linux-kernel - Re: [PATCH 2/3] kbuild: deb-pkg: add pkg.linux-upstream.nokernelheaders build profile

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <6fca7450-95e0-1bc0-7556-8889a398d0b6@w6rz.net>
Date: Wed, 23 Oct 2024 06:06:08 -0700
From: Ron Economos <re@...z.net>
To: Masahiro Yamada <masahiroy@...nel.org>, linux-kbuild@...r.kernel.org
Cc: Ben Hutchings <benh@...ian.org>, Bill Wendling <morbo@...gle.com>,
 Justin Stitt <justinstitt@...gle.com>, Nathan Chancellor
 <nathan@...nel.org>, Nick Desaulniers <ndesaulniers@...gle.com>,
 Nicolas Schier <nicolas@...sle.eu>, linux-kernel@...r.kernel.org,
 llvm@...ts.linux.dev
Subject: Re: [PATCH 2/3] kbuild: deb-pkg: add
 pkg.linux-upstream.nokernelheaders build profile

On 10/22/24 11:16 AM, Masahiro Yamada wrote:
> Since commit f1d87664b82a ("kbuild: cross-compile linux-headers package
> when possible"), 'make bindeb-pkg' may attempt to cross-compile the
> linux-headers package, but it fails under certain circumstances.
>
> For example, when CONFIG_MODULE_SIG_FORMAT is enabled on Debian, the
> following command fails:
>
>    $ make ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- bindeb-pkg
>        [ snip ]
>    Rebuilding host programs with aarch64-linux-gnu-gcc...
>      HOSTCC  debian/linux-headers-6.12.0-rc4/usr/src/linux-headers-6.12.0-rc4/scripts/kallsyms
>      HOSTCC  debian/linux-headers-6.12.0-rc4/usr/src/linux-headers-6.12.0-rc4/scripts/sorttable
>      HOSTCC  debian/linux-headers-6.12.0-rc4/usr/src/linux-headers-6.12.0-rc4/scripts/asn1_compiler
>      HOSTCC  debian/linux-headers-6.12.0-rc4/usr/src/linux-headers-6.12.0-rc4/scripts/sign-file
>    In file included from /usr/include/openssl/opensslv.h:109,
>                     from debian/linux-headers-6.12.0-rc4/usr/src/linux-headers-6.12.0-rc4/scripts/sign-file.c:25:
>    /usr/include/openssl/macros.h:14:10: fatal error: openssl/opensslconf.h: No such file or directory
>       14 | #include <openssl/opensslconf.h>
>          |          ^~~~~~~~~~~~~~~~~~~~~~~
>    compilation terminated.
>
> This commit adds a new profile, pkg.linux-upstream.nokernelheaders, to
> guard the linux-headers package.
>
> There are two options to fix the above issue.
>
> [option 1] Set the pkg.linux-upstream.nokernelheaders build profile
>
>    $ DEB_BUILD_PROFILES=pkg.linux-upstream.nokernelheaders \
>      make ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- bindeb-pkg
>
> This skips the building of the linux-headers package.
>
> [option 2] Install the necessary build dependencies
>
> If you want to cross-compile the linux-headers package, you need to
> install additional packages. This is a one-time installation step.
>
> For example, on Debian, the packages necessary for cross-compiling it
> to arm64 can be installed with the following commands:
>
>    # dpkg --add-architecture arm64
>    # apt update
>    # apt install gcc-aarch64-linux-gnu libssl-dev:arm64
>
> Fixes: f1d87664b82a ("kbuild: cross-compile linux-headers package when possible")
> Reported-by: Ron Economos <re@...z.net>
> Closes: https://lore.kernel.org/all/b3d4f49e-7ddb-29ba-0967-689232329b53@w6rz.net/
> Signed-off-by: Masahiro Yamada <masahiroy@...nel.org>
> ---
>
>   scripts/package/builddeb             | 2 +-
>   scripts/package/install-extmod-build | 6 ++----
>   scripts/package/mkdebian             | 9 ++++++++-
>   3 files changed, 11 insertions(+), 6 deletions(-)
>
> diff --git a/scripts/package/builddeb b/scripts/package/builddeb
> index 404587fc71fe..441b0bb66e0d 100755
