linuxkm: make external wolfentropy.ko opt-in; add arm32 Entropy_TimeHiRes shim

jackctj117 · jackctj117 · commit c5a61b88e628 · 2026-04-22T12:00:36.000-06:00
diff --git a/configure.ac b/configure.ac
@@ -6048,10 +6048,20 @@ AC_ARG_ENABLE([pwdbased],
 # MemUse Entropy
 # wolfEntropy Software Jitter SP800-90B certifiable entropy source
 
+if test "$KERNEL_MODE_DEFAULTS" = "yes" && \
+   test "$ENABLED_AMDRDSEED" != "yes" && \
+   test "$ENABLED_INTELRDRAND" != "yes" && \
+   test "$ENABLED_INTELRDSEED" != "yes"
+then
+    ENABLED_ENTROPY_MEMUSE_DEFAULT=yes
+else
+    ENABLED_ENTROPY_MEMUSE_DEFAULT=no
+fi
+
 AC_ARG_ENABLE([wolfEntropy],
     [AS_HELP_STRING([--enable-wolfEntropy],[Enable memuse entropy support (default: disabled)])],
     [ ENABLED_ENTROPY_MEMUSE=$enableval ],
-    [ ENABLED_ENTROPY_MEMUSE=no ]
+    [ ENABLED_ENTROPY_MEMUSE=$ENABLED_ENTROPY_MEMUSE_DEFAULT ]
     )
 AC_ARG_ENABLE([wolfentropy],
     [AS_HELP_STRING([--enable-wolfentropy],[Alias for --enable-wolfEntropy])],
@@ -6062,17 +6072,30 @@ AC_ARG_ENABLE([entropy-memuse],
     [ ENABLED_ENTROPY_MEMUSE=$enableval ]
     )
 
-# Default --enable-linuxkm to seed its FIPS DRBG from a separately-built
-# wolfentropy.ko module via WC_LINUXKM_WOLFENTROPY_IN_GLUE_LAYER (resolved
-# at module load time via a weak extern on wc_Entropy_Get).  Skipped if
-# wolfEntropy is being compiled into libwolfssl.ko itself, or if Intel/AMD
-# RDSEED/RDRAND was explicitly requested as the entropy source.
-if test "$KERNEL_MODE_DEFAULTS" = "yes" && \
-   test "x$ENABLED_ENTROPY_MEMUSE" = "xno" && \
-   test "$ENABLED_AMDRDSEED" != "yes" && \
-   test "$ENABLED_INTELRDRAND" != "yes" && \
-   test "$ENABLED_INTELRDSEED" != "yes"
-then
+# Opt-in: seed libwolfssl.ko's FIPS DRBG from a separately-built wolfentropy.ko
+# module via WC_LINUXKM_WOLFENTROPY_IN_GLUE_LAYER (resolved at module load time
+# via a weak extern on wc_Entropy_Get).  When enabled, libwolfssl.ko is no
+# longer free-standing -- wolfentropy.ko must be loaded first.  Mutually
+# exclusive with --enable-wolfEntropy (which compiles the entropy source
+# directly into libwolfssl.ko).
+AC_ARG_ENABLE([linuxkm-external-wolfentropy],
+    [AS_HELP_STRING([--enable-linuxkm-external-wolfentropy],[Seed libwolfssl.ko's DRBG from a separately-loaded wolfentropy.ko module instead of compiling wolfEntropy into libwolfssl.ko (default: disabled)])],
+    [ ENABLED_LINUXKM_EXTERNAL_WOLFENTROPY=$enableval ],
+    [ ENABLED_LINUXKM_EXTERNAL_WOLFENTROPY=no ]
+    )
+
+if test "$ENABLED_LINUXKM_EXTERNAL_WOLFENTROPY" = "yes"; then
+    if test "$ENABLED_LINUXKM" != "yes"; then
+        AC_MSG_ERROR([--enable-linuxkm-external-wolfentropy requires --enable-linuxkm.])
+    fi
+    if test "x$enable_wolfEntropy" = "xyes" || test "x$enable_wolfentropy" = "xyes" || \
+       test "x$enable_entropy_memuse" = "xyes"; then
+        AC_MSG_ERROR([--enable-linuxkm-external-wolfentropy is mutually exclusive with --enable-wolfEntropy; the external wolfentropy.ko provides wc_Entropy_Get.])
+    fi
+    # Override the KERNEL_MODE_DEFAULTS default of ENABLED_ENTROPY_MEMUSE=yes:
+    # in this mode the entropy source is provided by wolfentropy.ko, not
+    # compiled into libwolfssl.ko.
+    ENABLED_ENTROPY_MEMUSE=no
     AM_CFLAGS="$AM_CFLAGS -DWC_LINUXKM_WOLFENTROPY_IN_GLUE_LAYER"
 fi
 
