[PATCH v4 0/6] Enable strict percpu address space checks

[PATCH v4 0/6] Enable strict percpu address space checks

[Uros Bizjak]

Enable strict percpu address space checks via x86 named address space
qualifiers. Percpu variables are declared in __seg_gs/__seg_fs named
AS and kept named AS qualified until they are dereferenced via percpu
accessor. This approach enables various compiler checks for
cross-namespace variable assignments.

Please note that current version of sparse doesn't know anything about
__typeof_unqual__() operator. Avoid the usage of __typeof_unqual__()
when sparse checking is active to prevent sparse errors with unknowing
keyword. The proposed patch by Dan Carpenter to implement
__typeof_unqual__() handling in sparse is located at:

https://lore.kernel.org/lkml/5b8d0dee-8fb6-45af-ba6c-7f74aff9a4b8@stanley.mountain/

v2: - Add comment to remove test for __CHECKER__ once sparse learns
      about __typeof_unqual__.
    - Add Acked-by: tags.
v3: - Rename __per_cpu_qual to __percpu_qual.
    - Add more Acked-by: tags.
v4: - Do not auto-detect compiler support for __typeof_unqual__()

Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Dennis Zhou <dennis@kernel.org>
Cc: Tejun Heo <tj@kernel.org>
Cc: Christoph Lameter <cl@linux.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Nadav Amit <nadav.amit@gmail.com>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Dan Carpenter <dan.carpenter@linaro.org>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Peter Zijlstra <peterz@infradead.org>

Uros Bizjak (6):
  x86/kgdb: Use IS_ERR_PCPU() macro
  compiler.h: Introduce TYPEOF_UNQUAL() macro
  percpu: Use TYPEOF_UNQUAL() in variable declarations
  percpu: Use TYPEOF_UNQUAL() in *_cpu_ptr() accessors
  percpu: Repurpose __percpu tag as a named address space qualifier
  percpu/x86: Enable strict percpu checks via named AS qualifiers

 arch/x86/include/asm/percpu.h  | 33 +++++++++++++++++++---------
 arch/x86/kernel/kgdb.c         |  2 +-
 fs/bcachefs/util.h             |  2 +-
 include/asm-generic/percpu.h   | 39 ++++++++++++++++++++++------------
 include/linux/compiler-clang.h |  8 +++++++
 include/linux/compiler-gcc.h   |  8 +++++++
 include/linux/compiler.h       | 20 +++++++++++++++++
 include/linux/compiler_types.h |  2 +-
 include/linux/part_stat.h      |  2 +-
 include/linux/percpu-defs.h    |  6 +++---
 include/net/snmp.h             |  5 ++---
 kernel/locking/percpu-rwsem.c  |  2 +-
 net/mpls/internal.h            |  4 ++--
 13 files changed, 97 insertions(+), 36 deletions(-)

-- 
2.42.0

[PATCH v4 1/6] x86/kgdb: Use IS_ERR_PCPU() macro

[Uros Bizjak]

Use IS_ERR_PCPU() when checking the error pointer in the percpu
address space. This macro adds intermediate cast to unsigned long
when switching named address spaces.

The patch will avoid future build errors due to pointer address space
mismatch with enabled strict percpu address space checks.

Signed-off-by: Uros Bizjak <ubizjak@gmail.com>
Acked-by: Nadav Amit <nadav.amit@gmail.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Dennis Zhou <dennis@kernel.org>
Cc: Tejun Heo <tj@kernel.org>
Cc: Christoph Lameter <cl@linux.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Peter Zijlstra <peterz@infradead.org>
---
 arch/x86/kernel/kgdb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kernel/kgdb.c b/arch/x86/kernel/kgdb.c
index 9c9faa1634fb..102641fd2172 100644
--- a/arch/x86/kernel/kgdb.c
+++ b/arch/x86/kernel/kgdb.c
@@ -655,7 +655,7 @@ void kgdb_arch_late(void)
 		if (breakinfo[i].pev)
 			continue;
 		breakinfo[i].pev = register_wide_hw_breakpoint(&attr, NULL, NULL);
-		if (IS_ERR((void * __force)breakinfo[i].pev)) {
+		if (IS_ERR_PCPU(breakinfo[i].pev)) {
 			printk(KERN_ERR "kgdb: Could not allocate hw"
 			       "breakpoints\nDisabling the kernel debugger\n");
 			breakinfo[i].pev = NULL;
-- 
2.42.0

[PATCH v4 2/6] compiler.h: Introduce TYPEOF_UNQUAL() macro

[Uros Bizjak]

Define TYPEOF_UNQUAL() to use __typeof_unqual__() as typeof operator
when available, to return unqualified type of the expression.

Current version of sparse doesn't know anything about __typeof_unqual__()
operator. Avoid the usage of __typeof_unqual__() when sparse checking
is active to prevent sparse errors with unknowing keyword.

Signed-off-by: Uros Bizjak <ubizjak@gmail.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Dennis Zhou <dennis@kernel.org>
Cc: Tejun Heo <tj@kernel.org>
Cc: Christoph Lameter <cl@linux.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Peter Zijlstra <peterz@infradead.org>
---
v2: - Add comment to remove test for __CHECKER__ once sparse learns
      about __typeof_unqual__.
v4: - Do not auto-detect compiler support for __typeof_unqual__()
---
 include/linux/compiler-clang.h |  8 ++++++++
 include/linux/compiler-gcc.h   |  8 ++++++++
 include/linux/compiler.h       | 20 ++++++++++++++++++++
 3 files changed, 36 insertions(+)

diff --git a/include/linux/compiler-clang.h b/include/linux/compiler-clang.h
index 2e7c2c282f3a..4fc8e26914ad 100644
--- a/include/linux/compiler-clang.h
+++ b/include/linux/compiler-clang.h
@@ -128,3 +128,11 @@
  */
 #define ASM_INPUT_G "ir"
 #define ASM_INPUT_RM "r"
+
+/*
+ * Declare compiler support for __typeof_unqual__() operator.
+ *
+ * Bindgen uses LLVM even if our C compiler is GCC, so we cannot
+ * rely on the auto-detected CONFIG_CC_HAS_TYPEOF_UNQUAL.
+ */
+#define CC_HAS_TYPEOF_UNQUAL (__clang_major__ >= 19)
diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
index c9b58188ec61..32048052c64a 100644
--- a/include/linux/compiler-gcc.h
+++ b/include/linux/compiler-gcc.h
@@ -137,3 +137,11 @@
 #if GCC_VERSION < 90100
 #undef __alloc_size__
 #endif
+
+/*
+ * Declare compiler support for __typeof_unqual__() operator.
+ *
+ * Bindgen uses LLVM even if our C compiler is GCC, so we cannot
+ * rely on the auto-detected CONFIG_CC_HAS_TYPEOF_UNQUAL.
+ */
+#define CC_HAS_TYPEOF_UNQUAL (__GNUC__ >= 14)
diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index b087de2f3e94..a892c89ac28a 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -191,6 +191,26 @@ void ftrace_likely_update(struct ftrace_likely_data *f, int val,
 	__v;								\
 })
 
+/*
+ * Use __typeof_unqual__() when available.
+ *
+ * XXX: Remove test for __CHECKER__ once
+ * sparse learns about __typeof_unqual__().
+ */
+#if CC_HAS_TYPEOF_UNQUAL && !defined(__CHECKER__)
+# define USE_TYPEOF_UNQUAL 1
+#endif
+
+/*
+ * Define TYPEOF_UNQUAL() to use __typeof_unqual__() as typeof
+ * operator when available, to return an unqualified type of the exp.
+ */
+#if defined(USE_TYPEOF_UNQUAL)
+# define TYPEOF_UNQUAL(exp) __typeof_unqual__(exp)
+#else
+# define TYPEOF_UNQUAL(exp) __typeof__(exp)
+#endif
+
 #endif /* __KERNEL__ */
 
 /**
-- 
2.42.0

[PATCH v4 3/6] percpu: Use TYPEOF_UNQUAL() in variable declarations

[Uros Bizjak]

Use TYPEOF_UNQUAL() to declare variables as a corresponding
type without named address space qualifier to avoid
"‘__seg_gs’ specified for auto variable ‘var’" errors.

Signed-off-by: Uros Bizjak <ubizjak@gmail.com>
Acked-by: Nadav Amit <nadav.amit@gmail.com>
Acked-by: Christoph Lameter <cl@linux.com>
Cc: Dennis Zhou <dennis@kernel.org>
Cc: Tejun Heo <tj@kernel.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Kent Overstreet <kent.overstreet@linux.dev>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will@kernel.org>
Cc: Waiman Long <longman@redhat.com>
Cc: Boqun Feng <boqun.feng@gmail.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Brian Gerst <brgerst@gmail.com>
---
 arch/x86/include/asm/percpu.h | 10 +++++-----
 fs/bcachefs/util.h            |  2 +-
 include/asm-generic/percpu.h  | 26 +++++++++++++-------------
 include/linux/part_stat.h     |  2 +-
 include/linux/percpu-defs.h   |  4 ++--
 include/net/snmp.h            |  5 ++---
 kernel/locking/percpu-rwsem.c |  2 +-
 net/mpls/internal.h           |  4 ++--
 8 files changed, 27 insertions(+), 28 deletions(-)

diff --git a/arch/x86/include/asm/percpu.h b/arch/x86/include/asm/percpu.h
index e525cd85f999..666e4137b09f 100644
--- a/arch/x86/include/asm/percpu.h
+++ b/arch/x86/include/asm/percpu.h
@@ -180,7 +180,7 @@ do {									\
 	__pcpu_type_##size pto_val__ = __pcpu_cast_##size(_val);	\
 									\
 	if (0) {		                                        \
-		typeof(_var) pto_tmp__;					\
+		TYPEOF_UNQUAL(_var) pto_tmp__;				\
 		pto_tmp__ = (_val);					\
 		(void)pto_tmp__;					\
 	}								\
@@ -219,7 +219,7 @@ do {									\
 	__pcpu_type_##size pto_val__ = __pcpu_cast_##size(_val);	\
 									\
 	if (0) {		                                        \
-		typeof(_var) pto_tmp__;					\
+		TYPEOF_UNQUAL(_var) pto_tmp__;				\
 		pto_tmp__ = (_val);					\
 		(void)pto_tmp__;					\
 	}								\
@@ -240,7 +240,7 @@ do {									\
 			 (val) == (typeof(val))-1)) ? (int)(val) : 0;	\
 									\
 	if (0) {							\
-		typeof(var) pao_tmp__;					\
+		TYPEOF_UNQUAL(var) pao_tmp__;				\
 		pao_tmp__ = (val);					\
 		(void)pao_tmp__;					\
 	}								\
@@ -273,7 +273,7 @@ do {									\
  */
 #define raw_percpu_xchg_op(_var, _nval)					\
 ({									\
-	typeof(_var) pxo_old__ = raw_cpu_read(_var);			\
+	TYPEOF_UNQUAL(_var) pxo_old__ = raw_cpu_read(_var);		\
 									\
 	raw_cpu_write(_var, _nval);					\
 									\
@@ -287,7 +287,7 @@ do {									\
  */
 #define this_percpu_xchg_op(_var, _nval)				\
 ({									\
-	typeof(_var) pxo_old__ = this_cpu_read(_var);			\
+	TYPEOF_UNQUAL(_var) pxo_old__ = this_cpu_read(_var);		\
 									\
 	do { } while (!this_cpu_try_cmpxchg(_var, &pxo_old__, _nval));	\
 									\
diff --git a/fs/bcachefs/util.h b/fs/bcachefs/util.h
index 1a1720116071..e430a32050c2 100644
--- a/fs/bcachefs/util.h
+++ b/fs/bcachefs/util.h
@@ -609,7 +609,7 @@ do {									\
 
