{"id":2232775,"url":"http://patchwork.ozlabs.org/api/1.2/patches/2232775/?format=json","web_url":"http://patchwork.ozlabs.org/project/linuxppc-dev/patch/20260505-module-hashes-v5-14-e174a5a49fce@weissschuh.net/","project":{"id":2,"url":"http://patchwork.ozlabs.org/api/1.2/projects/2/?format=json","name":"Linux PPC development","link_name":"linuxppc-dev","list_id":"linuxppc-dev.lists.ozlabs.org","list_email":"linuxppc-dev@lists.ozlabs.org","web_url":"https://github.com/linuxppc/wiki/wiki","scm_url":"https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git","webscm_url":"https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git/","list_archive_url":"https://lore.kernel.org/linuxppc-dev/","list_archive_url_format":"https://lore.kernel.org/linuxppc-dev/{}/","commit_url_format":"https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git/commit/?id={}"},"msgid":"<20260505-module-hashes-v5-14-e174a5a49fce@weissschuh.net>","list_archive_url":"https://lore.kernel.org/linuxppc-dev/20260505-module-hashes-v5-14-e174a5a49fce@weissschuh.net/","date":"2026-05-05T09:05:18","name":"[v5,14/14] kbuild: make CONFIG_MODULE_HASHES compatible with module stripping","commit_ref":null,"pull_url":null,"state":"handled-elsewhere","archived":false,"hash":"0969d453f09424c03f92dfcb75ccce0994577f63","submitter":{"id":82751,"url":"http://patchwork.ozlabs.org/api/1.2/people/82751/?format=json","name":"Thomas Weißschuh","email":"linux@weissschuh.net"},"delegate":null,"mbox":"http://patchwork.ozlabs.org/project/linuxppc-dev/patch/20260505-module-hashes-v5-14-e174a5a49fce@weissschuh.net/mbox/","series":[{"id":502791,"url":"http://patchwork.ozlabs.org/api/1.2/series/502791/?format=json","web_url":"http://patchwork.ozlabs.org/project/linuxppc-dev/list/?series=502791","date":"2026-05-05T09:05:17","name":"module: Introduce hash-based integrity checking","version":5,"mbox":"http://patchwork.ozlabs.org/series/502791/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/2232775/comments/","check":"success","checks":"http://patchwork.ozlabs.org/api/patches/2232775/checks/","tags":{},"related":[],"headers":{"Return-Path":"\n ","X-Original-To":["incoming@patchwork.ozlabs.org","linuxppc-dev@lists.ozlabs.org"],"Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=weissschuh.net header.i=@weissschuh.net\n header.a=rsa-sha256 header.s=mail header.b=bQ5agIzB;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.ozlabs.org\n (client-ip=2404:9400:21b9:f100::1; helo=lists.ozlabs.org;\n envelope-from=linuxppc-dev+bounces-20461-incoming=patchwork.ozlabs.org@lists.ozlabs.org;\n receiver=patchwork.ozlabs.org)","lists.ozlabs.org;\n arc=none smtp.remote-ip=159.69.126.157","lists.ozlabs.org;\n dmarc=pass (p=quarantine dis=none) header.from=weissschuh.net","lists.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=weissschuh.net header.i=@weissschuh.net\n header.a=rsa-sha256 header.s=mail header.b=bQ5agIzB;\n\tdkim-atps=neutral","lists.