1. Patchew
  2. linux
  3. [PATCH v2 0/3] Detect changed compiler dependencies for full rebuild
  4. View patch

[PATCH v2 2/3] randstruct: Force full rebuild when seed changes

Kees Cook posted 3 patches 9 months, 1 week ago
There is a newer version of this series
[PATCH v2 2/3] randstruct: Force full rebuild when seed changes
Posted by Kees Cook 9 months, 1 week ago 
While the randstruct GCC plugin was being rebuilt if the randstruct
seed changed, Clangs build did not notice the change. Include the hash
header directly so that it becomes a universal build dependency and full
rebuilds will happen if it changes.

Since we cannot use "-include ..." as the randstruct flags are removed
via "filter-out" (which would cause all instances of "-include" to be
removed), use the existing -DRANDSTRUCT to control the header inclusion
via include/linux/compiler-version.h. Universally add a -I for the
scripts/basic directory, where header exists. The UM build requires that
the -I be explicitly added.

Signed-off-by: Kees Cook <kees@kernel.org>
---
Cc: Masahiro Yamada <masahiroy@kernel.org>
Cc: Nathan Chancellor <nathan@kernel.org>
Cc: Nicolas Schier <nicolas.schier@linux.dev>
Cc: Petr Pavlu <petr.pavlu@suse.com>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: <linux-kbuild@vger.kernel.org>
---
 Makefile                         |  1 +
 arch/um/Makefile                 |  1 +
 include/linux/compiler-version.h |  3 +++
 include/linux/vermagic.h         |  1 -
 scripts/basic/Makefile           | 11 ++++++-----
 5 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/Makefile b/Makefile
index 5aa9ee52a765..cef652227843 100644
--- a/Makefile
+++ b/Makefile
@@ -567,6 +567,7 @@ LINUXINCLUDE    := \
 		-I$(objtree)/arch/$(SRCARCH)/include/generated \
 		-I$(srctree)/include \
 		-I$(objtree)/include \
+		-I$(objtree)/scripts/basic \
 		$(USERINCLUDE)
 
 KBUILD_AFLAGS   := -D__ASSEMBLY__ -fno-PIE
diff --git a/arch/um/Makefile b/arch/um/Makefile
index 8cc0f22ebefa..38f6024e75d7 100644
--- a/arch/um/Makefile
+++ b/arch/um/Makefile
@@ -73,6 +73,7 @@ USER_CFLAGS = $(patsubst $(KERNEL_DEFINES),,$(patsubst -I%,,$(KBUILD_CFLAGS))) \
 		-D_FILE_OFFSET_BITS=64 -idirafter $(srctree)/include \
 		-idirafter $(objtree)/include -D__KERNEL__ -D__UM_HOST__ \
 		-I$(objtree)/scripts/gcc-plugins \
+		-I$(objtree)/scripts/basic \
 		-include $(srctree)/include/linux/compiler-version.h \
 		-include $(srctree)/include/linux/kconfig.h
 
