From 135e920976d339cf022e3db6d5efd093af59b666 Mon Sep 17 00:00:00 2001 From: night1rider Date: Mon, 23 Feb 2026 11:00:24 -0700 Subject: [PATCH 1/7] update configuration --- recipes-wolfssl/wolfssl/wolfssl-fips.bb | 3 +++ recipes-wolfssl/wolfssl/wolfssl-linuxkm-fips.bb | 5 ++++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/recipes-wolfssl/wolfssl/wolfssl-fips.bb b/recipes-wolfssl/wolfssl/wolfssl-fips.bb index 1118d23..2bf00e1 100644 --- a/recipes-wolfssl/wolfssl/wolfssl-fips.bb +++ b/recipes-wolfssl/wolfssl/wolfssl-fips.bb @@ -79,4 +79,7 @@ TARGET_CFLAGS += "-DFP_MAX_BITS=16384" EXTRA_OECONF += " \ --enable-fips=v5 \ --enable-reproducible-build \ + --enable-smallstack + --enable-sp-math-all + --disable-sp " diff --git a/recipes-wolfssl/wolfssl/wolfssl-linuxkm-fips.bb b/recipes-wolfssl/wolfssl/wolfssl-linuxkm-fips.bb index 9c9d77a..c38fbac 100644 --- a/recipes-wolfssl/wolfssl/wolfssl-linuxkm-fips.bb +++ b/recipes-wolfssl/wolfssl/wolfssl-linuxkm-fips.bb @@ -88,8 +88,11 @@ EXTRA_OECONF = " \ --enable-linuxkm \ --enable-fips=v5.2.4 \ --with-linux-source=${STAGING_KERNEL_BUILDDIR} \ - --enable-all-crypto \ --enable-crypttests \ + --enable-smallstack \ + --enable-sp-math-all \ + --disable-sp \ + --enable-linuxkm-lkcapi-register=all-kconfig \ " python __anonymous() { From 05457794013f04e2bb42ce2a3adab092a9782b11 Mon Sep 17 00:00:00 2001 From: night1rider Date: Mon, 23 Feb 2026 11:07:41 -0700 Subject: [PATCH 2/7] Update to remove kcapi setting --- recipes-wolfssl/wolfssl/wolfssl-linuxkm-fips.bb | 1 - 1 file changed, 1 deletion(-) diff --git a/recipes-wolfssl/wolfssl/wolfssl-linuxkm-fips.bb b/recipes-wolfssl/wolfssl/wolfssl-linuxkm-fips.bb index c38fbac..8eb9f0e 100644 --- a/recipes-wolfssl/wolfssl/wolfssl-linuxkm-fips.bb +++ b/recipes-wolfssl/wolfssl/wolfssl-linuxkm-fips.bb @@ -92,7 +92,6 @@ EXTRA_OECONF = " \ --enable-smallstack \ --enable-sp-math-all \ --disable-sp \ - --enable-linuxkm-lkcapi-register=all-kconfig \ " python __anonymous() { From 186bb07d83918030cae7445e2d004ad86172f01b Mon Sep 17 00:00:00 2001 From: night1rider Date: Wed, 25 Feb 2026 15:06:40 -0700 Subject: [PATCH 3/7] Update the config --- recipes-wolfssl/wolfssl/wolfssl-fips.bb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/recipes-wolfssl/wolfssl/wolfssl-fips.bb b/recipes-wolfssl/wolfssl/wolfssl-fips.bb index 2bf00e1..93b9691 100644 --- a/recipes-wolfssl/wolfssl/wolfssl-fips.bb +++ b/recipes-wolfssl/wolfssl/wolfssl-fips.bb @@ -79,7 +79,7 @@ TARGET_CFLAGS += "-DFP_MAX_BITS=16384" EXTRA_OECONF += " \ --enable-fips=v5 \ --enable-reproducible-build \ - --enable-smallstack - --enable-sp-math-all - --disable-sp + --enable-smallstack \ + --enable-sp-math-all \ + --disable-sp \ " From 43e886b348219194ce349b627a244984b12f9558 Mon Sep 17 00:00:00 2001 From: night1rider Date: Thu, 26 Feb 2026 12:49:09 -0700 Subject: [PATCH 4/7] add kernel module signing step to install stage via .inc --- .../wolfssl-linuxkm-sign-module-modern.inc | 16 +++++++++++ .../wolfssl-linuxkm-sign-module.inc | 28 +++++++++++++++++++ 2 files changed, 44 insertions(+) create mode 100644 inc/wolfssl-linuxkm/scarthgap/wolfssl-linuxkm-sign-module-modern.inc create mode 100644 inc/wolfssl-linuxkm/wolfssl-linuxkm-sign-module.inc diff --git