Currently, signed kernel modules skip the stripping process in order to preserve the file contents after signing. See commit: 4c47e5f171fa2603355e2f9183065ce8137a18c7
However, the kernel install Makefile supports stripping modules before signing them. This allows signed modules to be stripped while preserving a valid signature. Make non-signed kernel modules follow the standard Yocto stripping flow, while signed kernel modules use the kernel Makefile stripping flow. Fixes [YOCTO #12927] Reported-by: [email protected] Signed-off-by: Anis Bougrine <[email protected]> Cc: Antonin Godard <[email protected]> Cc: Bruce Ashfield <[email protected]> Cc: Jose Quaresma <[email protected]> --- changes in v3: - Fixing rebase issue. changes in v2: - Use the conditional INSTALL_MOD_STRIP environment variable to avoid duplicating the oe_runmake call. - Use `scripts/config` script instead of grepping .config file. --- meta/classes-recipe/kernel.bbclass | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/meta/classes-recipe/kernel.bbclass b/meta/classes-recipe/kernel.bbclass index a82bdf7ecb..0998de1548 100644 --- a/meta/classes-recipe/kernel.bbclass +++ b/meta/classes-recipe/kernel.bbclass @@ -451,8 +451,12 @@ kernel_do_install() { # # First install the modules # - unset CFLAGS CPPFLAGS CXXFLAGS LDFLAGS MACHINE + unset CFLAGS CPPFLAGS CXXFLAGS INSTALL_MOD_STRIP LDFLAGS MACHINE if (grep -q -i -e '^CONFIG_MODULES=y$' .config); then + # If the module will be auto-signed, perform stripping before signing. + if [ "$(${S}/scripts/config --state MODULE_SIG)" = "y" ] && [ "$(${S}/scripts/config --state MODULE_SIG_ALL)" = "y" ]; then + export INSTALL_MOD_STRIP="--strip-debug --remove-section=.comment --remove-section=.note --preserve-dates" + fi oe_runmake DEPMOD=echo MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION} INSTALL_FW_PATH=${D}${firmwaredir} modules_install rm -f "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/build" rm -f "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/source" -- 2.50.1 (Apple Git-155)
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#243387): https://lists.openembedded.org/g/openembedded-core/message/243387 Mute This Topic: https://lists.openembedded.org/mt/120739107/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
