diff --git a/meta-oe/recipes-crypto/leancrypto/files/0001-linux_kernel-use-target-architecture-for-generated-headers.patch b/meta-oe/recipes-crypto/leancrypto/files/0001-linux_kernel-use-target-architecture-for-generated-headers.patch new file mode 100644 index 0000000000..1ce848265e --- /dev/null +++ b/meta-oe/recipes-crypto/leancrypto/files/0001-linux_kernel-use-target-architecture-for-generated-headers.patch @@ -0,0 +1,164 @@ +From 47aedd8d985b94dc35836925c123cb705985796b Mon Sep 17 00:00:00 2001 +From: Ayoub Zaki +Date: Sun, 1 Nov 2026 16:55:00 +0100 +Subject: [PATCH] linux_kernel: use target architecture for generated headers + +Derive the architecture from the target kernel configuration and pass it +to the AWK generators instead of querying uname -m. +This prevents cross builds from using the build host's settings. + +Upstream-Status: Submitted [https://github.com/smuellerDD/leancrypto/pull/79] +Signed-off-by: Ayoub Zaki +--- + linux_kernel/Kbuild.autogen | 28 ++++++++++++++++++++++------ + linux_kernel/README.md | 8 ++++++++ + linux_kernel/lc_ascon_hash.awk | 7 ++----- + linux_kernel/lc_hash.h.awk | 9 +++------ + linux_kernel/lc_memory_support.awk | 11 ++++------- + 5 files changed, 39 insertions(+), 24 deletions(-) + +diff --git a/linux_kernel/Kbuild.autogen b/linux_kernel/Kbuild.autogen +index e5052406d..da6d5d05a 100644 +--- a/linux_kernel/Kbuild.autogen ++++ b/linux_kernel/Kbuild.autogen +@@ -3,6 +3,17 @@ + + # Generic support files + ++# Use the target kernel configuration not the build host architecture ++ifdef CONFIG_X86_64 ++lc_target_arch := x86_64 ++else ifdef CONFIG_ARM ++lc_target_arch := arm ++else ifdef CONFIG_ARM64 ++lc_target_arch := aarch64 ++else ++lc_target_arch := generic ++endif ++ + clean-files := $(obj)/lc_memory_support.h $(obj)/lc_hash.h + + $(obj)/posix_support.o: $(obj)/lc_memory_support.h +@@ -10,16 +21,19 @@ $(obj)/posix_support.o: $(obj)/lc_memory_support.h + targets += lc_memory_support.h + + quiet_cmd_build_lc_memory_support = GEN $@ +- cmd_build_lc_memory_support = awk -f $(src)/lc_memory_support.awk $< > $@ +-$(obj)/lc_memory_support.h: $(src)/../internal/api/lc_memory_support.h.in FORCE ++ cmd_build_lc_memory_support = awk -v target_arch=$(lc_target_arch) \ ++ -f $(src)/lc_memory_support.awk $< > $@ ++$(obj)/lc_memory_support.h: $(src)/../internal/api/lc_memory_support.h.in \ ++ $(src)/lc_memory_support.awk FORCE + $(call if_changed,build_lc_memory_support) + + $(obj)/leancrypto_kernel.o: $(obj)/lc_hash.h + targets += lc_hash.h + + quiet_cmd_build_lc_hash = GEN $@ +- cmd_build_lc_hash = awk -f $(src)/lc_hash.h.awk $< > $@ +-$(obj)/lc_hash.h: $(src)/../hash/api/lc_hash.h.in FORCE ++ cmd_build_lc_hash = awk -v target_arch=$(lc_target_arch) \ ++ -f $(src)/lc_hash.h.awk $< > $@ ++$(obj)/lc_hash.h: $(src)/../hash/api/lc_hash.h.in $(src)/lc_hash.h.awk FORCE + $(call if_changed,build_lc_hash) + + +@@ -103,8 +117,10 @@ clean-files += $(obj)/lc_ascon_hash.h + + + quiet_cmd_build_lc_ascon_hash = GEN $@ +- cmd_build_lc_ascon_hash = awk -f $(src)/lc_ascon_hash.awk $< > $@ +-$(obj)/lc_ascon_hash.h: $(src)/../hash/api/lc_ascon_hash.h.in FORCE ++ cmd_build_lc_ascon_hash = awk -v target_arch=$(lc_target_arch) \ ++ -f $(src)/lc_ascon_hash.awk $< > $@ ++$(obj)/lc_ascon_hash.h: $(src)/../hash/api/lc_ascon_hash.h.in \ ++ $(src)/lc_ascon_hash.awk FORCE + $(call if_changed,build_lc_ascon_hash) + + +diff --git a/linux_kernel/README.md b/linux_kernel/README.md +index 45ae377cc..17ff76b16 100644 +--- a/linux_kernel/README.md ++++ b/linux_kernel/README.md +@@ -21,6 +21,14 @@ directory `linux_kernel`: + + 2. the leancrypto library is provided with `leancrypto.ko` + ++For cross-compilation set `KDIR` to the configured and prepared target kernel ++build directory and pass the kernel architecture and compiler prefix: ++ ++```sh ++make KDIR=/path/to/target/kernel/build ARCH=arm64 \ ++ CROSS_COMPILE=aarch64-linux-gnu- ++``` ++ + ## Build in Tree + + When the use of leancrypto as a kernel module is insufficient, e.g. when its +diff --git a/linux_kernel/lc_ascon_hash.awk b/linux_kernel/lc_ascon_hash.awk +index e1fed4cf6..e3c048511 100644 +--- a/linux_kernel/lc_ascon_hash.awk ++++ b/linux_kernel/lc_ascon_hash.awk +@@ -1,9 +1,6 @@ +-# Set the Ascon memory size +-BEGIN { +- "uname -m" | getline host +-} ++# Set the Ascon memory size for target_arch + { +- if (host=="x86_64") { ++ if (target_arch=="x86_64") { + gsub("mesondefine LC_DEF_ASCON_AVX512", "define LC_DEF_ASCON_AVX512", $0) ; + } else { + gsub("mesondefine LC_DEF_ASCON_AVX512", "undef LC_DEF_ASCON_AVX512", $0) ; +diff --git a/linux_kernel/lc_hash.h.awk b/linux_kernel/lc_hash.h.awk +index d26e36304..0a83bade2 100644 +--- a/linux_kernel/lc_hash.h.awk ++++ b/linux_kernel/lc_hash.h.awk +@@ -1,9 +1,6 @@ +-# Set the hash alignment value +-BEGIN { +- "uname -m" | getline host +-} ++# Set the hash alignment value for target_arch + { +- if (host=="x86_64") { ++ if (target_arch=="x86_64") { + # This value has to be limited to 32 as otherwise the hash + # algorithms fail to register since their state is larger than + # HASH_MAX_DESCSIZE - this is an arbitrary defined value in +@@ -14,7 +11,7 @@ BEGIN { + # implementation as it requires an alignment of the buffer to + # 512 bits. + gsub("@hash_common_alignment@", "32", $0) ; +- } else if (host=="arm") { ++ } else if (target_arch=="arm") { + gsub("@hash_common_alignment@", "32", $0) ; + } else { + gsub("@hash_common_alignment@", "8", $0) ; +diff --git a/linux_kernel/lc_memory_support.awk b/linux_kernel/lc_memory_support.awk +index b3480a7e2..4b346a742 100644 +--- a/linux_kernel/lc_memory_support.awk ++++ b/linux_kernel/lc_memory_support.awk +@@ -1,17 +1,14 @@ +-# Set the XOR alignment value +-BEGIN { +- "uname -m" | getline host +-} ++# Set the XOR alignment value for target_arch + { +- if (host=="x86_64") { ++ if (target_arch=="x86_64") { + gsub("mesondefine LC_DEF_HOST_X86_64", "define LC_DEF_HOST_X86_64", $0) ; + gsub("mesondefine LC_DEF_HOST_ARM32_NEON", "undef LC_DEF_HOST_ARM32_NEON", $0) ; + gsub("mesondefine LC_DEF_HOST_AARCH64", "undef LC_DEF_HOST_AARCH64", $0) ; +- } else if (host=="arm") { ++ } else if (target_arch=="arm") { + gsub("mesondefine LC_DEF_HOST_X86_64", "undef LC_DEF_HOST_X86_64", $0) ; + gsub("mesondefine LC_DEF_HOST_ARM32_NEON", "define LC_DEF_HOST_ARM32_NEON", $0) ; + gsub("mesondefine LC_DEF_HOST_AARCH64", "undef LC_DEF_HOST_AARCH64", $0) ; +- } else if (host=="aarch64") { ++ } else if (target_arch=="aarch64") { + gsub("mesondefine LC_DEF_HOST_X86_64", "undef LC_DEF_HOST_X86_64", $0) ; + gsub("mesondefine LC_DEF_HOST_ARM32_NEON", "undef LC_DEF_HOST_ARM32_NEON", $0) ; + gsub("mesondefine LC_DEF_HOST_AARCH64", "define