[PATCH 0/2] kbuild: Fallout from moving '-mfentry' check into Kconfig stage

[PATCH 0/2] kbuild: Fallout from moving '-mfentry' check into Kconfig stage

[Nathan Chancellor]

Hi all,

Ricardo reported an issue from moving the compiler test for '-mfentry'
into Kconfig. In testing that patch, I noticed that the kernel.org GCC
builds for s390 were not probing correctly for '-mfentry' support.

The first patch moves the check for '-mfentry' back into Kbuild where we
have the proper information for whether this flag is actually supported.

The second patch documents the reasons for these issues for future
travelers to hopefully avoid these problems.

I plan to take this via kbuild-fixes after sufficient review/comments.

---
Nathan Chancellor (2):
      kbuild: Move testing of '-mfentry' back to Makefile from Kconfig
      scripts/Kconfig.toolchain: Highlight cc-option differences between Kconfig and Kbuild

 Makefile                  |  3 ++-
 scripts/Kconfig.toolchain | 23 +++++++++++++++++++----
 2 files changed, 21 insertions(+), 5 deletions(-)
---
base-commit: 997208ce9f43f01febac956cf9aeffe89945e3c1
change-id: 20261020-kconfig-fix-mfentry-check-50525bc5a6ca

Best regards,
--  
Cheers,
Nathan

[PATCH 1/2] kbuild: Move testing of '-mfentry' back to Makefile from Kconfig

[Nathan Chancellor]

Unlike cc-option in Kbuild, cc-option in Kconfig does not test options
with either bit ('-m32' / '-m64') or endianness ('-mbig-endian' /
'-mlittle-endian') flags because which flag to use may depend on the
result of the configuration stage. This difference changes the result of
testing for '-mfentry' support when using the kernel.org s390 cross
compiler, which is configured for 32-bit by default.

  $ s390-linux-gcc -mfentry -o /dev/null -x c -c /dev/null
  cc1: error: '-mfentry' is supported only for 64-bit CPUs

arch/s390/Makefile sets '-m64' in KBUILD_CPPFLAGS early, so '-mfentry'
support was properly tested before the move to Kconfig.

  $ s390-linux-gcc -m64 -mfentry -o /dev/null -x c -c /dev/null

Ricardo reported another issue with moving this check from Kbuild to
Kconfig, as '-mfentry' is not supported for x86_32 without '-fno-pic',
which affects GCC builds that are configured with PIE enabled by
default. arch/x86/Makefile adds '-fno-pic' to KBUILD_CFLAGS, so this
works properly in Kbuild.

Move the '-mfentry' check back into Kbuild to avoid adding additional
complexity to the Kconfig entry.

Fixes: 454e00cf8ee5 ("kbuild: avoid re-running compiler and linker probes")
Reported-by: Ricardo Ribalda <ribalda@chromium.org>
Closes: https://lore.kernel.org/20261020-pie-v1-1-9be09f2324b1@chromium.org/
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
---
Cc: linux-s390@vger.kernel.org
---
 Makefile                  | 3 ++-
 scripts/Kconfig.toolchain | 4 ----
 2 files changed, 2 insertions(+), 5 deletions(-)

diff --git a/Makefile b/Makefile
index 8d23af898d44..f123ac983e62 100644
--- a/Makefile
+++ b/Makefile
@@ -1057,7 +1057,8 @@ ifdef CONFIG_FTRACE_MCOUNT_USE_RECORDMCOUNT
   endif
 endif
 ifdef CONFIG_HAVE_FENTRY
-  ifdef CONFIG_CC_HAS_MFENTRY
+  # s390-linux-gnu-gcc did not support -mfentry until gcc-9.
+  ifeq ($(call cc-option-yn, -mfentry),y)
     CC_FLAGS_FTRACE	+= -mfentry
     CC_FLAGS_USING	+= -DCC_USING_FENTRY
   endif
diff --git a/scripts/Kconfig.toolchain b/scripts/Kconfig.toolchain
index 254393d4f98a..01b49fa5d6be 100644
--- a/scripts/Kconfig.toolchain
+++ b/scripts/Kconfig.toolchain
@@ -169,10 +169,6 @@ config CC_OPT_NO_ALLOW_STORE_DATA_RACES
 config CC_HAS_MNOP_MCOUNT
 	def_bool $(cc-option,-mnop-mcount)
 
