Merge pull request #159 from night1rider/fips-update-config

Fix some issues related to using FIPs kernel module and userland configurations

conf/wolfssl-fips.conf.sample

@@ -23,6 +23,14 @@ PREFERRED_PROVIDER_wolfssl = "wolfssl-fips"
 # FIPS hash mode: "auto" (QEMU-based extraction) or "manual" (use static FIPS_HASH)
 WOLFSSL_FIPS_HASH_MODE ?= "manual"
 
+# Linux kernel module FIPS hash mode:
+#   "manual" - Use FIPS_HASH_LINUXKM from config (two-pass: build once to get hash, set it, rebuild)
+#   "auto"   - Use 'make module-with-matching-fips-hash' to compute and embed hash automatically
+#WOLFSSL_FIPS_HASH_MODE_LINUXKM ?= "auto"
+
+# Kernel module FIPS hash (only needed for manual mode)
+#FIPS_HASH_LINUXKM = ""
+
 # ============================================================================
 # FIPS Bundle Configuration - EDIT THESE VALUES
 # ============================================================================

inc/wolfssl-linuxkm/scarthgap/wolfssl-linuxkm-sign-module-modern.inc

@@ -0,0 +1,29 @@
+# Use the linuxkm Makefile's native signing target to produce libwolfssl.ko.signed,
+# then install it in place of the unsigned libwolfssl.ko.
+
+do_compile() {
+    if [ "${WOLFSSL_FIPS_HASH_MODE_LINUXKM}" = "auto" ]; then
+        bbnote "Auto FIPS hash mode: running 'make module-with-matching-fips-hash'"
+        bbnote "This will build the .ko, compute the FIPS hash, patch it in-place, and sign it."
+        unset LDFLAGS
+        unset CPPFLAGS
+        oe_runmake module-with-matching-fips-hash HOSTCC=$(which ${BUILD_CC})
+    else
+        oe_runmake
+    fi
+}
+
+do_install() {
+    install -d ${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/extra
+    KO_SIGNED="${S}/linuxkm/libwolfssl.ko.signed"
+    KO_UNSIGNED="${S}/linuxkm/libwolfssl.ko"
+    if [ -f "${KO_SIGNED}" ]; then
+        bbnote "Installing libwolfssl.ko.signed (signed by linuxkm Makefile)"
+        install -m 0644 "${KO_SIGNED}" \
+            ${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/extra/libwolfssl.ko
+    else
+        bbwarn "libwolfssl.ko.signed not found - installing unsigned libwolfssl.ko"
+        install -m 0644 "${KO_UNSIGNED}" \
+            ${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/extra/
+    fi
+}

inc/wolfssl-linuxkm/wolfssl-linuxkm-sign-module.inc

@@ -0,0 +1,28 @@
+# Check Yocto version and include appropriate file
+def wolfssl_linuxkm_get_sign_inc(d):
+    import os
+    layerseries = d.getVar('LAYERSERIES_CORENAMES') or ""
+
+    bb.note("wolfssl-linuxkm-sign-module.inc: LAYERSERIES_CORENAMES = %s" % layerseries)
+
+    use_modern = False
+    codename = None
+    if layerseries:
+        series_list = layerseries.split()
+        modern_series = ['dunfell', 'gatesgarth', 'hardknott', 'honister', 'kirkstone', 'langdale', 'mickledore', 'nanbield', 'scarthgap']
+        for series in series_list:
+            codename = series
+            if series in modern_series:
+                use_modern = True
+                break
+
+    layerdir = d.getVar('WOLFSSL_LAYERDIR')
+    if use_modern:
+        inc_file = os.path.join(layerdir, 'inc/wolfssl-linuxkm/%s/wolfssl-linuxkm-sign-module-modern.inc' % codename)
+    else:
+        inc_file = os.path.join(layerdir, 'inc/wolfssl-linuxkm/%s/wolfssl-linuxkm-sign-module-legacy.inc' % codename)
+
+    bb.note("wolfssl-linuxkm-sign-module.inc: Including file: %s" % inc_file)
+    return inc_file
+
+require ${@wolfssl_linuxkm_get_sign_inc(d)}

recipes-wolfssl/wolfssl/wolfssl-fips.bb

@@ -79,4 +79,7 @@ TARGET_CFLAGS += "-DFP_MAX_BITS=16384"
 EXTRA_OECONF += " \
     --enable-fips=v5 \
     --enable-reproducible-build \
+    --enable-smallstack \
+    --enable-sp-math-all \
+    --disable-sp \
 "

recipes-wolfssl/wolfssl/wolfssl-linuxkm-fips.bb

@@ -88,8 +88,10 @@ EXTRA_OECONF = " \
     --enable-linuxkm \
     --enable-fips=v5.2.4 \
     --with-linux-source=${STAGING_KERNEL_BUILDDIR} \
-    --enable-all-crypto \
     --enable-crypttests \
+    --enable-smallstack \
+    --enable-sp-math-all \
+    --disable-sp \
 "
 
 python __anonymous() {
@@ -107,12 +109,36 @@ do_configure_fips_hash_check() {
             bbwarn "WOLFSSL_FIPS_HASH_MODE_LINUXKM=manual but FIPS_HASH_LINUXKM is not set"
         fi
     else
-        bbnote "Kernel module auto FIPS mode - hash will be determined by build"
+        bbnote "Kernel module auto FIPS mode - will use 'make module-with-matching-fips-hash-no-sign' to compute and embed the correct hash"
     fi
 }
 
 addtask do_configure_fips_hash_check after do_patch before do_configure
 
+do_compile() {
+    if [ "${WOLFSSL_FIPS_HASH_MODE_LINUXKM}" = "auto" ]; then
+        bbnote "Auto FIPS hash mode: running 'make module-with-matching-fips-hash-no-sign'"
+        bbnote "This will build the .ko, compute the FIPS hash, and patch it in-place."
+
+        # The linuxkm Makefile's libwolfssl-user-build step builds a host-native
+        # userspace wolfSSL library (it unsets CC/LD itself, uses host cc), but
+        # Yocto's cross-compilation LDFLAGS (containing --sysroot=...) and CPPFLAGS
+        # would leak through and break the host build. Unset them here — the kernel
+        # module build itself goes through 'make -C $(KERNEL_ROOT)' which is
+        # self-contained.
+        unset LDFLAGS
+        unset CPPFLAGS
+
+        # Run from top-level source dir so that the autotools-generated Makefile
+        # exports KERNEL_ROOT, KERNEL_ARCH, and other configure-derived variables
+        # to the linuxkm/ sub-make. Pass HOSTCC so the patched linuxkm Makefile
+        # uses the correct host-native compiler instead of bare 'cc'.
+        oe_runmake module-with-matching-fips-hash-no-sign HOSTCC=$(which ${BUILD_CC})
+    else
+        oe_runmake
+    fi
+}
+
 do_install() {
     install -d ${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/extra
     install -m 0644 ${S}/linuxkm/libwolfssl.ko \