a/inc/wolfssl-linuxkm/scarthgap/wolfssl-linuxkm-sign-module-modern.inc b/inc/wolfssl-linuxkm/scarthgap/wolfssl-linuxkm-sign-module-modern.inc new file mode 100644 index 0000000..61d1508 --- /dev/null +++ b/inc/wolfssl-linuxkm/scarthgap/wolfssl-linuxkm-sign-module-modern.inc @@ -0,0 +1,16 @@ +# Sign libwolfssl.ko with the kernel's own signing key to prevent +# "module verification failed: signature and/or required key missing" taint on load. + +do_install:append() { + KO="${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/extra/libwolfssl.ko" + SIGN_FILE="${STAGING_KERNEL_BUILDDIR}/scripts/sign-file" + KEY="${STAGING_KERNEL_BUILDDIR}/certs/signing_key.pem" + CERT="${STAGING_KERNEL_BUILDDIR}/certs/signing_key.x509" + + if [ -x "${SIGN_FILE}" ] && [ -f "${KEY}" ] && [ -f "${CERT}" ]; then + bbnote "Signing libwolfssl.ko with kernel signing key" + "${SIGN_FILE}" sha256 "${KEY}" "${CERT}" "${KO}" + else + bbwarn "Kernel signing key not found - libwolfssl.ko will taint the kernel on load" + fi +} diff --git a/inc/wolfssl-linuxkm/wolfssl-linuxkm-sign-module.inc b/inc/wolfssl-linuxkm/wolfssl-linuxkm-sign-module.inc new file mode 100644 index 0000000..06f0eda --- /dev/null +++ b/inc/wolfssl-linuxkm/wolfssl-linuxkm-sign-module.inc @@ -0,0 +1,28 @@ +# Check Yocto version and include appropriate file +def wolfssl_linuxkm_get_sign_inc(d): + import os + layerseries = d.getVar('LAYERSERIES_CORENAMES') or "" + + bb.note("wolfssl-linuxkm-sign-module.inc: LAYERSERIES_CORENAMES = %s" % layerseries) + + use_modern = False + codename = None + if layerseries: + series_list = layerseries.split() + modern_series = ['dunfell', 'gatesgarth', 'hardknott', 'honister', 'kirkstone', 'langdale', 'mickledore', 'nanbield', 'scarthgap'] + for series in series_list: + codename = series + if series in modern_series: + use_modern = True + break + + layerdir = d.getVar('WOLFSSL_LAYERDIR') + if use_modern: + inc_file = os.path.join(layerdir, 'inc/wolfssl-linuxkm/%s/wolfssl-linuxkm-sign-module-modern.inc' % codename) + else: + inc_file = os.path.join(layerdir, 'inc/wolfssl-linuxkm/%s/wolfssl-linuxkm-sign-module-legacy.inc' % codename) + + bb.note("wolfssl-linuxkm-sign-module.inc: Including file: %s" % inc_file) + return inc_file + +require ${@wolfssl_linuxkm_get_sign_inc(d)} From 2a26716073afca92ed2e44fcf61e14d59d9d5ee1 Mon Sep 17 00:00:00 2001 From: night1rider Date: Fri, 27 Feb 2026 12:37:49 -0700 Subject: [PATCH 5/7] Auto hash for kernel module builds --- conf/wolfssl-fips.conf.sample | 8 +++++ .../wolfssl/wolfssl-linuxkm-fips.bb | 35 ++++++++++++++++++- 2 files changed, 42 insertions(+), 1 deletion(-) diff --git a/conf/wolfssl-fips.conf.sample b/conf/wolfssl-fips.conf.sample index 2c34885..572185a 100644 --- a/conf/wolfssl-fips.conf.sample +++ b/conf/wolfssl-fips.conf.sample @@ -23,6 +23,14 @@ PREFERRED_PROVIDER_wolfssl = "wolfssl-fips" # FIPS hash mode: "auto" (QEMU-based extraction) or "manual" (use static FIPS_HASH) WOLFSSL_FIPS_HASH_MODE ?= "manual" +# Linux kernel module FIPS hash mode: +# "manual" - Use FIPS_HASH_LINUXKM from config (two-pass: build once to get hash, set it, rebuild) +# "auto" - Use 'make module-with-matching-fips-hash' to compute and embed hash automatically +#WOLFSSL_FIPS_HASH_MODE_LINUXKM ?