From patchwork Mon Nov 2 07:29:34 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ayoub Zaki X-Patchwork-Id: 102659 Received: from mailrelay-egress16.pub.mailoutpod3-cph3.one.com (mailrelay-egress16.pub.mailoutpod3-cph3.one.com [46.30.212.3]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.7637.1793604579823886910 for ; Sun, 01 Nov 2026 23:29:41 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@embetrix.com header.s=rsa1 header.b=TkC+qWkd; dkim=pass header.i=@embetrix.com header.s=ed1 header.b=SQUj1Bj0; spf=none, err=permanent DNS error (domain: embetrix.com, ip: 46.30.212.3, mailfrom: ayoub.zaki@embetrix.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; t=1793604576; x=1794209376; d=embetrix.com; s=rsa1; h=content-transfer-encoding:mime-version:message-id:date:subject:cc:to:from: from; bh=PvVFj5JHd3Jdo9Krz6suZE7EtdAhVrlqZyh8/wT7dNU=; b=TkC+qWkdCBej/NlUe/RbW/fAJkpJCLHNrdWZX/O+gc0IL8c8AVkxuwZXAInD3IvkzDY890RDu4Oxs 6gS4eHVe1yJPr7WCcUc8HaGsWoIuqfxxsVsYL4yx7JtYj3KQo8dmPmachYHjuM+NuL6puk8T6qCyRP 6jhEOnAAhwhpLWPKflzjPONf++b/Ioskpi5vMDZN27wwwDFcEwUCFLLyTJscuqXTAd65bOg1kJVAXi OcZYEmScEEgA8y3kBGfI/HkW4htZSNwMpHsuBSict1xutER3sfookWyHIKA6RMDJWDBfZ7wuYb2UDm GfMp+eDAEH8B+EAmsJlolV5iQMc4NjA== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; t=1793604576; x=1794209376; d=embetrix.com; s=ed1; h=content-transfer-encoding:mime-version:message-id:date:subject:cc:to:from: from; bh=PvVFj5JHd3Jdo9Krz6suZE7EtdAhVrlqZyh8/wT7dNU=; b=SQUj1Bj04uoU5gBn/wRfBDbQzrcBIDknK7e9M1BHXesAnQi2fondxrcACyzBRtfqc/t7NeDeAIvWG XERSXLNBg== X-HalOne-ID: 26c3ff81-d68f-11f1-9e85-4fe78d1e3c23 Received: from xps-13.fritz.box (dynamic-2a02-3102-8c10-1ae0-ac69-42a0-6860-65be.310.pool.telefonica.de [2a02:3102:8c10:1ae0:ac69:42a0:6860:65be]) by mailrelay2.pub.mailoutpod2-cph3.one.com (Halon) with ESMTPSA id 26c3ff81-d68f-11f1-9e85-4fe78d1e3c23; Mon, 02 Nov 2026 07:29:36 +0000 (UTC) From: "Ayoub Zaki" To: openembedded-devel@lists.openembedded.org Cc: Ayoub Zaki Subject: [meta-oe][PATCH] leancrypto: add Linux kernel module recipe Date: Mon, 2 Nov 2026 08:29:34 +0100 Message-ID: <20261102072934.89576-1-ayoub.zaki@embetrix.com> X-Mailer: git-send-email 2.53.0 MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Mon, 02 Nov 2026 07:58:34 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131742 Add leancrypto-module to build and package leancrypto.ko independently of the userspace library. Move common source and license metadata into leancrypto.inc and include the submitted upstream patch to generate headers using the target kernel architecture instead of the build host. Signed-off-by: Ayoub Zaki --- ...t-architecture-for-generated-headers.patch | 164 ++++++++++++++++++ .../leancrypto/leancrypto-module_1.9.1.bb | 25 +++ .../recipes-crypto/leancrypto/leancrypto.inc | 10 ++ .../leancrypto/leancrypto_1.9.1.bb | 18 +- 4 files changed, 205 insertions(+), 12 deletions(-) create mode 100644 meta-oe/recipes-crypto/leancrypto/files/0001-linux_kernel-use-target-architecture-for-generated-headers.patch create mode 100644 meta-oe/recipes-crypto/leancrypto/leancrypto-module_1.9.1.bb create mode 100644 meta-oe/recipes-crypto/leancrypto/leancrypto.inc diff --git