Merge pull request #1239 from c-po/compress-kernel-modules

Kernel: T5641: enable module compression to save disk space

Author: sever-sever

scripts/package-build/linux-kernel/build-accel-ppp-ng.sh

@@ -58,8 +58,12 @@ cmake -DBUILD_IPOE_DRIVER=TRUE \
     -DCPACK_TYPE=Debian12 ..
 CPATH="${VPP_INCLUDE_PATH}" LIBRARY_PATH="${VPP_LIBRARY_PATH}" make
 
-# Sign generated Kernel modules
-${CWD}/sign-modules.sh .
+# Sign generated Kernel modules. Keep the uncompressed .ko next to the
+# resulting .ko.xz: cpack's DEB packaging re-runs "make all" as part of
+# its install step, and if the .ko CMake tracks as a build output were
+# removed by compression, it would be silently rebuilt unsigned before
+# being packaged.
+${CWD}/sign-modules.sh . --keep
 
 cpack -G DEB
 

scripts/package-build/linux-kernel/build-ipt-netflow.sh

@@ -72,6 +72,6 @@ fpm --input-type dir --output-type deb --name vyos-ipt-netflow \
     --description "ipt_NETFLOW module" \
     --depends linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX} \
     --license "GPL2" -C ${IPT_NETFLOW_SRC}/tmp --after-install ${DEBIAN_POSTINST} \
-    ipt_NETFLOW.ko=/lib/modules/${KERNEL_VERSION}${KERNEL_SUFFIX}/extra/ipt_NETFLOW.ko \
+    ipt_NETFLOW.ko.xz=/lib/modules/${KERNEL_VERSION}${KERNEL_SUFFIX}/extra/ipt_NETFLOW.ko.xz \
     libipt_NETFLOW.so=/lib/$(uname -m)-linux-gnu/xtables/libipt_NETFLOW.so \
     libip6t_NETFLOW.so=/lib/$(uname -m)-linux-gnu/xtables/libip6t_NETFLOW.so

scripts/package-build/linux-kernel/build.py

@@ -274,6 +274,7 @@ def build_nat_rtsp(commit_id, scm_url):
     arg_parser.add_argument('--config', default='package.toml', help='Path to the package configuration file')
     arg_parser.add_argument('--packages', nargs='+', help='Names of packages to build (default: all)', default=[])
     arg_parser.add_argument('--install-dependencies', '-i', help='Only install build dependencies', action='store_true')
+    arg_parser.add_argument('--keep-kernel', '-k', help='Keep kernel intermediate objects and not create source tar-ball', action='store_true')
     args = arg_parser.parse_args()
 
     # Load package configuration
@@ -311,7 +312,7 @@ def build_nat_rtsp(commit_id, scm_url):
         # Copy generated .deb packages to parent directory
         copy_packages(Path(package['name']))
 
-    if linux_kernel_tarball:
+    if linux_kernel_tarball and not args.keep_kernel:
         source_dir = linux_kernel_tarball['source_dir']
         trusted_keys = f'{source_dir}/trusted_keys.pem'
         if os.path.exists(trusted_keys):

scripts/package-build/linux-kernel/config/02-module-signing.config

@@ -22,3 +22,9 @@ CONFIG_SYSTEM_TRUSTED_KEYRING=y
 CONFIG_MODULE_SIG_KEY="certs/signing_key.pem"
 CONFIG_MODULE_SIG_KEY_TYPE_RSA=y
 # CONFIG_MODULE_SIG_KEY_TYPE_ECDSA is not set
+CONFIG_MODULE_COMPRESS=y
+# CONFIG_MODULE_COMPRESS_GZIP is not set
+CONFIG_MODULE_COMPRESS_XZ=y
+# CONFIG_MODULE_COMPRESS_ZSTD is not set
+CONFIG_MODULE_COMPRESS_ALL=y
+CONFIG_MODULE_DECOMPRESS=y