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=weissschuh.net\n (client-ip=159.69.126.157; helo=todd.t-8ch.de;\n envelope-from=linux@weissschuh.net; receiver=lists.ozlabs.org)"],"Received":["from lists.ozlabs.org (lists.ozlabs.org\n [IPv6:2404:9400:21b9:f100::1])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g8t9H3kwNz1yJV\n\tfor ; Tue, 05 May 2026 19:13:39 +1000 (AEST)","from boromir.ozlabs.org (localhost [127.0.0.1])\n\tby lists.ozlabs.org (Postfix) with ESMTP id 4g8t971D5Hz30Tp;\n\tTue, 05 May 2026 19:13:31 +1000 (AEST)","from todd.t-8ch.de (todd.t-8ch.de [159.69.126.157])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature RSA-PSS (2048 bits) server-digest\n SHA256)\n\t(No client certificate requested)\n\tby lists.ozlabs.org (Postfix) with ESMTPS id 4g8t941FXPz2xSF\n\tfor ; Tue, 05 May 2026 19:13:27 +1000 (AEST)"],"ARC-Seal":"i=1; a=rsa-sha256; d=lists.ozlabs.org; s=201707; t=1777972410;\n\tcv=none;\n b=UkPXEUTIFR5ctDYrA3RURvqatxJXYsD9N7eV3Ah/cFYSeJATF8Uslm+QkM7Vv23bz6n02oGL0QbjwGJroIhCBOUeCaSfC5dtZIMaESafIt1zPzdIJW6xf5Ipfzn4ybpmoB7s3VxlTWFrZ4J8B9fzBNQISS2tJvudhAc8lMN4Phwroy3tKxDkbDZFGg5LDLtE8eGwFqbB3Bx+7Jtsw4qnIyxuxgM503fP9km3938Jduk7ApP6z4ImV3saPJGWTwVVP6Ad5KQjFbEMzyzFEvRdkTbMnWOPjh8wQP2AvbA3GmCJLP6cQLVP/GU3Ca2C76YTwKnnd22GWQqN3ecIo8UHjA==","ARC-Message-Signature":"i=1; a=rsa-sha256; d=lists.ozlabs.org; s=201707;\n\tt=1777972410; c=relaxed/relaxed;\n\tbh=SBuq4vfYe3Hpqde9JKSBVoRgLBmqEml8bQoudUK8xJA=;\n\th=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References:\n\t In-Reply-To:To:Cc;\n b=f5Q2+w3m/LK4G9NhtMIgj8I4ONTs2qsJLWgsASeZuCQPwI9PkzwaYgAZm0eW0HkgbWxBvHapYMBI+RGyNlZaJOGh0AX4O3Kq7Fei/J37MZaGNzhcbsYdytVL3liftIWLdc0kudR4mGvghkuck6XLrLxKXxnvdd3E57tgfAgbfyJBv7d8CVzdCGlpiiCrLH+VO1ZtdNJYakMi/KAE4asAo2drwCFKa2j1TSZ9dFCMsfbSe/4/OyZu2OQIuav99dHiP6DRs8Yp67wyytL7P8ZN0X2IUx4g6he9pXsImWLBiImK0sCS4LfBGTkhBD+1WhCn1ud7EIx+ujnQDSAsF4vyxA==","ARC-Authentication-Results":"i=1; lists.ozlabs.org;\n dmarc=pass (p=quarantine dis=none) header.from=weissschuh.net;\n dkim=pass (1024-bit key;\n unprotected) header.d=weissschuh.net header.i=@weissschuh.net\n header.a=rsa-sha256 header.s=mail header.b=bQ5agIzB; dkim-atps=neutral;\n spf=pass (client-ip=159.69.126.157; helo=todd.t-8ch.de;\n envelope-from=linux@weissschuh.net;\n receiver=lists.ozlabs.org) smtp.mailfrom=weissschuh.net","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/simple; d=weissschuh.net;\n\ts=mail; t=1777971923;\n\tbh=elZqxqWASNPH02Zi8B2qimxrAyck+wx1GcCTAUaTf68=;\n\th=From:Date:Subject:References:In-Reply-To:To:Cc:From;\n\tb=bQ5agIzBPRuFL7JWUhX7aDRNPbRhYiMMw3NdQA1wwclDcc9afVYMsG/75i/WNqhAA\n\t hijo/UrDsuQnHCYS7acn94RhzsDs7Y51FfF3ckZNMmNlu5Jpy4KPF9/PiukPGcZcfg\n\t X9HSI5nDm5v9ZQqJggt0rWkhUIJPYhzeHojeyMw8=","From":"=?utf-8?q?Thomas_Wei=C3=9Fschuh?