Zephyr fixes

.github/workflows/zephyr.yml

@@ -95,10 +95,18 @@ jobs:
         # Scope -T to the sample directory (not the whole module) so twister does
         # not load zephyr/tests/*/testcase.yaml. The condvar test's modern
         # list-form platform_allow is rejected by the 2.7.4 twister schema, and
-        # this is the only sample step that runs on 2.7.4. Runs both scenarios
-        # (wolfssl_test and wolfssl_test_no_malloc).
+        # this is the only sample step that runs on 2.7.4.
+        #
+        # Name the two scenarios rather than running the whole sample: the rest
+        # need a Zephyr these versions predate - hierarchical board names,
+        # COMMON_LIBC_MALLOC_ARENA_SIZE, and toolchains beyond the x86_64 one
+        # installed above. --test drops the others before their platform_allow
+        # is resolved, so an unrecognized board does not abort the run - but
+        # the yaml is still parsed, so a modern-only key would.
         run: |
-          ./zephyr/scripts/twister -T modules/crypto/wolfssl/zephyr/samples/wolfssl_test -vvv
+          ./zephyr/scripts/twister -T modules/crypto/wolfssl/zephyr/samples/wolfssl_test \
+            --test sample.crypto.wolfssl_test \
+            --test sample.crypto.wolfssl_test_no_malloc -vvv
           rm -rf zephyr/twister-out
 
       - name: Run wolfssl TLS sock test

.wolfssl_known_macro_extras

@@ -70,12 +70,17 @@ CONFIG_ARCH_POSIX
 CONFIG_ARCH_TEGRA
 CONFIG_ARM
 CONFIG_ARM64
+CONFIG_ARMV6_M_ARMV8_M_BASELINE
+CONFIG_ARMV7_M_ARMV8_M_MAINLINE
 CONFIG_BOARD_NATIVE_POSIX
 CONFIG_BOARD_NATIVE_SIM
 CONFIG_COMPILER_OPTIMIZATION_DEFAULT
 CONFIG_COMPILER_OPTIMIZATION_NONE
 CONFIG_COMPILER_OPTIMIZATION_PERF
 CONFIG_COMPILER_OPTIMIZATION_SIZE
+CONFIG_CPU_AARCH32_CORTEX_A
+CONFIG_CPU_AARCH32_CORTEX_R
+CONFIG_CPU_CORTEX_M
 CONFIG_CRYPTO_AES
 CONFIG_CRYPTO_CBC
 CONFIG_CRYPTO_CCM
@@ -171,14 +176,14 @@ CONFIG_TIMER_TASK_STACK_SIZE
 CONFIG_TLS_STACK_WOLFSSL
 CONFIG_USE_WOLFSSL_ESP_SDK_TIME
 CONFIG_USE_WOLFSSL_ESP_SDK_WIFI
-CONFIG_WOLFCRYPT_ARMASM
+CONFIG_WOLFCRYPT_ASM
 CONFIG_WOLFCRYPT_FIPS
 CONFIG_WOLFCRYPT_FIPS_READY
 CONFIG_WOLFCRYPT_FIPS_V2
 CONFIG_WOLFCRYPT_FIPS_V5
 CONFIG_WOLFCRYPT_FIPS_V6
 CONFIG_WOLFCRYPT_FIPS_V7
-CONFIG_WOLFCRYPT_INTELASM
+CONFIG_WOLFCRYPT_SP_SMALL
 CONFIG_WOLFSSL
 CONFIG_WOLFSSL_ALLOW_TLS13
 CONFIG_WOLFSSL_ALPN
@@ -193,6 +198,11 @@ CONFIG_WOLFSSL_CRYPTO_ONLY
 CONFIG_WOLFSSL_CURVE25519
 CONFIG_WOLFSSL_DTLS
 CONFIG_WOLFSSL_ECC
+CONFIG_WOLFSSL_ECC_256
+CONFIG_WOLFSSL_ECC_384
+CONFIG_WOLFSSL_ECC_512
+CONFIG_WOLFSSL_ECC_521
+CONFIG_WOLFSSL_ECC_BRAINPOOL
 CONFIG_WOLFSSL_ENABLE_KYBER
 CONFIG_WOLFSSL_EXAMPLE_NAME_ESP32_SSH_SERVER
 CONFIG_WOLFSSL_EXAMPLE_NAME_ESP8266_SSH_SERVER
@@ -224,7 +234,6 @@ CONFIG_WOLFSSL_SINGLE_THREADED
 CONFIG_WOLFSSL_SNI
 CONFIG_WOLFSSL_TARGET_HOST
 CONFIG_WOLFSSL_TARGET_PORT
-CONFIG_WOLFSSL_TLS13_ENABLED
 CONFIG_WOLFSSL_TLS_VERSION_1_2
 CONFIG_WOLFSSL_TLS_VERSION_1_3
 CONFIG_WOLFSSL_XMSS
@@ -1116,6 +1125,7 @@ WOLFSSL_SNIFFER_NO_RECOVERY
 WOLFSSL_SP_ARM32_UDIV
 WOLFSSL_SP_FAST_NCT_EXPTMOD
 WOLFSSL_SP_INT_SQR_VOLATILE
+WOLFSSL_SP_USE_UDIV
 WOLFSSL_SSLKEYLOGFILE_USE_ENV
 WOLFSSL_STACK_CHECK
 WOLFSSL_STM32C5
@@ -1265,6 +1275,7 @@ __ARM_ARCH_7M__
 __ARM_ARCH_PROFILE
 __ARM_FEATURE_CRYPTO
 __ARM_FEATURE_DSP
+__ARM_FEATURE_QRDMX
 __ARM_FEATURE_SIMD32
 __ARM_FEATURE_SME
 __ARM_FEATURE_SVE