 #define per_cpu_sum(_p)							\
 ({									\
-	typeof(*_p) _ret = 0;						\
+	TYPEOF_UNQUAL(*_p) _ret = 0;					\
 									\
 	int cpu;							\
 	for_each_possible_cpu(cpu)					\
diff --git a/include/asm-generic/percpu.h b/include/asm-generic/percpu.h
index 94cbd50cc870..50597b975a49 100644
--- a/include/asm-generic/percpu.h
+++ b/include/asm-generic/percpu.h
@@ -74,7 +74,7 @@ do {									\
 
 #define raw_cpu_generic_add_return(pcp, val)				\
 ({									\
-	typeof(pcp) *__p = raw_cpu_ptr(&(pcp));				\
+	TYPEOF_UNQUAL(pcp) *__p = raw_cpu_ptr(&(pcp));			\
 									\
 	*__p += val;							\
 	*__p;								\
@@ -82,8 +82,8 @@ do {									\
 
 #define raw_cpu_generic_xchg(pcp, nval)					\
 ({									\
-	typeof(pcp) *__p = raw_cpu_ptr(&(pcp));				\
-	typeof(pcp) __ret;						\
+	TYPEOF_UNQUAL(pcp) *__p = raw_cpu_ptr(&(pcp));			\
+	TYPEOF_UNQUAL(pcp) __ret;					\
 	__ret = *__p;							\
 	*__p = nval;							\
 	__ret;								\
@@ -91,7 +91,7 @@ do {									\
 
 #define __cpu_fallback_try_cmpxchg(pcp, ovalp, nval, _cmpxchg)		\
 ({									\
-	typeof(pcp) __val, __old = *(ovalp);				\
+	TYPEOF_UNQUAL(pcp) __val, __old = *(ovalp);			\
 	__val = _cmpxchg(pcp, __old, nval);				\
 	if (__val != __old)						\
 		*(ovalp) = __val;					\
@@ -100,8 +100,8 @@ do {									\
 
 #define raw_cpu_generic_try_cmpxchg(pcp, ovalp, nval)			\
 ({									\
-	typeof(pcp) *__p = raw_cpu_ptr(&(pcp));				\
-	typeof(pcp) __val = *__p, ___old = *(ovalp);			\
+	TYPEOF_UNQUAL(pcp) *__p = raw_cpu_ptr(&(pcp));			\
+	TYPEOF_UNQUAL(pcp) __val = *__p, ___old = *(ovalp);		\
 	bool __ret;							\
 	if (__val == ___old) {						\
 		*__p = nval;						\
@@ -115,14 +115,14 @@ do {									\
 
 #define raw_cpu_generic_cmpxchg(pcp, oval, nval)			\
 ({									\
-	typeof(pcp) __old = (oval);					\
+	TYPEOF_UNQUAL(pcp) __old = (oval);				\
 	raw_cpu_generic_try_cmpxchg(pcp, &__old, nval);			\
 	__old;								\
 })
 
 #define __this_cpu_generic_read_nopreempt(pcp)				\
 ({									\
-	typeof(pcp) ___ret;						\
+	TYPEOF_UNQUAL(pcp) ___ret;					\
 	preempt_disable_notrace();					\
 	___ret = READ_ONCE(*raw_cpu_ptr(&(pcp)));			\
 	preempt_enable_notrace();					\
@@ -131,7 +131,7 @@ do {									\
 
 #define __this_cpu_generic_read_noirq(pcp)				\
 ({									\
-	typeof(pcp) ___ret;						\
+	TYPEOF_UNQUAL(pcp) ___ret;					\
 	unsigned long ___flags;						\
 	raw_local_irq_save(___flags);					\
 	___ret = raw_cpu_generic_read(pcp);				\
@@ -141,7 +141,7 @@ do {									\
 
 #define this_cpu_generic_read(pcp)					\
 ({									\
-	typeof(pcp) __ret;						\
+	TYPEOF_UNQUAL(pcp) __ret;					\
 	if (__native_word(pcp))						\
 		__ret = __this_cpu_generic_read_nopreempt(pcp);		\
 	else								\
@@ -160,7 +160,7 @@ do {									\
 
 #define this_cpu_generic_add_return(pcp, val)				\
 ({									\
-	typeof(pcp) __ret;						\
+	TYPEOF_UNQUAL(pcp) __ret;					\
 	unsigned long __flags;						\
 	raw_local_irq_save(__flags);					\
 	__ret = raw_cpu_generic_add_return(pcp, val);			\
@@ -170,7 +170,7 @@ do {									\
 
 #define this_cpu_generic_xchg(pcp, nval)				\
 ({									\
-	typeof(pcp) __ret;						\
+	TYPEOF_UNQUAL(pcp) __ret;					\
 	unsigned long __flags;						\
 	raw_local_irq_save(__flags);					\
 	__ret = raw_cpu_generic_xchg(pcp, nval);			\
@@ -190,7 +190,7 @@ do {									\
 
 #define this_cpu_generic_cmpxchg(pcp, oval, nval)			\
 ({									\
-	typeof(pcp) __ret;						\
+	TYPEOF_UNQUAL(pcp) __ret;					\
 	unsigned long __flags;						\
 	raw_local_irq_save(__flags);					\
 	__ret = raw_cpu_generic_cmpxchg(pcp, oval, nval);		\
diff --git a/include/linux/part_stat.h b/include/linux/part_stat.h
index ac8c44dd8237..c5e9cac0575e 100644
--- a/include/linux/part_stat.h
+++ b/include/linux/part_stat.h
@@ -33,7 +33,7 @@ struct disk_stats {
 
 #define part_stat_read(part, field)					\
 ({									\
-	typeof((part)->bd_stats->field) res = 0;			\
+	TYPEOF_UNQUAL((part)->bd_stats->field) res = 0;			\
 	unsigned int _cpu;						\
 	for_each_possible_cpu(_cpu)					\
 		res += per_cpu_ptr((part)->bd_stats, _cpu)->field; \
diff --git a/include/linux/percpu-defs.h b/include/linux/percpu-defs.h
index 5b520fe86b60..79b9402404f1 100644
--- a/include/linux/percpu-defs.h
+++ b/include/linux/percpu-defs.h
@@ -317,7 +317,7 @@ static __always_inline void __this_cpu_preempt_check(const char *op) { }
 
 #define __pcpu_size_call_return(stem, variable)				\
 ({									\
-	typeof(variable) pscr_ret__;					\
+	TYPEOF_UNQUAL(variable) pscr_ret__;				\
 	__verify_pcpu_ptr(&(variable));					\
 	switch(sizeof(variable)) {					\
 	case 1: pscr_ret__ = stem##1(variable); break;			\
@@ -332,7 +332,7 @@ static __always_inline void __this_cpu_preempt_check(const char *op) { }
 
 #define __pcpu_size_call_return2(stem, variable, ...)			\
 ({									\
-	typeof(variable) pscr2_ret__;					\
+	TYPEOF_UNQUAL(variable) pscr2_ret__;				\
 	__verify_pcpu_ptr(&(variable));					\
 	switch(sizeof(variable)) {					\
 	case 1: pscr2_ret__ = stem##1(variable, __VA_ARGS__); break;	\
diff --git a/include/net/snmp.h b/include/net/snmp.h
index 468a67836e2f..4cb4326dfebe 100644
--- a/include/net/snmp.h
+++ b/include/net/snmp.h
@@ -159,7 +159,7 @@ struct linux_tls_mib {
 
 #define __SNMP_ADD_STATS64(mib, field, addend) 				\
 	do {								\
-		__typeof__(*mib) *ptr = raw_cpu_ptr(mib);		\
+		TYPEOF_UNQUAL(*mib) *ptr = raw_cpu_ptr(mib);		\
 		u64_stats_update_begin(&ptr->syncp);			\
 		ptr->mibs[field] += addend;				\
 		u64_stats_update_end(&ptr->syncp);			\
@@ -176,8 +176,7 @@ struct linux_tls_mib {
 #define SNMP_INC_STATS64(mib, field) SNMP_ADD_STATS64(mib, field, 1)
 #define __SNMP_UPD_PO_STATS64(mib, basefield, addend)			\
 	do {								\
-		__typeof__(*mib) *ptr;				\
-		ptr = raw_cpu_ptr((mib));				\
+		TYPEOF_UNQUAL(*mib) *ptr = raw_cpu_ptr(mib);		\
 		u64_stats_update_begin(&ptr->syncp);			\
 		ptr->mibs[basefield##PKTS]++;				\
 		ptr->mibs[basefield##OCTETS] += addend;			\
diff --git a/kernel/locking/percpu-rwsem.c b/kernel/locking/percpu-rwsem.c
index 6083883c4fe0..d6964fc29f51 100644
--- a/kernel/locking/percpu-rwsem.c
+++ b/kernel/locking/percpu-rwsem.c
@@ -184,7 +184,7 @@ EXPORT_SYMBOL_GPL(__percpu_down_read);
 
 #define per_cpu_sum(var)						\
 ({									\
-	typeof(var) __sum = 0;						\
+	TYPEOF_UNQUAL(var) __sum = 0;					\
 	int cpu;							\
 	compiletime_assert_atomic_type(__sum);				\
 	for_each_possible_cpu(cpu)					\
diff --git a/net/mpls/internal.h b/net/mpls/internal.h
index b9f492ddf93b..83c629529b57 100644
--- a/net/mpls/internal.h
+++ b/net/mpls/internal.h
@@ -33,7 +33,7 @@ struct mpls_dev {
 
 #define MPLS_INC_STATS_LEN(mdev, len, pkts_field, bytes_field)		\
 	do {								\
-		__typeof__(*(mdev)->stats) *ptr =			\
+		TYPEOF_UNQUAL(*(mdev)->stats) *ptr =			\
 			raw_cpu_ptr((mdev)->stats);			\
 		local_bh_disable();					\
 		u64_stats_update_begin(&ptr->syncp);			\
@@ -45,7 +45,7 @@ struct mpls_dev {
 
 #define MPLS_INC_STATS(mdev, field)					\
 	do {								\
-		__typeof__(*(mdev)->stats) *ptr =			\
+		TYPEOF_UNQUAL(*(mdev)->stats) *ptr =			\
 			raw_cpu_ptr((mdev)->stats);			\
 		local_bh_disable();					\
 		u64_stats_update_begin(&ptr->syncp);			\
-- 
2.42.0

[PATCH v4 4/6] percpu: Use TYPEOF_UNQUAL() in *_cpu_ptr() accessors

[Uros Bizjak]

Use TYPEOF_UNQUAL() macro to declare the return type of *_cpu_ptr()
accessors in the generic named address space to avoid access to
data from pointer to non-enclosed address space type of errors.

