Summary

Adds build infrastructure and runtime glue for wolfentropy.ko, a minimal Linux kernel module that provides an SP 800-90B entropy source separate from the FIPS boundary.

New: wolfentropy.ko build target

• linuxkm/Kbuild.entropy — dedicated Kbuild for the wolfentropy module. Uses override += for WOLFENTROPY_CFLAGS (a command-line variable), filters -pg from HOST_EXTRACFLAGS and passes CC_FLAGS_FTRACE= to suppress profiling
  flags that would cause _mcleanup: gmon.out: Permission denied from the get_thread_size host program.
• linuxkm/Makefile — adds wolfentropy / wolfentropy-clean targets. The build symlinks source into $(MODULE_TOP)/wolfentropy/ and invokes the kernel build against Kbuild.entropy. WOLFENTROPY_OBJ_FILES pulls in random.o,
  sha256.o, sha3.o, wc_port.o, memory.o, logging.o, and linuxkm_memory.o. WOLFENTROPY_LINUXKM_USE_MUTEXES is set to bypass PIE redirect table mutex.
• Makefile.am / configure.ac — expose wolfentropy / wolfentropy-clean targets at the top-level automake level, guarded by new BUILD_WOLFENTROPY_KO conditional (enabled when --enable-linuxkm + entropy memuse are both
  active).
• linuxkm/module_exports_entropy.c — static export file; exports only wc_Entropy_Get, wc_Entropy_GetRawEntropy, and wc_Entropy_OnDemandTest under the WOLFSSL symbol namespace. All other symbols compiled into wolfentropy.ko
  remain unexported, preventing collisions with libwolfssl.ko.
• linuxkm/module_hooks_entropy.c — module init/exit for wolfentropy.ko. Includes no-op wc_ecc_fp_init / wc_ecc_fp_free stubs (needed because wc_port.c references them via dead wolfCrypt_Init code).
• linuxkm/Kbuild — adds AWK exclusion for the three wc_Entropy_* symbols in the auto-export generator, preventing duplicate EXPORT_SYMBOL_NS_GPL when wolfentropy.ko symbols are visible to libwolfssl.ko's build.
• linuxkm/include.am — adds all new files to EXTRA_DIST.

Updated: libwolfssl.ko glue for external entropy

When libwolfssl.ko is built with -DWC_LINUXKM_WOLFENTROPY_IN_GLUE_LAYER:

• linuxkm/module_hooks.c — adds wc_linuxkm_GenerateSeed_wolfEntropy, which calls wc_Entropy_Get(MAX_ENTROPY_BITS, output, sz). When built without --enable-wolfentropy (module trees where wolfentropy is a separate module), wc_Entropy_Get is declared attribute((weak)) at file scope so modpost does not error on the unresolved symbol; a NULL check returns -ENODEV with a clear message if wolfentropy.ko was not loaded.
• Adds MODULE_SOFTDEP("pre: wolfentropy") and MODULE_IMPORT_NS (quoted string for kernel ≥ 6.13, unquoted for 5.4–6.12) after MODULE_VERSION.

Usage

Build entropy module

./configure --enable-linuxkm --enable-wolfentropy --with-linux-src=...
make wolfentropy # produces wolfentropy.ko

Build kernel module linked to external entropy kernel module

./configure --enable-linuxkm --with-linux-src=...
make

Runtime (order enforced by MODULE_SOFTDEP)

modprobe wolfentropy
modprobe libwolfssl

To replicate previous behavior, with libwolfssl.ko housing both the crypto and entropy

./configure --enable-linuxkm --enable-wolfentropy --with-linux-src=...
make

Testing

Tested on customers kernel module

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation