20260204-linuxkm-fips-hash by douzzer · Pull Request #9800 · wolfSSL/wolfssl

douzzer · 2026-02-19T06:04:11Z

Implement Linux kernel module FIPS integrity hash offline calculation:

Add:

linuxkm/linuxkm-fips-hash.c
linuxkm/linuxkm-fips-hash-wrapper.sh
linuxkm/linuxkm_memory.h

Move from linuxkm/module_hooks.c to linuxkm/linuxkm_memory.c:

reloc_layouts[]
find_reloc_tab_offset()
the body of wc_linuxkm_normalize_relocations() as wc_reloc_normalize_text()
most of updateFipsHash() as wc_fips_generate_hash()

Move from linuxkm/linuxkm_wc_port.h to linuxkm/linuxkm_memory.h:

struct wc_linuxkm_pie_reloc_tab_ent
enum wc_reloc_dest_segment
enum wc_reloc_type

linuxkm/Makefile:

Update GENERATE_RELOC_TAB recipe to populate new fields in struct wc_reloc_table_ent.
Add targets:
- libwolfssl-user-build/src/.libs/libwolfssl.so
- linuxkm-fips-hash
- module-with-matching-fips-hash
- module-with-matching-fips-hash-no-sign
Add support for alternate target module name, via LIBWOLFSSL_NAME make variable.

linuxkm/linuxkm_wc_port.h and linuxkm/module_hooks.c:

Fixes to make linuxkm-pie work with CONFIG_KASAN.
Implement WC_LINUXKM_STACK_DEBUG:
- wc_linuxkm_stack_bottom()
- wc_linuxkm_stack_top()
- wc_linuxkm_stack_current()
- wc_linuxkm_stack_left()
- wc_linuxkm_stack_hwm_prepare()
- wc_linuxkm_stack_hwm_measure_rel()
- wc_linuxkm_stack_hwm_measure_total()

wolfssl/wolfcrypt/settings.h:

When WOLFSSL_KERNEL_MODE, make sure WOLFSSL_GENERAL_ALIGNMENT is at least SIZEOF_LONG.
When WOLFCRYPT_FIPS_CORE_DYNAMIC_HASH_VALUE, make sure WOLFSSL_BASE16 is defined.

configure.ac and wolfcrypt/benchmark/benchmark.c: Disable scrypt when KERNEL_MODE_DEFAULTS, due to excessive memory requirements.

tested with

wolfssl-multi-test.sh ...
pr-check
'.*insmod.*'
'.*linuxkm.*'

with tweaks to wolfssl-multi-test.sh to exercise and verify offline hash calculation by default in FIPS do_linuxkm_scenario_load_with_self_test() scenarios, and in the FIPS aarch64 linuxkm scenarios.

Add: * linuxkm/linuxkm-fips-hash.c * linuxkm/linuxkm-fips-hash-wrapper.sh * linuxkm/linuxkm_memory.h Move from linuxkm/module_hooks.c to linuxkm/linuxkm_memory.c: * reloc_layouts[] * find_reloc_tab_offset() * the body of wc_linuxkm_normalize_relocations() as wc_reloc_normalize_text() * most of updateFipsHash() as wc_fips_generate_hash() Move from linuxkm/linuxkm_wc_port.h to linuxkm/linuxkm_memory.h: * struct wc_linuxkm_pie_reloc_tab_ent * enum wc_reloc_dest_segment * enum wc_reloc_type linuxkm/Makefile: * Update GENERATE_RELOC_TAB recipe to populate new fields in struct wc_reloc_table_ent. * Add targets: * libwolfssl-user-build/src/.libs/libwolfssl.so * linuxkm-fips-hash * module-with-matching-fips-hash * module-with-matching-fips-hash-no-sign * Add support for alternate target module name, via LIBWOLFSSL_NAME make variable. linuxkm/linuxkm_wc_port.h and linuxkm/module_hooks.c: * Fixes to make linuxkm-pie work with CONFIG_KASAN. * Implement WC_LINUXKM_STACK_DEBUG: * wc_linuxkm_stack_bottom() * wc_linuxkm_stack_top() * wc_linuxkm_stack_current() * wc_linuxkm_stack_left() * wc_linuxkm_stack_hwm_prepare() * wc_linuxkm_stack_hwm_measure_rel() * wc_linuxkm_stack_hwm_measure_total() wolfssl/wolfcrypt/settings.h: * When WOLFSSL_KERNEL_MODE, make sure WOLFSSL_GENERAL_ALIGNMENT is at least SIZEOF_LONG. * When WOLFCRYPT_FIPS_CORE_DYNAMIC_HASH_VALUE, make sure WOLFSSL_BASE16 is defined. configure.ac and wolfcrypt/benchmark/benchmark.c: Disable scrypt when KERNEL_MODE_DEFAULTS, due to excessive memory requirements.

