1. 13 9月, 2021 1 次提交
  2. 09 9月, 2021 1 次提交
  3. 06 9月, 2021 1 次提交
    • L
      Enable '-Werror' by default for all kernel builds · 3fe617cc
      Linus Torvalds 提交于
      ... but make it a config option so that broken environments can disable
      it when required.
      
      We really should always have a clean build, and will disable specific
      over-eager warnings as required, if we can't fix them.  But while I
      fairly religiously enforce that in my own tree, it doesn't get enforced
      by various build robots that don't necessarily report warnings.
      
      So this just makes '-Werror' a default compiler flag, but allows people
      to disable it for their configuration if they have some particular
      issues.
      
      Occasionally, new compiler versions end up enabling new warnings, and it
      can take a while before we have them fixed (or the warnings disabled if
      that is what it takes), so the config option allows for that situation.
      
      Hopefully this will mean that I get fewer pull requests that have new
      warnings that were not noticed by various automation we have in place.
      
      Knock wood.
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      3fe617cc
  4. 03 9月, 2021 4 次提交
    • N
      kbuild: Shuffle blank line to improve comment meaning · 6272cc38
      Nathan Chancellor 提交于
      -Wunused-but-set-variable and -Wunused-const-variable are both disabled
      for the same reason but there is a blank line between them and no blank
      line between -Wno-unused-const-variable and the block.
      
      Shuffle the new line so that it is clear that the comment applied to
      both flags and the next block is separate from them.
      Signed-off-by: NNathan Chancellor <nathan@kernel.org>
      Signed-off-by: NMasahiro Yamada <masahiroy@kernel.org>
      6272cc38
    • N
      kbuild: Add a comment above -Wno-gnu · 5c6ae0ef
      Nathan Chancellor 提交于
      Whenever a warning is disabled, it is helpful for future travelers to
      understand why the warning is disabled and why it is acceptable to do
      so. Add a comment for -Wno-gnu so that people understand why it is
      disabled.
      Signed-off-by: NNathan Chancellor <nathan@kernel.org>
      Signed-off-by: NMasahiro Yamada <masahiroy@kernel.org>
      5c6ae0ef
    • N
      kbuild: Remove -Wno-format-invalid-specifier from clang block · a312b60d
      Nathan Chancellor 提交于
      Turning on -Wformat does not reveal any instances of this warning across
      several different builds so remove this line to keep the number of
      disabled warnings as slim as possible.
      
      This has been disabled since commit 61163efa ("kbuild: LLVMLinux:
      Add Kbuild support for building kernel with Clang"), which does not
      explain exactly why it was turned off but since it was so long ago in
      terms of both the kernel and LLVM so it is possible that some bug got
      fixed along the way.
      Signed-off-by: NNathan Chancellor <nathan@kernel.org>
      Reviewed-by: NNick Desaulniers <ndesaulniers@google.com>
      Signed-off-by: NMasahiro Yamada <masahiroy@kernel.org>
      a312b60d
    • N
      Makefile: remove stale cc-option checks · 7d73c3e9
      Nick Desaulniers 提交于
      cc-option, cc-option-yn, and cc-disable-warning all invoke the compiler
      during build time, and can slow down the build when these checks become
      stale for our supported compilers, whose minimally supported versions
      increases over time. See Documentation/process/changes.rst for the
      current supported minimal versions (GCC 4.9+, clang 10.0.1+). Compiler
      version support for these flags may be verified on godbolt.org.
      
      The following flags are GCC only and supported since at least GCC 4.9.
      Remove cc-option and cc-disable-warning tests.
      * -fno-tree-loop-im
      * -Wno-maybe-uninitialized
      * -fno-reorder-blocks
      * -fno-ipa-cp-clone
      * -fno-partial-inlining
      * -femit-struct-debug-baseonly
      * -fno-inline-functions-called-once
      * -fconserve-stack
      
      The following flags are supported by all supported versions of GCC and
      Clang. Remove their cc-option, cc-option-yn, and cc-disable-warning tests.
      * -fno-delete-null-pointer-checks
      * -fno-var-tracking
      * -Wno-array-bounds
      
      The following configs are made dependent on GCC, since they use GCC
      specific flags.
      * READABLE_ASM
      * DEBUG_SECTION_MISMATCH
      
      -mfentry was not supported by s390-linux-gnu-gcc until gcc-9+, add a
      comment.
      
