@@ -451,8 +451,12 @@ kernel_do_install() {
#
# First install the modules
#
- unset CFLAGS CPPFLAGS CXXFLAGS LDFLAGS MACHINE
+ unset CFLAGS CPPFLAGS CXXFLAGS INSTALL_MOD_STRIP LDFLAGS MACHINE
if (grep -q -i -e '^CONFIG_MODULES=y$' .config); then
+ # If the module will be auto-signed, perform stripping before signing.
+ if [ "$(${S}/scripts/config --state MODULE_SIG)" = "y" ] && [ "$(${S}/scripts/config --state MODULE_SIG_ALL)" = "y" ]; then
+ export INSTALL_MOD_STRIP="--strip-debug --remove-section=.comment --remove-section=.note --preserve-dates"
+ fi
oe_runmake DEPMOD=echo MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION} INSTALL_FW_PATH=${D}${firmwaredir} modules_install
rm -f "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/build"
rm -f "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/source"
Currently, signed kernel modules skip the stripping process in order to preserve the file contents after signing. See commit: 4c47e5f171fa2603355e2f9183065ce8137a18c7 However, the kernel install Makefile supports stripping modules before signing them. This allows signed modules to be stripped while preserving a valid signature. Make non-signed kernel modules follow the standard Yocto stripping flow, while signed kernel modules use the kernel Makefile stripping flow. Fixes [YOCTO #12927] Reported-by: ross.burton@arm.com Signed-off-by: Anis Bougrine <anis.bougrine10@gmail.com> Cc: Antonin Godard <antonin.godard@bootlin.com> Cc: Bruce Ashfield <bruce.ashfield@gmail.com> Cc: Jose Quaresma <jose.quaresma@oss.qualcomm.com> --- changes in v3: - Fixing rebase issue. changes in v2: - Use the conditional INSTALL_MOD_STRIP environment variable to avoid duplicating the oe_runmake call. - Use `scripts/config` script instead of grepping .config file. --- meta/classes-recipe/kernel.bbclass | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)