Signed-off-by: Uros Bizjak <ubizjak@gmail.com>
Acked-by: Nadav Amit <nadav.amit@gmail.com>
Acked-by: Christoph Lameter <cl@linux.com>
Cc: Dennis Zhou <dennis@kernel.org>
Cc: Tejun Heo <tj@kernel.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Peter Zijlstra <peterz@infradead.org>
---
 arch/x86/include/asm/percpu.h | 8 ++++++--
 include/linux/percpu-defs.h   | 2 +-
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/arch/x86/include/asm/percpu.h b/arch/x86/include/asm/percpu.h
index 666e4137b09f..27f668660abe 100644
--- a/arch/x86/include/asm/percpu.h
+++ b/arch/x86/include/asm/percpu.h
@@ -73,10 +73,14 @@
 	unsigned long tcp_ptr__ = raw_cpu_read_long(this_cpu_off);	\
 									\
 	tcp_ptr__ += (__force unsigned long)(_ptr);			\
-	(typeof(*(_ptr)) __kernel __force *)tcp_ptr__;			\
+	(TYPEOF_UNQUAL(*(_ptr)) __force __kernel *)tcp_ptr__;		\
 })
 #else
-#define arch_raw_cpu_ptr(_ptr) ({ BUILD_BUG(); (typeof(_ptr))0; })
+#define arch_raw_cpu_ptr(_ptr)						\
+({									\
+	BUILD_BUG();							\
+	(TYPEOF_UNQUAL(*(_ptr)) __force __kernel *)0;			\
+})
 #endif
 
 #define PER_CPU_VAR(var)	%__percpu_seg:(var)__percpu_rel
diff --git a/include/linux/percpu-defs.h b/include/linux/percpu-defs.h
index 79b9402404f1..a7cf954ea99d 100644
--- a/include/linux/percpu-defs.h
+++ b/include/linux/percpu-defs.h
@@ -221,7 +221,7 @@ do {									\
 } while (0)
 
 #define PERCPU_PTR(__p)							\
-	(typeof(*(__p)) __force __kernel *)((__force unsigned long)(__p))
+	(TYPEOF_UNQUAL(*(__p)) __force __kernel *)((__force unsigned long)(__p))
 
 #ifdef CONFIG_SMP
 
-- 
2.42.0

[PATCH v4 5/6] percpu: Repurpose __percpu tag as a named address space qualifier

[Uros Bizjak]

The patch introduces __percpu_qual define and repurposes __percpu
tag as a named address space qualifier using the new define.

Arches can now conditionally define __percpu_qual as their
named address space qualifier for percpu variables.

Signed-off-by: Uros Bizjak <ubizjak@gmail.com>
Acked-by: Nadav Amit <nadav.amit@gmail.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Dennis Zhou <dennis@kernel.org>
Cc: Tejun Heo <tj@kernel.org>
Cc: Christoph Lameter <cl@linux.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Peter Zijlstra <peterz@infradead.org>
---
v3: - Rename __per_cpu_qual to __percpu_qual.
---
 include/asm-generic/percpu.h   | 13 +++++++++++++
 include/linux/compiler_types.h |  2 +-
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/include/asm-generic/percpu.h b/include/asm-generic/percpu.h
index 50597b975a49..02aeca21479a 100644
--- a/include/asm-generic/percpu.h
+++ b/include/asm-generic/percpu.h
@@ -6,6 +6,19 @@
 #include <linux/threads.h>
 #include <linux/percpu-defs.h>
 
+/*
+ * __percpu_qual is the qualifier for the percpu named address space.
+ *
+ * Most arches use generic named address space for percpu variables but
+ * some arches define percpu variables in different named address space
+ * (on the x86 arch, percpu variable may be declared as being relative
+ * to the %fs or %gs segments using __seg_fs or __seg_gs named address
+ * space qualifier).
+ */
+#ifndef __percpu_qual
+# define __percpu_qual
+#endif
+
 #ifdef CONFIG_SMP
 
 /*
diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h
index 981cc3d7e3aa..5d6544545658 100644
--- a/include/linux/compiler_types.h
+++ b/include/linux/compiler_types.h
@@ -57,7 +57,7 @@ static inline void __chk_io_ptr(const volatile void __iomem *ptr) { }
 #  define __user	BTF_TYPE_TAG(user)
 # endif
 # define __iomem
-# define __percpu	BTF_TYPE_TAG(percpu)
+# define __percpu	__percpu_qual BTF_TYPE_TAG(percpu)
 # define __rcu		BTF_TYPE_TAG(rcu)
 
 # define __chk_user_ptr(x)	(void)0
-- 
2.42.0

[PATCH v4 6/6] percpu/x86: Enable strict percpu checks via named AS qualifiers

[Uros Bizjak]

This patch declares percpu variables in __seg_gs/__seg_fs named AS
and keeps them named AS qualified until they are dereferenced with
percpu accessor. This approach enables various compiler check
for cross-namespace variable assignments.

Signed-off-by: Uros Bizjak <ubizjak@gmail.com>
Acked-by: Nadav Amit <nadav.amit@gmail.com>
Cc: Dennis Zhou <dennis@kernel.org>
Cc: Tejun Heo <tj@kernel.org>
Cc: Christoph Lameter <cl@linux.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Peter Zijlstra <peterz@infradead.org>
---
 arch/x86/include/asm/percpu.h | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/arch/x86/include/asm/percpu.h b/arch/x86/include/asm/percpu.h
index 27f668660abe..474d648bca9a 100644
--- a/arch/x86/include/asm/percpu.h
+++ b/arch/x86/include/asm/percpu.h
@@ -95,9 +95,18 @@
 
 #endif /* CONFIG_SMP */
 
-#define __my_cpu_type(var)	typeof(var) __percpu_seg_override
-#define __my_cpu_ptr(ptr)	(__my_cpu_type(*(ptr))*)(__force uintptr_t)(ptr)
-#define __my_cpu_var(var)	(*__my_cpu_ptr(&(var)))
+#if defined(CONFIG_USE_X86_SEG_SUPPORT) && defined(USE_TYPEOF_UNQUAL)
+# define __my_cpu_type(var)	typeof(var)
+# define __my_cpu_ptr(ptr)	(ptr)
+# define __my_cpu_var(var)	(var)
+
+# define __percpu_qual		__percpu_seg_override
+#else
+# define __my_cpu_type(var)	typeof(var) __percpu_seg_override
+# define __my_cpu_ptr(ptr)	(__my_cpu_type(*(ptr))*)(__force uintptr_t)(ptr)
+# define __my_cpu_var(var)	(*__my_cpu_ptr(&(var)))
+#endif
+
 #define __percpu_arg(x)		__percpu_prefix "%" #x
 #define __force_percpu_arg(x)	__force_percpu_prefix "%" #x
 
-- 
2.42.0

Re: [PATCH v4 6/6] percpu/x86: Enable strict percpu checks via named AS qualifiers

[Jiri Slaby]

On 27. 01. 25, 17:05, Uros Bizjak wrote:
> This patch declares percpu variables in __seg_gs/__seg_fs named AS
> and keeps them named AS qualified until they are dereferenced with
> percpu accessor. This approach enables various compiler check
> for cross-namespace variable assignments.

So this causes modpost to fail to version some symbols:

> WARNING: modpost: EXPORT symbol "xen_vcpu_id" [vmlinux] version generation failed, symbol will not be versioned.
> Is "xen_vcpu_id" prototyped in <asm/asm-prototypes.h>?
> WARNING: modpost: EXPORT symbol "irq_stat" [vmlinux] version generation failed, symbol will not be versioned.
> Is "irq_stat" prototyped in <asm/asm-prototypes.h>?
> WARNING: modpost: EXPORT symbol "fred_rsp0" [vmlinux] version generation failed, symbol will not be versioned.
> Is "fred_rsp0" prototyped in <asm/asm-prototypes.h>?
> WARNING: modpost: EXPORT symbol "cpu_dr7" [vmlinux] version generation failed, symbol will not be versioned.
> Is "cpu_dr7" prototyped in <asm/asm-prototypes.h>?
> WARNING: modpost: EXPORT symbol "cpu_tss_rw" [vmlinux] version generation failed, symbol will not be versioned.
> Is "cpu_tss_rw" prototyped in <asm/asm-prototypes.h>?
> WARNING: modpost: EXPORT symbol "__tss_limit_invalid" [vmlinux] version generation failed, symbol will not be versioned.
> Is "__tss_limit_invalid" prototyped in <asm/asm-prototypes.h>?
> WARNING: modpost: EXPORT symbol "irq_fpu_usable" [vmlinux] version generation failed, symbol will not be versioned.
> Is "irq_fpu_usable" prototyped in <asm/asm-prototypes.h>?
> WARNING: modpost: EXPORT symbol "cpu_info" [vmlinux] version generation failed, symbol will not be versioned.
> Is "cpu_info" prototyped in <asm/asm-prototypes.h>?
> WARNING: modpost: EXPORT symbol "gdt_page" [vmlinux] version generation failed, symbol will not be versioned.
> Is "gdt_page" prototyped in <asm/asm-prototypes.h>?
 > ...

That happens both with 6.15-rc1 and today's -next. Ideas?