a/meta-oe/recipes-crypto/leancrypto/files/0001-linux_kernel-use-target-architecture-for-generated-headers.patch b/meta-oe/recipes-crypto/leancrypto/files/0001-linux_kernel-use-target-architecture-for-generated-headers.patch new file mode 100644 index 0000000000..1ce848265e --- /dev/null +++ b/meta-oe/recipes-crypto/leancrypto/files/0001-linux_kernel-use-target-architecture-for-generated-headers.patch @@ -0,0 +1,164 @@ +From 47aedd8d985b94dc35836925c123cb705985796b Mon Sep 17 00:00:00 2001 +From: Ayoub Zaki +Date: Sun, 1 Nov 2026 16:55:00 +0100 +Subject: [PATCH] linux_kernel: use target architecture for generated headers + +Derive the architecture from the target kernel configuration and pass it +to the AWK generators instead of querying uname -m. +This prevents cross builds from using the build host's settings. + +Upstream-Status: Submitted [https://github.com/smuellerDD/leancrypto/pull/79] +Signed-off-by: Ayoub Zaki +--- + linux_kernel/Kbuild.autogen | 28 ++++++++++++++++++++++------ + linux_kernel/README.md | 8 ++++++++ + linux_kernel/lc_ascon_hash.awk | 7 ++----- + linux_kernel/lc_hash.h.awk | 9 +++------ + linux_kernel/lc_memory_support.awk | 11 ++++------- + 5 files changed, 39 insertions(+), 24 deletions(-) + +diff --git a/linux_kernel/Kbuild.autogen b/linux_kernel/Kbuild.autogen +index e5052406d..da6d5d05a 100644 +--- a/linux_kernel/Kbuild.autogen ++++ b/linux_kernel/Kbuild.autogen +@@ -3,6 +3,17 @@ + + # Generic support files + ++# Use the target kernel configuration not the build host architecture ++ifdef CONFIG_X86_64 ++lc_target_arch := x86_64 ++else ifdef CONFIG_ARM ++lc_target_arch := arm ++else ifdef CONFIG_ARM64 ++lc_target_arch := aarch64 ++else ++lc_target_arch := generic ++endif ++ + clean-files := $(obj)/lc_memory_support.h $(obj)/lc_hash.h + + $(obj)/posix_support.o: $(obj)/lc_memory_support.h +@@ -10,16 +21,19 @@ $(obj)/posix_support.o: $(obj)/lc_memory_support.h + targets += lc_memory_support.h + + quiet_cmd_build_lc_memory_support = GEN $@ +- cmd_build_lc_memory_support = awk -f $(src)/lc_memory_support.awk $< > $@ +-$(obj)/lc_memory_support.h: $(src)/../internal/api/lc_memory_support.h.in FORCE ++ cmd_build_lc_memory_support = awk -v target_arch=$(lc_target_arch) \ ++ -f $(src)/lc_memory_support.awk $< > $@ ++$(obj)/lc_memory_support.h: $(src)/../internal/api/lc_memory_support.h.in \ ++ $(src)/lc_memory_support.awk FORCE + $(call if_changed,build_lc_memory_support) + + $(obj)/leancrypto_kernel.o: $(obj)/lc_hash.h + targets += lc_hash.h + + quiet_cmd_build_lc_hash = GEN $@ +- cmd_build_lc_hash = awk -f $(src)/lc_hash.h.awk $< > $@ +-$(obj)/lc_hash.h: $(src)/../hash/api/lc_hash.h.in FORCE ++ cmd_build_lc_hash = awk -v target_arch=$(lc_target_arch) \ ++ -f $(src)/lc_hash.h.awk $< > $@ ++$(obj)/lc_hash.h: $(src)/../hash/api/lc_hash.h.in $(src)/lc_hash.h.awk FORCE + $(call if_changed,build_lc_hash) + + +@@ -103,8 +117,10 @@ clean-files += $(obj)/lc_ascon_hash.h + + + quiet_cmd_build_lc_ascon_hash = GEN $@ +- cmd_build_lc_ascon_hash = awk -f $(src)/lc_ascon_hash.awk $< > $@ +-$(obj)/lc_ascon_hash.h: $(src)/../hash/api/lc_ascon_hash.h.in FORCE ++ cmd_build_lc_ascon_hash = awk -v target_arch=$(lc_target_arch) \ ++ -f $(src)/lc_ascon_hash.awk $< > $@ ++$(obj)/lc_ascon_hash.h: $(src)/../hash/api/lc_ascon_hash.h.in \ ++ $(src)/lc_ascon_hash.awk FORCE + $(call if_changed,build_lc_ascon_hash) + + +diff --git a/linux_kernel/README.md b/linux_kernel/README.md +index 45ae377cc..17ff76b16 100644 +--- a/linux_kernel/README.md ++++ b/linux_kernel/README.md +@@ -21,6 +21,14 @@ directory `linux_kernel`: + + 2. the leancrypto library is provided with `leancrypto.ko` + ++For cross-compilation set `KDIR` to the configured and prepared target kernel ++build directory and pass the kernel architecture and compiler prefix: ++ ++```sh ++make KDIR=/path/to/target/kernel/build ARCH=arm64 \ ++ CROSS_COMPILE=aarch64-linux-gnu- ++``` ++ + ## Build in Tree + + When the use of leancrypto as a kernel module is insufficient, e.g. when its +diff --git a/linux_kernel/lc_ascon_hash.awk b/linux_kernel/lc_ascon_hash.awk +index e1fed4cf6..e3c048511 100644 +--- a/linux_kernel/lc_ascon_hash.awk ++++ b/linux_kernel/lc_ascon_hash.awk +@@ -1,9 +1,6 @@ +-# Set the Ascon memory size +-BEGIN { +- "uname -m" | getline host +-} ++# Set the Ascon memory size for target_arch + { +- if (host=="x86_64") { ++ if (target_arch=="x86_64") { + gsub("mesondefine LC_DEF_ASCON_AVX512", "define LC_DEF_ASCON_AVX512", $0) ; + } else { + gsub("mesondefine LC_DEF_ASCON_AVX512", "undef LC_DEF_ASCON_AVX512", $0) ; +diff --git a/linux_kernel/lc_hash.h.awk b/linux_kernel/lc_hash.h.awk +index d26e36304..0a83bade2 100644 +--- a/linux_kernel/lc_hash.h.awk ++++ b/linux_kernel/lc_hash.h.awk +@@ -1,9 +1,6 @@ +-# Set the hash alignment value +-BEGIN { +- "uname -m" | getline host +-} ++# Set the hash alignment value for target_arch + { +- if (host=="x86_64") { ++ if (target_arch=="x86_64") { + # This value has to be limited to 32 as otherwise the hash + # algorithms fail to register since their state is larger than + # HASH_MAX_DESCSIZE - this is an arbitrary defined value in +@@ -14,7 +11,7 @@ BEGIN { + # implementation as it requires an alignment of the buffer to + # 512 bits. + gsub("@hash_common_alignment@", "32", $0) ; +- } else if (host=="arm") { ++ } else if (target_arch=="arm") { + gsub("@hash_common_alignment@", "32", $0) ; + } else { + gsub("@hash_common_alignment@", "8", $0) ; +diff --git a/linux_kernel/lc_memory_support.awk b/linux_kernel/lc_memory_support.awk +index b3480a7e2..4b346a742 100644 +--- a/linux_kernel/lc_memory_support.awk ++++ b/linux_kernel/lc_memory_support.awk +@@ -1,17 +1,14 @@ +-# Set the XOR alignment value +-BEGIN { +- "uname -m" | getline host +-} ++# Set the XOR alignment value for target_arch + { +- if (host=="x86_64") { ++ if (target_arch=="x86_64") { + gsub("mesondefine LC_DEF_HOST_X86_64", "define LC_DEF_HOST_X86_64", $0) ; + gsub("mesondefine LC_DEF_HOST_ARM32_NEON", "undef LC_DEF_HOST_ARM32_NEON", $0) ; + gsub("mesondefine LC_DEF_HOST_AARCH64", "undef LC_DEF_HOST_AARCH64", $0) ; +- } else if (host=="arm") { ++ } else if (target_arch=="arm") { + gsub("mesondefine LC_DEF_HOST_X86_64", "undef LC_DEF_HOST_X86_64", $0) ; + gsub("mesondefine LC_DEF_HOST_ARM32_NEON", "define LC_DEF_HOST_ARM32_NEON", $0) ; + gsub("mesondefine LC_DEF_HOST_AARCH64", "undef LC_DEF_HOST_AARCH64", $0) ; +- } else if (host=="aarch64") { ++ } else if (target_arch=="aarch64") { + gsub("mesondefine LC_DEF_HOST_X86_64", "undef