@@ -7217,6 +7240,7 @@ then
         ;;
       random_c)
         WOLFENTROPY_IN_RANDOM_C=yes
+        AM_CFLAGS="$AM_CFLAGS -DWOLFENTROPY_IN_RANDOM_C"
         ;;
       *)
         AC_MSG_ERROR([Invalid MemUse Entropy option. Valid are: thread, nofallback, random_c. Seen: $ENABLED_ENTROPY_MEMUSE.])
@@ -11527,7 +11551,11 @@ AM_CONDITIONAL([BUILD_ECCSI],[test "x$ENABLED_ECCSI" = "xyes" || test "x$ENABLED
 AM_CONDITIONAL([BUILD_SAKKE],[test "x$ENABLED_SAKKE" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
 AM_CONDITIONAL([BUILD_MEMORY],[test "x$ENABLED_MEMORY" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
 AM_CONDITIONAL([BUILD_MEMUSE],[test "x$ENABLED_ENTROPY_MEMUSE" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
-AM_CONDITIONAL([BUILD_WOLFENTROPY_C],[test "x$WOLFENTROPY_IN_RANDOM_C" != "xyes" && test "x$ENABLED_ENTROPY_MEMUSE" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
+# In --enable-wolfentropy=random_c mode, wolfentropy.c is textually #included
+# from random.c rather than compiled as its own TU, so it must be excluded
+# from the library source list.  Orthogonal to BUILD_MEMUSE, which still
+# gates all other wolfentropy-dependent code.
+AM_CONDITIONAL([BUILD_WOLFENTROPY_IN_RANDOM_C],[test "x$WOLFENTROPY_IN_RANDOM_C" = "xyes"])
 AM_CONDITIONAL([BUILD_RNG_BANK],[test "$ENABLED_RNG_BANK" = "yes" || test "$ENABLED_USERSETTINGS" = "yes"])
 AM_CONDITIONAL([BUILD_RSA],[test "x$ENABLED_RSA" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
 AM_CONDITIONAL([BUILD_DH],[test "x$ENABLED_DH" != "xno" || test "x$ENABLED_USERSETTINGS" = "xyes"])
@@ -11625,7 +11653,7 @@ AM_CONDITIONAL([BUILD_PKCS7],[test "x$ENABLED_PKCS7" = "xyes" || test "x$ENABLED
 AM_CONDITIONAL([BUILD_SMIME],[test "x$ENABLED_SMIME" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
 AM_CONDITIONAL([BUILD_HASHFLAGS],[test "x$ENABLED_HASHFLAGS" = "xyes"])
 AM_CONDITIONAL([BUILD_LINUXKM],[test "$ENABLED_LINUXKM" = "yes"])
-AM_CONDITIONAL([BUILD_WOLFENTROPY_KO],[test "$ENABLED_LINUXKM" = "yes" && test "x$ENABLED_ENTROPY_MEMUSE" != "xno"])
+AM_CONDITIONAL([BUILD_WOLFENTROPY_KO],[test "$ENABLED_LINUXKM" = "yes" && { test "x$ENABLED_ENTROPY_MEMUSE" != "xno" || test "x$ENABLED_LINUXKM_EXTERNAL_WOLFENTROPY" = "xyes"; }])
 AM_CONDITIONAL([BUILD_KERNEL_MODE_DEFAULTS],[test "$KERNEL_MODE_DEFAULTS" != "no"])
 AM_CONDITIONAL([BUILD_BSDKM],[test "$ENABLED_BSDKM" = "yes"])
 AM_CONDITIONAL([BUILD_KERNEL_MODULE],[test "$ENABLED_BSDKM" = "yes" || test "$ENABLED_LINUXKM" = "yes"])
diff --git a/linuxkm/Kbuild b/linuxkm/Kbuild
@@ -368,7 +368,7 @@ ifndef NO_EXPORTS
 	$(READELF) --symbols --wide $(filter %.o,$^) |
 		$(AWK) '/^ *[0-9]+: / {
 		  if ($$8 !~ /^(wc_|wolf|WOLF|TLSX_)/){next;}
-		  if ($$8 ~ /^wc_Entropy_(Get|GetRawEntropy|OnDemandTest)$$/){next;}
+		  $(if $(findstring -DWC_LINUXKM_WOLFENTROPY_IN_GLUE_LAYER,$(WOLFSSL_CFLAGS)),if ($$8 ~ /^wc_Entropy_(Get|GetRawEntropy|OnDemandTest)$$/){next;})
 		  if (($$4 == "FUNC") && ($$5 == "GLOBAL") && ($$6 == "DEFAULT")) {
 		    print "$(EXPORT_SYMBOL)(" $$8 ", '"$$ns"');";
 		  }
diff --git a/linuxkm/Makefile b/linuxkm/Makefile
@@ -483,18 +483,25 @@ WOLFENTROPY_MODULE_TOP := $(MODULE_TOP)/wolfentropy
 # Add wolfcrypt/src/sha3_asm.o here for platforms with SHA3 ASM acceleration.
 WOLFENTROPY_OBJ_FILES := \
     wolfcrypt/src/random.o \
+    wolfcrypt/src/wolfentropy.o \
+    wolfcrypt/src/rng_bank.o \
     wolfcrypt/src/sha256.o \
     wolfcrypt/src/sha3.o \
     wolfcrypt/src/wc_port.o \
     wolfcrypt/src/memory.o \
     wolfcrypt/src/logging.o \
     linuxkm/linuxkm_memory.o
 
