[PATCH 2/2] kbuild: link-vmlinux.sh: improve detection of third pass requirement

[André Draszik]

It can happen that symbol sizes within .tmp_vmlinux1.kallsyms.o and
.tmp_vmlinux2.kallsyms.o differ, without affecting file size on disk
because of section alignment and/or padding emitted by the assembler.

link-vmlinux.sh doesn't detect this case currently and keeps using
.tmp_vmlinux2.kallsyms.o to link the final vmlinux. Due to the
different symbol sizes, other symbols are shifted within the final
image compared to .tmp_vmlinux2, and the final comparison of System.map
against "${kallsyms_sysmap}" fails with the message:

    Inconsistent kallsyms data
    Try "make KALLSYMS_EXTRA_PASS=1" as a workaround

This can happen in particular if the linker emits additional symbols
that might have different names between our (re-)linking steps, e.g.
because those names depend on the virtual address of the symbol. Linker
stubs for ARM errata work-arounds are one such case.

These changed symbol names can cause the output of the token
compression of kallsyms.c to change due to the changed symbol substring
count, which in turn can change the size of the kallsyms_names symbol
itself, causing the potential shift of subsequent symbol addresses in
.tmp_vmlinux2.kallsyms.o and therefore the final image.

Update link-vmlinux.sh to not rely on file size of
.tmp_vmlinux?.kallsyms.o alone but to also consider symbol offsets
within to resolve this, and do a third pass if required.

Signed-off-by: André Draszik <andre.draszik@xxxxxxxxxx>

---
The issue was hitting:

In a build with CONFIG_ARM64_ERRATUM_843419=y, the linker adds numerous
instances of __CortexA53843419_<stub target virtual address> stubs
(LLVM in my case). As the second part of the symbol name depends on the
virtual address of the stub target, it changes between .tmp_vmlinux1
and .tmp_vmlinux2.

This change made kallsyms_names bigger by one byte:

-       .byte 0x1c, 0x74, 0xff, 0x43, 0xb9, 0xc3, 0x78, 0x41, 0x35, 0x33, 0x38, 0x34, 0x33, 0x34, 0x31, 0x39, 0x5f, 0x1a, 0x1a, 0x1a, 0x43, 0x30, 0x38, 0x33, 0x41, 0x1a, 0x30, 0x30, 0x34      /* t__CortexA53843419_FFFFFFC083AFF004 */
+       .byte 0x1d, 0x74, 0xff, 0x43, 0xb9, 0xc3, 0x78, 0x41, 0x35, 0x33, 0x38, 0x34, 0x33, 0x34, 0x31, 0x39, 0x5f, 0x1a, 0x1a, 0x1a, 0x43, 0x30, 0x38, 0x34, 0x38, 0x38, 0x46, 0x30, 0x30, 0x34        /* t__CortexA53843419_FFFFFFC08488F004 */

and grew the total size of kallsyms_names from 3879944 to 3879945
bytes. Since this moved it past the four byte alignment, all subsequent
symbols were shifted by 4 bytes, causing the final sanity check to
fail.

$ stat -c'%s' .tmp_vmlinux1.kallsyms.o .tmp_vmlinux2.kallsyms.o
18458168
18458168

$ diff -u <(nm -n .tmp_vmlinux1.kallsyms.o) <(nm -n .tmp_vmlinux2.kallsyms.o)
--- /dev/fd/63	2026-07-28 12:17:55.542466443 +0100
+++ /dev/fd/62	2026-07-28 12:17:55.542466443 +0100
@@ -4,8 +4,8 @@
 0000000000000000 N $d
 0000000000000000 R kallsyms_num_syms
 0000000000000004 R kallsyms_names
-00000000003b340c R kallsyms_markers
-00000000003b50bc R kallsyms_token_table
-00000000003b563c R kallsyms_token_index
-00000000003b583c R kallsyms_offsets
-00000000005806c8 R kallsyms_seqs_of_names
+00000000003b3410 R kallsyms_markers
+00000000003b50c0 R kallsyms_token_table
+00000000003b5640 R kallsyms_token_index
+00000000003b5840 R kallsyms_offsets
+00000000005806cc R kallsyms_seqs_of_names

$ size -A .tmp_vmlinux1.kallsyms.o .tmp_vmlinux2.kallsyms.o
.tmp_vmlinux1.kallsyms.o  :
section              size   addr
.text                   0      0
.rodata           7178673      0
.debug_line            49      0
.debug_line_str        72      0
Total             7178794

.tmp_vmlinux2.kallsyms.o  :
section              size   addr
.text                   0      0
.rodata           7178677      0
.debug_line            49      0
.debug_line_str        72      0
Total             7178798
---
 scripts/link-vmlinux.sh | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/scripts/link-vmlinux.sh b/scripts/link-vmlinux.sh
index c8f27e4175f9..ab0b8125c8cb 100755
--- a/scripts/link-vmlinux.sh
+++ b/scripts/link-vmlinux.sh
@@ -106,6 +106,18 @@ vmlinux_link()
 		${kallsymso} ${btf_vmlinux_bin_o} ${arch_vmlinux_o} ${ldlibs}
 }
 
+# Check if kallsymso_prev and kallsymso differ
+# If symbol sizes within ${kallsymso} change, any symbols within vmlinux are
+# likely to shift, invalidating ${kallsymso}.
+# Since file size can remain unchanged even if symbol sizes change, compare the
+# actual symbols instead of relying on file size only.
+kallsymso_changed()
+{
+	${NM} -n "${kallsymso_prev}" > "${kallsymso_prev}.sym"
+	${NM} -n "${kallsymso}" > "${kallsymso}.sym"
+	! cmp -s "${kallsymso_prev}.sym" "${kallsymso}.sym"
+}
+
 # Create ${2}.o file with all symbols from the ${1} object file
 kallsyms()
 {
@@ -126,6 +138,7 @@ kallsyms()
 	${CC} ${NOSTDINC_FLAGS} ${LINUXINCLUDE} ${KBUILD_CPPFLAGS} \
 	      ${KBUILD_AFLAGS} ${KBUILD_AFLAGS_KERNEL} -c -o "${2}.o" "${2}.S"
 
+	kallsymso_prev="${kallsymso:-}"
 	kallsymso=${2}.o
 }
 
@@ -255,7 +268,12 @@ if is_enabled CONFIG_KALLSYMS; then
 	sysmap_and_kallsyms .tmp_vmlinux2
 	size2=$(${CONFIG_SHELL} "${srctree}/scripts/file-size.sh" ${kallsymso})
 
-	if [ $size1 -ne $size2 ] || [ -n "${KALLSYMS_EXTRA_PASS}" ]; then
+	# Due to alignment, file size of the kallsymso object file might remain
+	# unchanged even if individual symbols within change size. Changed
+	# symbol sizes can still shift other symbols, though. Therefore, don't
+	# rely on file size alone.
+	if [ $size1 -ne $size2 ] || kallsymso_changed || \
+			[ -n "${KALLSYMS_EXTRA_PASS}" ]; then
 		vmlinux_link .tmp_vmlinux3
 		sysmap_and_kallsyms .tmp_vmlinux3
 	fi

-- 
2.55.0.229.g6434b31f56-goog