Config:
https://github.com/SUSE/kernel-source/blob/master/config/x86_64/default

It is enough to:
   make CC='ccache gcc-14' O=../our -j160 vmlinux
to see the above.

> Signed-off-by: Uros Bizjak <ubizjak@gmail.com>
> Acked-by: Nadav Amit <nadav.amit@gmail.com>
> Cc: Dennis Zhou <dennis@kernel.org>
> Cc: Tejun Heo <tj@kernel.org>
> Cc: Christoph Lameter <cl@linux.com>
> Cc: Thomas Gleixner <tglx@linutronix.de>
> Cc: Ingo Molnar <mingo@kernel.org>
> Cc: Borislav Petkov <bp@alien8.de>
> Cc: Dave Hansen <dave.hansen@linux.intel.com>
> Cc: "H. Peter Anvin" <hpa@zytor.com>
> Cc: Linus Torvalds <torvalds@linux-foundation.org>
> Cc: Andy Lutomirski <luto@kernel.org>
> Cc: Brian Gerst <brgerst@gmail.com>
> Cc: Peter Zijlstra <peterz@infradead.org>
> ---
>   arch/x86/include/asm/percpu.h | 15 ++++++++++++---
>   1 file changed, 12 insertions(+), 3 deletions(-)
> 
> diff --git a/arch/x86/include/asm/percpu.h b/arch/x86/include/asm/percpu.h
> index 27f668660abe..474d648bca9a 100644
> --- a/arch/x86/include/asm/percpu.h
> +++ b/arch/x86/include/asm/percpu.h
> @@ -95,9 +95,18 @@
>   
>   #endif /* CONFIG_SMP */
>   
> -#define __my_cpu_type(var)	typeof(var) __percpu_seg_override
> -#define __my_cpu_ptr(ptr)	(__my_cpu_type(*(ptr))*)(__force uintptr_t)(ptr)
> -#define __my_cpu_var(var)	(*__my_cpu_ptr(&(var)))
> +#if defined(CONFIG_USE_X86_SEG_SUPPORT) && defined(USE_TYPEOF_UNQUAL)
> +# define __my_cpu_type(var)	typeof(var)
> +# define __my_cpu_ptr(ptr)	(ptr)
> +# define __my_cpu_var(var)	(var)
> +
> +# define __percpu_qual		__percpu_seg_override
> +#else
> +# define __my_cpu_type(var)	typeof(var) __percpu_seg_override
> +# define __my_cpu_ptr(ptr)	(__my_cpu_type(*(ptr))*)(__force uintptr_t)(ptr)
> +# define __my_cpu_var(var)	(*__my_cpu_ptr(&(var)))
> +#endif
> +
>   #define __percpu_arg(x)		__percpu_prefix "%" #x
>   #define __force_percpu_arg(x)	__force_percpu_prefix "%" #x

thanks,
-- 
js
suse labs

Re: [PATCH v4 6/6] percpu/x86: Enable strict percpu checks via named AS qualifiers

[Uros Bizjak]

On Wed, Apr 9, 2025 at 1:07 PM Jiri Slaby <jirislaby@kernel.org> wrote:
>
> On 27. 01. 25, 17:05, Uros Bizjak wrote:
> > This patch declares percpu variables in __seg_gs/__seg_fs named AS
> > and keeps them named AS qualified until they are dereferenced with
> > percpu accessor. This approach enables various compiler check
> > for cross-namespace variable assignments.
>
> So this causes modpost to fail to version some symbols:
>
> > WARNING: modpost: EXPORT symbol "xen_vcpu_id" [vmlinux] version generation failed, symbol will not be versioned.
> > Is "xen_vcpu_id" prototyped in <asm/asm-prototypes.h>?
> > WARNING: modpost: EXPORT symbol "irq_stat" [vmlinux] version generation failed, symbol will not be versioned.
> > Is "irq_stat" prototyped in <asm/asm-prototypes.h>?
> > WARNING: modpost: EXPORT symbol "fred_rsp0" [vmlinux] version generation failed, symbol will not be versioned.
> > Is "fred_rsp0" prototyped in <asm/asm-prototypes.h>?
> > WARNING: modpost: EXPORT symbol "cpu_dr7" [vmlinux] version generation failed, symbol will not be versioned.
> > Is "cpu_dr7" prototyped in <asm/asm-prototypes.h>?
> > WARNING: modpost: EXPORT symbol "cpu_tss_rw" [vmlinux] version generation failed, symbol will not be versioned.
> > Is "cpu_tss_rw" prototyped in <asm/asm-prototypes.h>?
> > WARNING: modpost: EXPORT symbol "__tss_limit_invalid" [vmlinux] version generation failed, symbol will not be versioned.
> > Is "__tss_limit_invalid" prototyped in <asm/asm-prototypes.h>?
> > WARNING: modpost: EXPORT symbol "irq_fpu_usable" [vmlinux] version generation failed, symbol will not be versioned.
> > Is "irq_fpu_usable" prototyped in <asm/asm-prototypes.h>?
> > WARNING: modpost: EXPORT symbol "cpu_info" [vmlinux] version generation failed, symbol will not be versioned.
> > Is "cpu_info" prototyped in <asm/asm-prototypes.h>?
> > WARNING: modpost: EXPORT symbol "gdt_page" [vmlinux] version generation failed, symbol will not be versioned.
> > Is "gdt_page" prototyped in <asm/asm-prototypes.h>?
>  > ...
>
> That happens both with 6.15-rc1 and today's -next. Ideas?

https://lore.kernel.org/lkml/20250404102535.705090-1-ubizjak@gmail.com/

Uros.

Re: [PATCH v4 6/6] percpu/x86: Enable strict percpu checks via named AS qualifiers

[H. Peter Anvin]

On April 9, 2025 4:43:27 AM PDT, Uros Bizjak <ubizjak@gmail.com> wrote:
>On Wed, Apr 9, 2025 at 1:07 PM Jiri Slaby <jirislaby@kernel.org> wrote:
>>
>> On 27. 01. 25, 17:05, Uros Bizjak wrote:
>> > This patch declares percpu variables in __seg_gs/__seg_fs named AS
>> > and keeps them named AS qualified until they are dereferenced with
>> > percpu accessor. This approach enables various compiler check
>> > for cross-namespace variable assignments.
>>
>> So this causes modpost to fail to version some symbols:
>>
>> > WARNING: modpost: EXPORT symbol "xen_vcpu_id" [vmlinux] version generation failed, symbol will not be versioned.
>> > Is "xen_vcpu_id" prototyped in <asm/asm-prototypes.h>?
>> > WARNING: modpost: EXPORT symbol "irq_stat" [vmlinux] version generation failed, symbol will not be versioned.
>> > Is "irq_stat" prototyped in <asm/asm-prototypes.h>?
>> > WARNING: modpost: EXPORT symbol "fred_rsp0" [vmlinux] version generation failed, symbol will not be versioned.
>> > Is "fred_rsp0" prototyped in <asm/asm-prototypes.h>?
>> > WARNING: modpost: EXPORT symbol "cpu_dr7" [vmlinux] version generation failed, symbol will not be versioned.
>> > Is "cpu_dr7" prototyped in <asm/asm-prototypes.h>?
>> > WARNING: modpost: EXPORT symbol "cpu_tss_rw" [vmlinux] version generation failed, symbol will not be versioned.
>> > Is "cpu_tss_rw" prototyped in <asm/asm-prototypes.h>?
>> > WARNING: modpost: EXPORT symbol "__tss_limit_invalid" [vmlinux] version generation failed, symbol will not be versioned.
>> > Is "__tss_limit_invalid" prototyped in <asm/asm-prototypes.h>?
>> > WARNING: modpost: EXPORT symbol "irq_fpu_usable" [vmlinux] version generation failed, symbol will not be versioned.
>> > Is "irq_fpu_usable" prototyped in <asm/asm-prototypes.h>?
>> > WARNING: modpost: EXPORT symbol "cpu_info" [vmlinux] version generation failed, symbol will not be versioned.
>> > Is "cpu_info" prototyped in <asm/asm-prototypes.h>?
>> > WARNING: modpost: EXPORT symbol "gdt_page" [vmlinux] version generation failed, symbol will not be versioned.
>> > Is "gdt_page" prototyped in <asm/asm-prototypes.h>?
>>  > ...
>>
>> That happens both with 6.15-rc1 and today's -next. Ideas?
>
>https://lore.kernel.org/lkml/20250404102535.705090-1-ubizjak@gmail.com/
>
>Uros.
>

A lot of those seem to be things that definitely shouldn't be expected...

Re: [PATCH v4 6/6] percpu/x86: Enable strict percpu checks via named AS qualifiers

[Uros Bizjak]

On Wed, Apr 9, 2025 at 5:09 PM H. Peter Anvin <hpa@zytor.com> wrote:
>
> On April 9, 2025 4:43:27 AM PDT, Uros Bizjak <ubizjak@gmail.com> wrote:
> >On Wed, Apr 9, 2025 at 1:07 PM Jiri Slaby <jirislaby@kernel.org> wrote:
> >>
> >> On 27. 01. 25, 17:05, Uros Bizjak wrote:
> >> > This patch declares percpu variables in __seg_gs/__seg_fs named AS
> >> > and keeps them named AS qualified until they are dereferenced with
> >> > percpu accessor. This approach enables various compiler check
> >> > for cross-namespace variable assignments.
> >>
> >> So this causes modpost to fail to version some symbols:
> >>
> >> > WARNING: modpost: EXPORT symbol "xen_vcpu_id" [vmlinux] version generation failed, symbol will not be versioned.
> >> > Is "xen_vcpu_id" prototyped in <asm/asm-prototypes.h>?
> >> > WARNING: modpost: EXPORT symbol "irq_stat" [vmlinux] version generation failed, symbol will not be versioned.
> >> > Is "irq_stat" prototyped in <asm/asm-prototypes.h>?
> >> > WARNING: modpost: EXPORT symbol "fred_rsp0" [vmlinux] version generation failed, symbol will not be versioned.
> >> > Is "fred_rsp0" prototyped in <asm/asm-prototypes.h>?
> >> > WARNING: modpost: EXPORT symbol "cpu_dr7" [vmlinux] version generation failed, symbol will not be versioned.
> >> > Is "cpu_dr7" prototyped in <asm/asm-prototypes.h>?
> >> > WARNING: modpost: EXPORT symbol "cpu_tss_rw" [vmlinux] version generation failed, symbol will not be versioned.
> >> > Is "cpu_tss_rw" prototyped in <asm/asm-prototypes.h>?
> >> > WARNING: modpost: EXPORT symbol "__tss_limit_invalid" [vmlinux] version generation failed, symbol will not be versioned.
> >> > Is "__tss_limit_invalid" prototyped in <asm/asm-prototypes.h>?
> >> > WARNING: modpost: EXPORT symbol "irq_fpu_usable" [vmlinux] version generation failed, symbol will not be versioned.
> >> > Is "irq_fpu_usable" prototyped in <asm/asm-prototypes.h>?
> >> > WARNING: modpost: EXPORT symbol "cpu_info" [vmlinux] version generation failed, symbol will not be versioned.
> >> > Is "cpu_info" prototyped in <asm/asm-prototypes.h>?
> >> > WARNING: modpost: EXPORT symbol "gdt_page" [vmlinux] version generation failed, symbol will not be versioned.
> >> > Is "gdt_page" prototyped in <asm/asm-prototypes.h>?
> >>  > ...
> >>
> >> That happens both with 6.15-rc1 and today's -next. Ideas?
> >
> >https://lore.kernel.org/lkml/20250404102535.705090-1-ubizjak@gmail.com/

> A lot of those seem to be things that definitely shouldn't be expected...