= "auto" + +# Kernel module FIPS hash (only needed for manual mode) +#FIPS_HASH_LINUXKM = "" + # ============================================================================ # FIPS Bundle Configuration - EDIT THESE VALUES # ============================================================================ diff --git a/recipes-wolfssl/wolfssl/wolfssl-linuxkm-fips.bb b/recipes-wolfssl/wolfssl/wolfssl-linuxkm-fips.bb index 8eb9f0e..90b90d5 100644 --- a/recipes-wolfssl/wolfssl/wolfssl-linuxkm-fips.bb +++ b/recipes-wolfssl/wolfssl/wolfssl-linuxkm-fips.bb @@ -109,12 +109,45 @@ do_configure_fips_hash_check() { bbwarn "WOLFSSL_FIPS_HASH_MODE_LINUXKM=manual but FIPS_HASH_LINUXKM is not set" fi else - bbnote "Kernel module auto FIPS mode - hash will be determined by build" + bbnote "Kernel module auto FIPS mode - will use 'make module-with-matching-fips-hash-no-sign' to compute and embed the correct hash" fi } addtask do_configure_fips_hash_check after do_patch before do_configure +do_compile() { + if [ "${WOLFSSL_FIPS_HASH_MODE_LINUXKM}" = "auto" ]; then + bbnote "Auto FIPS hash mode: running 'make module-with-matching-fips-hash-no-sign'" + bbnote "This will build the .ko, compute the FIPS hash, and patch it in-place." + + # The linuxkm Makefile's libwolfssl-user-build step builds a host-native + # userspace wolfSSL library (it unsets CC/LD itself, uses host cc), but + # Yocto's cross-compilation LDFLAGS (containing --sysroot=...) and CPPFLAGS + # would leak through and break the host build. Unset them here — the kernel + # module build itself goes through 'make -C $(KERNEL_ROOT)' which is + # self-contained. + unset LDFLAGS + unset CPPFLAGS + + # The linuxkm Makefile hardcodes 'cc' for host-native builds (linuxkm-fips-hash + # and libwolfssl-user-build). Yocto's build environment doesn't provide 'cc' + # on PATH. Create a temporary symlink using BUILD_CC (the host-native compiler). + mkdir -p ${B}/host-bin + ln -sf $(which ${BUILD_CC}) ${B}/host-bin/cc + export PATH="${B}/host-bin:${PATH}" + + # Run from top-level source dir so that the autotools-generated Makefile + # exports KERNEL_ROOT, KERNEL_ARCH, and other configure-derived variables + # to the linuxkm/ sub-make. + oe_runmake module-with-matching-fips-hash-no-sign + + # Clean up temporary symlink + rm -rf ${B}/host-bin + else + oe_runmake + fi +} + do_install() { install -d ${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/extra install -m 0644 ${S}/linuxkm/libwolfssl.ko \ From 56cfb5840ceda3d8e944dfc639c1b61e49ba8c21 Mon Sep 17 00:00:00 2001 From: night1rider Date: Fri, 27 Feb 2026 14:53:18 -0700 Subject: [PATCH 6/7] Prep for eventual update to pass a HOST CC to linux km fips auto hash process --- recipes-wolfssl/wolfssl/wolfssl-linuxkm-fips.bb | 15 +++------------ 1 file changed, 3 insertions(+), 12 deletions(-) diff --git a/recipes-wolfssl/wolfssl/wolfssl-linuxkm-fips.bb b/recipes-wolfssl/wolfssl/wolfssl-linuxkm-fips.bb index 90b90d5..f81578b 100644 --- a/recipes-wolfssl/wolfssl/wolfssl-linuxkm-fips.bb +++ b/recipes-wolfssl/wolfssl/wolfssl-linuxkm-fips.bb @@ -129,20 +129,11 @@ do_compile() { unset LDFLAGS unset CPPFLAGS - # The linuxkm Makefile hardcodes 'cc' for host-native builds (linuxkm-fips-hash - # and libwolfssl-user-build). Yocto's build environment