scripts/package-build/linux-kernel/config/arm64/vyos_defconfig

@@ -780,14 +780,6 @@ CONFIG_MODULE_FORCE_UNLOAD=y
 CONFIG_MODVERSIONS=y
 CONFIG_ASM_MODVERSIONS=y
 # CONFIG_MODULE_SRCVERSION_ALL is not set
-CONFIG_MODULE_SIG=y
-CONFIG_MODULE_SIG_FORCE=y
-CONFIG_MODULE_SIG_ALL=y
-# CONFIG_MODULE_SIG_SHA1 is not set
-# CONFIG_MODULE_SIG_SHA256 is not set
-# CONFIG_MODULE_SIG_SHA384 is not set
-CONFIG_MODULE_SIG_SHA512=y
-CONFIG_MODULE_SIG_HASH="sha512"
 # CONFIG_MODULE_ALLOW_MISSING_NAMESPACE_IMPORTS is not set
 CONFIG_MODPROBE_PATH="/sbin/modprobe"
 # CONFIG_TRIM_UNUSED_KSYMS is not set

scripts/package-build/linux-kernel/patches/accel-ppp-ng/0001-cmake-package-signed-compressed-kernel-modules.patch

@@ -0,0 +1,66 @@
+From: Christian Breunig <christian@vyos.io>
+Date: Sun, 5 Jul 2026 00:00:00 +0200
+Subject: [PATCH] cmake: package signed/compressed kernel modules
+
+sign-modules.sh signs the built ipoe/vlan_mon/pptp kernel modules and,
+if the target kernel's .config enables CONFIG_MODULE_COMPRESS_XZ,
+compresses them to .ko.xz before cpack packages the Debian archive.
+The Debian packaging rules installed the drivers by their exact
+pre-sign build path (*.ko) unconditionally, so a compressed build
+never actually shipped the compressed module. Mirror sign-modules.sh's
+own .config check to pick the extension that actually ends up on disk.
+
+---
+ cmake/debian/debian.cmake | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/cmake/debian/debian.cmake b/cmake/debian/debian.cmake
+index 8db274a..64b8f7d 100644
+--- a/cmake/debian/debian.cmake
++++ b/cmake/debian/debian.cmake
+@@ -9,6 +9,18 @@ if (NOT DEFINED MODULES_KDIR)
+ 	)
+ endif()
+
++# sign-modules.sh signs the built .ko files and, if the target kernel's
++# .config has module compression enabled, xz-compresses them in place.
++# Mirror that check here so we install whichever artifact actually ends
++# up on disk.
++SET(KMOD_EXT ".ko")
++IF (DEFINED KDIR AND EXISTS "${KDIR}/.config")
++	FILE(STRINGS "${KDIR}/.config" _ACCEL_PPP_KMOD_COMPRESS_XZ REGEX "^CONFIG_MODULE_COMPRESS_XZ=y$")
++	IF (_ACCEL_PPP_KMOD_COMPRESS_XZ)
++		SET(KMOD_EXT ".ko.xz")
++	ENDIF ()
++ENDIF ()
++
+ if (BUILD_PPTP_DRIVER)
+ 	if (BUILD_DRIVER_ONLY)
+ 		SET(CPACK_PACKAGE_VERSION_MAJOR "0")
+@@ -21,7 +33,7 @@ if (BUILD_PPTP_DRIVER)
+ 		SET(CPACK_DEBIAN_PACKAGE_CONTROL_EXTRA "${CMAKE_CURRENT_SOURCE_DIR}/cmake/debian-kmod/postinst")
+ 	endif ()
+ 	#INSTALL(DIRECTORY lib/modules/${DEBIAN_KDIR}/extra)
+-	INSTALL(FILES ${CMAKE_CURRENT_BINARY_DIR}/driver/driver/pptp.ko DESTINATION /lib/modules/${MODULES_KDIR}/extra)
++	INSTALL(FILES ${CMAKE_CURRENT_BINARY_DIR}/driver/driver/pptp${KMOD_EXT} DESTINATION /lib/modules/${MODULES_KDIR}/extra)
+ 	#SET(CPACK_DEBIAN_PACKAGE_DEPENDS "linux-image (= ${LINUX_IMAGE})")
+ endif (BUILD_PPTP_DRIVER)
+
+@@ -33,7 +45,7 @@ if (BUILD_IPOE_DRIVER)
+ 		SET(CPACK_DEBIAN_PACKAGE_DEPENDS "")
+ 		SET(CPACK_DEBIAN_PACKAGE_CONTROL_EXTRA "${CMAKE_CURRENT_SOURCE_DIR}/cmake/debian-kmod/postinst")
+ 	endif ()
+-	INSTALL(FILES ${CMAKE_CURRENT_BINARY_DIR}/drivers/ipoe/driver/ipoe.ko DESTINATION /lib/modules/${MODULES_KDIR}/extra)
++	INSTALL(FILES ${CMAKE_CURRENT_BINARY_DIR}/drivers/ipoe/driver/ipoe${KMOD_EXT} DESTINATION /lib/modules/${MODULES_KDIR}/extra)
+ endif (BUILD_IPOE_DRIVER)
+
+ if (BUILD_VLAN_MON_DRIVER)
+@@ -44,7 +56,7 @@ if (BUILD_VLAN_MON_DRIVER)
+ 		SET(CPACK_DEBIAN_PACKAGE_DEPENDS "")
+ 		SET(CPACK_DEBIAN_PACKAGE_CONTROL_EXTRA "${CMAKE_CURRENT_SOURCE_DIR}/cmake/debian-kmod/postinst")
+ 	endif ()
+-	INSTALL(FILES ${CMAKE_CURRENT_BINARY_DIR}/drivers/vlan_mon/driver/vlan_mon.ko DESTINATION /lib/modules/${MODULES_KDIR}/extra)
++	INSTALL(FILES ${CMAKE_CURRENT_BINARY_DIR}/drivers/vlan_mon/driver/vlan_mon${KMOD_EXT} DESTINATION /lib/modules/${MODULES_KDIR}/extra)
+ endif (BUILD_VLAN_MON_DRIVER)
+
+ if (NOT BUILD_DRIVER_ONLY)