-# s390-linux-gnu-gcc did not support -mfentry until gcc-9.
-config CC_HAS_MFENTRY
-	def_bool $(cc-option,-mfentry)
-
 config LD_OPT_FORCE_GROUP_ALLOCATION
 	def_string "$(ld-option-str,--force-group-allocation)"
 

-- 
2.56.0

Re: [PATCH 1/2] kbuild: Move testing of '-mfentry' back to Makefile from Kconfig

[sashiko-bot]

> Unlike cc-option in Kbuild, cc-option in Kconfig does not test options
> with either bit ('-m32' / '-m64') or endianness ('-mbig-endian' /
> '-mlittle-endian') flags because which flag to use may depend on the
> result of the configuration stage. This difference changes the result of
> testing for '-mfentry' support when using the kernel.org s390 cross
> compiler, which is configured for 32-bit by default.
> 
>   $ s390-linux-gcc -mfentry -o /dev/null -x c -c /dev/null
>   cc1: error: '-mfentry' is supported only for 64-bit CPUs
> 
> arch/s390/Makefile sets '-m64' in KBUILD_CPPFLAGS early, so '-mfentry'
> support was properly tested before the move to Kconfig.
> 
>   $ s390-linux-gcc -m64 -mfentry -o /dev/null -x c -c /dev/null
> 
> Ricardo reported another issue with moving this check from Kbuild to
> Kconfig, as '-mfentry' is not supported for x86_32 without '-fno-pic',
> which affects GCC builds that are configured with PIE enabled by
> default. arch/x86/Makefile adds '-fno-pic' to KBUILD_CFLAGS, so this
> works properly in Kbuild.
> 
> Move the '-mfentry' check back into Kbuild to avoid adding additional
> complexity to the Kconfig entry.
> 
> Fixes: 454e00cf8ee5 ("kbuild: avoid re-running compiler and linker probes")
> Reported-by: Ricardo Ribalda <ribalda@chromium.org>
> Closes: https://lore.kernel.org/20261020-pie-v1-1-9be09f2324b1@chromium.org/
> Signed-off-by: Nathan Chancellor <nathan@kernel.org>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261020-kconfig-fix-mfentry-check-v1-0-428258bc0fc0@kernel.org?part=1

Re: [PATCH 1/2] kbuild: Move testing of '-mfentry' back to Makefile from Kconfig

[Kees Cook]

On October 20, 2026 2:52:18 PM PDT, Nathan Chancellor <nathan@kernel.org> wrote:
>Unlike cc-option in Kbuild, cc-option in Kconfig does not test options
>with either bit ('-m32' / '-m64') or endianness ('-mbig-endian' /
>'-mlittle-endian') flags because which flag to use may depend on the
>result of the configuration stage.

Oooh, yeah... Do we have any silent failures due to this in other places? On x86 I worry we'll see similar problems. Stack protector arg checking comes to mind. I will go see if I can find anything...

-Kees

-- 
Kees Cook

Re: [PATCH 1/2] kbuild: Move testing of '-mfentry' back to Makefile from Kconfig

[Nathan Chancellor]

On Wed, Oct 21, 2026 at 07:44:16AM -0700, Kees Cook wrote:
> 
> 
> On October 20, 2026 2:52:18 PM PDT, Nathan Chancellor <nathan@kernel.org> wrote:
> >Unlike cc-option in Kbuild, cc-option in Kconfig does not test options
> >with either bit ('-m32' / '-m64') or endianness ('-mbig-endian' /
> >'-mlittle-endian') flags because which flag to use may depend on the
> >result of the configuration stage.
> 
> Oooh, yeah... Do we have any silent failures due to this in other places? On x86 I worry we'll see similar problems. Stack protector arg checking comes to mind. I will go see if I can find anything...

I am not sure. I did not look that far, mainly because I thought it
might be hard to audit what is expected vs. unexpected but I guess it
would be easy enough to just dump the result of cc-probe from
scripts/Kconfig.include into a file then look at the tested flag.