wolfcrypt/src/cpuid.c

@@ -85,6 +85,20 @@
         #define cpuid(a,b,c) __cpuidex((int*)a,b,c)
     #endif /* _MSC_VER */
 
+    /* Read XCR0. Only valid once CPUID.1:ECX.OSXSAVE[27] is known set. */
+    #ifndef _MSC_VER
+        static WC_INLINE word32 cpuid_xgetbv0(void)
+        {
+            word32 eax, edx;
+            __asm__ __volatile__ ("xgetbv"
+                : "=a" (eax), "=d" (edx) : "c" (0));
+            (void)edx;
+            return eax;
+        }
+    #else
+        #define cpuid_xgetbv0() ((word32)_xgetbv(0))
+    #endif /* _MSC_VER */
+
     #define EAX 0
     #define EBX 1
     #define ECX 2
@@ -116,6 +130,31 @@
                 XMEMCMP((char *)&(reg[ECX]), "cAMD", 4) == 0);
     }
 
+    /* XCR0 state-component masks. AVX needs the SSE and AVX regions; AVX-512
+     * also needs opmask, ZMM_Hi256 and Hi16_ZMM on top of them. */
+    #define WC_XCR0_AVX     0x06
+    #define WC_XCR0_AVX512  0xe6
+
+    /* Return 1 when the OS has enabled XSAVE and every state component in
+     * 'mask'. CPUID's feature bits only say the silicon has the unit;
+     * executing the instruction also needs CR4.OSXSAVE and the matching XCR0
+     * bits, which an OS that does not context-switch those registers leaves
+     * clear. Without this test wolfSSL dispatches the vector code on such a
+     * system and it faults with #UD. */
+    static int cpuid_os_state_enabled(word32 mask)
+    {
+        unsigned int reg[5];
+
+        XMEMSET(reg, '\0', sizeof(reg));
+        cpuid(reg, 1, 0);
+
+        /* CPUID.1:ECX.OSXSAVE[27] - XGETBV is illegal when this is clear. */
+        if (((reg[ECX] >> 27) & 0x1) == 0)
+            return 0;
+
+        return (cpuid_xgetbv0() & mask) == mask;
+    }
+
     static cpuid_flags_t cpuid_flag(word32 leaf, word32 sub, word32 num,
         word32 bit)
     {
@@ -139,8 +178,13 @@
         #endif
             cpuid_flags_t new_cpuid_flags = 0,
                 old_cpuid_flags = WC_CPUID_INITIALIZER;
-            if (cpuid_flag(1, 0, ECX, 28)) { new_cpuid_flags |= CPUID_AVX1  ; }
-            if (cpuid_flag(7, 0, EBX,  5)) { new_cpuid_flags |= CPUID_AVX2  ; }
+            int os_avx    = cpuid_os_state_enabled(WC_XCR0_AVX);
+            int os_avx512 = cpuid_os_state_enabled(WC_XCR0_AVX512);
+
+            if (os_avx) {
+                if (cpuid_flag(1, 0, ECX, 28)) { new_cpuid_flags |= CPUID_AVX1; }
+                if (cpuid_flag(7, 0, EBX,  5)) { new_cpuid_flags |= CPUID_AVX2; }
+            }
             if (cpuid_flag(7, 0, EBX,  8)) { new_cpuid_flags |= CPUID_BMI2  ; }
             if (cpuid_flag(1, 0, ECX, 30)) { new_cpuid_flags |= CPUID_RDRAND; }
             if (cpuid_flag(7, 0, EBX, 18)) { new_cpuid_flags |= CPUID_RDSEED; }
@@ -149,25 +193,30 @@
             if (cpuid_flag(1, 0, ECX, 22)) { new_cpuid_flags |= CPUID_MOVBE ; }