diff --git a/include/linux/compiler-version.h b/include/linux/compiler-version.h
index 08943df04ebb..05d555320a0f 100644
--- a/include/linux/compiler-version.h
+++ b/include/linux/compiler-version.h
@@ -16,3 +16,6 @@
 #ifdef GCC_PLUGINS_ENABLED
 #include "gcc-plugins-deps.h"
 #endif
+#ifdef RANDSTRUCT
+#include "randstruct_hash.h"
+#endif
diff --git a/include/linux/vermagic.h b/include/linux/vermagic.h
index 939ceabcaf06..335c360d4f9b 100644
--- a/include/linux/vermagic.h
+++ b/include/linux/vermagic.h
@@ -33,7 +33,6 @@
 #define MODULE_VERMAGIC_MODVERSIONS ""
 #endif
 #ifdef RANDSTRUCT
-#include <generated/randstruct_hash.h>
 #define MODULE_RANDSTRUCT "RANDSTRUCT_" RANDSTRUCT_HASHED_SEED
 #else
 #define MODULE_RANDSTRUCT
diff --git a/scripts/basic/Makefile b/scripts/basic/Makefile
index dd289a6725ac..31637ce4dc5c 100644
--- a/scripts/basic/Makefile
+++ b/scripts/basic/Makefile
@@ -8,9 +8,10 @@ hostprogs-always-y	+= fixdep
 # before running a Clang kernel build.
 gen-randstruct-seed	:= $(srctree)/scripts/gen-randstruct-seed.sh
 quiet_cmd_create_randstruct_seed = GENSEED $@
-cmd_create_randstruct_seed = \
-	$(CONFIG_SHELL) $(gen-randstruct-seed) \
-		$@ $(objtree)/include/generated/randstruct_hash.h
-$(obj)/randstruct.seed: $(gen-randstruct-seed) FORCE
+      cmd_create_randstruct_seed = $(CONFIG_SHELL) $(gen-randstruct-seed) \
+		$(obj)/randstruct.seed $(obj)/randstruct_hash.h
+
+$(obj)/randstruct_hash.h $(obj)/randstruct.seed: $(gen-randstruct-seed) FORCE
 	$(call if_changed,create_randstruct_seed)
-always-$(CONFIG_RANDSTRUCT) += randstruct.seed
+
+always-$(CONFIG_RANDSTRUCT) += randstruct.seed randstruct_hash.h
-- 
2.34.1
Re: [PATCH v2 2/3] randstruct: Force full rebuild when seed changes
Posted by Masahiro Yamada 9 months, 1 week ago 
On Sat, May 3, 2025 at 7:54 AM Kees Cook <kees@kernel.org> wrote:
>
> While the randstruct GCC plugin was being rebuilt if the randstruct
> seed changed, Clangs build did not notice the change. Include the hash
> header directly so that it becomes a universal build dependency and full
> rebuilds will happen if it changes.
>
> Since we cannot use "-include ..." as the randstruct flags are removed
> via "filter-out" (which would cause all instances of "-include" to be
> removed), use the existing -DRANDSTRUCT to control the header inclusion
> via include/linux/compiler-version.h. Universally add a -I for the
> scripts/basic directory, where header exists. The UM build requires that
> the -I be explicitly added.
>
> Signed-off-by: Kees Cook <kees@kernel.org>
> ---
> Cc: Masahiro Yamada <masahiroy@kernel.org>
> Cc: Nathan Chancellor <nathan@kernel.org>
> Cc: Nicolas Schier <nicolas.schier@linux.dev>
> Cc: Petr Pavlu <petr.pavlu@suse.com>
> Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
> Cc: <linux-kbuild@vger.kernel.org>
> ---
>  Makefile                         |  1 +
>  arch/um/Makefile                 |  1 +
>  include/linux/compiler-version.h |  3 +++
>  include/linux/vermagic.h         |  1 -
>  scripts/basic/Makefile           | 11 ++++++-----
>  5 files changed, 11 insertions(+), 6 deletions(-)
>
> diff --git a/Makefile b/Makefile
> index 5aa9ee52a765..cef652227843 100644
> --- a/Makefile
> +++ b/Makefile
> @@ -567,6 +567,7 @@ LINUXINCLUDE    := \
>                 -I$(objtree)/arch/$(SRCARCH)/include/generated \
>                 -I$(srctree)/include \
>                 -I$(objtree)/include \
> +               -I$(objtree)/scripts/basic \


Now you are adding random header search paths everywhere.
This is very hacky.


I recommend keeping <generated/randstruct_hash.h>

Then,  -I$(objtree)/scripts/basic is unneeded.