scripts/package-build/linux-kernel/sign-modules.sh

@@ -1,15 +1,28 @@
-#!/bin/sh
+#!/bin/sh -x
 
 BASE_DIR=$(dirname $0)
 MODULE_DIR=$1
+# Pass "--keep" as $2 to retain the uncompressed, signed .ko next to the
+# .ko.xz it produces. Needed by callers whose build system tracks the
+# uncompressed .ko as a build output (e.g. CMake custom commands) and
+# would otherwise consider it missing and regenerate an unsigned copy.
+KEEP_UNCOMPRESSED=$2
 . ${BASE_DIR}/kernel-vars
 
 SIGN_FILE="${KERNEL_DIR}/scripts/sign-file"
+CONFIG_FILE="${KERNEL_DIR}/.config"
 
 if [ -f ${EPHEMERAL_KEY} ] && [ -f ${EPHEMERAL_CERT} ]; then
     find ${MODULE_DIR} -type f -name \*.ko | while read MODULE; do
       echo "I: Signing ${MODULE} ..."
       ${SIGN_FILE} sha512 ${EPHEMERAL_KEY} ${EPHEMERAL_CERT} ${MODULE}
+      if [ -f "$CONFIG_FILE" ] && grep -qx "CONFIG_MODULE_COMPRESS_XZ=y" "$CONFIG_FILE"; then
+          if [ "${KEEP_UNCOMPRESSED}" = "--keep" ]; then
+              xz --compress --keep ${MODULE}
+          else
+              xz --compress ${MODULE}
+          fi
+      fi
     done
+    find ${MODULE_DIR}
 fi
-