linux-kernel - Re: [PATCH v6 6/8] kbuild: Allow adding modules into the FIT ramdisk

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAFLszTjsgkPV_-Si79RY5T_Fxd5+f-b1VbpG11uS3E9Lk4Ofmg@mail.gmail.com>
Date: Tue, 25 Nov 2025 14:58:12 -0700
From: Simon Glass <sjg@...omium.org>
To: Thomas Weißschuh <thomas.weissschuh@...utronix.de>
Cc: linux-arm-kernel@...ts.infradead.org, 
	Masahiro Yamada <masahiroy@...nel.org>, Tom Rini <trini@...sulko.com>, 
	Ahmad Fatoum <a.fatoum@...gutronix.de>, J . Neuschäfer <j.ne@...teo.net>, 
	Nicolas Schier <nicolas@...sle.eu>, Chen-Yu Tsai <wenst@...omium.org>, 
	"Reviewed-by : Nicolas Schier" <nsc@...nel.org>, Nathan Chancellor <nathan@...nel.org>, Ard Biesheuvel <ardb@...nel.org>, 
	Catalin Marinas <catalin.marinas@....com>, Josh Poimboeuf <jpoimboe@...nel.org>, 
	Kees Cook <kees@...nel.org>, Miguel Ojeda <ojeda@...nel.org>, 
	Nicolas Schier <nicolas.schier@...ux.dev>, Rong Xu <xur@...gle.com>, 
	Tamir Duberstein <tamird@...il.com>, Will Deacon <will@...nel.org>, linux-kbuild@...r.kernel.org, 
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH v6 6/8] kbuild: Allow adding modules into the FIT ramdisk

Hi Thomas,

On Thu, 20 Nov 2025 at 00:49, Thomas Weißschuh
<thomas.weissschuh@...utronix.de> wrote:
>
> On Wed, Nov 19, 2025 at 11:13:27AM -0700, Simon Glass wrote:
> > Support 'make image.fit FIT_MODULES=1' to put all the modules into a
> > ramdisk image within the FIT.
> >
> > Add image.fit as a target which requires modules, so that modules will
> > built automatically when using FIT_MODULES is not empty.
> >
> > Signed-off-by: Simon Glass <sjg@...omium.org>
> > Suggested-by: Ahmad Fatoum <a.fatoum@...gutronix.de>
> > Suggested-by: Reviewed-by: Nicolas Schier <nsc@...nel.org>
> > Acked-by: Nathan Chancellor <nathan@...nel.org>
> > ---
> >
> > Changes in v6:
> > - Mention that FIT_MODULES just needs to be non-empty
> > - Make use of modules.order instead of using 'find'
> >
> > Changes in v5:
> > - Build modules automatically if needed (fix from Nicolas Schier)
> >
> > Changes in v4:
> > - Rename the Makefile variable from 'EXTRA' to 'MAKE_FIT_FLAGS'
> > - Use an empty FIT_MODULES to disable the feature, instead of '0'
> > - Make use of the 'modules' dependency to ensure modules are built
> > - Pass the list of modules to the script
> >
> >  Makefile             | 1 +
> >  arch/arm64/Makefile  | 1 +
> >  scripts/Makefile.lib | 6 +++++-
> >  3 files changed, 7 insertions(+), 1 deletion(-)
> >
> > diff --git a/Makefile b/Makefile
> > index 8cd46222fc48..4eccaef95826 100644
> > --- a/Makefile
> > +++ b/Makefile
> > @@ -773,6 +773,7 @@ endif
> >  # Just "make" or "make all" shall build modules as well
> >
> >  modules-targets := all
> > +modules-targets += $(if $(FIT_MODULES),image.fit)
> >  modules-targets += modules
> >  modules-targets += nsdeps
> >  modules-targets += compile_commands.json
> > diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile
> > index 73a10f65ce8b..7036f251ab40 100644
> > --- a/arch/arm64/Makefile
> > +++ b/arch/arm64/Makefile
> > @@ -174,6 +174,7 @@ endif
> >  all: $(notdir $(KBUILD_IMAGE))
> >
> >  image.fit: dtbs
> > +image.fit: $(if $(FIT_MODULES),modules)
> >
> >  vmlinuz.efi image.fit: Image
> >  $(BOOT_TARGETS): vmlinux
> > diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
> > index 1d581ba5df66..28e0cc0865b1 100644
> > --- a/scripts/Makefile.lib
> > +++ b/scripts/Makefile.lib
> > @@ -398,11 +398,15 @@ MAKE_FIT := $(srctree)/scripts/make_fit.py
> >  # Use this to override the compression algorithm
> >  FIT_COMPRESSION ?= gzip
> >
> > +# Set this to non-empty to include an initrd with all the kernel modules
> > +FIT_MODULES ?=
> > +
> >  quiet_cmd_fit = FIT     $@
> >        cmd_fit = $(MAKE_FIT) -o $@ --arch $(UIMAGE_ARCH) --os linux \
> > -             --name '$(UIMAGE_NAME)' \
> > +             --name '$(UIMAGE_NAME)' $(MAKE_FIT_FLAGS) \
>
> Remnant of a previous revision?

The flags are there to allow extra options to be passed if needed.

>
> >               $(if $(findstring 1,$(KBUILD_VERBOSE)),-v) \
> >               $(if $(FIT_DECOMPOSE_DTBS),--decompose-dtbs) \
> > +             $(if $(FIT_MODULES),--modules @$(objtree)/modules.order) \
>
> I am wondering how module dependencies work without the depmod invocation
> and modules.dep file.

We have a mechanism to place a pre-build initrd with the filesystem,
etc. into the FIT. But for this particular feature (suggested by Ahmad
Fatoum) we are just providing the raw modules. Presumably another
initrd would be needed to provide the startup files?

>
> >               --compress $(FIT_COMPRESSION) -k $< @$(word 2,$^)
> >
> >  # XZ
> > --
> > 2.43.0
> >

Regards,
Simon