new file mode 100644
@@ -0,0 +1,96 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Khem Raj <khem.raj@oss.qualcomm.com>
+Date: Mon, 19 Oct 2026 23:09:52 -0700
+Subject: [PATCH] FIPS checker builder: Use $OBJCOPY and report failures
+
+The script that inserts the FIPS integrity digest into leancrypto-fips
+runs the build machine's objcopy. When cross compiling, that objcopy
+usually cannot read the target ELF file. The failure is not noticed
+either: "exit $?" after echo returns the status of echo, so the
+script exits 0, and the library is installed with the placeholder
+digest. At runtime the integrity test then fails and all algorithms
+are put into the error state:
+
+ ERROR: objcopy command failed: 0
+
+Use $OBJCOPY when set, as cross build environments export the objcopy
+for the target there, and keep the exit status so errors fail the
+build.
+
+llvm-objcopy fails when a section to dump does not exist, and some C
+libraries (e.g. musl on RISC-V) provide no .init section. Extract the
+init section separately and use an empty file when it is not present,
+which matches the empty range the linker script provides for it.
+
+Upstream-Status: Pending
+Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
+---
+ addon/fips_integrity_checker_elf_generator.sh | 34 +++++++++++++------
+ 1 file changed, 23 insertions(+), 11 deletions(-)
+
+diff --git a/addon/fips_integrity_checker_elf_generator.sh b/addon/fips_integrity_checker_elf_generator.sh
+index 10628f5..1675f23 100755
+--- a/addon/fips_integrity_checker_elf_generator.sh
++++ b/addon/fips_integrity_checker_elf_generator.sh
+@@ -9,7 +9,7 @@ RODATASEGMENT=".lc_fips_rodata"
+ FIPSDATASEGMENT=".lc_fips_integrity_data"
+ SECOUTFILE="extracted_sections.digest"
+
+-OBJCOPY="objcopy"
++OBJCOPY="${OBJCOPY:-objcopy}"
+ CAT="cat"
+ CUT="cut"
+
+@@ -43,30 +43,42 @@ touch $RODATASEGMENT
+ # Extract sections
+ $OBJCOPY \
+ --dump-section $TEXTSEGMENT=$TEXTSEGMENT \
+- --dump-section $INITSEGMENT=$INITSEGMENT \
+ --dump-section $RODATASEGMENT=$RODATASEGMENT \
+- $SOFILE 2>/dev/null
++ $SOFILE
++ret=$?
++if [ $ret -ne 0 ]
++then
++ echo "ERROR: $OBJCOPY command failed: $ret"
++ exit $ret
++fi
++
++# Not every C library provides an init section (e.g. musl on RISC-V). The
++# linker script then defines an empty init range, which matches the empty
++# file created above. llvm-objcopy fails on a missing section, so extract it
++# separately and only when it is present.
++$OBJCOPY --dump-section $INITSEGMENT=$INITSEGMENT $SOFILE 2>/dev/null
+ if [ $? -ne 0 ]
+ then
+- echo "ERROR: $OBJCOPY command failed: $?"
+- exit $?
++ : > $INITSEGMENT
+ fi
+
+ # Merge sections into file and create digest
+ $CAT $TEXTSEGMENT $INITSEGMENT $RODATASEGMENT | $HASHER -b - > $SECOUTFILE 2>/dev/null
+-if [ $? -ne 0 ]
++ret=$?
++if [ $ret -ne 0 ]
+ then
+- echo "ERROR: $CAT command failed: $?"
+- exit $?
++ echo "ERROR: $CAT command failed: $ret"
++ exit $ret
+ fi
+
+ # Insert data into library file using an atomic operation
+ trap "rm -f $SOFILE.$$" 0 1 2 3 15
+ cp $SOFILE $SOFILE.$$
+ $OBJCOPY --update-section $FIPSDATASEGMENT="$SECOUTFILE" $SOFILE.$$
+-if [ $? -ne 0 ]
++ret=$?
++if [ $ret -ne 0 ]
+ then
+- echo "ERROR: $OBJCOPY command failed: $?"
+- exit $?
++ echo "ERROR: $OBJCOPY command failed: $ret"
++ exit $ret
+ fi
+ mv -f $SOFILE.$$ $SOFILE
@@ -15,6 +15,7 @@ SRC_URI = "git://github.com/smuellerDD/leancrypto.git;branch=master;protocol=htt
file://leancrypto-tests.sh \
file://0001-secure_execution_linux-drop-redundant-linux-prctl.h-.patch \
file://0002-Linker-script-Handle-a-missing-.init-section.patch \
+ file://0003-FIPS-checker-builder-Use-OBJCOPY-and-report-failures.patch \
"
SRCREV = "65eb4e7e84e3a5499460a66b1623ccf6c59628b1"
The script that inserts the FIPS integrity digest into libleancrypto-fips runs the build host's objcopy, which cannot read the target ELF file, and it hides the failure because "exit $?" after echo returns 0. The library is then installed with the placeholder digest, its integrity self-test fails at load time and all algorithms are put into the error state. Make the script use $OBJCOPY, which points to the target objcopy, keep the exit status of failing commands, and tolerate a missing .init section which llvm-objcopy otherwise errors out on. Tested by loading the riscv64 musl library under qemu-riscv64: the integrity test now passes and FIPS140Mode is reported as true. AI-Generated: Uses Claude Code Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> --- ...lder-Use-OBJCOPY-and-report-failures.patch | 96 +++++++++++++++++++ .../leancrypto/leancrypto_1.9.1.bb | 1 + 2 files changed, 97 insertions(+) create mode 100644 meta-oe/recipes-crypto/leancrypto/files/0003-FIPS-checker-builder-Use-OBJCOPY-and-report-failures.patch