL");
96+
MODULE_AUTHOR("https://www.wolfssl.com/");
97+
MODULE_DESCRIPTION("wolfEntropy SP 800-90B jitter entropy source for wolfSSL FIPS DRBG");
98+
MODULE_VERSION(LIBWOLFSSL_VERSION_STRING);

0 commit comments

Comments
 (0)