             if (cpuid_flag(7, 0, EBX,  3)) { new_cpuid_flags |= CPUID_BMI1  ; }
             if (cpuid_flag(7, 0, EBX, 29)) { new_cpuid_flags |= CPUID_SHA   ; }
-            if (cpuid_flag(7, 0, ECX,  9)) { new_cpuid_flags |= CPUID_VAES  ; }
-            if (cpuid_flag(7, 0, EBX, 16)) { new_cpuid_flags |= CPUID_AVX512; }
-            if (cpuid_flag(7, 0, ECX,  1)) {
-                new_cpuid_flags |= CPUID_AVX512_VBMI;
-            }
-            if (cpuid_flag(7, 0, ECX,  6)) {
-                new_cpuid_flags |= CPUID_AVX512_VBMI2;
-            }
-            if (cpuid_flag(7, 0, EBX, 21)) {
-                new_cpuid_flags |= CPUID_AVX512_IFMA;
-            }
-            if (cpuid_flag(7, 0, EBX, 31)) {
-                new_cpuid_flags |= CPUID_AVX512_VL;
-            }
-            if (cpuid_flag(7, 0, EBX, 17)) {
-                new_cpuid_flags |= CPUID_AVX512_DQ;
+            /* VAES is VEX/EVEX encoded, so it needs the AVX state too. */
+            if (os_avx && cpuid_flag(7, 0, ECX, 9)) {
+                new_cpuid_flags |= CPUID_VAES;
             }
-            if (cpuid_flag(7, 0, EBX, 30)) {
-                new_cpuid_flags |= CPUID_AVX512_BW;
+            if (os_avx512) {
+                if (cpuid_flag(7, 0, EBX, 16)) { new_cpuid_flags |= CPUID_AVX512; }
+                if (cpuid_flag(7, 0, ECX,  1)) {
+                    new_cpuid_flags |= CPUID_AVX512_VBMI;
+                }
+                if (cpuid_flag(7, 0, ECX,  6)) {
+                    new_cpuid_flags |= CPUID_AVX512_VBMI2;
+                }
+                if (cpuid_flag(7, 0, EBX, 21)) {
+                    new_cpuid_flags |= CPUID_AVX512_IFMA;
+                }
+                if (cpuid_flag(7, 0, EBX, 31)) {
+                    new_cpuid_flags |= CPUID_AVX512_VL;
+                }
+                if (cpuid_flag(7, 0, EBX, 17)) {
+                    new_cpuid_flags |= CPUID_AVX512_DQ;
+                }
+                if (cpuid_flag(7, 0, EBX, 30)) {
+                    new_cpuid_flags |= CPUID_AVX512_BW;
+                }
             }
             if (cpuid_is_intel())          { new_cpuid_flags |= CPUID_INTEL ; }
             if (cpuid_is_amd())            { new_cpuid_flags |= CPUID_AMD   ; }

wolfcrypt/src/ecc.c

@@ -349,33 +349,24 @@ ECC Curve Sizes:
     #define HAVE_ECC_CHECK_PUBKEY_ORDER
 #endif
 
-#if defined(WOLFSSL_SP_MATH_ALL) && SP_INT_BITS < MAX_ECC_BITS_NEEDED
+/* MAX_ECC_BITS is the largest curve compiled in unless the user raised it, and
+ * ecc.h rejects a smaller one.  MAX_ECC_BITS_EXTRA is the bit ECC_KEY_MAX_BITS
+ * adds below, so the working values need room for it too. */
+#if defined(WOLFSSL_SP_MATH_ALL) && \
+    SP_INT_BITS < (MAX_ECC_BITS + MAX_ECC_BITS_EXTRA)
 #define MAX_ECC_BITS_USE    SP_INT_BITS
 #else
-#define MAX_ECC_BITS_USE    MAX_ECC_BITS_NEEDED
+#define MAX_ECC_BITS_USE    (MAX_ECC_BITS + MAX_ECC_BITS_EXTRA)
 #endif
 
