K5: x86-64 at distribution strength

[tamnd]

This tracks K5, x86-64 at distribution strength: the Debian config and then Fedora's, allmodconfig, kselftest and LTP, modules built by one compiler loaded into a kernel built by the other, and DWARF and BTF. The full text is in docs/plan/15-milestones.md.

Harness

• rk cross-modules (Add rk cross-modules #34). It checks every module against the other kernel without booting (relocations, the whole vermagic, missing exports, CRCs), then boots the kunit suite with the reference kernel and its own modules, the reference kernel with the rucc modules, and the rucc kernel with the reference modules. Both crossed boots must pass every unit the first one passed. The nightly runs it after rk test, and it does not turn the night red yet
• kselftest and LTP in the initramfs. kselftest is done (rk selftests, and kselftest units in rk test #35): rk selftests builds the row's collections against a finished build with either compiler, and rk test --kinds kselftest boots each collection with its programs and their shared libraries in the initramfs and grades kselftest:<collection>:<program> units like KUnit. On the 7.2.8 runner 26 collections built 199 programs with gcc-14. LTP followed in Build LTP with rk ltp and run it in rk test #37: ltp.toml pins LTP 20260529 by hash, rk ltp builds it against a finished build with either compiler and strips the debug info, and rk test --kinds ltp boots each runtest file (syscalls, mm, fs, sched, cve and four more on X64 and A64) with only the programs it names and grades ltp:<runtest>:<tag> units. With gcc on 6.12.111 every test in those nine files built. The guest gets enough memory for the initramfs since then. With rucc, libltp stopped on strlen of a literal in a static initializer, which folds since Fold strlen and strcmp of string literals under their plain names rucc#2599. The kernel and nightly workflows pin rucc 0.18.8 since Pin rucc v0.18.8 in the kernel and nightly workflows #38, and with it tinyconfig gets through Kconfig and compiles all but the four -m16 realmode units
• Pinned distro configs for Debian 13 and Fedora 44 (Pinned Debian 13 and Fedora 44 kernel configs for rk build #36). configs/distro/ holds the configs from linux-image-6.12.111+deb13-amd64 and kernel-core-7.2.8-200.fc44, unchanged, with the package and config hashes in distros.toml. rk build 6.12.111 --config debian-13 and rk build 7.2.8 --config fedora-44 check the hash, blank the distribution certificates, settle with olddefconfig, and list in build.json what the toolchain could not keep (BTF without pahole, Rust without rustc)
• The BTF differential