LC_DEF_HOST_AARCH64", $0) ; diff --git a/meta-oe/recipes-crypto/leancrypto/leancrypto-module_1.9.1.bb b/meta-oe/recipes-crypto/leancrypto/leancrypto-module_1.9.1.bb new file mode 100644 index 0000000000..ea74347792 --- /dev/null +++ b/meta-oe/recipes-crypto/leancrypto/leancrypto-module_1.9.1.bb @@ -0,0 +1,25 @@ +SUMMARY = "Leancrypto Linux kernel module" +DESCRIPTION = "Standalone Linux kernel module providing PQC-resistant algorithms" + +require leancrypto.inc + +SRC_URI += "file://0001-linux_kernel-use-target-architecture-for-generated-headers.patch" + +inherit module + +B = "${S}/linux_kernel" + +MAKE_TARGETS = "modules" +# Also apply when a custom Kbuild.config is supplied +EXTRA_OEMAKE += "KDIR=${STAGING_KERNEL_DIR} \ + CONFIG_LEANCRYPTO=m \ + CONFIG_LEANCRYPTO_TEST_MODULES=n \ +" + +# Supply Kbuild.config to SRC_URI in a bbappend to select algorithms +# Otherwise retain upstream settings +do_configure() { + if [ -f ${UNPACKDIR}/Kbuild.config ]; then + install -m 0644 ${UNPACKDIR}/Kbuild.config ${B}/Kbuild.config + fi +} diff --git a/meta-oe/recipes-crypto/leancrypto/leancrypto.inc b/meta-oe/recipes-crypto/leancrypto/leancrypto.inc new file mode 100644 index 0000000000..fdccdb5a77 --- /dev/null +++ b/meta-oe/recipes-crypto/leancrypto/leancrypto.inc @@ -0,0 +1,10 @@ +HOMEPAGE = "https://leancrypto.org" +LICENSE = "BSD-3-Clause OR GPL-2.0-only" +LIC_FILES_CHKSUM = " \ + file://LICENSE;md5=581f53c96a634ae7f241516370a8f1ee \ + file://LICENSE.bsd;md5=66a5cedaf62c4b2637025f049f9b826f \ + file://LICENSE.gplv2;md5=eb723b61539feef013de476e68b5c50a \ +" + +SRC_URI = "git://github.com/smuellerDD/leancrypto.git;branch=master;protocol=https;tag=v${PV}" +SRCREV = "65eb4e7e84e3a5499460a66b1623ccf6c59628b1" diff --git a/meta-oe/recipes-crypto/leancrypto/leancrypto_1.9.1.bb b/meta-oe/recipes-crypto/leancrypto/leancrypto_1.9.1.bb index 17f7f0a7f7..b732fc5764 100644 --- a/meta-oe/recipes-crypto/leancrypto/leancrypto_1.9.1.bb +++ b/meta-oe/recipes-crypto/leancrypto/leancrypto_1.9.1.bb @@ -3,21 +3,15 @@ DESCRIPTION = "leancrypto is a cryptographic library that exclusively contains \ PQC-resistant cryptographic algorithms. It is lean, has minimal dependencies, \ supports stack-only operation and provides optimized implementations for \ ML-KEM (Kyber), ML-DSA (Dilithium), SLH-DSA (Sphincs+) and many more" -HOMEPAGE = "https://leancrypto.org" -LICENSE = "BSD-3-Clause OR GPL-2.0-only" -LIC_FILES_CHKSUM = " \ - file://LICENSE;md5=581f53c96a634ae7f241516370a8f1ee \ - file://LICENSE.bsd;md5=66a5cedaf62c4b2637025f049f9b826f \ - file://LICENSE.gplv2;md5=eb723b61539feef013de476e68b5c50a \ - " SECTION = "libs" -SRC_URI = "git://github.com/smuellerDD/leancrypto.git;branch=master;protocol=https;tag=v${PV} \ - file://leancrypto-tests.sh \ - file://0001-secure_execution_linux-drop-redundant-linux-prctl.h-.patch \ - file://0002-Linker-script-Handle-a-missing-.init-section.patch \ - file://0003-FIPS-checker-builder-Use-OBJCOPY-and-report-failures.patch \ - " -SRCREV = "65eb4e7e84e3a5499460a66b1623ccf6c59628b1" + +require leancrypto.inc + +SRC_URI += "file://leancrypto-tests.sh \ + file://0001-secure_execution_linux-drop-redundant-linux-prctl.h-.patch \ + file://0002-Linker-script-Handle-a-missing-.init-section.patch \ + file://0003-FIPS-checker-builder-Use-OBJCOPY-and-report-failures.patch \ +" inherit pkgconfig meson