LC_DEF_HOST_X86_64", $0) ; + gsub("mesondefine LC_DEF_HOST_ARM32_NEON", "undef LC_DEF_HOST_ARM32_NEON", $0) ; + gsub("mesondefine LC_DEF_HOST_AARCH64", "define LC_DEF_HOST_AARCH64", $0) ; diff --git a/meta-oe/recipes-crypto/leancrypto/leancrypto-module_1.9.1.bb b/meta-oe/recipes-crypto/leancrypto/leancrypto-module_1.9.1.bb new file mode 100644 index 0000000000..ea74347792 --- /dev/null +++ b/meta-oe/recipes-crypto/leancrypto/leancrypto-module_1.9.1.bb @@ -0,0 +1,25 @@ +SUMMARY = "Leancrypto Linux kernel module" +DESCRIPTION = "Standalone Linux kernel module providing PQC-resistant algorithms" + +require leancrypto.inc + +SRC_URI += "file://0001-linux_kernel-use-target-architecture-for-generated-headers.patch" + +inherit module + +B = "${S}/linux_kernel" + +MAKE_TARGETS = "modules" +# Also apply when a custom Kbuild.config is supplied +EXTRA_OEMAKE += "KDIR=${STAGING_KERNEL_DIR} \ + CONFIG_LEANCRYPTO=m \ + CONFIG_LEANCRYPTO_TEST_MODULES=n \ +" + +# Supply Kbuild.config to SRC_URI in a bbappend to select algorithms +# Otherwise retain upstream settings +do_configure() { + if [ -f ${UNPACKDIR}/Kbuild.config ]; then + install -m 0644 ${UNPACKDIR}/Kbuild.config ${B}/Kbuild.config + fi +} diff --git a/meta-oe/recipes-crypto/leancrypto/leancrypto.inc b/meta-oe/recipes-crypto/leancrypto/leancrypto.inc new file mode 100644 index 0000000000..fdccdb5a77 --- /dev/null +++ b/meta-oe/recipes-crypto/leancrypto/leancrypto.inc @@ -0,0 +1,10 @@ +HOMEPAGE = "https://leancrypto.org" +LICENSE = "BSD-3-Clause OR GPL-2.0-only" +LIC_FILES_CHKSUM = " \ + file://LICENSE;md5=581f53c96a634ae7f241516370a8f1ee \ + file://LICENSE.bsd;md5=66a5cedaf62c4b2637025f049f9b826f \ + file://LICENSE.gplv2;md5=eb723b61539feef013de476e68b5c50a \ +" + +SRC_URI = "git://github.com/smuellerDD/leancrypto.git;branch=master;protocol=https;tag=v${PV}" +SRCREV = "65eb4e7e84e3a5499460a66b1623ccf6c59628b1" diff --git a/meta-oe/recipes-crypto/leancrypto/leancrypto_1.9.1.bb b/meta-oe/recipes-crypto/leancrypto/leancrypto_1.9.1.bb index 083b70fe8c..43d4b13655 100644 --- a/meta-oe/recipes-crypto/leancrypto/leancrypto_1.9.1.bb +++ b/meta-oe/recipes-crypto/leancrypto/leancrypto_1.9.1.bb @@ -3,19 +3,13 @@ DESCRIPTION = "leancrypto is a cryptographic library that exclusively contains \ PQC-resistant cryptographic algorithms. It is lean, has minimal dependencies, \ supports stack-only operation and provides optimized implementations for \ ML-KEM (Kyber), ML-DSA (Dilithium), SLH-DSA (Sphincs+) and many more" -HOMEPAGE = "https://leancrypto.org" -LICENSE = "BSD-3-Clause OR GPL-2.0-only" -LIC_FILES_CHKSUM = " \ - file://LICENSE;md5=581f53c96a634ae7f241516370a8f1ee \ - file://LICENSE.bsd;md5=66a5cedaf62c4b2637025f049f9b826f \ - file://LICENSE.gplv2;md5=eb723b61539feef013de476e68b5c50a \ - " SECTION = "libs" -SRC_URI = "git://github.com/smuellerDD/leancrypto.git;branch=master;protocol=https;tag=v${PV} \ - file://leancrypto-tests.sh \ - file://0001-secure_execution_linux-drop-redundant-linux-prctl.h-.patch \ - " -SRCREV = "65eb4e7e84e3a5499460a66b1623ccf6c59628b1" + +require leancrypto.inc + +SRC_URI += "file://leancrypto-tests.sh \ + file://0001-secure_execution_linux-drop-redundant-linux-prctl.h-.patch \ +" inherit pkgconfig meson