rucc

• Hardening flags: -fzero-call-used-regs (Honor -fzero-call-used-regs and the zero_call_used_regs attribute rucc#2345), -ftrivial-auto-var-init (Honor -ftrivial-auto-var-init and the uninitialized attribute rucc#2348), -fstrict-flex-arrays (Honor -fstrict-flex-arrays in __builtin_object_size rucc#2387), the cs prefix (Honor the x86-64 speculation hardening flags rucc#2331) and call depth tracking padding, which already matched gcc 15 through -fpatchable-function-entry=16,16 with -fmin-function-alignment=16
• no_stack_protector and __seg_gs. optimize("no-stack-protector"), stack_protect and -fstack-protector-explicit landed in Read stack_protect, -fstack-protector-explicit and optimize("no-stack-protector") rucc#2377, __seg_gs and __seg_fs in Support the __seg_gs and __seg_fs named address spaces on x86 rucc#2381
• DWARF 4 (debug: write DWARF 4 under -gdwarf-4 rucc#2370) and -gz (zlib in debug: compress debug sections under -gz rucc#2374, zstd in debug: write zstd debug sections under -gz=zstd rucc#2376)
• BTF agreement with pahole
• SHF_GNU_RETAIN and COMDAT groups (Write ELF notes, section groups, retained and empty declared sections rucc#2340)
• __builtin_has_attribute and __builtin_counted_by_ref, with the counted_by attribute (Add __builtin_has_attribute, __builtin_counted_by_ref and counted_by rucc#2384)
• What allmodconfig demands beyond defconfig: AVX-512 crypto, VMX and SVM, FPU regions with vector code. The assembler now reads the syntax the kernel crypto files use (register aliases, bracketed displacements, 32-bit addresses), in Read the kernel crypto assembly syntax gas takes rucc#2393, and writes AVX2, AES-NI and PCLMUL in Write the AVX2, AES-NI and PCLMUL instructions the kernel's crypto code uses rucc#2398. AVX-512, GFNI, the mask instructions and vpblendvb followed in asm: write the AVX-512, GFNI and mask instructions the crypto code uses rucc#2401, and all 48 x86 crypto files now assemble to the same bytes and relocations as gas. The VMX and SVM instructions already encode the same as llvm-mc, and the FPU flags already give SSE code. sema: compile the kernel's common headers quietly under -Werror rucc#2404 lets the headers every KVM unit includes compile quietly under CONFIG_WERROR. Packed enums (sema: size a packed enumeration the way -fshort-enums does rucc#2405), compound literals in a block's static initializer (sema: take a block's compound literal as a constant value in a static initializer rucc#2407) and a back end crash on a protected tail call (codegen: leave a protected function's tail call as a call rucc#2408) are fixed, and the KVM units now get through the front end. An "i" asm operand that is a static's address plus an offset, which every pr_debug hands the jump label, is spelled name+offset since codegen: spell a symbol plus an offset in an asm immediate rucc#2411. -Wno-pointer-sign, -Werror= and -Wno-error= act on 39 named warnings since driver: act on -Wno-, -Werror= and -Wno-error= for named warnings rucc#2412. Flag outputs (=@ccc) work on x86-64 and AArch64 since lower: flag outputs on x86-64 and AArch64 rucc#2415, which also defines __GCC_ASM_FLAG_OUTPUTS__ and adds bt on memory. The four lib/raid6 x86 files (SSE2, AVX2, AVX-512 and the AVX2 recovery code) compile since asm: the non-temporal stores and shifts lib/raid6 uses rucc#2419, which adds the rows they need, lets a kept template read a second memory operand through its address register, and reads %% in an operand-less template as extended asm. A constant printed under a width modifier like %b1 is an immediate since Print a constant asm operand under a width modifier rucc#2423. Constant division folds and the image pass runs again after the late constant folding since opt: fold constant division and run the image pass again late rucc#2422, so the BUILD_BUG_ON checks in reverse_cpuid.h are proven false and svm.c, sev.c, vmx.c and nested.c all compile. Released in 0.18.3. The 36 AMD display files under dc/dml, which Kbuild builds with SSE and the x87 turned back on, compile since driver: take a boundary of 3 with SSE and -mno-fp-ret-in-387 with the x87 on rucc#2430, which takes a stack boundary of 3 with SSE (realigning a frame that keeps a vector) and -mno-fp-ret-in-387 with the x87 on, as gcc does. Both KVM vmenter.S files assemble to the same bytes and relocations as gas since asm: skip a space between % and a register name rucc#2431 and Read a register written with a space after the percent sign, and compare registers in a conditional rucc#2433. A