These symbols are just declared with an extra __seg_gs that genksyms
doesn't understand, e.g.:

extern __seg_gs __attribute__((section(".data..percpu" "..hot.."
"this_cpu_off"))) __typeof__(unsigned long) this_cpu_off;

The workaround falls back when __GENKSYMS__ is defined to:

extern __attribute__((section(".data..percpu" "..hot.."
"this_cpu_off"))) __typeof__(unsigned long) this_cpu_off;

which is what genksyms processes without problems.

Uros.

Large modules with 6.15 [was: [PATCH v4 6/6] percpu/x86: Enable strict percpu checks via named AS qualifiers]

[Jiri Slaby]

On 27. 01. 25, 17:05, Uros Bizjak wrote:
> This patch declares percpu variables in __seg_gs/__seg_fs named AS
> and keeps them named AS qualified until they are dereferenced with
> percpu accessor. This approach enables various compiler check
> for cross-namespace variable assignments.
> 
> Signed-off-by: Uros Bizjak <ubizjak@gmail.com>
> Acked-by: Nadav Amit <nadav.amit@gmail.com>
> Cc: Dennis Zhou <dennis@kernel.org>
> Cc: Tejun Heo <tj@kernel.org>
> Cc: Christoph Lameter <cl@linux.com>
> Cc: Thomas Gleixner <tglx@linutronix.de>
> Cc: Ingo Molnar <mingo@kernel.org>
> Cc: Borislav Petkov <bp@alien8.de>
> Cc: Dave Hansen <dave.hansen@linux.intel.com>
> Cc: "H. Peter Anvin" <hpa@zytor.com>
> Cc: Linus Torvalds <torvalds@linux-foundation.org>
> Cc: Andy Lutomirski <luto@kernel.org>
> Cc: Brian Gerst <brgerst@gmail.com>
> Cc: Peter Zijlstra <peterz@infradead.org>
> ---
>   arch/x86/include/asm/percpu.h | 15 ++++++++++++---
>   1 file changed, 12 insertions(+), 3 deletions(-)
> 
> diff --git a/arch/x86/include/asm/percpu.h b/arch/x86/include/asm/percpu.h
> index 27f668660abe..474d648bca9a 100644
> --- a/arch/x86/include/asm/percpu.h
> +++ b/arch/x86/include/asm/percpu.h
> @@ -95,9 +95,18 @@
>   
>   #endif /* CONFIG_SMP */
>   
> -#define __my_cpu_type(var)	typeof(var) __percpu_seg_override
> -#define __my_cpu_ptr(ptr)	(__my_cpu_type(*(ptr))*)(__force uintptr_t)(ptr)
> -#define __my_cpu_var(var)	(*__my_cpu_ptr(&(var)))
> +#if defined(CONFIG_USE_X86_SEG_SUPPORT) && defined(USE_TYPEOF_UNQUAL)
> +# define __my_cpu_type(var)	typeof(var)
> +# define __my_cpu_ptr(ptr)	(ptr)
> +# define __my_cpu_var(var)	(var)
> +
> +# define __percpu_qual		__percpu_seg_override
> +#else
> +# define __my_cpu_type(var)	typeof(var) __percpu_seg_override
> +# define __my_cpu_ptr(ptr)	(__my_cpu_type(*(ptr))*)(__force uintptr_t)(ptr)
> +# define __my_cpu_var(var)	(*__my_cpu_ptr(&(var)))
> +#endif
> +

Another issue with this is this causes all modules in 6.15 are 2-4 times 
(compressed size) bigger:
$ ll /usr/lib/modules/*-[0-9]-default/kernel/drivers/atm/atmtcp.ko.zst
 > -rw-r--r--. 1 root root 10325 May 13 11:49 
/usr/lib/modules/6.14.6-2-default/kernel/drivers/atm/atmtcp.ko.zst
 > -rw-r--r--. 1 root root 39677 Jun  2 09:13 
/usr/lib/modules/6.15.0-1-default/kernel/drivers/atm/atmtcp.ko.zst

It's due to larger .BTF section:
.BTF              PROGBITS         0000000000000000  [-00003080-]
[-       00000000000011a8-]  {+00003100+}
{+       0000000000012cf8+}  0000000000000000           0     0     1

There are a lot of new BTF types defined in each module like:
+attribute_group STRUCT
+backing_dev_info STRUCT
+bdi_writeback STRUCT
+bin_attribute STRUCT
+bio_end_io_t TYPEDEF
+bio_list STRUCT
+bio_set STRUCT
+bio STRUCT
+bio_vec STRUCT

Reverting this gives me back to normal sizes.

Any ideas?

FTR downstream report:
https://bugzilla.suse.com/show_bug.cgi?id=1244135

thanks,
-- 
js
suse labs

Re: Large modules with 6.15 [was: [PATCH v4 6/6] percpu/x86: Enable strict percpu checks via named AS qualifiers]

[Jiri Slaby]

Cc BPF people, just so you know.

On 05. 06. 25, 16:27, Jiri Slaby wrote:
> On 27. 01. 25, 17:05, Uros Bizjak wrote:
>> This patch declares percpu variables in __seg_gs/__seg_fs named AS
>> and keeps them named AS qualified until they are dereferenced with
>> percpu accessor. This approach enables various compiler check
>> for cross-namespace variable assignments.
>>
>> Signed-off-by: Uros Bizjak <ubizjak@gmail.com>
>> Acked-by: Nadav Amit <nadav.amit@gmail.com>
>> Cc: Dennis Zhou <dennis@kernel.org>
>> Cc: Tejun Heo <tj@kernel.org>
>> Cc: Christoph Lameter <cl@linux.com>
>> Cc: Thomas Gleixner <tglx@linutronix.de>
>> Cc: Ingo Molnar <mingo@kernel.org>
>> Cc: Borislav Petkov <bp@alien8.de>
>> Cc: Dave Hansen <dave.hansen@linux.intel.com>
>> Cc: "H. Peter Anvin" <hpa@zytor.com>
>> Cc: Linus Torvalds <torvalds@linux-foundation.org>
>> Cc: Andy Lutomirski <luto@kernel.org>
>> Cc: Brian Gerst <brgerst@gmail.com>
>> Cc: Peter Zijlstra <peterz@infradead.org>
>> ---
>>   arch/x86/include/asm/percpu.h | 15 ++++++++++++---
>>   1 file changed, 12 insertions(+), 3 deletions(-)
>>
>> diff --git a/arch/x86/include/asm/percpu.h b/arch/x86/include/asm/ 
>> percpu.h
>> index 27f668660abe..474d648bca9a 100644
>> --- a/arch/x86/include/asm/percpu.h
>> +++ b/arch/x86/include/asm/percpu.h
>> @@ -95,9 +95,18 @@
>>   #endif /* CONFIG_SMP */
>> -#define __my_cpu_type(var)    typeof(var) __percpu_seg_override
>> -#define __my_cpu_ptr(ptr)    (__my_cpu_type(*(ptr))*)(__force 
>> uintptr_t)(ptr)
>> -#define __my_cpu_var(var)    (*__my_cpu_ptr(&(var)))
>> +#if defined(CONFIG_USE_X86_SEG_SUPPORT) && defined(USE_TYPEOF_UNQUAL)
>> +# define __my_cpu_type(var)    typeof(var)
>> +# define __my_cpu_ptr(ptr)    (ptr)
>> +# define __my_cpu_var(var)    (var)
>> +
>> +# define __percpu_qual        __percpu_seg_override
>> +#else
>> +# define __my_cpu_type(var)    typeof(var) __percpu_seg_override
>> +# define __my_cpu_ptr(ptr)    (__my_cpu_type(*(ptr))*)(__force 
>> uintptr_t)(ptr)
>> +# define __my_cpu_var(var)    (*__my_cpu_ptr(&(var)))
>> +#endif
>> +
> 
> Another issue with this is this causes all modules in 6.15 are 2-4 times 
> (compressed size) bigger:
> $ ll /usr/lib/modules/*-[0-9]-default/kernel/drivers/atm/atmtcp.ko.zst
>  > -rw-r--r--. 1 root root 10325 May 13 11:49 /usr/lib/modules/6.14.6-2- 
> default/kernel/drivers/atm/atmtcp.ko.zst
>  > -rw-r--r--. 1 root root 39677 Jun  2 09:13 /usr/lib/modules/6.15.0-1- 
> default/kernel/drivers/atm/atmtcp.ko.zst
> 
> It's due to larger .BTF section:
> .BTF              PROGBITS         0000000000000000  [-00003080-]
> [-       00000000000011a8-]  {+00003100+}
> {+       0000000000012cf8+}  0000000000000000           0     0     1
> 
> There are a lot of new BTF types defined in each module like:
> +attribute_group STRUCT
> +backing_dev_info STRUCT
> +bdi_writeback STRUCT
> +bin_attribute STRUCT
> +bio_end_io_t TYPEDEF
> +bio_list STRUCT
> +bio_set STRUCT
> +bio STRUCT
> +bio_vec STRUCT
> 
> Reverting this gives me back to normal sizes.
> 
> Any ideas?
> 
> FTR downstream report:
> https://bugzilla.suse.com/show_bug.cgi?id=1244135
> 
> thanks,

-- 
js
suse labs

Re: Large modules with 6.15 [was: [PATCH v4 6/6] percpu/x86: Enable strict percpu checks via named AS qualifiers]

[Dr. David Alan Gilbert]

