linux-kernel - RE: [PATCH 2/2] objtool/klp: Only enable --checksum when needed

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID:
 <SN6PR02MB4157D1FD4F6AE2BEFE1E9DF5D4CDA@SN6PR02MB4157.namprd02.prod.outlook.com>
Date: Thu, 13 Nov 2025 02:29:04 +0000
From: Michael Kelley <mhklinux@...look.com>
To: Josh Poimboeuf <jpoimboe@...nel.org>, "x86@...nel.org" <x86@...nel.org>
CC: "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, Peter
 Zijlstra <peterz@...radead.org>, "live-patching@...r.kernel.org"
	<live-patching@...r.kernel.org>
Subject: RE: [PATCH 2/2] objtool/klp: Only enable --checksum when needed

From: Josh Poimboeuf <jpoimboe@...nel.org> Sent: Wednesday, November 12, 2025 3:33 PM
> 
> With CONFIG_KLP_BUILD enabled, checksums are only needed during a
> klp-build run.  There's no need to enable them for normal kernel builds.
> 
> This also has the benefit of softening the xxhash dependency.
> 
> Signed-off-by: Josh Poimboeuf <jpoimboe@...nel.org>
> ---
>  arch/x86/boot/startup/Makefile | 2 +-
>  scripts/Makefile.lib           | 1 -
>  scripts/livepatch/klp-build    | 4 ++++
>  3 files changed, 5 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/x86/boot/startup/Makefile b/arch/x86/boot/startup/Makefile
> index e8fdf020b422..5e499cfb29b5 100644
> --- a/arch/x86/boot/startup/Makefile
> +++ b/arch/x86/boot/startup/Makefile
> @@ -36,7 +36,7 @@ $(patsubst %.o,$(obj)/%.o,$(lib-y)):
> OBJECT_FILES_NON_STANDARD := y
>  # relocations, even if other objtool actions are being deferred.
>  #
>  $(pi-objs): objtool-enabled	= 1
> -$(pi-objs): objtool-args	= $(if $(delay-objtool),,$(objtool-args-y)) --noabs
> +$(pi-objs): objtool-args	= $(if $(delay-objtool),--dry-run,$(objtool-args-y)) --noabs
> 
>  #
>  # Confine the startup code by prefixing all symbols with __pi_ (for position
> diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
> index f4b33919ec37..28a1c08e3b22 100644
> --- a/scripts/Makefile.lib
> +++ b/scripts/Makefile.lib
> @@ -173,7 +173,6 @@ ifdef CONFIG_OBJTOOL
> 
>  objtool := $(objtree)/tools/objtool/objtool
> 
> -objtool-args-$(CONFIG_KLP_BUILD)			+= --checksum
>  objtool-args-$(CONFIG_HAVE_JUMP_LABEL_HACK)		+= --hacks=jump_label
>  objtool-args-$(CONFIG_HAVE_NOINSTR_HACK)		+= --hacks=noinstr
>  objtool-args-$(CONFIG_MITIGATION_CALL_DEPTH_TRACKING)	+= --hacks=skylake
> diff --git a/scripts/livepatch/klp-build b/scripts/livepatch/klp-build
> index 881e052e7fae..882272120c9e 100755
> --- a/scripts/livepatch/klp-build
> +++ b/scripts/livepatch/klp-build
> @@ -489,8 +489,11 @@ clean_kernel() {
> 
>  build_kernel() {
>  	local log="$TMP_DIR/build.log"
> +	local objtool_args=()
>  	local cmd=()
> 
> +	objtool_args=("--checksum")
> +
>  	cmd=("make")
> 
>  	# When a patch to a kernel module references a newly created unexported
> @@ -513,6 +516,7 @@ build_kernel() {
>  	cmd+=("$VERBOSE")
>  	cmd+=("-j$JOBS")
>  	cmd+=("KCFLAGS=-ffunction-sections -fdata-sections")
> +	cmd+=("OBJTOOL_ARGS=${objtool_args[*]}")
>  	cmd+=("vmlinux")
>  	cmd+=("modules")
> 
> --
> 2.51.1

Did a normal linux-next kernel build on an Ubuntu 20.04 system, which by default
does not have xxhash installed. Previous error about needing to install libxxhash-dev
is no longer generated. Have not tested a klp-build.

Tested-by: Michael Kelley <mhklinux@...look.com>