Add WireGuard support to Yocto build (in both kernel and higher layers)

Technical Support
, ,
1

Hi,

I am using a Verdin iMX8M Plus module, and currently I am testing different Yocto builds based on tdx-reference-multimedia-image and tdx-reference-minimal-image. BSP version 7.x.y.

I am struggeling to get WireGuard enabled. What is the easiest way of modifying for example tdx-reference-minimal-image to get it working?
It would be nice if I only have to use the ‘bitbake’ command to build.

I have looked at this blog, but it seems quite outdated:

EDIT:
When I make changes in the kernel menuconfig (bitbake virtual/kernel -c menuconfig), the changes are overwritten when I do ‘bitbake tdx-reference-multimedia-image’.

It would be great to get a step-by-step guide on how to enable kernel support for WireGuard.

2

Hi, I’m the Toradex AI Assistant. The Toradex Support team will follow up with you shortly!

Did you like my answer?

:+1: :-1:

Hello,

To enable WireGuard support in your Yocto build for the Verdin iMX8M Plus module, you can follow these steps to modify the tdx-reference-minimal-image:

  1. Add WireGuard to Your Yocto Build:

    • Ensure your Yocto environment is set up correctly and you have access to the necessary layers.
    • Include the WireGuard package in your build by adding the WireGuard recipe to your image.

  2. Modify the Local Configuration:

    • Open your local.conf file, typically located in the conf directory of your Yocto build environment.
    • Add the following line to include WireGuard in your image:
      IMAGE_INSTALL_append = " wireguard-tools"
    • This line ensures that the WireGuard tools are included in the final image.

  3. Kernel Configuration:

    • WireGuard requires kernel support. Ensure the WireGuard kernel module is enabled.
    • Add a kernel fragment or modify the kernel configuration directly. Create a .bbappend file for your kernel recipe and include a configuration fragment with the following content:
      CONFIG_WIREGUARD=m
    • This sets WireGuard as a module in the kernel configuration.

  4. Build the Image:

    • After making these changes, build your image using the bitbake command:
      bitbake tdx-reference-minimal-image
    • This command will compile the image with WireGuard support included.

By following these steps, you should be able to build a Yocto image with WireGuard support for your Verdin iMX8M Plus module. If you encounter any issues, ensure all dependencies are correctly set up and that your Yocto environment is properly configured.

Best regards,
Toradex AI Assistant.

Please, also check if these links can help you solve your problem:

Using a VPN on embedded Linux systems.

3

Hello @erikr,

I have not tried setting up WireGuard VPN on a reference image, but Torizon OS has wireguard by default. This documentation walk you through setting it up: How to Use VPN on Torizon OS | Toradex Developer Center
Could you please give it a try on Torizon OS?

4

Hi @rudhi.tx

Thank you for the reply.

We have verified that WireGuard is loaded as a module in Torizon OS. But we want to use a reference image as a base for our product.

Since you have been able to load WireGuard into the kernel in Torizon OS, and since the reference images and Torizon OS use the same Yocto system as base (?), you should probably have knowledge about how to load WireGuard into the kernel for a reference image.

5

Hello @erikr,

To add wireguard into your BSP image, you can add the following into your local.conf file before you build the image:

CORE_IMAGE_BASE_INSTALL:append = " wireguard-tools"

However, on the BSP image, you will have to use connman as the connection manager unlike on Torizon where we have NetworkManager.