* Jiri Slaby (jirislaby@kernel.org) wrote:
> On 27. 01. 25, 17:05, Uros Bizjak wrote:
> > This patch declares percpu variables in __seg_gs/__seg_fs named AS
> > and keeps them named AS qualified until they are dereferenced with
> > percpu accessor. This approach enables various compiler check
> > for cross-namespace variable assignments.
> > 
> > Signed-off-by: Uros Bizjak <ubizjak@gmail.com>
> > Acked-by: Nadav Amit <nadav.amit@gmail.com>
> > Cc: Dennis Zhou <dennis@kernel.org>
> > Cc: Tejun Heo <tj@kernel.org>
> > Cc: Christoph Lameter <cl@linux.com>
> > Cc: Thomas Gleixner <tglx@linutronix.de>
> > Cc: Ingo Molnar <mingo@kernel.org>
> > Cc: Borislav Petkov <bp@alien8.de>
> > Cc: Dave Hansen <dave.hansen@linux.intel.com>
> > Cc: "H. Peter Anvin" <hpa@zytor.com>
> > Cc: Linus Torvalds <torvalds@linux-foundation.org>
> > Cc: Andy Lutomirski <luto@kernel.org>
> > Cc: Brian Gerst <brgerst@gmail.com>
> > Cc: Peter Zijlstra <peterz@infradead.org>
> > ---
> >   arch/x86/include/asm/percpu.h | 15 ++++++++++++---
> >   1 file changed, 12 insertions(+), 3 deletions(-)
> > 
> > diff --git a/arch/x86/include/asm/percpu.h b/arch/x86/include/asm/percpu.h
> > index 27f668660abe..474d648bca9a 100644
> > --- a/arch/x86/include/asm/percpu.h
> > +++ b/arch/x86/include/asm/percpu.h
> > @@ -95,9 +95,18 @@
> >   #endif /* CONFIG_SMP */
> > -#define __my_cpu_type(var)	typeof(var) __percpu_seg_override
> > -#define __my_cpu_ptr(ptr)	(__my_cpu_type(*(ptr))*)(__force uintptr_t)(ptr)
> > -#define __my_cpu_var(var)	(*__my_cpu_ptr(&(var)))
> > +#if defined(CONFIG_USE_X86_SEG_SUPPORT) && defined(USE_TYPEOF_UNQUAL)
> > +# define __my_cpu_type(var)	typeof(var)
> > +# define __my_cpu_ptr(ptr)	(ptr)
> > +# define __my_cpu_var(var)	(var)
> > +
> > +# define __percpu_qual		__percpu_seg_override
> > +#else
> > +# define __my_cpu_type(var)	typeof(var) __percpu_seg_override
> > +# define __my_cpu_ptr(ptr)	(__my_cpu_type(*(ptr))*)(__force uintptr_t)(ptr)
> > +# define __my_cpu_var(var)	(*__my_cpu_ptr(&(var)))
> > +#endif
> > +
> 
> Another issue with this is this causes all modules in 6.15 are 2-4 times
> (compressed size) bigger:

Oh, is that why config-all kernel is too big?

Dave

> $ ll /usr/lib/modules/*-[0-9]-default/kernel/drivers/atm/atmtcp.ko.zst
> > -rw-r--r--. 1 root root 10325 May 13 11:49
> /usr/lib/modules/6.14.6-2-default/kernel/drivers/atm/atmtcp.ko.zst
> > -rw-r--r--. 1 root root 39677 Jun  2 09:13
> /usr/lib/modules/6.15.0-1-default/kernel/drivers/atm/atmtcp.ko.zst
> 
> It's due to larger .BTF section:
> .BTF              PROGBITS         0000000000000000  [-00003080-]
> [-       00000000000011a8-]  {+00003100+}
> {+       0000000000012cf8+}  0000000000000000           0     0     1
> 
> There are a lot of new BTF types defined in each module like:
> +attribute_group STRUCT
> +backing_dev_info STRUCT
> +bdi_writeback STRUCT
> +bin_attribute STRUCT
> +bio_end_io_t TYPEDEF
> +bio_list STRUCT
> +bio_set STRUCT
> +bio STRUCT
> +bio_vec STRUCT
> 
> Reverting this gives me back to normal sizes.
> 
> Any ideas?
> 
> FTR downstream report:
> https://bugzilla.suse.com/show_bug.cgi?id=1244135
> 
> thanks,
> -- 
> js
> suse labs
> 
> 
-- 
 -----Open up your eyes, open up your mind, open up your code -------   
/ Dr. David Alan Gilbert    |       Running GNU/Linux       | Happy  \ 
\        dave @ treblig.org |                               | In Hex /
 \ _________________________|_____ http://www.treblig.org   |_______/

Re: Large modules with 6.15 [was: [PATCH v4 6/6] percpu/x86: Enable strict percpu checks via named AS qualifiers]

[Alexei Starovoitov]

On Thu, Jun 5, 2025 at 7:32 AM Jiri Slaby <jirislaby@kernel.org> wrote:
>
> Cc BPF people, just so you know.
>
> On 05. 06. 25, 16:27, Jiri Slaby wrote:
> > On 27. 01. 25, 17:05, Uros Bizjak wrote:
> >> This patch declares percpu variables in __seg_gs/__seg_fs named AS
> >> and keeps them named AS qualified until they are dereferenced with
> >> percpu accessor. This approach enables various compiler check
> >> for cross-namespace variable assignments.
> >>
> >> Signed-off-by: Uros Bizjak <ubizjak@gmail.com>
> >> Acked-by: Nadav Amit <nadav.amit@gmail.com>
> >> Cc: Dennis Zhou <dennis@kernel.org>
> >> Cc: Tejun Heo <tj@kernel.org>
> >> Cc: Christoph Lameter <cl@linux.com>
> >> Cc: Thomas Gleixner <tglx@linutronix.de>
> >> Cc: Ingo Molnar <mingo@kernel.org>
> >> Cc: Borislav Petkov <bp@alien8.de>
> >> Cc: Dave Hansen <dave.hansen@linux.intel.com>
> >> Cc: "H. Peter Anvin" <hpa@zytor.com>
> >> Cc: Linus Torvalds <torvalds@linux-foundation.org>
> >> Cc: Andy Lutomirski <luto@kernel.org>
> >> Cc: Brian Gerst <brgerst@gmail.com>
> >> Cc: Peter Zijlstra <peterz@infradead.org>
> >> ---
> >>   arch/x86/include/asm/percpu.h | 15 ++++++++++++---
> >>   1 file changed, 12 insertions(+), 3 deletions(-)
> >>
> >> diff --git a/arch/x86/include/asm/percpu.h b/arch/x86/include/asm/
> >> percpu.h
> >> index 27f668660abe..474d648bca9a 100644
> >> --- a/arch/x86/include/asm/percpu.h
> >> +++ b/arch/x86/include/asm/percpu.h
> >> @@ -95,9 +95,18 @@
> >>   #endif /* CONFIG_SMP */
> >> -#define __my_cpu_type(var)    typeof(var) __percpu_seg_override
> >> -#define __my_cpu_ptr(ptr)    (__my_cpu_type(*(ptr))*)(__force
> >> uintptr_t)(ptr)
> >> -#define __my_cpu_var(var)    (*__my_cpu_ptr(&(var)))
> >> +#if defined(CONFIG_USE_X86_SEG_SUPPORT) && defined(USE_TYPEOF_UNQUAL)
> >> +# define __my_cpu_type(var)    typeof(var)
> >> +# define __my_cpu_ptr(ptr)    (ptr)
> >> +# define __my_cpu_var(var)    (var)
> >> +
> >> +# define __percpu_qual        __percpu_seg_override
> >> +#else
> >> +# define __my_cpu_type(var)    typeof(var) __percpu_seg_override
> >> +# define __my_cpu_ptr(ptr)    (__my_cpu_type(*(ptr))*)(__force
> >> uintptr_t)(ptr)
> >> +# define __my_cpu_var(var)    (*__my_cpu_ptr(&(var)))
> >> +#endif
> >> +
> >
> > Another issue with this is this causes all modules in 6.15 are 2-4 times
> > (compressed size) bigger:
> > $ ll /usr/lib/modules/*-[0-9]-default/kernel/drivers/atm/atmtcp.ko.zst
> >  > -rw-r--r--. 1 root root 10325 May 13 11:49 /usr/lib/modules/6.14.6-2-
> > default/kernel/drivers/atm/atmtcp.ko.zst
> >  > -rw-r--r--. 1 root root 39677 Jun  2 09:13 /usr/lib/modules/6.15.0-1-
> > default/kernel/drivers/atm/atmtcp.ko.zst
> >
> > It's due to larger .BTF section:
> > .BTF              PROGBITS         0000000000000000  [-00003080-]
> > [-       00000000000011a8-]  {+00003100+}
> > {+       0000000000012cf8+}  0000000000000000           0     0     1
> >
> > There are a lot of new BTF types defined in each module like:
> > +attribute_group STRUCT
> > +backing_dev_info STRUCT
> > +bdi_writeback STRUCT
> > +bin_attribute STRUCT
> > +bio_end_io_t TYPEDEF
> > +bio_list STRUCT
> > +bio_set STRUCT
> > +bio STRUCT
> > +bio_vec STRUCT
> >
> > Reverting this gives me back to normal sizes.
> >
> > Any ideas?

Try newer pahole ?
It was fixed by:
https://lore.kernel.org/bpf/20250429161042.2069678-1-alan.maguire@oracle.com/

Re: Large modules with 6.15 [was: [PATCH v4 6/6] percpu/x86: Enable strict percpu checks via named AS qualifiers]

[Dave Hansen]

On 6/5/25 07:27, Jiri Slaby wrote:
> Reverting this gives me back to normal sizes.
> 
> Any ideas?

I don't see any reason not to revert it. The benefits weren't exactly
clear from the changelogs or cover letter. Enabling "various compiler
checks" doesn't exactly scream that this is critical to end users in
some way.

The only question is if we revert just this last patch or the whole series.

Uros, is there an alternative to reverting?

Re: Large modules with 6.15 [was: [PATCH v4 6/6] percpu/x86: Enable strict percpu checks via named AS qualifiers]

[Uros Bizjak]

On Thu, Jun 5, 2025 at 7:15 PM Dave Hansen <dave.hansen@intel.com> wrote:
>
> On 6/5/25 07:27, Jiri Slaby wrote:
> > Reverting this gives me back to normal sizes.
> >
> > Any ideas?
>
> I don't see any reason not to revert it. The benefits weren't exactly
> clear from the changelogs or cover letter. Enabling "various compiler
> checks" doesn't exactly scream that this is critical to end users in
> some way.
>
> The only question is if we revert just this last patch or the whole series.
>
> Uros, is there an alternative to reverting?