-# Inherit the same compiler flags as the main module; configure already added
-# -DHAVE_ENTROPY_MEMUSE (and -DWOLFSSL_SHA3) when --enable-wolfentropy was set.
+# Inherit the same compiler flags as the main module.  -DHAVE_ENTROPY_MEMUSE
+# and -DWOLFSSL_SHA3 are forced on here because wolfentropy.ko must always
+# provide wc_Entropy_* regardless of whether the main libwolfssl.ko was
+# built with in-tree wolfEntropy or with --enable-linuxkm-external-wolfentropy
+# (which omits them from the main module).
 # WOLFSSL_LINUXKM_USE_MUTEXES: use kernel mutexes directly; wolfentropy.ko
 # does not have the PIE redirect table that wc_lkm_LockMutex requires.
-WOLFENTROPY_CFLAGS := $(WOLFSSL_CFLAGS) -DWOLFSSL_LINUXKM_USE_MUTEXES
+# -Wno-error=type-limits: some cross toolchains (e.g. arm-linux-gnueabihf gcc
+# 9.x) emit -Wtype-limits in the entropy pipeline; downgrade to warn-only.
+WOLFENTROPY_CFLAGS := $(WOLFSSL_CFLAGS) -DHAVE_ENTROPY_MEMUSE -DWOLFSSL_SHA3 -DWOLFSSL_LINUXKM_USE_MUTEXES -Wno-error=type-limits
 
 export WOLFENTROPY_OBJ_FILES WOLFENTROPY_CFLAGS
 
diff --git a/linuxkm/linuxkm_entropy_time.h b/linuxkm/linuxkm_entropy_time.h
@@ -0,0 +1,23 @@
+/* linuxkm_entropy_time.h
+ *
+ * arm32 kernel-space Entropy_TimeHiRes shim. The frozen FIPS wolfentropy.c
+ * has no __arm__ kernel branch and its POSIX fallback (clock_gettime) is
+ * user-space only. Selected via -DCUSTOM_ENTROPY_TIMEHIRES=wc_linuxkm_time_hires,
+ * which takes precedence over every arch branch in wolfentropy.c.
+ *
+ * Must be included from linuxkm_wc_port.h AFTER the WC_PIE_INDIRECT_SYM(ktime_get_raw)
+ * #define. Under FIPS/WC_CONTAINERIZE_THIS, that macro rewrites the ktime_get_raw
+ * call below into an indirected redirect-table lookup. For wolfentropy.ko
+ * (non-PIE), the call resolves directly against the kernel symbol.
+ * <linux/timekeeping.h> is assumed to have been pulled in transitively earlier.
+ */
+
+#ifndef LINUXKM_ENTROPY_TIME_H
+#define LINUXKM_ENTROPY_TIME_H
+
+static inline u64 wc_linuxkm_time_hires(void)
+{
+    return (u64) ktime_get_raw();
+}
+
+#endif /* LINUXKM_ENTROPY_TIME_H */
diff --git a/linuxkm/linuxkm_wc_port.h b/linuxkm/linuxkm_wc_port.h
@@ -995,6 +995,10 @@
         #else
             typeof(ktime_get_coarse_real_ts64) *ktime_get_coarse_real_ts64;
         #endif
+        #ifdef CONFIG_ARM
+            /* arm32 kernel Entropy_TimeHiRes shim (see linuxkm_entropy_time.h). */
+            typeof(ktime_get_raw) *ktime_get_raw;
+        #endif
 
         struct task_struct *(*get_current)(void);
 
@@ -1338,6 +1342,10 @@
     #else
         #define ktime_get_coarse_real_ts64 WC_PIE_INDIRECT_SYM(ktime_get_coarse_real_ts64)
     #endif
+    #ifdef CONFIG_ARM
+        /* arm32 kernel Entropy_TimeHiRes shim (see linuxkm_entropy_time.h). */
+        #define ktime_get_raw WC_PIE_INDIRECT_SYM(ktime_get_raw)
+    #endif
 
     #undef get_current
     #define get_current WC_PIE_INDIRECT_SYM(get_current)
@@ -1467,6 +1475,22 @@
 
     #endif /* WC_SYM_RELOC_TABLES */
 
+#ifdef CONFIG_ARM
+    /* arm32 kernel-space Entropy_TimeHiRes shim. The frozen FIPS wolfentropy.c
+     * has no __arm__ kernel branch and its POSIX fallback uses user-space
+     * clock_gettime(). wc_linuxkm_time_hires() reads ktime_get_raw(); when
+     * WC_CONTAINERIZE_THIS is active above, the #define routes the call through
+     * the PIE redirect table, otherwise it resolves directly.
+     *
+     * Auto-set CUSTOM_ENTROPY_TIMEHIRES so the arm32 branch is selected without
+     * requiring downstream CFLAGS changes. Callers can pre-define it to pick a
+     * different implementation. */
+    #ifndef CUSTOM_ENTROPY_TIMEHIRES
+        #define CUSTOM_ENTROPY_TIMEHIRES wc_linuxkm_time_hires
+    #endif
+    #include "linuxkm_entropy_time.h"
+#endif /* CONFIG_ARM */
+
 #if defined(WOLFSSL_KERNEL_STACK_DEBUG) || defined(WC_LINUXKM_STACK_DEBUG)
 
     #ifndef CONFIG_THREAD_INFO_IN_TASK
diff --git a/linuxkm/module_hooks.c b/linuxkm/module_hooks.c
@@ -1377,6 +1377,10 @@ static int set_up_wolfssl_linuxkm_pie_redirect_table(void) {
         wolfssl_linuxkm_pie_redirect_table.ktime_get_coarse_real_ts64 =
             ktime_get_coarse_real_ts64;
     #endif
+    #ifdef CONFIG_ARM
+        /* arm32 kernel Entropy_TimeHiRes shim (see linuxkm_entropy_time.h). */
+        wolfssl_linuxkm_pie_redirect_table.ktime_get_raw = ktime_get_raw;
+    #endif
 
     wolfssl_linuxkm_pie_redirect_table.get_current = my_get_current_thread;
 
diff --git a/linuxkm/module_hooks_entropy.c b/linuxkm/module_hooks_entropy.c
@@ -92,6 +92,14 @@ void wc_ecc_fp_init(void) {}
 void wc_ecc_fp_free(void) {}
 #endif
 
