[MarkAtwood]

Description

Instantiate the kernel cts template over the wolfCrypt cbc(aes) in linuxkm.

The krb5 aes-sha2 enctypes (RFC 8009, e.g. libceph's AES256KRB5 cephx keys) allocate authenc(hmac(sha384),cts(cbc(aes))). linuxkm registers cbc(aes) but no cts. crypto_larval_lookup() returns any alg already registered under a cra_name and only asks cryptomgr to build a template instance when none exists, and aesni registers a native cts(cbc(aes)) (cts-cbc-aes-aesni, priority 400). So a cts(cbc(aes)) lookup never builds cts over the wolfCrypt cbc, and that traffic never reaches wolfCrypt.

After cbcAesAlg registers, allocate cts(cbc-aes<suffix>) once by driver name. The kernel instantiates and self-tests (cts_mode_tv_template, fips_allowed) the template instance, which inherits the cbc priority (WOLFSSL_LINUXKM_LKCAPI_PRIORITY) and wins every later cts(cbc(aes)) lookup; check_skcipher_driver_masking() then confirms that. The ciphertext-stealing step is the kernel template; the AES-CBC under it is wolfCrypt. The instance persists after the probe tfm is freed, is torn down with cbcAesAlg on unregister, and does not pin the module. Skipped when the target kernel lacks CONFIG_CRYPTO_CTS.

Testing

• Builds with no new warnings against 6.17.9 headers and a 7.0.14 tree (warning sets identical to unpatched master).
• QEMU (7.0.14, CONFIG_CRYPTO_SELFTESTS=y): /proc/crypto shows cts(cbc(aes)) -> cts(cbc-aes-*-wolfcrypt), priority 100000, selftest: passed; before load it resolves to cts-cbc-aes-aesni.
• Independent oracle: CS3 ciphertexts from the guest (16- and 32-byte keys) match pyca/cryptography; clean unload after deinstall_algs.
• Also carried in a signed Proxmox kernel build and run on AVX-512 EC2 nodes: the kernel Ceph client's AES256KRB5 authenc/cts traffic traced entirely on wolfCrypt.

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[Copilot]

Copilot review overview

🟡 Changes recommended

The persistent CTS instance prevents the existing CBC deinstallation path from unregistering the algorithm, and one error log has a format mismatch.

Review effort: Balanced
Findings: 2

Open (2)

• CTS teardown leaves CBC instance registered and returns -EBUSY · New
• Format PTR_ERR() with %ld instead of %d · New

What changed in this PR

Instantiates Linux kernel CTS over wolfCrypt AES-CBC so Kerberos AES-SHA2 traffic selects wolfCrypt.

Changes:

• Creates and self-tests a CTS template instance.
• Verifies generic CTS lookup selects the wolfCrypt-backed driver.

File	Description
linuxkm/​lkcapi_glue.c	Adds CTS-over-AES-CBC registration and masking validation.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[MarkAtwood]

not a bug, registered instances drop their spawn ref. on 7.0 idle rmmod deregisters clean, rmmod with a live cts tfm refuses

[MarkAtwood]

PTR_ERR is redefined to int in linuxkm_wc_port.h, %ld breaks -Werror. added an explicit cast

[github-actions]

MemBrowse Memory Report · Explore what changed →

zephyr-frdm_rw612

• FLASH: log_const_area -8 B, rodata -8 B, text +1,560 B (+0.5%, 284,008 B / 67,108,864 B, total: 0% used)

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• stm32-sim-stm32h753

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}