This functionality can easily be disabled in include/linux/compiler.h
by not defining USE_TYPEOF_UNQUAL:

#if CC_HAS_TYPEOF_UNQUAL && !defined(__CHECKER__)
# define USE_TYPEOF_UNQUAL 1
#endif

(support for typeof_unqual keyword is required to handle __seg_gs
qualifiers), but ...

... the issue is reportedly fixed, please see [1], and ...

... you will disable much sought of feature, just ask tglx (and please
read his rant at [2]):

--q--
If the compiler people would have provided a way to utilize the anyway
non-standard name space support in a useful way, I could have spared the
time to bang my head agaist the wall simply because this would have failed
to build in the first place long ago. That just makes me sad.
--/q--

[1] https://lore.kernel.org/bpf/20250429161042.2069678-1-alan.maguire@oracle.com/
[2] https://lore.kernel.org/lkml/20240303235029.555787150@linutronix.de/

Uros.

Re: Large modules with 6.15 [was: [PATCH v4 6/6] percpu/x86: Enable strict percpu checks via named AS qualifiers]

[Jiri Slaby]

On 05. 06. 25, 19:31, Uros Bizjak wrote:
> On Thu, Jun 5, 2025 at 7:15 PM Dave Hansen <dave.hansen@intel.com> wrote:
>>
>> On 6/5/25 07:27, Jiri Slaby wrote:
>>> Reverting this gives me back to normal sizes.
>>>
>>> Any ideas?
>>
>> I don't see any reason not to revert it. The benefits weren't exactly
>> clear from the changelogs or cover letter. Enabling "various compiler
>> checks" doesn't exactly scream that this is critical to end users in
>> some way.
>>
>> The only question is if we revert just this last patch or the whole series.
>>
>> Uros, is there an alternative to reverting?
> 
> This functionality can easily be disabled in include/linux/compiler.h
> by not defining USE_TYPEOF_UNQUAL:
> 
> #if CC_HAS_TYPEOF_UNQUAL && !defined(__CHECKER__)
> # define USE_TYPEOF_UNQUAL 1
> #endif
> 
> (support for typeof_unqual keyword is required to handle __seg_gs
> qualifiers), but ...
> 
> ... the issue is reportedly fixed, please see [1], and ...

Confirmed, I need a patched userspace (libbpf).

> ... you will disable much sought of feature, just ask tglx (and please
> read his rant at [2]):

Given this is the second time I hit a bug with this, perhaps introduce 
an EXPERIMENTAL CONFIG option, so that random users can simply disable 
it if an issue occurs? Without the need of patching random userspace and 
changing random kernel headers?

> --q--
> If the compiler people would have provided a way to utilize the anyway
> non-standard name space support in a useful way, I could have spared the
> time to bang my head agaist the wall simply because this would have failed
> to build in the first place long ago. That just makes me sad.
> --/q--
> 
> [1] https://lore.kernel.org/bpf/20250429161042.2069678-1-alan.maguire@oracle.com/
> [2] https://lore.kernel.org/lkml/20240303235029.555787150@linutronix.de/

thanks,
-- 
js
suse labs

Re: Large modules with 6.15 [was: [PATCH v4 6/6] percpu/x86: Enable strict percpu checks via named AS qualifiers]

[Uros Bizjak]

On Fri, Jun 6, 2025 at 11:17 AM Jiri Slaby <jirislaby@kernel.org> wrote:
>
> On 05. 06. 25, 19:31, Uros Bizjak wrote:
> > On Thu, Jun 5, 2025 at 7:15 PM Dave Hansen <dave.hansen@intel.com> wrote:
> >>
> >> On 6/5/25 07:27, Jiri Slaby wrote:
> >>> Reverting this gives me back to normal sizes.
> >>>
> >>> Any ideas?
> >>
> >> I don't see any reason not to revert it. The benefits weren't exactly
> >> clear from the changelogs or cover letter. Enabling "various compiler
> >> checks" doesn't exactly scream that this is critical to end users in
> >> some way.
> >>
> >> The only question is if we revert just this last patch or the whole series.
> >>
> >> Uros, is there an alternative to reverting?
> >
> > This functionality can easily be disabled in include/linux/compiler.h
> > by not defining USE_TYPEOF_UNQUAL:
> >
> > #if CC_HAS_TYPEOF_UNQUAL && !defined(__CHECKER__)
> > # define USE_TYPEOF_UNQUAL 1
> > #endif
> >
> > (support for typeof_unqual keyword is required to handle __seg_gs
> > qualifiers), but ...
> >
> > ... the issue is reportedly fixed, please see [1], and ...
>
> Confirmed, I need a patched userspace (libbpf).
>
> > ... you will disable much sought of feature, just ask tglx (and please
> > read his rant at [2]):
>
> Given this is the second time I hit a bug with this, perhaps introduce
> an EXPERIMENTAL CONFIG option, so that random users can simply disable
> it if an issue occurs? Without the need of patching random userspace and
> changing random kernel headers?

In both cases, the patch *exposed* a bug in a related utility
software, it is not that the patch itself is buggy. IMO, waving off
the issue by disabling the feature you just risk the bug in the
related software to hit even harder in some not too distant future.

Uros.

Re: Large modules with 6.15 [was: [PATCH v4 6/6] percpu/x86: Enable strict percpu checks via named AS qualifiers]

[James Bottomley]

On Fri, 2025-06-06 at 11:27 +0200, Uros Bizjak wrote:
> On Fri, Jun 6, 2025 at 11:17 AM Jiri Slaby <jirislaby@kernel.org>
> wrote:
[...]
> > Given this is the second time I hit a bug with this, perhaps
> > introduce an EXPERIMENTAL CONFIG option, so that random users can
> > simply disable it if an issue occurs? Without the need of patching
> > random userspace and changing random kernel headers?
> 
> In both cases, the patch *exposed* a bug in a related utility
> software, it is not that the patch itself is buggy. IMO, waving off
> the issue by disabling the feature you just risk the bug in the
> related software to hit even harder in some not too distant future.

Given the severity of the problem absent tools updates the usual way of
handling this is a (sometimes partial) revert for the estimated time to
fix the tool chain followed by a resend.  This is exactly what we did
when an efivarfs bug fixe exposed a bug in the firmware update service:

https://lore.kernel.org/all/ffd953c76d3a0bc0f88aeb319589632e8da032dc.camel@HansenPartnership.com/

It only took about 3 months to get the update through the distros, what
would the estimate for this be?

Regards,

James

Re: Large modules with 6.15 [was: [PATCH v4 6/6] percpu/x86: Enable strict percpu checks via named AS qualifiers]

[Dave Hansen]

[-- Attachment #1: Type: text/plain, Size: 453 bytes --]

On 6/6/25 02:17, Jiri Slaby wrote:
> Given this is the second time I hit a bug with this, perhaps introduce
> an EXPERIMENTAL CONFIG option, so that random users can simply disable
> it if an issue occurs? Without the need of patching random userspace and
> changing random kernel headers?

What about something like the attached (untested) patch? That should at
least get folks back to the old, universal working behavior even when
using new compilers.

[-- Attachment #2: CC_USE_TYPEOF_UNQUAL1.patch --]
[-- Type: text/x-patch, Size: 2128 bytes --]

From 08d98b4fa08ba76be96e406b53ae69946842f6a9 Mon Sep 17 00:00:00 2001
From: Dave Hansen <dave.hansen@linux.intel.com>
Date: Fri, 6 Jun 2025 08:33:29 -0700
Subject: [PATCH] compiler.h: Enable config choice for using unqualified casts

TYPEOF_UNQUAL() has a noble goal of letting normal compilers do more
of the job normally reserved for sparse. But it has caused (or
exposed) a number of nasty bugs and is not quite ready for prime time.
Even nastier, some of these issues need separate userspace fixes.

Right now, __typeof_unqual__ will be whenever the compiler supports
it. Restrict it to cases where users have opted in with a new Kconfig
option. This option can either be removed or have its default polarity
flipped when userspace is widely fixed up.

Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
---
 include/linux/compiler.h |  2 +-
 init/Kconfig             | 11 +++++++++++
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index 27725f1ab5abc..3efa93f8eca66 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -232,7 +232,7 @@ void ftrace_likely_update(struct ftrace_likely_data *f, int val,
  * XXX: Remove test for __CHECKER__ once
  * sparse learns about __typeof_unqual__().
  */
-#if CC_HAS_TYPEOF_UNQUAL && !defined(__CHECKER__)
+#if defined(CONFIG_CC_USE_TYPEOF_UNQUAL) && CC_HAS_TYPEOF_UNQUAL && !defined(__CHECKER__)
 # define USE_TYPEOF_UNQUAL 1
 #endif
 
diff --git a/init/Kconfig b/init/Kconfig
index 63f5974b9fa6e..74e5e8d640750 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -1489,6 +1489,17 @@ config CC_OPTIMIZE_FOR_SIZE
 
 endchoice
 
+config CC_USE_TYPEOF_UNQUAL
+	bool "Use compiler-provided unqualified casts (EXPERIMENTAL)"
+	depends on EXPERT
+	help
+	  Newer compilers have the ability to do "unqualified" casts which
+	  strip out type qualifiers like 'const'. Kernel builds can
+	  leverage these to do more strict type checking with normal
+	  compilers instead of resorting to using sparse.
+
+	  If unsure, say N here.
+
 config HAVE_LD_DEAD_CODE_DATA_ELIMINATION
 	bool
 	help
-- 
2.34.1

Re: Large modules with 6.15 [was: [PATCH v4 6/6] percpu/x86: Enable strict percpu checks via named AS qualifiers]

[Alexei Starovoitov]

On Fri, Jun 6, 2025 at 2:27 AM Uros Bizjak <ubizjak@gmail.com> wrote:
>
> On Fri, Jun 6, 2025 at 11:17 AM Jiri Slaby <jirislaby@kernel.org> wrote:
> >
> > On 05. 06. 25, 19:31, Uros Bizjak wrote:
> > > On Thu, Jun 5, 2025 at 7:15 PM Dave Hansen <dave.hansen@intel.com> wrote:
> > >>
> > >> On 6/5/25 07:27, Jiri Slaby wrote:
> > >>> Reverting this gives me back to normal sizes.
> > >>>
> > >>> Any ideas?
> > >>
> > >> I don't see any reason not to revert it. The benefits weren't exactly
> > >> clear from the changelogs or cover letter. Enabling "various compiler
> > >> checks" doesn't exactly scream that this is critical to end users in
> > >> some way.
> > >>
> > >> The only question is if we revert just this last patch or the whole series.
> > >>
> > >> Uros, is there an alternative to reverting?
> > >
> > > This functionality can easily be disabled in include/linux/compiler.h
> > > by not defining USE_TYPEOF_UNQUAL:
> > >
> > > #if CC_HAS_TYPEOF_UNQUAL && !defined(__CHECKER__)
> > > # define USE_TYPEOF_UNQUAL 1
> > > #endif
> > >
> > > (support for typeof_unqual keyword is required to handle __seg_gs
> > > qualifiers), but ...
> > >
> > > ... the issue is reportedly fixed, please see [1], and ...
> >
> > Confirmed, I need a patched userspace (libbpf).
> >
> > > ... you will disable much sought of feature, just ask tglx (and please
> > > read his rant at [2]):
> >
> > Given this is the second time I hit a bug with this, perhaps introduce
> > an EXPERIMENTAL CONFIG option, so that random users can simply disable
> > it if an issue occurs? Without the need of patching random userspace and
> > changing random kernel headers?
>
> In both cases, the patch *exposed* a bug in a related utility
> software, it is not that the patch itself is buggy. IMO, waving off
> the issue by disabling the feature you just risk the bug in the
> related software to hit even harder in some not too distant future.

