Re: [PATCH v4.1 03/10] x86/entry/vdso: refactor the vdso build

On Tue,  6 Jan 2026 13:18:36 -0800 "H. Peter Anvin" <[email protected]> wrote:

Hi everyone,

I ran the tip master branch through my AI review prompts and this one was
flagged.  These look right to me, apologies if it's noise:

> diff --git a/arch/x86/entry/vdso/common/Makefile.include b/arch/x86/entry/vdso/common/Makefile.include
> new file mode 100644
> index 0000000000000..3514b4a6869b7
> --- /dev/null
> +++ b/arch/x86/entry/vdso/common/Makefile.include

[ ... ]

> +#
> +# Options from KBUILD_[AC]FLAGS that should *NOT* be kept
> +#
> +flags-remove-y += \
> +	-D__KERNEL__ -mcmodel=kernel -mregparm=3 \
> +	-fno-pic -fno-PIC -fno-pie fno-PIE \
                                  ^^^^^^^

Should this be "-fno-PIE" with the leading dash? The other flags in this
line all have the dash prefix, but "fno-PIE" is missing it. Without the
dash, filter-out won't match the actual compiler flag.

> +	-mfentry -pg \
> +	$(RANDSTRUCT_CFLAGS) $(GCC_PLUGIN_CFLAGS) $(KSTACK_ERASE_CFLAGS) \
                              ^^^^^^^^^^^^^^^^^

Is GCC_PLUGIN_CFLAGS the right variable name here? The kbuild system
defines GCC_PLUGINS_CFLAGS (with an 's') in scripts/Makefile.gcc-plugins.
Other vDSO Makefiles (arm64, sparc, arm) use GCC_PLUGINS_CFLAGS. Without
the fix, gcc plugin flags won't be filtered out when CONFIG_GCC_PLUGINS=y.

> +	$(RETPOLINE_CFLAGS) $(CC_FLAGS_LTO) $(CC_FLAGS_CFI) \
> +	$(PADDING_CFLAGS)

[ ... ]

> +# Reset cf protections enabled by compiler default
> +flags-y += $(call cc-option, -fcf-protection=none)
> +flags-$(X86_USER_SHADOW_STACK) += $(call cc-option, -fcf-protection=return)
           ^^^^^^^^^^^^^^^^^^^^^

Should this be CONFIG_X86_USER_SHADOW_STACK? The Kconfig symbol is defined
as "config X86_USER_SHADOW_STACK" and kbuild exposes it as a CONFIG_
prefixed variable. The next lines show the pattern:

> +# When user space IBT is supported, enable this.
> +# flags-$(CONFIG_USER_IBT) += $(call cc-option, -fcf-protection=branch)
> +
> +flags-$(CONFIG_MITIGATION_RETPOLINE) += $(RETPOLINE_VDSO_CFLAGS)

Both of these correctly use the CONFIG_ prefix. Without it, the shadow
stack cf-protection flag will never be added to vDSO builds even when
CONFIG_X86_USER_SHADOW_STACK=y.