cpuid: run the CASTs after a feature change, not on first use

Author: kaleb-himes

wolfcrypt/src/cpuid.c

@@ -952,8 +952,9 @@
     }
 
     /* A new feature set is a new operating environment: re-run the power-on
-     * self test, which resets every CAST to run again on the new lanes.
-     * The kernel module suspends signal handling around the self test. */
+     * self test, then run every CAST on the new lanes now instead of waiting
+     * for first use, which is what the kernel module does at load.  Signals
+     * stay suspended across both so a CAST cannot be cut short. */
     static WC_INLINE void cpuid_recast(void)
     {
     #if defined(HAVE_FIPS) && FIPS_VERSION3_GE(7,0,0)
@@ -963,6 +964,8 @@
             return;
         }
         ret = wolfCrypt_IntegrityTest_fips();
+        if (ret == 0)
+            ret = wc_RunAllCast_fips();
         (void)WC_SIG_IGNORE_END();
         if (ret != 0)
             WOLFSSL_MSG("cpuid: self test failed after a feature change");

wolfssl/wolfcrypt/cpuid.h

@@ -247,8 +247,9 @@ typedef word32 cpuid_flags_t;
     }
 
     /* Public APIs to modify flags.  In FIPS builds a call that changes them
-     * re-runs the power-on self test; operations in flight see the module in
-     * its start-up state and fail until it completes. */
+     * re-runs the power-on self test and every CAST on the new lanes;
+     * operations in flight see the module in its start-up state and fail
+     * until it completes. */
 
     #ifdef WOLFSSL_API_PREFIX_MAP
         #define cpuid_select_flags wc_cpuid_select_flags