linux-toradex.git/include/linux/compiler_attributes.h, branch v5.19-rc8

Compiler Attributes: Add __diagnose_as for Clang

2022-02-14T00:50:07+00:00

Clang will perform various compile-time diagnostics on uses of various
functions (e.g. simple bounds-checking on strcpy(), etc). These
diagnostics can be assigned to other functions (for example, new
implementations of the string functions under CONFIG_FORTIFY_SOURCE)
using the "diagnose_as_builtin" attribute. This allows those functions
to retain their compile-time diagnostic warnings.

Cc: Nathan Chancellor 
Cc: llvm@lists.linux.dev
Reviewed-by: Miguel Ojeda 
Reviewed-by: Nick Desaulniers 
Signed-off-by: Kees Cook 
Link: https://lore.kernel.org/r/20220208225350.1331628-5-keescook@chromium.org

Compiler Attributes: Add __overloadable for Clang

2022-02-14T00:50:07+00:00

In order for FORTIFY_SOURCE to use __pass_object_size on an "extern
inline" function, as all the fortified string functions are, the functions
must be marked as being overloadable (i.e. different prototypes due
to the implicitly injected object size arguments). This allows the
__pass_object_size versions to take precedence.

Cc: Nathan Chancellor 
Cc: llvm@lists.linux.dev
Reviewed-by: Miguel Ojeda 
Reviewed-by: Nick Desaulniers 
Signed-off-by: Kees Cook 
Link: https://lore.kernel.org/r/20220208225350.1331628-4-keescook@chromium.org

Compiler Attributes: Add __pass_object_size for Clang

2022-02-14T00:50:06+00:00

In order to gain greater visibility to type information when using
__builtin_object_size(), Clang has a function attribute "pass_object_size"
that will make size information available for marked arguments in
a function by way of implicit additional function arguments that are
then wired up the __builtin_object_size().

This is needed to implement FORTIFY_SOURCE in Clang, as a workaround
to Clang's __builtin_object_size() having limited visibility[1] into types
across function calls (even inlines).

This attribute has an additional benefit that it can be used even on
non-inline functions to gain argument size information.

[1] https://github.com/llvm/llvm-project/issues/53516

Cc: Nick Desaulniers 
Cc: Nathan Chancellor 
Cc: llvm@lists.linux.dev
Reviewed-by: Miguel Ojeda 
Signed-off-by: Kees Cook 
Reviewed-by: Nick Desaulniers 
Link: https://lore.kernel.org/r/20220208225350.1331628-3-keescook@chromium.org

compiler_attributes.h: Add __disable_sanitizer_instrumentation

2021-12-10T00:42:28+00:00

The new attribute maps to
__attribute__((disable_sanitizer_instrumentation)), which will be
supported by Clang >= 14.0. Future support in GCC is also possible.

This attribute disables compiler instrumentation for kernel sanitizer
tools, making it easier to implement noinstr. It is different from the
existing __no_sanitize* attributes, which may still allow certain types
of instrumentation to prevent false positives.

Signed-off-by: Alexander Potapenko 
Signed-off-by: Marco Elver 
Signed-off-by: Paul E. McKenney

Merge tag 'compiler-attributes-for-linus-v5.16' of git://github.com/ojeda/linux

2021-11-07T18:38:17+00:00

Pull compiler attributes update from Miguel Ojeda:
 "An improvement for `__compiletime_assert` and a trivial cleanup"

* tag 'compiler-attributes-for-linus-v5.16' of git://github.com/ojeda/linux:
  compiler_types: mark __compiletime_assert failure as __noreturn
  Compiler Attributes: remove GCC 5.1 mention

Compiler Attributes: add __alloc_size() for better bounds checking

2021-11-06T20:30:33+00:00

GCC and Clang can use the "alloc_size" attribute to better inform the
results of __builtin_object_size() (for compile-time constant values).
Clang can additionally use alloc_size to inform the results of
__builtin_dynamic_object_size() (for run-time values).

Because GCC sees the frequent use of struct_size() as an allocator size
argument, and notices it can return SIZE_MAX (the overflow indication),
it complains about these call sites overflowing (since SIZE_MAX is
greater than the default -Walloc-size-larger-than=PTRDIFF_MAX).  This
isn't helpful since we already know a SIZE_MAX will be caught at
run-time (this was an intentional design).  To deal with this, we must
disable this check as it is both a false positive and redundant.  (Clang
does not have this warning option.)

Unfortunately, just checking the -Wno-alloc-size-larger-than is not
sufficient to make the __alloc_size attribute behave correctly under
older GCC versions.  The attribute itself must be disabled in those
situations too, as there appears to be no way to reliably silence the
SIZE_MAX constant expression cases for GCC versions less than 9.1:

   In file included from ./include/linux/resource_ext.h:11,
                    from ./include/linux/pci.h:40,
                    from drivers/net/ethernet/intel/ixgbe/ixgbe.h:9,
                    from drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c:4:
   In function 'kmalloc_node',
       inlined from 'ixgbe_alloc_q_vector' at ./include/linux/slab.h:743:9:
   ./include/linux/slab.h:618:9: error: argument 1 value '18446744073709551615' exceeds maximum object size 9223372036854775807 [-Werror=alloc-size-larger-than=]
     return __kmalloc_node(size, flags, node);
            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   ./include/linux/slab.h: In function 'ixgbe_alloc_q_vector':
   ./include/linux/slab.h:455:7: note: in a call to allocation function '__kmalloc_node' declared here
    void *__kmalloc_node(size_t size, gfp_t flags, int node) __assume_slab_alignment __malloc;
          ^~~~~~~~~~~~~~