The typeof_unqual exposed the issue in the way GCC generates dwarf.
The libbpf/pahole is a workaround for incorrect dwarf.
The compiler shouldn't emit two identical dwarf definition for
one underlying type within one compilation unit. In this case
typeof_unqual somehow confused gcc.

Re: Large modules with 6.15 [was: [PATCH v4 6/6] percpu/x86: Enable strict percpu checks via named AS qualifiers]

[Uros Bizjak]

On Fri, Jun 6, 2025 at 6:39 PM Alexei Starovoitov
<alexei.starovoitov@gmail.com> wrote:
>
> On Fri, Jun 6, 2025 at 2:27 AM Uros Bizjak <ubizjak@gmail.com> wrote:
> >
> > On Fri, Jun 6, 2025 at 11:17 AM Jiri Slaby <jirislaby@kernel.org> wrote:
> > >
> > > On 05. 06. 25, 19:31, Uros Bizjak wrote:
> > > > On Thu, Jun 5, 2025 at 7:15 PM Dave Hansen <dave.hansen@intel.com> wrote:
> > > >>
> > > >> On 6/5/25 07:27, Jiri Slaby wrote:
> > > >>> Reverting this gives me back to normal sizes.
> > > >>>
> > > >>> Any ideas?
> > > >>
> > > >> I don't see any reason not to revert it. The benefits weren't exactly
> > > >> clear from the changelogs or cover letter. Enabling "various compiler
> > > >> checks" doesn't exactly scream that this is critical to end users in
> > > >> some way.
> > > >>
> > > >> The only question is if we revert just this last patch or the whole series.
> > > >>
> > > >> Uros, is there an alternative to reverting?
> > > >
> > > > This functionality can easily be disabled in include/linux/compiler.h
> > > > by not defining USE_TYPEOF_UNQUAL:
> > > >
> > > > #if CC_HAS_TYPEOF_UNQUAL && !defined(__CHECKER__)
> > > > # define USE_TYPEOF_UNQUAL 1
> > > > #endif
> > > >
> > > > (support for typeof_unqual keyword is required to handle __seg_gs
> > > > qualifiers), but ...
> > > >
> > > > ... the issue is reportedly fixed, please see [1], and ...
> > >
> > > Confirmed, I need a patched userspace (libbpf).
> > >
> > > > ... you will disable much sought of feature, just ask tglx (and please
> > > > read his rant at [2]):
> > >
> > > Given this is the second time I hit a bug with this, perhaps introduce
> > > an EXPERIMENTAL CONFIG option, so that random users can simply disable
> > > it if an issue occurs? Without the need of patching random userspace and
> > > changing random kernel headers?
> >
> > In both cases, the patch *exposed* a bug in a related utility
> > software, it is not that the patch itself is buggy. IMO, waving off
> > the issue by disabling the feature you just risk the bug in the
> > related software to hit even harder in some not too distant future.
>
> The typeof_unqual exposed the issue in the way GCC generates dwarf.
> The libbpf/pahole is a workaround for incorrect dwarf.
> The compiler shouldn't emit two identical dwarf definition for
> one underlying type within one compilation unit. In this case
> typeof_unqual somehow confused gcc.

Can you please file a bugreport in GCC bugzilla, so we can analyze the issue?

Uros.

Re: Large modules with 6.15 [was: [PATCH v4 6/6] percpu/x86: Enable strict percpu checks via named AS qualifiers]

[Uros Bizjak]

On Fri, Jun 6, 2025 at 5:44 PM Dave Hansen <dave.hansen@intel.com> wrote:
>
> On 6/6/25 02:17, Jiri Slaby wrote:
> > Given this is the second time I hit a bug with this, perhaps introduce
> > an EXPERIMENTAL CONFIG option, so that random users can simply disable
> > it if an issue occurs? Without the need of patching random userspace and
> > changing random kernel headers?
>
> What about something like the attached (untested) patch? That should at
> least get folks back to the old, universal working behavior even when
> using new compilers.

IMO the commit message is unnecessarily overly dramatic. The "nasty
bugs" were in fact:

- unfortunate mix of clang < 19 and new gcc-14 [1], fixed by
robustifying the  detection of typeof_unqual

[1] https://lore.kernel.org/lkml/CA+G9fYuP2bHnDvJwfMm6+8Y8UYk74qCw-2HsFyRzJDFiQ5dbpQ@mail.gmail.com/

- sparse doesn't understand new keyword, patch at [2], but sparse is
effectively unmaintained so a workaround is in place

[2] https://lore.kernel.org/linux-sparse/5b8d0dee-8fb6-45af-ba6c-7f74aff9a4b8@stanley.mountain/

- genksyms didn't understand the new keyword, fixed by [3].

[3] https://lore.kernel.org/lkml/174461594538.31282.5752735096854392083.tip-bot2@tip-bot2/

- a performance regression, again due to the unfortunate usage of old
gcc-13 [4]. The new gcc-14 would break compilation due to the missing
__percpu qualifier. This is one of the examples, where new checks
would prevent the issue during the development. Fixed with the help of
gcc-14.

[4] https://lore.kernel.org/all/CAADnVQ+iFBxauKq99=-Xk+BdG+Lv=Xgvwi1dC4fpG0utmXJiiA@mail.gmail.com/

- the issue in this thread, already fixed/worked around. Looking at
the fix, I don't think gcc is at fault, but I speculate that there
could be some invalid assumption about dwarf representation of
variables in non-default address space at play. I'll look at this one
in some more detail.

Please also note that besides the above issues, the GCC type system
and related checks around named address spaces was rock solid; there
were *zero* bugs regarding __percpu variables, and the referred patch
moves *all of them* to __seg_gs named address space. The patch builds
off an equally stable and now well proven GCC named address space
support, so in my opinion, it *is* ready for prime time. As
demonstrated in the above list of issues, it was *never* the compiler
at fault.

Let me reiterate what the patch brings to the table. It prevents
invalid references of per cpu variables to non-percpu locations. One
missing percpu dereference can have disastrous consequences (all CPUs
will access data in the shared space). Currently, the safety builds on
checking sparse logs, but sparse errors don't break the build. With
new checks in place, *every* invalid access is detected and breaks the
build with some 50 lines of errors.

Hiding these checks behind the CONFIG_EXPERT option breaks the
intention of the patch. IMO, it should be always enabled to avoid
errors, mentioned in the previous paragraph, already during the
development time.

I'm much more inclined to James' proposal. Maybe we can disable these
checks in v6.15 stable series, but leave them in v6.16? This would
leave a couple of months for distributions to update libbpf.

Thanks,
Uros.

Re: Large modules with 6.15 [was: [PATCH v4 6/6] percpu/x86: Enable strict percpu checks via named AS qualifiers]

[Dave Hansen]

On 6/7/25 01:52, Uros Bizjak wrote:
> Let me reiterate what the patch brings to the table. It prevents
> invalid references of per cpu variables to non-percpu locations.

Yes, it's a very useful mechanism. That's exactly why I want to preserve
it for developers or things like 0day that do build tests and don't care
about modules quadrupling in size.

> Hiding these checks behind the CONFIG_EXPERT option breaks the
> intention of the patch. IMO, it should be always enabled to avoid
> errors, mentioned in the previous paragraph, already during the
> development time.

I agree, it should always be enabled ... eventually. But now now. That's
why we're having this conversation: it's breaking too many things and
needs to be disabled.

> I'm much more inclined to James' proposal. Maybe we can disable these
> checks in v6.15 stable series, but leave them in v6.16? This would
> leave a couple of months for distributions to update libbpf.

I'd be worried that it will hit a whole bunch of folks doing 6.16 work.
I was expecting to revert it _everywhere_ for now, if we go the revert
route.

James, by partial revert, did you mean to revert in stable but not
mainline? I assumed you meant to just revert patch 6/6 of the series
(stable and mainline) but leave 1-5 in place so turning it back on later
was easier.

Re: Large modules with 6.15 [was: [PATCH v4 6/6] percpu/x86: Enable strict percpu checks via named AS qualifiers]

[James Bottomley]

On Sat, 2025-06-07 at 07:12 -0700, Dave Hansen wrote:
[...]
> James, by partial revert, did you mean to revert in stable but not
> mainline? I assumed you meant to just revert patch 6/6 of the series
> (stable and mainline) but leave 1-5 in place so turning it back on
> later was easier.

No, we had to put the revert through mainline because too many people
who build their own kernels use the firmware service.

We definitely didn't revert the entire series.  I constructed a new
patch which was effectively a partial revert only of the behaviour that
was tickling the bug.

For the record, this was the series containing the problem:

https://lore.kernel.org/all/20250119151214.23562-1-James.Bottomley@HansenPartnership.com/

And this is the revert we eventually came up with:

https://lore.kernel.org/all/63837c36eceaf8cf2af7933dccca54ff4dd9f30d.camel@HansenPartnership.com/

So it was specifically not a general revert but a narrowly crafted one
to get firmware services working again.

The mechanism we did was to queue the revert as an -rc fix so it went
in immediately and got backported to stable and then queue the revert
of the revert for the next merge window (and check before sending to
Linus that the user space update had spread far enough otherwise we'd
have skipped to the merge window after).

Regards,

James