sameehj · 2026-02-19T11:15:14Z

wolfcrypt/benchmark/benchmark.c

 #endif

-/* use kB instead of mB for embedded benchmarking */
+/* use kB instead of MB for embedded benchmarking */


Should we make the k capital as well?

sameehj · 2026-02-19T12:46:39Z

linuxkm/linuxkm-fips-hash.c

+    ret = wc_fips_generate_hash(
+        &seg_map,
+        FIPS_IN_CORE_DIGEST_SIZE,
+        coreKey,


user_coreKey is never used after assignment, only coreKey.

sameehj · 2026-02-19T12:48:25Z

linuxkm/linuxkm-fips-hash.c

+        (seg_map.reloc_tab_len_start >= seg_map.reloc_tab_len_end) ||
+        (seg_map.reloc_tab_len_end >= st.st_size))
+    {
+        fprintf(stderr, "%s: supplied reloc_tab fencepost(s) are out of bounds.\n", progname, mod_path, st.st_size);


format arguments are missing

sameehj · 2026-02-19T13:04:34Z

linuxkm/linuxkm-fips-hash.c

+
+    if (seg_map.verifyCore_end - seg_map.verifyCore_start != new_verifyCore_size) {
+        fprintf(stderr, "%s: unexpected verifyCore length %zu.\n", progname, (size_t)(seg_map.verifyCore_end - seg_map.verifyCore_start));
+        goto out;


should ret be set to non zero here?

sameehj · 2026-02-19T13:04:54Z

linuxkm/linuxkm-fips-hash.c

+
+    if (new_verifyCore_size < sizeof new_verifyCore) {
+        fprintf(stderr, "%s: wc_fips_generate_hash() returned unexpected verifyCore length %u.\n", progname, new_verifyCore_size);
+        goto out;


what about ret here?

sameehj · 2026-02-19T13:06:45Z

linuxkm/linuxkm-fips-hash.c

+    int mod_fd;
+    struct stat st;
+    byte *mod_map = NULL;
+    word32 reloc_tab_len;


sameehj · 2026-02-19T13:08:02Z

linuxkm/linuxkm-fips-hash.c

+        { }
+    };
+
+    ret = wolfCrypt_Init();


we need to call wolfCrypt_Cleanup() at the end

sameehj · 2026-02-19T13:11:48Z

linuxkm/linuxkm-fips-hash.c

+
+    ret = wc_HmacInit(&hmac, NULL, INVALID_DEVID);
+    if (ret != 0) {
+        fprintf(stderr, "%s: wc_HmacInit() failed: %s.\n", progname, wc_GetErrorString(ret));


mmap cleanup on error path

sameehj · 2026-02-19T13:21:16Z

Hey @douzzer,

Nice work on the offline FIPS hash PR! A few docs suggestions:

README update -- A section in linuxkm/README.md about the offline hash workflow and the new make targets (module-with-matching-fips-hash, etc.) would help discoverability.
linuxkm-fips-hash tool -- A brief usage write-up beyond --help (even just a header comment in the .c) would save folks from reading the wrapper script.
API docs -- wc_fips_generate_hash() and wc_reloc_normalize_text() are public API -- doxygen comments on them and the key structs/callbacks would be great.
Breaking change note -- wc_reloc_table_ent layout changed (new fields, packed, enums now start at 1 instead of 0). Worth a note for anyone with custom reloc tooling.

douzzer requested review from philljj and sameehj February 19, 2026 06:04

douzzer assigned wolfSSL-Bot Feb 19, 2026

douzzer requested a review from lealem47 February 19, 2026 06:11

sameehj reviewed Feb 19, 2026

View reviewed changes

linuxkm/linuxkm-fips-hash.c

int mod_fd;

struct stat st;

byte *mod_map = NULL;

word32 reloc_tab_len;

Copy link

Contributor

sameehj Feb 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

unused?

sameehj reviewed Feb 19, 2026

View reviewed changes

linuxkm/linuxkm-fips-hash.c

{ }

};

ret = wolfCrypt_Init();

Copy link

Contributor

sameehj Feb 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we need to call wolfCrypt_Cleanup() at the end

sameehj reviewed Feb 19, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

20260204-linuxkm-fips-hash#9800

20260204-linuxkm-fips-hash#9800
douzzer wants to merge 1 commit intowolfSSL:masterfrom
douzzer:20260204-linuxkm-fips-hash

douzzer commented Feb 19, 2026 •

edited

Loading

Uh oh!

sameehj Feb 19, 2026

Uh oh!

sameehj Feb 19, 2026

Uh oh!

sameehj Feb 19, 2026

Uh oh!

sameehj Feb 19, 2026

Uh oh!

sameehj Feb 19, 2026

Uh oh!

sameehj Feb 19, 2026

Uh oh!

sameehj Feb 19, 2026

Uh oh!

sameehj Feb 19, 2026

Uh oh!

sameehj commented Feb 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Comments

Conversation

douzzer commented Feb 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sameehj commented Feb 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Comments

douzzer commented Feb 19, 2026 •

edited

Loading