[OE-core] [PATCH] kernel.bbclass: add strip process for signed kernel modules

[Anis Bougrine <anis.bougrine10@gmail.com>]

Currently, signed kernel modules skip the stripping process in order
to preserve the file contents after signing. See commit:
4c47e5f171fa2603355e2f9183065ce8137a18c7

However, the kernel install Makefile supports stripping modules before
signing them. This allows signed modules to be stripped while preserving
a valid signature.

Make non-signed kernel modules follow the standard Yocto stripping flow,
while signed kernel modules use the kernel Makefile stripping flow.

Fixes [YOCTO #12927]

Reported-by: ross.burton@arm.com
Signed-off-by: Anis Bougrine <anis.bougrine10@gmail.com>
---
 meta/classes-recipe/kernel.bbclass | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/meta/classes-recipe/kernel.bbclass b/meta/classes-recipe/kernel.bbclass
index a82bdf7ecb..0d8d370e9d 100644
--- a/meta/classes-recipe/kernel.bbclass
+++ b/meta/classes-recipe/kernel.bbclass
@@ -453,7 +453,21 @@ kernel_do_install() {
 	#
 	unset CFLAGS CPPFLAGS CXXFLAGS LDFLAGS MACHINE
 	if (grep -q -i -e '^CONFIG_MODULES=y$' .config); then
-		oe_runmake DEPMOD=echo MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION} INSTALL_FW_PATH=${D}${firmwaredir} modules_install
+		# If the module will be auto-signed, perform stripping before signing.
+		if grep -q '^CONFIG_MODULE_SIG=y$' .config && grep -q '^CONFIG_MODULE_SIG_ALL=y$' .config; then
+			oe_runmake \
+				INSTALL_MOD_STRIP="--strip-debug --remove-section=.comment --remove-section=.note --preserve-dates" \
+				DEPMOD=echo \
+				MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION} \
+				INSTALL_FW_PATH=${D}${nonarch_base_libdir}/firmware \
+				modules_install
+		else
+			oe_runmake \
+				DEPMOD=echo \
+				MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION} \
+				INSTALL_FW_PATH=${D}${nonarch_base_libdir}/firmware \
+				modules_install
+		fi
 		rm -f "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/build"
 		rm -f "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/source"
 		# Remove empty module directories to prevent QA issues
-- 
2.50.1 (Apple Git-155)