-
Notifications
You must be signed in to change notification settings - Fork 3
/
kmp-trigger.sh
102 lines (93 loc) · 3.23 KB
/
kmp-trigger.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
# get rid of broken weak-updates symlinks created in some %post apparently;
# either by kmp itself or by kernel package update
for i in $(find /lib/modules/*/weak-updates -type l 2> /dev/null); do
test -e $(readlink -f $i) || rm $i
done
%ifarch %ix86
arch=i386
%endif
%ifarch x86_64
arch=x86_64
%endif
%ifarch aarch64
arch=aarch64
%endif
flavor=%1
#export CONCURRENCY_LEVEL=nproc && \
#export JOBS=${CONCURRENCY_LEVEL} && \
#export __JOBS=${JOBS} && \
#export MAKEFLAGS="-j ${JOBS}"
kver=$(make -j$(nproc) -sC /usr/src/linux-obj/$arch/$flavor kernelrelease)
RES=0
# mold is not supported (boo#1223344)
export LD=ld.bfd
make -j$(nproc) -C /usr/src/linux-obj/$arch/$flavor \
modules \
M=/usr/src/kernel-modules/nvidia-%{-v*}-$flavor \
SYSSRC=/lib/modules/$kver/source \
SYSOUT=/usr/src/linux-obj/$arch/$flavor || RES=1
pushd /usr/src/kernel-modules/nvidia-%{-v*}-$flavor
make -j$(nproc) -f Makefile \
nv-linux.o \
SYSSRC=/lib/modules/$kver/source \
SYSOUT=/usr/src/linux-obj/$arch/$flavor || RES=1
popd
install -m 755 -d /lib/modules/$kver/updates
install -m 644 /usr/src/kernel-modules/nvidia-%{-v*}-$flavor/nvidia*.ko \
/lib/modules/$kver/updates
depmod $kver
# cleanup (boo#1200310)
pushd /usr/src/kernel-modules/nvidia-%{-v*}-$flavor || true
cp -a Makefile{,.tmp} || true
make clean || true
# NVIDIA's "make clean" not being perfect (boo#1201937)
rm -f conftest*.c nv_compiler.h
mv Makefile{.tmp,} || true
popd || true
%if 0%{?suse_version} >= 1550
# Sign modules on secureboot systems
if [ -x /usr/bin/mokutil ]; then
mokutil --sb-state | grep -q "SecureBoot enabled"
if [ $? -eq 0 ]; then
privkey=$(mktemp /tmp/MOK.priv.XXXXXX)
pubkeydir=/usr/share/nvidia-pubkeys
pubkey=$pubkeydir/MOK-%{name}-%{-v*}-%{-r*}-$flavor.der
# make sure creation of pubkey doesn't fail later
test -d pubkeydir || mkdir -p $pubkeydir
if [ $1 -eq 2 ] && [ -e $pubkey ]; then
# Special case: reinstall of the same pkg version
# ($pubkey file name includes version and release)
# Run mokutil --delete here, because we can't be sure preun
# will be run (bsc#1176146)
mv -f $pubkey $pubkey.delete
mokutil --delete $pubkey.delete --root-pw
# We can't remove $pubkey.delete, the preun script
# uses it as indicator not to delete $pubkey
else
rm -f $pubkey $pubkey.delete
fi
# Create a key pair (private key, public key)
openssl req -new -x509 -newkey rsa:2048 \
-keyout $privkey \
-outform DER -out $pubkey -days 1000 \
-subj "/CN=Local build for %{name} %{-v*} on $(date +"%Y-%m-%d")/" \
-addext "extendedKeyUsage=codeSigning" \
-nodes
# Install the public key to MOK
mokutil --import $pubkey --root-pw
# Sign the Nvidia modules (weak-updates appears to be broken)
for i in /lib/modules/$kver/updates/nvidia*.ko; do
/lib/modules/$kver/build/scripts/sign-file sha256 $privkey $pubkey $i
done
# cleanup: private key no longer needed
rm -f $privkey
fi
fi
%endif
# recreate initrd if old modules are still in there (gh issue#25)
if lsinitrd | grep -q nvidia.ko; then
# Let all initrds get generated by regenerate-initrd-posttrans
mkdir -p /run/regenerate-initrd
touch /run/regenerate-initrd/all
fi
exit $RES