doesn't provide 'cc' - # on PATH. Create a temporary symlink using BUILD_CC (the host-native compiler). - mkdir -p ${B}/host-bin - ln -sf $(which ${BUILD_CC}) ${B}/host-bin/cc - export PATH="${B}/host-bin:${PATH}" - # Run from top-level source dir so that the autotools-generated Makefile # exports KERNEL_ROOT, KERNEL_ARCH, and other configure-derived variables - # to the linuxkm/ sub-make. - oe_runmake module-with-matching-fips-hash-no-sign - - # Clean up temporary symlink - rm -rf ${B}/host-bin + # to the linuxkm/ sub-make. Pass HOSTCC so the patched linuxkm Makefile + # uses the correct host-native compiler instead of bare 'cc'. + oe_runmake module-with-matching-fips-hash-no-sign HOSTCC=$(which ${BUILD_CC}) else oe_runmake fi From b1c3277d134ee552d3ab034fac12a6bfe41937b3 Mon Sep 17 00:00:00 2001 From: night1rider Date: Tue, 3 Mar 2026 10:14:45 -0700 Subject: [PATCH 7/7] update method for kernel signing to be handled by the makefile process --- .../wolfssl-linuxkm-sign-module-modern.inc | 37 +++++++++++++------ 1 file changed, 25 insertions(+), 12 deletions(-) diff --git a/inc/wolfssl-linuxkm/scarthgap/wolfssl-linuxkm-sign-module-modern.inc b/inc/wolfssl-linuxkm/scarthgap/wolfssl-linuxkm-sign-module-modern.inc index 61d1508..10bec82 100644 --- a/inc/wolfssl-linuxkm/scarthgap/wolfssl-linuxkm-sign-module-modern.inc +++ b/inc/wolfssl-linuxkm/scarthgap/wolfssl-linuxkm-sign-module-modern.inc @@ -1,16 +1,29 @@ -# Sign libwolfssl.ko with the kernel's own signing key to prevent -# "module verification failed: signature and/or required key missing" taint on load. +# Use the linuxkm Makefile's native signing target to produce libwolfssl.ko.signed, +# then install it in place of the unsigned libwolfssl.ko. -do_install:append() { - KO="${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/extra/libwolfssl.ko" - SIGN_FILE="${STAGING_KERNEL_BUILDDIR}/scripts/sign-file" - KEY="${STAGING_KERNEL_BUILDDIR}/certs/signing_key.pem" - CERT="${STAGING_KERNEL_BUILDDIR}/certs/signing_key.x509" - - if [ -x "${SIGN_FILE}" ] && [ -f "${KEY}" ] && [ -f "${CERT}" ]; then - bbnote "Signing libwolfssl.ko with kernel signing key" - "${SIGN_FILE}" sha256 "${KEY}" "${CERT}" "${KO}" +do_compile() { + if [ "${WOLFSSL_FIPS_HASH_MODE_LINUXKM}" = "auto" ]; then + bbnote "Auto FIPS hash mode: running 'make module-with-matching-fips-hash'" + bbnote "This will build the .ko, compute the FIPS hash, patch it in-place, and sign it." + unset LDFLAGS + unset CPPFLAGS + oe_runmake module-with-matching-fips-hash HOSTCC=$(which ${BUILD_CC}) else - bbwarn "Kernel signing key not found - libwolfssl.ko will taint the kernel on load" + oe_runmake + fi +} + +do_install() { + install -d ${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/extra + KO_SIGNED="${S}/linuxkm/libwolfssl.ko.signed" + KO_UNSIGNED="${S}/linuxkm/libwolfssl.ko" + if [ -f "${KO_SIGNED}" ]; then + bbnote "Installing libwolfssl.ko.signed (signed by linuxkm Makefile)" + install -m 0644 "${KO_SIGNED}" \ + ${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/extra/libwolfssl.ko + else + bbwarn "libwolfssl.ko.signed not found - installing unsigned libwolfssl.ko" + install -m 0644 "${KO_UNSIGNED}" \ + ${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/extra/ fi }