      --param=allow-store-data-races=0 was renamed to -fno-allow-store-data-races
      in the GCC 10 release; add a comment.
      
      -Wmaybe-uninitialized (GCC specific) was being added for CONFIG_GCOV,
      then again unconditionally; add it only once.
      
      Also, base RETPOLINE_CFLAGS and RETPOLINE_VDSO_CFLAGS on CONFIC_CC_IS_*
      then remove cc-option tests for Clang.
      
      Link: https://github.com/ClangBuiltLinux/linux/issues/1436Acked-by: NMiguel Ojeda <ojeda@kernel.org>
      Reviewed-by: NNathan Chancellor <nathan@kernel.org>
      Signed-off-by: NNick Desaulniers <ndesaulniers@google.com>
      Signed-off-by: NMasahiro Yamada <masahiroy@kernel.org>
      7d73c3e9
  5. 02 9月, 2021 1 次提交
  6. 30 8月, 2021 1 次提交
  7. 23 8月, 2021 1 次提交
  8. 16 8月, 2021 1 次提交
  9. 10 8月, 2021 4 次提交
  10. 09 8月, 2021 1 次提交
  11. 05 8月, 2021 2 次提交
  12. 02 8月, 2021 1 次提交
  13. 26 7月, 2021 1 次提交
  14. 21 7月, 2021 1 次提交
    • K
      hardening: Introduce CONFIG_ZERO_CALL_USED_REGS · a82adfd5
      Kees Cook 提交于
      When CONFIG_ZERO_CALL_USED_REGS is enabled, build the kernel with
      "-fzero-call-used-regs=used-gpr" (in GCC 11). This option will zero any
      caller-used register contents just before returning from a function,
      ensuring that temporary values are not leaked beyond the function
      boundary. This means that register contents are less likely to be
      available for side channel attacks and information exposures.
      
      Additionally this helps reduce the number of useful ROP gadgets in the
      kernel image by about 20%:
      
      $ ROPgadget.py --nosys --nojop --binary vmlinux.stock | tail -n1
      Unique gadgets found: 337245
      
      $ ROPgadget.py --nosys --nojop --binary vmlinux.zero-call-regs | tail -n1
      Unique gadgets found: 267175
      
      and more notably removes simple "write-what-where" gadgets:
      
      $ ROPgadget.py --ropchain --binary vmlinux.stock | sed -n '/Step 1/,/Step 2/p'
      - Step 1 -- Write-what-where gadgets
      
              [+] Gadget found: 0xffffffff8102d76c mov qword ptr [rsi], rdx ; ret
              [+] Gadget found: 0xffffffff81000cf5 pop rsi ; ret
              [+] Gadget found: 0xffffffff8104d7c8 pop rdx ; ret
              [-] Can't find the 'xor rdx, rdx' gadget. Try with another 'mov [reg], reg'
      
              [+] Gadget found: 0xffffffff814c2b4c mov qword ptr [rsi], rdi ; ret
              [+] Gadget found: 0xffffffff81000cf5 pop rsi ; ret
              [+] Gadget found: 0xffffffff81001e51 pop rdi ; ret
              [-] Can't find the 'xor rdi, rdi' gadget. Try with another 'mov [reg], reg'
      
              [+] Gadget found: 0xffffffff81540d61 mov qword ptr [rsi], rdi ; pop rbx ; pop rbp ; ret
              [+] Gadget found: 0xffffffff81000cf5 pop rsi ; ret
              [+] Gadget found: 0xffffffff81001e51 pop rdi ; ret
              [-] Can't find the 'xor rdi, rdi' gadget. Try with another 'mov [reg], reg'
      
              [+] Gadget found: 0xffffffff8105341e mov qword ptr [rsi], rax ; ret
              [+] Gadget found: 0xffffffff81000cf5 pop rsi ; ret
              [+] Gadget found: 0xffffffff81029a11 pop rax ; ret
              [+] Gadget found: 0xffffffff811f1c3b xor rax, rax ; ret
      