= ","Date":"Tue, 05 May 2026 11:05:18 +0200","Subject":"[PATCH v5 14/14] kbuild: make CONFIG_MODULE_HASHES compatible with\n module stripping","X-Mailing-List":"linuxppc-dev@lists.ozlabs.org","List-Id":"","List-Help":"","List-Owner":"","List-Post":"","List-Archive":",\n ","List-Subscribe":",\n ,\n ","List-Unsubscribe":"","Precedence":"list","MIME-Version":"1.0","Content-Type":"text/plain; charset=\"utf-8\"","Content-Transfer-Encoding":"8bit","Message-Id":"<20260505-module-hashes-v5-14-e174a5a49fce@weissschuh.net>","References":"<20260505-module-hashes-v5-0-e174a5a49fce@weissschuh.net>","In-Reply-To":"<20260505-module-hashes-v5-0-e174a5a49fce@weissschuh.net>","To":"Alexei Starovoitov ,\n Daniel Borkmann , Andrii Nakryiko ,\n Eduard Zingerman ,\n Kumar Kartikeya Dwivedi ,\n Nathan Chancellor , Nicolas Schier ,\n Arnd Bergmann , Luis Chamberlain ,\n Petr Pavlu , Sami Tolvanen ,\n Daniel Gomez , Paul Moore ,\n James Morris , \"Serge E. Hallyn\" ,\n Jonathan Corbet , Madhavan Srinivasan ,\n Michael Ellerman , Nicholas Piggin ,\n Naveen N Rao , Mimi Zohar ,\n Roberto Sassu ,\n Dmitry Kasatkin ,\n Eric Snowberg ,\n Nicolas Schier ,\n Daniel Gomez , Aaron Tomlin ,\n \"Christophe Leroy (CS GROUP)\" ,\n Nicolas Bouchinet ,\n Xiu Jianfeng ,\n Christophe Leroy ","Cc":"Martin KaFai Lau , Song Liu ,\n Yonghong Song , Jiri Olsa ,\n bpf@vger.kernel.org,\n =?utf-8?q?Fabian_Gr=C3=BCnbichler?= ,\n Arnout Engelen , Mattia Rizzolo ,\n kpcyrd , Christian Heusel ,\n\t=?utf-8?q?C=C3=A2ju_Mihai-Drosi?= ,\n Eric Biggers ,\n Sebastian Andrzej Siewior ,\n linux-kbuild@vger.kernel.org, linux-kernel@vger.kernel.org,\n linux-arch@vger.kernel.org, linux-modules@vger.kernel.org,\n linux-security-module@vger.kernel.org, linux-doc@vger.kernel.org,\n linuxppc-dev@lists.ozlabs.org, linux-integrity@vger.kernel.org,\n debian-kernel@lists.debian.org,\n =?utf-8?q?Thomas_Wei=C3=9Fschuh?= ","X-Mailer":"b4 0.15.2","X-Developer-Signature":"v=1; a=ed25519-sha256; t=1777971921; l=3316;\n i=linux@weissschuh.net; s=20221212; h=from:subject:message-id;\n bh=elZqxqWASNPH02Zi8B2qimxrAyck+wx1GcCTAUaTf68=;\n b=VL/y6lxcfMaVVCAqnHqBHAsMZQRoRMAJFmErw+a7YjNMWb7GcK//q6XoNoKQXYhMyaE3gwwLJ\n is6WW72xVPJDMy3Dd1T+JiFrphn8xBMZBZ2NTjggWulGxg5uKuR6cHw","X-Developer-Key":"i=linux@weissschuh.net; a=ed25519;\n pk=KcycQgFPX2wGR5azS7RhpBqedglOZVgRPfdFSPB1LNw=","X-Spam-Status":"No, score=-0.2 required=3.0 tests=DKIM_SIGNED,DKIM_VALID,\n\tDKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS autolearn=disabled\n\tversion=4.0.1 OzLabs 8","X-Spam-Checker-Version":"SpamAssassin 4.0.1 (2024-03-25) on lists.ozlabs.org"},"content":"CONFIG_MODULE_HASHES needs to process the modules at build time in the\nexact form they will be loaded at runtime. If the modules are stripped\nafterwards they will not be loadable anymore.\n\nAlso evaluate INSTALL_MOD_STRIP at build time and build the hashes based\non modules stripped this way.\n\nIf users specify inconsistent values of INSTALL_MOD_STRIP between build\nand installation time, an error is reported.