On immediate glance across the tree, the s390 Kconfig checks might be
problematic with s390-linux-gcc like '-mfentry' was. Arnd, could the
target for s390 be flipped for the kernel.org GCC toolchains to
s390x-linux-gcc so that '-m64' was the default but the toolchain could
still generate compat code, which seems way more standard for distros?
FWIW, compat support is being killed in the toolchains too, so it feels
like it is worth making this switch even more:

  https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=5886bb453a6a010fc218d90c18febf94a1be30d1
  https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=748bc6a7febf874d84657f538c9d9e3b8153c6e7

The kCFI checks could become problematic if one of the 32/64 or
bi-endian architectures gained asymmetric support in the toolchain but
it was not the target triple that scripts/Makefile.clang uses, but that
feels somewhat unlikely.

Everything else probably does not matter much in practice just due to
lack of use (think 32-bit RISC-V probes when using clang since it has a
64-bit target triple). It does make me a little worried though.

-- 
Cheers,
Nathan

Re: [PATCH 0/2] kbuild: Fallout from moving '-mfentry' check into Kconfig stage

[Ricardo Ribalda]

Hi Nathan

Thanks for the series, it fixes the issue for media-ci

Tested-by: Ricardo Ribalda <ribalda@chromium.org>


On Wed, 21 Oct 2026 at 06:52, Nathan Chancellor <nathan@kernel.org> wrote:
>
> Hi all,
>
> Ricardo reported an issue from moving the compiler test for '-mfentry'
> into Kconfig. In testing that patch, I noticed that the kernel.org GCC
> builds for s390 were not probing correctly for '-mfentry' support.
>
> The first patch moves the check for '-mfentry' back into Kbuild where we
> have the proper information for whether this flag is actually supported.
>
> The second patch documents the reasons for these issues for future
> travelers to hopefully avoid these problems.
>
> I plan to take this via kbuild-fixes after sufficient review/comments.
>
> ---
> Nathan Chancellor (2):
>       kbuild: Move testing of '-mfentry' back to Makefile from Kconfig
>       scripts/Kconfig.toolchain: Highlight cc-option differences between Kconfig and Kbuild
>
>  Makefile                  |  3 ++-
>  scripts/Kconfig.toolchain | 23 +++++++++++++++++++----
>  2 files changed, 21 insertions(+), 5 deletions(-)
> ---
> base-commit: 997208ce9f43f01febac956cf9aeffe89945e3c1
> change-id: 20261020-kconfig-fix-mfentry-check-50525bc5a6ca
>
> Best regards,
> --
> Cheers,
> Nathan
>


-- 
Ricardo Ribalda

Re: [PATCH 0/2] kbuild: Fallout from moving '-mfentry' check into Kconfig stage

[Lorenzo Stoakes (ARM)]

On Tue, Oct 20, 2026 at 02:52:17PM -0700, Nathan Chancellor wrote:
> Hi all,
>
> Ricardo reported an issue from moving the compiler test for '-mfentry'
> into Kconfig. In testing that patch, I noticed that the kernel.org GCC
> builds for s390 were not probing correctly for '-mfentry' support.
>
> The first patch moves the check for '-mfentry' back into Kbuild where we
> have the proper information for whether this flag is actually supported.
>
> The second patch documents the reasons for these issues for future
> travelers to hopefully avoid these problems.
>
> I plan to take this via kbuild-fixes after sufficient review/comments.

Also a valid solution :)

LGTM so:

Acked-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>

>
> ---
> Nathan Chancellor (2):
>       kbuild: Move testing of '-mfentry' back to Makefile from Kconfig
>       scripts/Kconfig.toolchain: Highlight cc-option differences between Kconfig and Kbuild
>
>  Makefile                  |  3 ++-
>  scripts/Kconfig.toolchain | 23 +++++++++++++++++++----
>  2 files changed, 21 insertions(+), 5 deletions(-)
> ---
> base-commit: 997208ce9f43f01febac956cf9aeffe89945e3c1
> change-id: 20261020-kconfig-fix-mfentry-check-50525bc5a6ca
>
> Best regards,
> --
> Cheers,
> Nathan
>

--
Cheers, Lorenzo