Specifically:
 '-Wno-alloc-size-larger-than' is not correctly handled by GCC < 9.1
    https://godbolt.org/z/hqsfG7q84 (doesn't disable)
    https://godbolt.org/z/P9jdrPTYh (doesn't admit to not knowing about option)
    https://godbolt.org/z/465TPMWKb (only warns when other warnings appear)

 '-Walloc-size-larger-than=18446744073709551615' is not handled by GCC < 8.2
    https://godbolt.org/z/73hh1EPxz (ignores numeric value)

Since anything marked with __alloc_size would also qualify for marking
with __malloc, just include __malloc along with it to avoid redundant
markings.  (Suggested by Linus Torvalds.)

Finally, make sure checkpatch.pl doesn't get confused about finding the
__alloc_size attribute on functions.  (Thanks to Joe Perches.)

Link: https://lkml.kernel.org/r/20210930222704.2631604-3-keescook@chromium.org
Signed-off-by: Kees Cook 
Tested-by: Randy Dunlap 
Cc: Andy Whitcroft 
Cc: Christoph Lameter 
Cc: Daniel Micay 
Cc: David Rientjes 
Cc: Dennis Zhou 
Cc: Dwaipayan Ray 
Cc: Joe Perches 
Cc: Joonsoo Kim 
Cc: Lukas Bulwahn 
Cc: Pekka Enberg 
Cc: Tejun Heo 
Cc: Vlastimil Babka 
Cc: Alexandre Bounine 
Cc: Gustavo A. R. Silva 
Cc: Ira Weiny 
Cc: Jing Xiangfeng 
Cc: John Hubbard 
Cc: kernel test robot 
Cc: Matt Porter 
Cc: Miguel Ojeda 
Cc: Nathan Chancellor 
Cc: Nick Desaulniers 
Cc: Souptick Joarder 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

Compiler Attributes: remove GCC 5.1 mention

2021-10-21T22:50:34+00:00

GCC 5.1 is now the minimum version.

Acked-by: Nick Desaulniers 
Signed-off-by: Miguel Ojeda

Merge branch 'gcc-min-version-5.1' (make gcc-5.1 the minimum version)

2021-09-13T17:43:04+00:00

Merge patch series from Nick Desaulniers to update the minimum gcc
version to 5.1.

This is some of the left-overs from the merge window that I didn't want
to deal with yesterday, so it comes in after -rc1 but was sent before.

Gcc-4.9 support has been an annoyance for some time, and with -Werror I
had the choice of applying a fairly big patch from Kees Cook to remove a
fair number of initializer warnings (still leaving some), or this patch
series from Nick that just removes the source of the problem.

The initializer cleanups might still be worth it regardless, but
honestly, I preferred just tackling the problem with gcc-4.9 head-on.
We've been more aggressiuve about no longer having to care about
compilers that were released a long time ago, and I think it's been a
good thing.

I added a couple of patches on top to sort out a few left-overs now that
we no longer support gcc-4.x.

As noted by Arnd, as a result of this minimum compiler version upgrade
we can probably change our use of '--std=gnu89' to '--std=gnu11', and
finally start using local loop declarations etc.  But this series does
_not_ yet do that.

Link: https://lore.kernel.org/all/20210909182525.372ee687@canb.auug.org.au/
Link: https://lore.kernel.org/lkml/CAK7LNASs6dvU6D3jL2GG3jW58fXfaj6VNOe55NJnTB8UPuk2pA@mail.gmail.com/
Link: https://github.com/ClangBuiltLinux/linux/issues/1438

* emailed patches from Nick Desaulniers :
  Drop some straggling mentions of gcc-4.9 as being stale
  compiler_attributes.h: drop __has_attribute() support for gcc4
  vmlinux.lds.h: remove old check for GCC 4.9
  compiler-gcc.h: drop checks for older GCC versions
  Makefile: drop GCC < 5 -fno-var-tracking-assignments workaround
  arm64: remove GCC version check for ARCH_SUPPORTS_INT128
  powerpc: remove GCC version check for UPD_CONSTR
  riscv: remove Kconfig check for GCC version for ARCH_RV64I
  Kconfig.debug: drop GCC 5+ version check for DWARF5
  mm/ksm: remove old GCC 4.9+ check
  compiler.h: drop fallback overflow checkers
  Documentation: raise minimum supported version of GCC to 5.1

Drop some straggling mentions of gcc-4.9 as being stale

2021-09-13T17:29:44+00:00

Fix up the admin-guide README file to the new gcc-5.1 requirement, and
remove a stale comment about gcc support for the __assume_aligned__
attribute.

Signed-off-by: Linus Torvalds

compiler_attributes.h: drop __has_attribute() support for gcc4

2021-09-13T17:20:01+00:00

Now that GCC 5.1 is the minimally supported default, the manual
workaround for older gcc versions not having __has_attribute() are no
longer relevant and can be removed.

Signed-off-by: Linus Torvalds