Re: [PATCH v8 29/29] KVM: s390: Enforce no unexpected external symbol exports in s390 KVM

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] Makefile: kvm_check_exports prints false-positive violations in error log
--

commit 539bcae6d5e99f65300c56bf0e306743cc8f639c
Author: Steffen Eiden <seiden@linux.ibm.com>

KVM: s390: Enforce no unexpected external symbol exports in s390 KVM

Add a Makefile check to arch/s390/kvm that fails the build on any
EXPORT_SYMBOL_GPL or EXPORT_SYMBOL not in the allowed list. A symbol
may only use EXPORT_SYMBOL_GPL if it is defined in exactly one of the
two s390 KVM modules (kvm or kvm-arm64).

> diff --git a/arch/s390/kvm/arm64/Makefile b/arch/s390/kvm/arm64/Makefile
> index bd78d64939d1a..d84d3be74037d 100644
> --- a/arch/s390/kvm/arm64/Makefile
> +++ b/arch/s390/kvm/arm64/Makefile

[ ... ]

> @@ -91,3 +92,16 @@ targets += kvm-unnamespaced.o kvm_symbol_list kvm-namespaced.o
>  endif
>  
>  obj-$(CONFIG_KVM) += kvm-arm64.o
> +
> +# Fail the build if there is unexpected EXPORT_SYMBOL_GPL (or EXPORT_SYMBOL)
> +# usage in arm64 KVM code. A symbol may only use EXPORT_SYMBOL_GPL if it is
> +# defined in exactly one of the two s390 KVM modules (kvm or kvm_arm64). A
> +# symbol defined in both would cause a conflict during linking if builtin is
> +# selected. Catch the issue early.
> +
> +# This "symbol" is not exported by arm on s390 but still in the source code and the
> +# export check scans unexpanded source code.
> +kvm_exports_allowed := kvm_file_to_kvm_fn
> +
> +$(eval $(call kvm_check_exports,EXPORT_SYMBOL_GPL))

[Severity: Low]
Will kvm_check_exports print false-positive violations in the error log here?

While KVM_CHECK_EXPORT_DIRS is overridden in this Makefile to restrict the
export check to its own specific directories, __kvm_get_exports ignores this
customization and hardcodes the search path to:
$(srctree)/virt/kvm $(srctree)/arch/$(SRCARCH)/kvm

This search path covers the entire s390/kvm tree. If an unwanted export
triggers a build error in the arm64 module, the error message invoking
__kvm_get_exports will inadvertently list valid, allowed exports from the
s390 module as unwanted occurrences.

> +$(eval $(call kvm_check_exports,EXPORT_SYMBOL))

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260918133107.1042730-1-seiden@linux.ibm.com?part=29