-#if !defined(WOLFSSL_CUSTOM_CURVES) && (ECC_MIN_KEY_SZ > 160) && \
-    (!defined(HAVE_ECC_KOBLITZ) || (ECC_MIN_KEY_SZ > 224))
-
+/* MAX_ECC_BITS_EXTRA (ecc.h) is the one bit the builds whose order can be a bit
+ * greater than the prime need, and the ceiling is sized from the same macro. */
 #define ECC_KEY_MAX_BITS(key)                                       \
     ((((key) == NULL) || ((key)->dp == NULL)) ? MAX_ECC_BITS_USE :  \
-        ((unsigned)((key)->dp->size * 8)))
+        ((unsigned)((key)->dp->size * 8 + MAX_ECC_BITS_EXTRA)))
 #define ECC_KEY_MAX_BITS_NONULLCHECK(key)                           \
     (((key)->dp == NULL) ? MAX_ECC_BITS_USE :                       \
-        ((unsigned)((key)->dp->size * 8)))
-
-#else
-
-/* Add one bit for cases when order is a bit greater than prime. */
-#define ECC_KEY_MAX_BITS(key)                                       \
-    ((((key) == NULL) || ((key)->dp == NULL)) ? MAX_ECC_BITS_USE :  \
-        ((unsigned)((key)->dp->size * 8 + 1)))
-#define ECC_KEY_MAX_BITS_NONULLCHECK(key)                           \
-    (((key)->dp == NULL) ? MAX_ECC_BITS_USE :                       \
-        ((unsigned)((key)->dp->size * 8 + 1)))
-
-#endif
+        ((unsigned)((key)->dp->size * 8 + MAX_ECC_BITS_EXTRA)))
 
 #ifdef WOLFSSL_ECC_BLIND_K
 /* Number of digits covered by the fixed-width XORs below. */
@@ -7964,10 +7955,10 @@ int wc_ecc_gen_deterministic_k(const byte* hash, word32 hashSz,
 {
     int ret = 0;
 #ifndef WOLFSSL_SMALL_STACK
-    byte h1[MAX_ECC_BYTES];
+    byte h1[MAX_ECC_ORDER_BYTES];
     byte V[WC_MAX_DIGEST_SIZE];
     byte K[WC_MAX_DIGEST_SIZE];
-    byte x[MAX_ECC_BYTES];
+    byte x[MAX_ECC_ORDER_BYTES];
     mp_int z1[1];
 #else
     byte *h1 = NULL;
@@ -8005,13 +7996,19 @@ int wc_ecc_gen_deterministic_k(const byte* hash, word32 hashSz,
         }
     }
 
-    if (mp_unsigned_bin_size(priv) > MAX_ECC_BYTES) {
+    if (mp_unsigned_bin_size(priv) > MAX_ECC_ORDER_BYTES) {
         WOLFSSL_MSG("private key larger than max expected!");
         return BAD_FUNC_ARG;
     }
 
+    /* x and h1 below are written to the order's length. */
+    if (mp_unsigned_bin_size(order) > MAX_ECC_ORDER_BYTES) {
+        WOLFSSL_MSG("order larger than max expected!");
+        return BAD_FUNC_ARG;
+    }
+
 #ifdef WOLFSSL_SMALL_STACK
-    h1 = (byte*)XMALLOC(MAX_ECC_BYTES, heap, DYNAMIC_TYPE_DIGEST);
+    h1 = (byte*)XMALLOC(MAX_ECC_ORDER_BYTES, heap, DYNAMIC_TYPE_DIGEST);
     if (h1 == NULL) {
         ret = MEMORY_E;
     }
@@ -8029,7 +8026,8 @@ int wc_ecc_gen_deterministic_k(const byte* hash, word32 hashSz,
     }
 
     if (ret == 0) {
-        x = (byte*)XMALLOC(MAX_ECC_BYTES, heap, DYNAMIC_TYPE_PRIVATE_KEY);
+        x = (byte*)XMALLOC(MAX_ECC_ORDER_BYTES, heap,
+                           DYNAMIC_TYPE_PRIVATE_KEY);
         if (x == NULL)
             ret = MEMORY_E;
     }
@@ -8090,7 +8088,7 @@ int wc_ecc_gen_deterministic_k(const byte* hash, word32 hashSz,
 
     /* bits2octets on h1 */
     if (ret == 0) {
-        XMEMSET(h1, 0, MAX_ECC_BYTES);
+        XMEMSET(h1, 0, MAX_ECC_ORDER_BYTES);
 
