Re: [PATCH v3 09/21] kbuild: Only run objtool if there is at least one command
Josh Poimboeuf <[email protected]>
| Newsgroups | org.kernel.vger.live-patching,org.infradead.lists.linux-arm-kernel,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <4bjd5d6sbmhorxcmzoaswr3emdhybswtjo5nbdsgtb3sxe43ip@eayelnnw6fi7> |
On Thu, May 14, 2026 at 10:25:15PM +0000, [email protected] wrote: > Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: > - [Low] Leaking objtool options into vmlinux.o validation causes a fatal build failure (`--cfi requires --prefix`) and silently alters validation behavior. > -- > > commit 68e454f3a8ccd3d638c67c092eee264996286695 > Author: Josh Poimboeuf <[email protected]> > > kbuild: Only run objtool if there is at least one command > > This commit splits the objtool arguments into commands and options to > prevent objtool from running when no commands are enabled. > > > diff --git a/scripts/Makefile.vmlinux_o b/scripts/Makefile.vmlinux_o > > index 527352c222ff6..09af33203bd8d 100644 > > --- a/scripts/Makefile.vmlinux_o > > +++ b/scripts/Makefile.vmlinux_o > [ ... ] > > @@ -36,18 +36,13 @@ endif > > # For !delay-objtool + CONFIG_NOINSTR_VALIDATION, it runs on both translation > > # units and vmlinux.o, with the latter only used for noinstr/unret validation. > > > > -objtool-enabled := $(or $(delay-objtool),$(CONFIG_NOINSTR_VALIDATION)) > > - > > -ifeq ($(delay-objtool),y) > > -vmlinux-objtool-args-y += $(objtool-args-y) > > -else > > -vmlinux-objtool-args-$(CONFIG_OBJTOOL_WERROR) += --werror > > +ifneq ($(delay-objtool),y) > > +objtool-cmds-y = > > +objtool-opts-y += --link > > Does this code unintentionally retain the options from scripts/Makefile.lib? > > Since objtool-cmds-y is cleared here, commands like --prefix are dropped. > However, because objtool-opts-y is only appended to, options like --cfi > remain active. > > This causes objtool to fail with a fatal error: "--cfi requires --prefix" > during vmlinux.o validation on configurations with KCFI. > > Should objtool-opts-y be assigned directly using = or := instead of > appended? Indeed, adding this on top: diff --git a/scripts/Makefile.vmlinux_o b/scripts/Makefile.vmlinux_o index dc0a5d19f383c..729f82eb85b35 100644 --- a/scripts/Makefile.vmlinux_o +++ b/scripts/Makefile.vmlinux_o @@ -38,7 +38,8 @@ endif ifneq ($(delay-objtool),y) objtool-cmds-y = -objtool-opts-y += --link +objtool-opts-y = --link +objtool-opts-$(CONFIG_OBJTOOL_WERROR) += --werror endif objtool-cmds-$(CONFIG_NOINSTR_VALIDATION) += --noinstr \