      - Step 2 -- Init syscall number gadgets
      
      $ ROPgadget.py --ropchain --binary vmlinux.zero* | sed -n '/Step 1/,/Step 2/p'
      - Step 1 -- Write-what-where gadgets
      
              [-] Can't find the 'mov qword ptr [r64], r64' gadget
      
      For an x86_64 parallel build tests, this has a less than 1% performance
      impact, and grows the image size less than 1%:
      
      $ size vmlinux.stock vmlinux.zero-call-regs
         text    data     bss     dec     hex filename
      22437676   8559152 14127340 45124168 2b08a48 vmlinux.stock
      22453184   8563248 14110956 45127388 2b096dc vmlinux.zero-call-regs
      
      Impact for other architectures may vary. For example, arm64 sees a 5.5%
      image size growth, mainly due to needing to always clear x16 and x17:
      https://lore.kernel.org/lkml/20210510134503.GA88495@C02TD0UTHF1T.local/Signed-off-by: NKees Cook <keescook@chromium.org>
      a82adfd5
  15. 19 7月, 2021 1 次提交
  16. 18 7月, 2021 1 次提交
  17. 16 7月, 2021 1 次提交
    • L
      Revert "Makefile: Enable -Wimplicit-fallthrough for Clang" · d936eb23
      Linus Torvalds 提交于
      This reverts commit b7eb335e.
      
      It turns out that the problem with the clang -Wimplicit-fallthrough
      warning is not about the kernel source code, but about clang itself, and
      that the warning is unusable until clang fixes its broken ways.
      
      In particular, when you enable this warning for clang, you not only get
      warnings about implicit fallthroughs.  You also get this:
      
         warning: fallthrough annotation in unreachable code [-Wimplicit-fallthrough]
      
      which is completely broken becasue it
      
       (a) doesn't even tell you where the problem is (seriously: no line
           numbers, no filename, no nothing).
      
       (b) is fundamentally broken anyway, because there are perfectly valid
           reasons to have a fallthrough statement even if it turns out that
           it can perhaps not be reached.
      
      In the kernel, an example of that second case is code in the scheduler:
      
                      switch (state) {
                      case cpuset:
                              if (IS_ENABLED(CONFIG_CPUSETS)) {
                                      cpuset_cpus_allowed_fallback(p);
                                      state = possible;
                                      break;
                              }
                              fallthrough;
                      case possible:
      
      where if CONFIG_CPUSETS is enabled you actually never hit the
      fallthrough case at all.  But that in no way makes the fallthrough
      wrong.
      
      So the warning is completely broken, and enabling it for clang is a very
      bad idea.
      
      In the meantime, we can keep the gcc option enabled, and make the gcc
      build use
      
          -Wimplicit-fallthrough=5
      
      which means that we will at least continue to require a proper
      fallthrough statement, and that gcc won't silently accept the magic
      comment versions. Because gcc does this all correctly, and while the odd
      "=5" part is kind of obscure, it's documented in [1]:
      
        "-Wimplicit-fallthrough=5 doesn’t recognize any comments as
         fallthrough comments, only attributes disable the warning"
      
      so if clang ever fixes its bad behavior we can try enabling it there again.
      
      Link: https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html [1]
      Cc: Kees Cook <keescook@chromium.org>
      Cc: Gustavo A. R. Silva <gustavoars@kernel.org>
      Cc: Nathan Chancellor <nathan@kernel.org>
      Cc: Nick Desaulniers <ndesaulniers@google.com>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      d936eb23
  18. 15 7月, 2021 1 次提交
    • G
      Makefile: Enable -Wimplicit-fallthrough for Clang · b7eb335e
      Gustavo A. R. Silva 提交于
      With the recent fixes for fallthrough warnings, it is now possible to
      enable -Wimplicit-fallthrough for Clang.
      
