32-bit AES hardening and the 32-bit Arm FIPS kernel module

[kaleb-himes]

Description

Pairs with: https://github.com/wolfSSL/scripts/pull/679

Reminder to self, this is stacked on top of branch L, once L merges, resolve merge conflicts before N can merge. Keep self-assigned till L merge. L merged on Sep 30, N now ready for review.

32-bit AES hardening and the 32-bit Arm FIPS kernel module. The AES half keeps the 32-bit x86 AES-GCM assembly out of 32-bit builds (its text relocations cannot be covered by the integrity hash), carries an AES-CBC decrypt failure out through the vector-register pop, enforces the SP 800-38E data-unit limit per unit and on decrypt, zeroizes key-unwrap scratch and rejected CCM/GCM output on every exit, refuses AES-SIV and AES-EAX under FIPS v7, and gives every 32-bit Arm assembly call site a status. The kernel half makes libwolfssl.ko load and pass POST on 32-bit Arm: SIMD through the arm vector-register glue, claims around the arm32 SHA lanes, wolfSSL mutexes taking bottom halves off instead of interrupts on Arm, scalar SHA-2 and C SHA-3 so the system random source can hash from every context, and ARM-mode call and jump relocations plus the EABI division helpers inside the PIE container. Tested by boot on 6.6.99 and 6.1.62 with a per-context SHA-256/AES probe.

Testing

Emulated on both x86_64 already, working on standing up a spot-VM to emulate on real arm where we should be able to test performance better. Will update this note once those tests finish. No changes to asm this PR so no scripts/ counterpart.

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m3

• FLASH: .text +28 B (+0.0%, 129,161 B / 262,144 B, total: 49% used)

gcc-arm-cortex-m4

• FLASH: .text +64 B (+0.0%, 207,916 B / 262,144 B, total: 79% used)

gcc-arm-cortex-m4-baremetal

• FLASH: .text +64 B (+0.1%, 71,587 B / 262,144 B, total: 27% used)

gcc-arm-cortex-m4-crypto-only

• FLASH: .text +64 B (+0.0%, 180,893 B / 262,144 B, total: 69% used)

gcc-arm-cortex-m4-dtls13

• FLASH: .text +64 B (+0.0%, 192,324 B / 1,048,576 B, total: 18% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .text +64 B (+0.0%, 790,556 B / 1,048,576 B, total: 75% used)

gcc-arm-cortex-m4-pkcs7

• FLASH: .text +64 B (+0.0%, 221,662 B / 262,144 B, total: 85% used)

gcc-arm-cortex-m4-rsa-only

• FLASH: .text +64 B (+0.0%, 338,608 B / 1,048,576 B, total: 32% used)

gcc-arm-cortex-m7-pq

• FLASH: .text +64 B (+0.0%, 309,232 B / 1,048,576 B, total: 29% used)

gcc-arm-cortex-m7-tls13

• FLASH: .text +64 B (+0.0%, 247,262 B / 262,144 B, total: 94% used)
  No memory changes detected for:
• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• linuxkm-pie
• linuxkm-standard
• stm32-sim-stm32h753

[kaleb-himes]

retest this please.

[kaleb-himes]

retest this please

Fenrir no longer available for reviews, dismissing now resolved review.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Architecture-specific cryptographic assembly, kernel SIMD state, and PIE relocation changes require final human review and native Arm validation.

Review effort: Balanced
Findings: None

Resolved since last review (2)

• RISC-V decryption bypasses plaintext cleanup on authentication failure
• Add unaligned eight-block AArch32 XTS decrypt regression coverage