\n\nSigned-off-by: Thomas Weißschuh \n---\n .gitignore | 1 +\n kernel/module/Kconfig | 5 +++++\n scripts/Makefile.modfinal | 9 +++++++++\n scripts/Makefile.modinst | 4 ++--\n scripts/Makefile.vmlinux | 2 +-\n 5 files changed, 18 insertions(+), 3 deletions(-)","diff":"diff --git a/.gitignore b/.gitignore\nindex 78cf799401e6..6ce10623c5a3 100644\n--- a/.gitignore\n+++ b/.gitignore\n@@ -30,6 +30,7 @@\n *.gz\n *.i\n *.ko\n+*.ko.stripped\n *.lex.c\n *.ll\n *.lst\ndiff --git a/kernel/module/Kconfig b/kernel/module/Kconfig\nindex acbbda58e7c8..48be498a4452 100644\n--- a/kernel/module/Kconfig\n+++ b/kernel/module/Kconfig\n@@ -423,6 +423,11 @@ config MODULE_HASHES\n \n \t Also see the warning in MODULE_SIG about stripping modules.\n \n+# To validate the consistency of INSTALL_MOD_STRIP for MODULE_HASHES\n+config MODULE_INSTALL_STRIP\n+\tstring\n+\tdefault \"$(INSTALL_MOD_STRIP)\"\n+\n config MODULE_ALLOW_MISSING_NAMESPACE_IMPORTS\n \tbool \"Allow loading of modules with missing namespace imports\"\n \thelp\ndiff --git a/scripts/Makefile.modfinal b/scripts/Makefile.modfinal\nindex 44a382689a5a..9924a7bb73c5 100644\n--- a/scripts/Makefile.modfinal\n+++ b/scripts/Makefile.modfinal\n@@ -64,7 +64,16 @@ ifdef CONFIG_DEBUG_INFO_BTF_MODULES\n endif\n \t+$(call cmd,check_tracepoint)\n \n+%.ko.stripped: %.ko $(wildcard include/config/MODULE_INSTALL_STRIP)\n+\t$(call cmd,install_mod)\n+\t$(call cmd,strip_mod)\n+\n+ifneq ($(CONFIG_MODULE_INSTALL_STRIP),)\n+modules.order: $(modules:%.o=%.ko.stripped)\n+endif\n+\n targets += $(modules:%.o=%.ko) $(modules:%.o=%.mod.o) .module-common.o\n+targets += $(modules:%.o=%.ko.stripped)\n \n # Update modules.order when a module is (re-)built.\n # Allow using it as target dependency.\ndiff --git a/scripts/Makefile.modinst b/scripts/Makefile.modinst\nindex b95f613e23c8..fd1fb89bb0bd 100644\n--- a/scripts/Makefile.modinst\n+++ b/scripts/Makefile.modinst\n@@ -68,8 +68,8 @@ __modinst: $(install-y)\n \n ifdef CONFIG_MODULE_HASHES\n ifeq ($(KBUILD_EXTMOD),)\n-ifdef INSTALL_MOD_STRIP\n-$(error CONFIG_MODULE_HASHES and INSTALL_MOD_STRIP are mutually exclusive)\n+ifneq ($(INSTALL_MOD_STRIP),$(CONFIG_MODULE_INSTALL_STRIP))\n+$(error Inconsistent values for INSTALL_MOD_STRIP between build and installation)\n endif\n endif\n endif\ndiff --git a/scripts/Makefile.vmlinux b/scripts/Makefile.vmlinux\nindex a0332c06bde1..a2d170241a2f 100644\n--- a/scripts/Makefile.vmlinux\n+++ b/scripts/Makefile.vmlinux\n@@ -86,7 +86,7 @@ modules.order: vmlinux.unstripped FORCE\n \t$(Q)$(MAKE) -f $(srctree)/Makefile modules\n \n quiet_cmd_modules_merkle_tree = MERKLE $@\n- cmd_modules_merkle_tree = $< $@ .ko\n+ cmd_modules_merkle_tree = $< $@ $(if $(CONFIG_MODULE_INSTALL_STRIP),.ko.stripped,.ko)\n \n targets += .tmp_module_hashes.c\n .tmp_module_hashes.c: $(objtree)/scripts/modules-merkle-tree modules.order FORCE\n","prefixes":["v5","14/14"]}