      It's important to mention that since we have adopted the use of the
      pseudo-keyword macro fallthrough; we also want to avoid having more
      /* fall through */ comments being introduced. Notice that contrary
      to GCC, Clang doesn't recognize any comments as implicit fall-through
      markings when the -Wimplicit-fallthrough option is enabled. So, in
      order to avoid having more comments being introduced, we have to use
      the option -Wimplicit-fallthrough=5 for GCC, which similar to Clang,
      will cause a warning in case a code comment is intended to be used
      as a fall-through marking.
      Co-developed-by: NKees Cook <keescook@chromium.org>
      Signed-off-by: NKees Cook <keescook@chromium.org>
      Signed-off-by: NGustavo A. R. Silva <gustavoars@kernel.org>
      b7eb335e
  19. 12 7月, 2021 1 次提交
  20. 28 6月, 2021 1 次提交
  21. 21 6月, 2021 1 次提交
  22. 17 6月, 2021 1 次提交
    • M
      kbuild: remove trailing slashes from $(KBUILD_EXTMOD) · 74ee585b
      Masahiro Yamada 提交于
      M= (or KBUILD_EXTMOD) generally expects a directory path without any
      trailing slashes, like M=a/b/c.
      
      If you add a trailing slash, like M=a/b/c/, you will get ugly build
      logs (two slashes in a series), but it still works fine as long as it
      is consistent between 'make modules' and 'make modules_install'.
      
      The following commands correctly build and install the modules.
      
        $ make M=a/b/c/ modules
        $ sudo make M=a/b/c/ modules_install
      
      Since commit ccae4cfa ("kbuild: refactor scripts/Makefile.modinst"),
      a problem happens if you add a trailing slash only for modules_install.
      
        $ make M=a/b/c modules
        $ sudo make M=a/b/c/ modules_install
      
      No module is installed in this case, Johannes Berg reported. [1]
      
      Trim any trailing slashes from $(KBUILD_EXTMOD).
      
      I used the 'dirname' command to remove all the trailing slashes in
      case someone adds more slashes like M=a/b/c/////. The Make's built-in
      function, $(dir ...) cannot take care of such a case.
      
      [1]: https://lore.kernel.org/lkml/10cc8522b27a051e6a9c3e158a4c4b6414fd04a0.camel@sipsolutions.net/
      
      Fixes: ccae4cfa ("kbuild: refactor scripts/Makefile.modinst")
      Reported-by: NJohannes Berg <johannes@sipsolutions.net>
      Signed-off-by: NMasahiro Yamada <masahiroy@kernel.org>
      74ee585b
  23. 15 6月, 2021 1 次提交
  24. 14 6月, 2021 1 次提交
  25. 08 6月, 2021 1 次提交
  26. 07 6月, 2021 1 次提交
  27. 31 5月, 2021 1 次提交
  28. 27 5月, 2021 1 次提交
  29. 26 5月, 2021 1 次提交
  30. 25 5月, 2021 1 次提交
    • N
      Makefile: LTO: have linker check -Wframe-larger-than · 24845dcb
      Nick Desaulniers 提交于
      -Wframe-larger-than= requires stack frame information, which the
      frontend cannot provide. This diagnostic is emitted late during
      compilation once stack frame size is available.
      
      When building with LTO, the frontend simply lowers C to LLVM IR and does
      not have stack frame information, so it cannot emit this diagnostic.
      When the linker drives LTO, it restarts optimizations and lowers LLVM IR
      to object code. At that point, it has stack frame information but
      doesn't know to check for a specific max stack frame size.
      
      I consider this a bug in LLVM that we need to fix. There are some
      details we're working out related to LTO such as which value to use when
      there are multiple different values specified per TU, or how to
      propagate these to compiler synthesized routines properly, if at all.
      
      Until it's fixed, ensure we don't miss these. At that point we can wrap
      this in a compiler version guard or revert this based on the minimum
      support version of Clang.
      
      The error message is not generated during link:
        LTO     vmlinux.o
      ld.lld: warning: stack size limit exceeded (8224) in foobarbaz
      
      Cc: Sami Tolvanen <samitolvanen@google.com>
      Reported-by: 八两学士's avatarCandle Sun <candlesea@gmail.com>
      Suggested-by: NFangrui Song <maskray@google.com>
      Signed-off-by: NNick Desaulniers <ndesaulniers@google.com>
      Signed-off-by: NKees Cook <keescook@chromium.org>
      Link: https://lore.kernel.org/r/20210312010942.1546679-1-ndesaulniers@google.com
      24845dcb
  31. 24 5月, 2021 3 次提交