[PATCH 1/2] make kernel module build reproducible

[PATCH 1/2] make kernel module build reproducible

['Felix Moessbauer' via isar-users]

The debug information of kernel modules contain absolute file paths
into the builder schroot. To fix this, we inject a debug-prefix-map,
similar to how it is already done for the kernel build. While doing
that, we also enable the user to inject other KCFLAGS and KAFLAGS as
well.

Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
---
 meta/recipes-kernel/linux-module/files/debian/rules.tmpl | 2 +-
 meta/recipes-kernel/linux-module/module.inc              | 6 ++++++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/meta/recipes-kernel/linux-module/files/debian/rules.tmpl b/meta/recipes-kernel/linux-module/files/debian/rules.tmpl
index bc4e09cb..7511a17d 100755
--- a/meta/recipes-kernel/linux-module/files/debian/rules.tmpl
+++ b/meta/recipes-kernel/linux-module/files/debian/rules.tmpl
@@ -49,7 +49,7 @@ override_dh_auto_clean:
 	$(MAKE) -C $(KDIR) M=${MODULE_DIR} clean
 
 override_dh_auto_build:
-	$(MAKE) -C $(KDIR) M=${MODULE_DIR} $(PARALLEL_MAKE) modules
+	$(MAKE) -C $(KDIR) M=${MODULE_DIR} $(PARALLEL_MAKE) KCFLAGS="${KCFLAGS}" KAFLAGS="${KAFLAGS}" modules
 ifneq ($(filter pkg.sign,$(DEB_BUILD_PROFILES)),)
 	find . -name "*.ko" -print -exec $(KDIR)/scripts/sign-file ${SIGNATURE_HASHFN} ${SIGNATURE_KEYFILE} ${SIGNATURE_CERTFILE} {} \;
 endif
diff --git a/meta/recipes-kernel/linux-module/module.inc b/meta/recipes-kernel/linux-module/module.inc
index 229e6a5c..344dc50f 100644
--- a/meta/recipes-kernel/linux-module/module.inc
+++ b/meta/recipes-kernel/linux-module/module.inc
@@ -48,6 +48,8 @@ TEMPLATE_VARS += " \
     KERNEL_TYPE \
     KERNEL_IMAGE_PKG \
     KERNEL_HEADERS_PKG \
+    KCFLAGS \
+    KAFLAGS \
     MODULE_DIR \
     DEBIAN_BUILD_DEPENDS \
     SIGNATURE_KEYFILE \
@@ -55,6 +57,10 @@ TEMPLATE_VARS += " \
     SIGNATURE_HASHFN \
     PN"
 
+# Add custom cflags to the kernel build
+KCFLAGS ?= "-fdebug-prefix-map=${CURDIR}=. -fmacro-prefix-map=${CURDIR}=."
+KAFLAGS ?= "-fdebug-prefix-map=${CURDIR}=."
+
 do_prepare_build() {
     rm -rf ${S}/debian
     cp -r ${WORKDIR}/debian ${S}/
-- 
2.39.2

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/isar-users/20240913151642.374093-1-felix.moessbauer%40siemens.com.

[PATCH 2/2] strip debug information from kernel modules

['Felix Moessbauer' via isar-users]

If not requested otherwise (e.g. via DEB_BUILD_OPTIONS=nostrip), strip
the debug information from the kernel module. This significantly reduces
the size of the .ko file. As the stripping needs to happen prior to
compression and signing, we need to do it during the build step.

Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
---
 meta/recipes-kernel/linux-module/files/debian/rules.tmpl | 3 +++
 meta/recipes-kernel/linux-module/module.inc              | 2 ++
 2 files changed, 5 insertions(+)

diff --git a/meta/recipes-kernel/linux-module/files/debian/rules.tmpl b/meta/recipes-kernel/linux-module/files/debian/rules.tmpl
index 7511a17d..ad743437 100755
--- a/meta/recipes-kernel/linux-module/files/debian/rules.tmpl
+++ b/meta/recipes-kernel/linux-module/files/debian/rules.tmpl
@@ -50,6 +50,9 @@ override_dh_auto_clean:
 
