[PATCH v8 06/29] KVM: Move export symbol check macros to Makefile.kvm
From: Steffen Eiden <seiden@linux.ibm.com>
Date: 2026-09-18 13:33:04
Also in:
kvm, kvmarm, linux-s390, lkml
Subsystem:
kernel virtual machine (kvm), kernel virtual machine for x86 (kvm/x86), the rest, x86 architecture (32-bit and 64-bit) · Maintainers:
Paolo Bonzini, Sean Christopherson, Linus Torvalds, Thomas Gleixner, Ingo Molnar, Borislav Petkov, Dave Hansen
The EXPORT_SYMBOL_GPL/EXPORT_SYMBOL enforcement logic in arch/x86/kvm/Makefile is useful for any KVM architecture wanting to restrict the exported symbols. Move the check macros to virt/kvm/Makefile.kvm so they can be shared. Arch Makefiles only need to set kvm_exports_allowed to a space-separated list of symbols that are permitted and then call kvm_check_exports for each symbol type they want to enforce. No functional change. Signed-off-by: Steffen Eiden <seiden@linux.ibm.com> --- arch/x86/kvm/Makefile | 49 +++++++++---------------------------------- virt/kvm/Makefile.kvm | 33 +++++++++++++++++++++++++++++ 2 files changed, 43 insertions(+), 39 deletions(-)
diff --git a/arch/x86/kvm/Makefile b/arch/x86/kvm/Makefile
index c6bf463f5032..1bfd630c0767 100644
--- a/arch/x86/kvm/Makefile
+++ b/arch/x86/kvm/Makefile@@ -54,43 +54,14 @@ clean-files += kvm-asm-offsets.h # Only a handful of exports intended for other modules (VFIO, KVMGT) should # use EXPORT_SYMBOL_GPL, and EXPORT_SYMBOL should never be used. ifdef CONFIG_KVM_X86 -# Search recursively for whole words and print line numbers. Filter out the -# allowed set of exports, i.e. those that are intended for external usage. -exports_grep_trailer := --include='*.[ch]' -nrw $(srctree)/virt/kvm $(srctree)/arch/x86/kvm | \ - grep -v -e kvm_page_track_register_notifier \ - -e kvm_page_track_unregister_notifier \ - -e kvm_write_track_add_gfn \ - -e kvm_write_track_remove_gfn \ - -e kvm_file_to_kvm_fn - -# Force grep to emit a goofy group separator that can in turn be replaced with -# the above newline macro (newlines in Make are a nightmare). Note, grep only -# prints the group separator when N lines of context are requested via -C, -# a.k.a. --NUM. Simply request zero lines. Print the separator only after -# filtering out expected exports to avoid extra newlines in the error message. -define get_kvm_exports -$(shell grep "$(1)" -C0 $(exports_grep_trailer) | grep "$(1)" -C0 --group-separator="!SEP!") -endef - -define check_kvm_exports -nr_kvm_exports := $(shell grep "$(1)" $(exports_grep_trailer) | wc -l) - -ifneq (0,$$(nr_kvm_exports)) -$$(error ERROR ***\ -$$(newline)found $$(nr_kvm_exports) unwanted occurrences of $(1):\ -$$(newline) $(subst !SEP!,$$(newline) ,$(call get_kvm_exports,$(1)))\ -$$(newline)in directories:\ -$$(newline) $(srctree)/arch/x86/kvm\ -$$(newline) $(srctree)/virt/kvm\ -$$(newline)Use EXPORT_SYMBOL_FOR_KVM_INTERNAL, not $(1)) -endif # nr_kvm_exports != 0 -undefine nr_kvm_exports -endef # check_kvm_exports - -$(eval $(call check_kvm_exports,EXPORT_SYMBOL_GPL)) -$(eval $(call check_kvm_exports,EXPORT_SYMBOL)) - -undefine check_kvm_exports -undefine get_kvm_exports -undefine exports_grep_trailer +kvm_exports_allowed := kvm_page_track_register_notifier \ + kvm_page_track_unregister_notifier \ + kvm_write_track_add_gfn \ + kvm_write_track_remove_gfn \ + kvm_file_to_kvm_fn + +$(eval $(call kvm_check_exports,EXPORT_SYMBOL_GPL)) +$(eval $(call kvm_check_exports,EXPORT_SYMBOL)) + +undefine kvm_exports_allowed endif # CONFIG_KVM_X86
diff --git a/virt/kvm/Makefile.kvm b/virt/kvm/Makefile.kvm
index d047d4cf58c9..dd40544b8ecb 100644
--- a/virt/kvm/Makefile.kvm
+++ b/virt/kvm/Makefile.kvm@@ -13,3 +13,36 @@ kvm-$(CONFIG_HAVE_KVM_IRQ_ROUTING) += $(KVM)/irqchip.o kvm-$(CONFIG_HAVE_KVM_DIRTY_RING) += $(KVM)/dirty_ring.o kvm-$(CONFIG_HAVE_KVM_PFNCACHE) += $(KVM)/pfncache.o kvm-$(CONFIG_KVM_GUEST_MEMFD) += $(KVM)/guest_memfd.o + +# Force grep to emit a goofy group separator that can in turn be replaced with +# the above newline macro (newlines in Make are a nightmare). Note, grep only +# prints the group separator when N lines of context are requested via -C, +# a.k.a. --NUM. Simply request zero lines. Print the separator only after +# filtering out expected exports to avoid extra newlines in the error message. +define __kvm_get_exports +$(shell grep "$(1)" -C0 --include='*.[ch]' -nrw \ + $(srctree)/virt/kvm $(srctree)/arch/$(SRCARCH)/kvm \ + $(addprefix | grep -v -e ,$(kvm_exports_allowed)) \ + | grep "$(1)" -C0 --group-separator="!SEP!") +endef + + +KVM_CHECK_EXPORT_DIRS ?= $(srctree)/virt/kvm $(srctree)/arch/$(ARCH)/kvm + +# Fail the build if any unwanted $(1) usage is found outside kvm_exports_allowed. +define kvm_check_exports +kvm_nr_exports := $(shell grep "$(1)" --include='*.[ch]' -nrw \ + $(KVM_CHECK_EXPORT_DIRS) \ + $(addprefix | grep -v -e ,$(kvm_exports_allowed)) | wc -l) + +ifneq (0,$$(kvm_nr_exports)) +$$(error ERROR ***\ +$$(newline)found $$(kvm_nr_exports) unwanted occurrences of $(1):\ +$$(newline) $(subst !SEP!,$$(newline) ,$(call __kvm_get_exports,$(1)))\ +$$(newline)in directories:\ +$$(newline) $(KVM_CHECK_EXPORT_DIRS)\ +$$(newline)If this is a valid exception add it to kvm_exports_allowed or\ +$$(newline)use EXPORT_SYMBOL_FOR_KVM_INTERNAL, not $(1)) +endif # kvm_nr_exports != 0 +undefine kvm_nr_exports +endef # kvm_check_exports
--
2.53.0