name reached through an anonymous member now clashes with its neighbours, as in gcc, since sema: a member reached through an anonymous one clashes with its neighbours rucc#2436. All 46 preprocessed units in the FPU and vector set now build. A wider sweep over 532 units of allmodconfig (kernel, mm, lib, block, crypto, security, ext4, btrfs, net core and ipv4, NVMe and the Intel NICs, with the sanitizer flags taken off) found 34 failures, now fixed: gcc's -fno-schedule-insns and -fno-code-hoisting in crypto (Take gcc's -fschedule-insns and -fcode-hoisting as pass names to drop rucc#2448), a (bool) cast of a pointer (Keep a cast from a pointer to _Bool quiet about the width rucc#2451), enum { A = -1U, B = A - 1 } in blk-mq.h (Give an enumerator too wide for an int its own type while the list is read rucc#2452), an attribute in front of a later declarator (Take GNU attributes in front of a later declarator of a list rucc#2455) and andb $-129 from clear_bit (Take a negative immediate as far down as gas does quietly rucc#2456). A second sweep, still running as the gcc build adds units, found addq of a 64-bit constant under the e constraint in lib/atomic64_test.c and lib/percpu-refcount.c, now put in a register as gcc does (Bound the e and Z asm constraints to thirty two bits rucc#2494), and vmovapd on zmm registers in lib/raid6/recov_avx512.c, now EVEX encoded (Encode vmovapd and friends with EVEX when the operands need it rucc#2503). The same sweep also found an enum cast to void * warned about in kunit (Leave a cast between a pointer and an enum quiet rucc#2508), -fsched-pressure in serpent (Take gcc's -fsched- flags as a family rucc#2511), vxorps in crypto/xor.c (Write vxorps and the other bitwise operations on packed floats rucc#2516), a pointer to an array of unknown length in landlock (Let a pointer to an array of unknown length be dereferenced rucc#2518, tidied in Refuse a subscript over an array of unknown length again rucc#2528) and landlock's BUILD_BUG_ON(!dst) on a local's address (Fold a stack slot's address compared against null rucc#2525), IS_ERR on a number cast to a pointer in test_printf (Fold a wide number cast to a pointer and back rucc#2530) and a simplify rewrite that turned a subscript off a null pointer into an integer in test_bitmap (Keep a ptr_add a pointer when its base is null rucc#2532). lib/overflow_kunit.c took ten minutes at -O2 because closing a loop's leaked values climbed the dominator tree from every block, and builds in six seconds since Name a closed loop value in one walk down the dominator tree rucc#2538. test_bitmap now gets past BUILD_BUG_ON(!__builtin_constant_p(res)) on a bitmap it just cleared, since Leave __builtin_constant_p of a dereference to the optimizer rucc#2543 leaves a question about *p to the optimizer, folds a local's address compared with zero and forwards the store to the load once the answers have merged the blocks. A bool cast to void * in lib/kunit/attributes.c is no longer warned about, as in gcc (Leave a _Bool cast to a pointer unwarned rucc#2551). Against current main, lib/bitfield_kunit.c, lib/test_printf.c, mm/rmap.c, net/ipv4/fib_trie.c and fs/ext4/super.c from that sweep now compile too. What is left is the 50 units under kernel/trace, which allmodconfig builds with -fprofile-arcs for GCOV_PROFILE_FTRACE, and nine units that timed out under the old binary. Against current main eight of those nine build in one to three seconds each (overflow_kunit was the ninth). The last, mm/ksm.c, checked BUILD_BUG_ON(STABLE_NODE_DUP_HEAD <= &migrate_nodes) on two places in one list head, and that order now folds (Fold the order of two places in one object rucc#2553). -fprofile-arcs is implemented since Count arcs for -fprofile-arcs rucc#2556: counters on the edges off a spanning tree, the gcov_info record laid out for the claimed gcc version, a constructor at priority 101 calling __gcov_init, and no_profile_instrument_function. -ftest-coverage and --coverage write the .gcno file since Write the .gcno file for -ftest-coverage rucc#2561, and gcov 13 reads what a rucc build leaves behind: two test programs give the same report as gcc's build line for line, and a third differs only on the lines of labels. Functions end at their closing brace as in gcc since End a gcov function at its closing brace rucc#2574, and all 61 kernel/trace units now compile with -fprofile-arcs -ftest-coverage and write a note for every C file. What is left of this item is a full rerun of the sweep against current main.