> --- a/scripts/package/builddeb
> +++ b/scripts/package/builddeb
> @@ -123,7 +123,7 @@ install_kernel_headers () {
>   	pdir=debian/$1
>   	version=${1#linux-headers-}
>   
> -	"${srctree}/scripts/package/install-extmod-build" "${pdir}/usr/src/linux-headers-${version}"
> +	CC="${DEB_HOST_GNU_TYPE}-gcc" "${srctree}/scripts/package/install-extmod-build" "${pdir}/usr/src/linux-headers-${version}"
>   
>   	mkdir -p $pdir/lib/modules/$version/
>   	ln -s /usr/src/linux-headers-$version $pdir/lib/modules/$version/build
> diff --git a/scripts/package/install-extmod-build b/scripts/package/install-extmod-build
> index d2c9cacecc0c..7ec1f061a519 100755
> --- a/scripts/package/install-extmod-build
> +++ b/scripts/package/install-extmod-build
> @@ -44,13 +44,11 @@ mkdir -p "${destdir}"
>   	fi
>   } | tar -c -f - -T - | tar -xf - -C "${destdir}"
>   
> -# When ${CC} and ${HOSTCC} differ, we are likely cross-compiling. Rebuild host
> -# programs using ${CC}. This assumes CC=${CROSS_COMPILE}gcc, which is usually
> -# the case for package building. It does not cross-compile when CC=clang.
> +# When ${CC} and ${HOSTCC} differ, rebuild host programs using ${CC}.
>   #
>   # This caters to host programs that participate in Kbuild. objtool and
>   # resolve_btfids are out of scope.
> -if [ "${CC}" != "${HOSTCC}" ] && is_enabled CONFIG_CC_CAN_LINK; then
> +if [ "${CC}" != "${HOSTCC}" ]; then
>   	echo "Rebuilding host programs with ${CC}..."
>   
>   	cat <<-'EOF' >  "${destdir}/Kbuild"
> diff --git a/scripts/package/mkdebian b/scripts/package/mkdebian
> index 10637d403777..93eb50356ddb 100755
> --- a/scripts/package/mkdebian
> +++ b/scripts/package/mkdebian
> @@ -179,6 +179,8 @@ fi
>   
>   echo $debarch > debian/arch
>   
> +host_gnu=$(dpkg-architecture -a "${debarch}" -q DEB_HOST_GNU_TYPE | sed 's/_/-/g')
> +
>   # Generate a simple changelog template
>   cat <<EOF > debian/changelog
>   $sourcename ($packageversion) $distribution; urgency=low
> @@ -196,7 +198,11 @@ Priority: optional
>   Maintainer: $maintainer
>   Rules-Requires-Root: no
>   Build-Depends: debhelper-compat (= 12)
> -Build-Depends-Arch: bc, bison, cpio, flex, kmod, libelf-dev:native, libssl-dev:native, rsync
> +Build-Depends-Arch: bc, bison, cpio, flex,
> + gcc-${host_gnu} <!pkg.${sourcename}.nokernelheaders>,
> + kmod, libelf-dev:native,
> + libssl-dev:native, libssl-dev <!pkg.${sourcename}.nokernelheaders>,
> + rsync
>   Homepage: https://www.kernel.org/
>   
>   Package: $packagename-$version
> @@ -224,6 +230,7 @@ cat <<EOF >> debian/control
>   
>   Package: linux-headers-$version
>   Architecture: $debarch
> +Build-Profiles: <!pkg.${sourcename}.nokernelheaders>
>   Description: Linux kernel headers for $version on $debarch
>    This package provides kernel header files for $version on $debarch
>    .

Tested with option 2 for RISC-V. On Ubuntu 24.04, the following must be 
added to the file /etc/apt/sources.list.d/ubuntu.sources for apt update 
to fetch the correct repositories:

Types: deb
URIs: http://ports.ubuntu.com/ubuntu-ports
Suites: noble noble-updates noble-backports
Components: main universe restricted multiverse
Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
Architectures: riscv64

Then:

sudo dpkg --add-architecture riscv64
sudo apt-get update
sudo apt-get install libssl-dev:riscv64

The tool chain at https://github.com/riscv-collab/riscv-gnu-toolchain 
can also be made to work. See:

https://github.com/riscv-collab/riscv-gnu-toolchain/issues/1590

Tested-by: Ron Economos <re@...z.net>