>                 $(USERINCLUDE)
>
>  KBUILD_AFLAGS   := -D__ASSEMBLY__ -fno-PIE
> diff --git a/arch/um/Makefile b/arch/um/Makefile
> index 8cc0f22ebefa..38f6024e75d7 100644
> --- a/arch/um/Makefile
> +++ b/arch/um/Makefile
> @@ -73,6 +73,7 @@ USER_CFLAGS = $(patsubst $(KERNEL_DEFINES),,$(patsubst -I%,,$(KBUILD_CFLAGS))) \
>                 -D_FILE_OFFSET_BITS=64 -idirafter $(srctree)/include \
>                 -idirafter $(objtree)/include -D__KERNEL__ -D__UM_HOST__ \
>                 -I$(objtree)/scripts/gcc-plugins \
> +               -I$(objtree)/scripts/basic \
>                 -include $(srctree)/include/linux/compiler-version.h \
>                 -include $(srctree)/include/linux/kconfig.h
>
> diff --git a/include/linux/compiler-version.h b/include/linux/compiler-version.h
> index 08943df04ebb..05d555320a0f 100644
> --- a/include/linux/compiler-version.h
> +++ b/include/linux/compiler-version.h
> @@ -16,3 +16,6 @@
>  #ifdef GCC_PLUGINS_ENABLED
>  #include "gcc-plugins-deps.h"
>  #endif
> +#ifdef RANDSTRUCT
> +#include "randstruct_hash.h"
> +#endif
> diff --git a/include/linux/vermagic.h b/include/linux/vermagic.h
> index 939ceabcaf06..335c360d4f9b 100644
> --- a/include/linux/vermagic.h
> +++ b/include/linux/vermagic.h
> @@ -33,7 +33,6 @@
>  #define MODULE_VERMAGIC_MODVERSIONS ""
>  #endif
>  #ifdef RANDSTRUCT
> -#include <generated/randstruct_hash.h>
>  #define MODULE_RANDSTRUCT "RANDSTRUCT_" RANDSTRUCT_HASHED_SEED
>  #else
>  #define MODULE_RANDSTRUCT
> diff --git a/scripts/basic/Makefile b/scripts/basic/Makefile
> index dd289a6725ac..31637ce4dc5c 100644
> --- a/scripts/basic/Makefile
> +++ b/scripts/basic/Makefile
> @@ -8,9 +8,10 @@ hostprogs-always-y     += fixdep
>  # before running a Clang kernel build.
>  gen-randstruct-seed    := $(srctree)/scripts/gen-randstruct-seed.sh
>  quiet_cmd_create_randstruct_seed = GENSEED $@
> -cmd_create_randstruct_seed = \
> -       $(CONFIG_SHELL) $(gen-randstruct-seed) \
> -               $@ $(objtree)/include/generated/randstruct_hash.h
> -$(obj)/randstruct.seed: $(gen-randstruct-seed) FORCE
> +      cmd_create_randstruct_seed = $(CONFIG_SHELL) $(gen-randstruct-seed) \
> +               $(obj)/randstruct.seed $(obj)/randstruct_hash.h
> +
> +$(obj)/randstruct_hash.h $(obj)/randstruct.seed: $(gen-randstruct-seed) FORCE
>         $(call if_changed,create_randstruct_seed)


This is wrong.


$(obj)/randstruct_hash.h $(obj)/randstruct.seed: $(gen-randstruct-seed) FORCE
         $(call if_changed,create_randstruct_seed)

is equivalent to:

$(obj)/randstruct_hash.h: $(gen-randstruct-seed) FORCE
         $(call if_changed,create_randstruct_seed)

$(obj)/randstruct.seed: $(gen-randstruct-seed) FORCE
         $(call if_changed,create_randstruct_seed)


So, this rule is executed twice; for randstruct_hash.h and for randstruct.seed

randstruct_hash.h and randstruct.seed will contain different hash values.

I recommend keeping the current code.













--
Best Regards
Masahiro Yamada
Re: [PATCH v2 2/3] randstruct: Force full rebuild when seed changes
Posted by Kees Cook 9 months, 1 week ago 
On Sat, May 03, 2025 at 03:13:06PM +0900, Masahiro Yamada wrote:
> On Sat, May 3, 2025 at 7:54 AM Kees Cook <kees@kernel.org> wrote:
> > +$(obj)/randstruct_hash.h $(obj)/randstruct.seed: $(gen-randstruct-seed) FORCE
> >         $(call if_changed,create_randstruct_seed)
> [...]
> So, this rule is executed twice; for randstruct_hash.h and for randstruct.seed
> 
> randstruct_hash.h and randstruct.seed will contain different hash values.
> 
> I recommend keeping the current code.

Agreed -- getting stuff into generated is much preferred. Thank you!

-- 
Kees Cook

Patchew 2.1-devel-b67e4c2

© 2016 - 2026 Red Hat, Inc.