 override_dh_auto_build:
 	$(MAKE) -C $(KDIR) M=${MODULE_DIR} $(PARALLEL_MAKE) KCFLAGS="${KCFLAGS}" KAFLAGS="${KAFLAGS}" modules
+ifeq ($(filter nostrip,$(DEB_BUILD_OPTIONS)),)
+	find . -name "*.ko" -print -exec strip --strip-debug --remove-section=.note.gnu.build-id {} \;
+endif
 ifneq ($(filter pkg.sign,$(DEB_BUILD_PROFILES)),)
 	find . -name "*.ko" -print -exec $(KDIR)/scripts/sign-file ${SIGNATURE_HASHFN} ${SIGNATURE_KEYFILE} ${SIGNATURE_CERTFILE} {} \;
 endif
diff --git a/meta/recipes-kernel/linux-module/module.inc b/meta/recipes-kernel/linux-module/module.inc
index 344dc50f..1734816b 100644
--- a/meta/recipes-kernel/linux-module/module.inc
+++ b/meta/recipes-kernel/linux-module/module.inc
@@ -19,6 +19,8 @@ KERNEL_IMAGE_PKG ??= "linux-image-${KERNEL_NAME}"
 KERNEL_HEADERS_PKG ??= "linux-headers-${KERNEL_NAME}"
 DEPENDS += "${KERNEL_HEADERS_PKG}-native"
 DEBIAN_BUILD_DEPENDS = "${KERNEL_HEADERS_PKG}"
+# Do not generate debug symbols packages, as not supported for modules
+DEB_BUILD_OPTIONS += "noautodbgsym"
 
 SIGNATURE_KEYFILE ??= ""
 SIGNATURE_CERTFILE ??= ""
-- 
2.39.2

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/isar-users/20240913151642.374093-2-felix.moessbauer%40siemens.com.

Re: [PATCH 1/2] make kernel module build reproducible

[Uladzimir Bely]

On Fri, 2024-09-13 at 17:16 +0200, 'Felix Moessbauer' via isar-users
wrote:
> The debug information of kernel modules contain absolute file paths
> into the builder schroot. To fix this, we inject a debug-prefix-map,
> similar to how it is already done for the kernel build. While doing
> that, we also enable the user to inject other KCFLAGS and KAFLAGS as
> well.
> 
> Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
> ---
>  meta/recipes-kernel/linux-module/files/debian/rules.tmpl | 2 +-
>  meta/recipes-kernel/linux-module/module.inc              | 6 ++++++
>  2 files changed, 7 insertions(+), 1 deletion(-)
> 
> diff --git a/meta/recipes-kernel/linux-module/files/debian/rules.tmpl
> b/meta/recipes-kernel/linux-module/files/debian/rules.tmpl
> index bc4e09cb..7511a17d 100755
> --- a/meta/recipes-kernel/linux-module/files/debian/rules.tmpl
> +++ b/meta/recipes-kernel/linux-module/files/debian/rules.tmpl
> @@ -49,7 +49,7 @@ override_dh_auto_clean:
>  	$(MAKE) -C $(KDIR) M=${MODULE_DIR} clean
>  
>  override_dh_auto_build:
> -	$(MAKE) -C $(KDIR) M=${MODULE_DIR} $(PARALLEL_MAKE) modules
> +	$(MAKE) -C $(KDIR) M=${MODULE_DIR} $(PARALLEL_MAKE)
> KCFLAGS="${KCFLAGS}" KAFLAGS="${KAFLAGS}" modules
>  ifneq ($(filter pkg.sign,$(DEB_BUILD_PROFILES)),)
>  	find . -name "*.ko" -print -exec $(KDIR)/scripts/sign-file
> ${SIGNATURE_HASHFN} ${SIGNATURE_KEYFILE} ${SIGNATURE_CERTFILE} {} \;
>  endif
> diff --git a/meta/recipes-kernel/linux-module/module.inc
> b/meta/recipes-kernel/linux-module/module.inc
> index 229e6a5c..344dc50f 100644
> --- a/meta/recipes-kernel/linux-module/module.inc
> +++ b/meta/recipes-kernel/linux-module/module.inc
> @@ -48,6 +48,8 @@ TEMPLATE_VARS += " \
>      KERNEL_TYPE \
>      KERNEL_IMAGE_PKG \
>      KERNEL_HEADERS_PKG \
> +    KCFLAGS \
> +    KAFLAGS \
>      MODULE_DIR \
>      DEBIAN_BUILD_DEPENDS \
>      SIGNATURE_KEYFILE \
> @@ -55,6 +57,10 @@ TEMPLATE_VARS += " \
>      SIGNATURE_HASHFN \
>      PN"
>  
> +# Add custom cflags to the kernel build
> +KCFLAGS ?= "-fdebug-prefix-map=${CURDIR}=. -fmacro-prefix-
> map=${CURDIR}=."
> +KAFLAGS ?= "-fdebug-prefix-map=${CURDIR}=."
> +
>  do_prepare_build() {
>      rm -rf ${S}/debian
>      cp -r ${WORKDIR}/debian ${S}/
> -- 
> 2.39.2
> 

Applied to next, thanks.

-- 
Best regards,
Uladzimir.

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/isar-users/6c6b1495be89358d1af803461f6e49091883f7ec.camel%40ilbers.de.