+/* wolfentropy.c and rng_bank.c call wc_linuxkm_check_for_intr_signals() and
+ * wc_linuxkm_relax_long_loop() directly (no PIE redirect in wolfentropy.ko).
+ * Their real implementations live in module_hooks.c (libwolfssl.ko only).
+ * Provide no-op stubs here so modpost can resolve the references.
+ */
+int wc_linuxkm_check_for_intr_signals(void) { return 0; }
+void wc_linuxkm_relax_long_loop(void) {}
+
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("https://www.wolfssl.com/");
 MODULE_DESCRIPTION("wolfEntropy SP 800-90B jitter entropy source for wolfSSL FIPS DRBG");
diff --git a/src/include.am b/src/include.am
@@ -187,9 +187,11 @@ src_libwolfssl@LIBSUFFIX@_la_SOURCES += \
                wolfcrypt/src/hmac.c \
                wolfcrypt/src/random.c
 
-if BUILD_WOLFENTROPY_C
+if BUILD_MEMUSE
+if !BUILD_WOLFENTROPY_IN_RANDOM_C
 src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/wolfentropy.c
 endif
+endif
 
 if BUILD_RNG_BANK
 src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/rng_bank.c
@@ -441,18 +443,22 @@ src_libwolfssl@LIBSUFFIX@_la_SOURCES += \
                wolfcrypt/src/random.c
 
 if BUILD_FIPS_V6
-if BUILD_WOLFENTROPY_C
+if BUILD_MEMUSE
+if !BUILD_WOLFENTROPY_IN_RANDOM_C
 if BUILD_KERNEL_MODE_DEFAULTS
 src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/wolfentropy.c
 endif
 endif
 endif
+endif
 
 if !BUILD_FIPS_V6
-if BUILD_WOLFENTROPY_C
+if BUILD_MEMUSE
+if !BUILD_WOLFENTROPY_IN_RANDOM_C
 src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/wolfentropy.c
 endif
 endif
+endif
 
 if BUILD_RNG_BANK
 src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/rng_bank.c
@@ -810,9 +816,11 @@ endif !BUILD_FIPS_V5
 if !BUILD_FIPS_V2_PLUS
 if BUILD_RNG
 src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/random.c
-if BUILD_WOLFENTROPY_C
+if BUILD_MEMUSE
+if !BUILD_WOLFENTROPY_IN_RANDOM_C
 src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/wolfentropy.c
 endif
+endif
 if BUILD_RNG_BANK
 src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/rng_bank.c
 endif
diff --git a/tests/api/test_random.c b/tests/api/test_random.c
@@ -346,8 +346,7 @@ int test_wc_RNG_TestSeed(void)
     XMEMSET(seed, 0xa5, sizeof(seed));
     /* Return value is DRBG_CONT_FAILURE which is not public. */
     /* Moving forward with the RCT test check LT instead of GT */
-#if !defined(HAVE_ENTROPY_MEMUSE) && (!defined(HAVE_FIPS) || \
-    ( defined(HAVE_FIPS) && FIPS_VERSION3_GE(7,0,0)))
+#if !defined(HAVE_FIPS) || ( defined(HAVE_FIPS) && FIPS_VERSION3_GE(7,0,0) )
     ExpectIntLT(wc_RNG_TestSeed(seed, sizeof(seed)), 0);
 #else
     ExpectIntGT(wc_RNG_TestSeed(seed, sizeof(seed)), 0);

Original file line number	Diff line number	Diff line change
`@@ -368,7 +368,7 @@ ifndef NO_EXPORTS`
`368`	`368`	`$(READELF) --symbols --wide $(filter %.o,$^) \|`
`369`	`369`	`$(AWK) '/^ *[0-9]+: / {`
`370`	`370`	`if ($$8 !~ /^(wc_\|wolf\|WOLF\|TLSX_)/){next;}`
`371`		`- if ($$8 ~ /^wc_Entropy_(Get\|GetRawEntropy\|OnDemandTest)$$/){next;}`
	`371`	`+ $(if $(findstring -DWC_LINUXKM_WOLFENTROPY_IN_GLUE_LAYER,$(WOLFSSL_CFLAGS)),if ($$8 ~ /^wc_Entropy_(Get\|GetRawEntropy\|OnDemandTest)$$/){next;})`
`372`	`372`	`if (($$4 == "FUNC") && ($$5 == "GLOBAL") && ($$6 == "DEFAULT")) {`
`373`	`373`	`print "$(EXPORT_SYMBOL)(" $$8 ", '"$$ns"');";`
`374`	`374`	`}`