     #if !defined(WOLFSSL_ECDSA_DETERMINISTIC_K_VARIANT)
         /* mod reduce by order using conditional subtract
@@ -8102,7 +8100,7 @@ int wc_ecc_gen_deterministic_k(const byte* hash, word32 hashSz,
 
             mp_sub(z1, order, z1);
             z1Sz = mp_unsigned_bin_size(z1);
-            if (z1Sz < 0 || z1Sz > MAX_ECC_BYTES) {
+            if (z1Sz < 0 || z1Sz > MAX_ECC_ORDER_BYTES) {
                 ret = BUFFER_E;
             }
             else {
@@ -8205,7 +8203,7 @@ int wc_ecc_gen_deterministic_k(const byte* hash, word32 hashSz,
         } while (ret == 0 && err != 0);
     }
 
-    ForceZero(x, MAX_ECC_BYTES);
+    ForceZero(x, MAX_ECC_ORDER_BYTES);
     ForceZero(K, WC_MAX_DIGEST_SIZE);
     ForceZero(V, WC_MAX_DIGEST_SIZE);
 #ifdef WOLFSSL_SMALL_STACK
@@ -8215,7 +8213,7 @@ int wc_ecc_gen_deterministic_k(const byte* hash, word32 hashSz,
     XFREE(V, heap, DYNAMIC_TYPE_ECC_BUFFER);
     XFREE(h1, heap, DYNAMIC_TYPE_DIGEST);
 #elif defined(WOLFSSL_CHECK_MEM_ZERO)
-    wc_MemZero_Check(x, MAX_ECC_BYTES);
+    wc_MemZero_Check(x, MAX_ECC_ORDER_BYTES);
     wc_MemZero_Check(K, WC_MAX_DIGEST_SIZE);
     wc_MemZero_Check(V, WC_MAX_DIGEST_SIZE);
 #endif

wolfcrypt/src/port/arm/armv8-aes-asm.S

@@ -35,6 +35,7 @@
 #ifndef WOLFSSL_ARMASM_INLINE
 #if !defined(NO_AES) && defined(WOLFSSL_ARMASM)
 #ifndef WOLFSSL_ARMASM_NO_HW_CRYPTO
+.arch_extension crypto
 #ifndef __APPLE__
 .text
 .globl	AES_set_key_AARCH64
@@ -14910,6 +14911,7 @@ L_aes_gcm_decrypt_arm64_crypto_done:
 #endif /* __APPLE__ */
 #endif /* HAVE_AES_DECRYPT || HAVE_AESGCM_DECRYPT */
 #ifdef WOLFSSL_ARMASM_CRYPTO_SHA3
+.arch_extension sha3
 #ifndef __APPLE__
 .text
 .globl	AES_GCM_encrypt_AARCH64_EOR3
@@ -32806,6 +32808,7 @@ L_aes_gcm_decrypt_final_arm64_crypto_tag_loaded:
 #endif /* __APPLE__ */
 #endif /* HAVE_AES_DECRYPT || HAVE_AESGCM_DECRYPT */
 #ifdef WOLFSSL_ARMASM_CRYPTO_SHA3
+.arch_extension sha3
 #ifndef __APPLE__
 .text
 .globl	AES_GCM_init_AARCH64_EOR3

wolfcrypt/src/port/arm/armv8-aes-asm.asm

@@ -25,6 +25,7 @@
 ;       ../wolfssl/wolfcrypt/src/port/arm/armv8-aes-asm.asm
 	IF :LNOT::DEF:NO_AES :LAND: {TRUE}
 	IF :LNOT::DEF:WOLFSSL_ARMASM_NO_HW_CRYPTO
+; .arch_extension crypto
 	AREA	|.text|, CODE, READONLY
 	ALIGN	4
 	EXPORT	AES_set_key_AARCH64
@@ -14768,6 +14769,7 @@ L_aes_gcm_decrypt_arm64_crypto_done
 	ENDP
 	ENDIF
 	IF :DEF:WOLFSSL_ARMASM_CRYPTO_SHA3
+; .arch_extension sha3
 	AREA	|.text|, CODE, READONLY
 	ALIGN	4
 	EXPORT	AES_GCM_encrypt_AARCH64_EOR3
@@ -32544,6 +32546,7 @@ L_aes_gcm_decrypt_final_arm64_crypto_tag_loaded
 	ENDP
 	ENDIF
 	IF :DEF:WOLFSSL_ARMASM_CRYPTO_SHA3
+; .arch_extension sha3
 	AREA	|.text|, CODE, READONLY
 	ALIGN	4
 	EXPORT	AES_GCM_init_AARCH64_EOR3