rucc-real-corpus

• LTP and kselftest built as user projects

Exit criterion

• rk test 7.2.8 --row X64 --config debian-13+test --kinds boot,smoke,kunit,kselftest,ltp passes and the dmesg subset holds
• rk build 7.2.8 --row X64 --config allmodconfig succeeds with every differential and objtool clean
• rk cross-modules 7.2.8 --row X64 passes both ways
• The BTF differential is clean apart from functions that depend on inlining
• The first three hold on 6.12.y and 6.6.y

[tamnd]

Update on the hardening flags: tamnd/rucc#2345 adds -fzero-call-used-regs for the general register choices and tamnd/rucc#2348 adds -ftrivial-auto-var-init with zero and pattern, both matching gcc 13. The cs prefix for the retpoline thunks is already on main from tamnd/rucc#2331. SHF_GNU_RETAIN and COMDAT groups landed in tamnd/rucc#2340, so I ticked that line. Left on the hardening line: -fstrict-flex-arrays above 0 and the call depth tracking padding.

[tamnd]

DWARF 4 is up in tamnd/rucc#2370. -gdwarf-4 now writes version 4 with .debug_ranges, .debug_loc, inline line table names, .debug_str unit strings and DW_LANG_C99, matching gcc 13's layout. llvm-dwarfdump --verify is clean on the object and the linked program, and gdb reads it the same as the DWARF 5 build. That clears the CONFIG_DEBUG_INFO_DWARF4 refusal. The item stays open for BTF against pahole and the -gz decision, which is tamnd/rucc#2288 next.

[tamnd]

Opened tamnd/rucc#2374 for -gz. It compresses the debug sections with zlib, both the SHF_COMPRESSED layout and the older .zdebug one, and asks the linker to keep them compressed. This covers CONFIG_DEBUG_INFO_COMPRESSED_ZLIB. -gz=zstd is still refused, so CONFIG_DEBUG_INFO_COMPRESSED_ZSTD needs a zstd writer, which is next under tamnd/rucc#2288. The item stays open until that and the pahole check are done.

[tamnd]

Opened tamnd/rucc#2376 for -gz=zstd, stacked on tamnd/rucc#2374. With both in, every value of -gz is written, so CONFIG_DEBUG_INFO_COMPRESSED_ZLIB and CONFIG_DEBUG_INFO_COMPRESSED_ZSTD both have a compiler behind them. On the SQLite object the zstd output is within 0.3 percent of what objcopy writes, and ld 2.42, gdb and llvm-dwarfdump --verify all read it. What is left on this item is the BTF check against pahole.

[tamnd]

Opened tamnd/rucc#2377 for the stack protector half of the no_stack_protector and __seg_gs item. no_stack_protector itself already worked. What was missing was optimize("no-stack-protector"), which is what __nostackprotector expands to on the older kernels and on a compiler without the attribute, plus stack_protect and -fstack-protector-explicit. Which functions get a canary now matches gcc 13 under every flag, including a function that says both attributes. __seg_gs is next on this item.

[tamnd]

Opened tamnd/rucc#2381 for __seg_gs and __seg_fs. They are keywords in GNU C on x86. Loads, stores, structure copies and asm memory operands in a space all go through the segment, so return gs; is movslq %gs:gs(%rip), %rax and *p += v is addq %rsi, %gs:(%rdi), which matches gcc 13. The address space errors match gcc's wording. With this in, the CC_HAS_NAMED_AS probe passes, so 6.9 and later build their per-CPU accessors the named address space way. Once this and #2377 land, item 13 can be ticked.

[tamnd]

Opened tamnd/rucc#2384 for __builtin_has_attribute, __builtin_counted_by_ref and the counted_by attribute. With it, compiler.h turns on __annotated and the __must_be_cstr check, and __flex_counter in overflow.h becomes the real builtin. All 37 has_attribute answers in the new test, and the counted_by error messages, match gcc-15 on the same source. One gap: __builtin_dynamic_object_size does not read the count yet, so fortify checks a counted array against its layout, the same as an array without the attribute.

[tamnd]

tamnd/rucc#2387 adds -fstrict-flex-arrays, which we used to refuse. Through a pointer, __builtin_object_size(p->name, 1) now gives the member's size instead of (size_t) -1, so the fortified copies the kernel builds at level 3 are checked. Trailing arrays follow gcc 15's four levels, and members of a union still get no answer. It is checked against gcc 15 at -O2 on 16 shapes at every level. Still open under hardening: call depth tracking padding.

[tamnd]

I compared the call depth tracking padding with gcc 15 under the kernel's flags (-O2 -fpatchable-function-entry=16,16 -fmin-function-alignment=16 -mcmodel=kernel). Each function gets 16 nops in front of a 16 byte aligned entry, plus one __patchable_function_entries section per function with the WAL flags, linked to .text and holding an R_X86_64_64 to the start of the padding. That matches gcc, so no rucc change is needed for it. Once the three PRs in review (tamnd/rucc#2345, tamnd/rucc#2348 and tamnd/rucc#2387) merge, the hardening item is finished.