Re: [PATCH] kbuild: add -fdiagnostics-show-inlining-chain for FORTIFY_SOURCE

[Justin Stitt]

Hi,

On Fri, Mar 27, 2026 at 3:18 PM Nathan Chancellor <nathan@xxxxxxxxxx> wrote:
>
> On Fri, Mar 27, 2026 at 02:59:20PM -0700, Justin Stitt wrote:
> > Clang recently added -fdiagnostics-show-inlining-chain [1] to improve
> > the visibility of inlining chains in diagnostics. This is particularly
> > useful for CONFIG_FORTIFY_SOURCE where detections can happen deep in
> > inlined functions.
> >
> > Add this flag to KBUILD_CFLAGS when CONFIG_FORTIFY_SOURCE is enabled
> > and the compiler supports it.
> >
> > Link: https://github.com/llvm/llvm-project/pull/174892 [1]
> > Link: https://github.com/ClangBuiltLinux/linux/issues/1571
> > Signed-off-by: Justin Stitt <justinstitt@xxxxxxxxxx>
> > ---
> >  Makefile | 6 ++++++
> >  1 file changed, 6 insertions(+)
> >
> > diff --git a/Makefile b/Makefile
> > index e1279c4d5b24..978726aeb1ef 100644
> > --- a/Makefile
> > +++ b/Makefile
> > @@ -973,6 +973,12 @@ KBUILD_CFLAGS    += $(call cc-option, -fno-stack-clash-protection)
> >  # Get details on warnings generated due to GCC value tracking.
> >  KBUILD_CFLAGS        += $(call cc-option, -fdiagnostics-show-context=2)
> >
> > +# Show inlining chain notes for FORTIFY_SOURCE-related diagnostics.
> > +# GCC does this by default while Clang 23+ supports a flag.
> > +ifdef CONFIG_FORTIFY_SOURCE
>
> While this is indeed particularly useful for CONFIG_FORTIFY_SOURCE, this
> impacts the warning and error attributes, which can be used anywhere
> (see __bad_copy_from() for example). Is this being wrapped due to the
> potential compile time impact? Can we use something like hyperfine to
> quantify it and see if the impact is worth the trade off of always
> having it enabled for friendlier diagnostics?

The compile time impact is not measurable (within expected noise). The
peak memory usage may increase by somewhere in the 0.5% to 1.5% range
depending on build configuration.

I bundled this under fortify to limit initial impact as its had
virtually no real-world testing and may produce unhelpful diagnostic
notes under its heuristic mode. I don't expect folks to use `-g1` in
the kernel (which would enable full-proof diagnostic notes).

> If not, maybe worth adding a Kconfig option that is force selected by FORTIFY_SOURCE with
> clang or can be optionally enabled by a user?

I'll defer to you on this one. We could add
CONFIG_SHOW_INLINING_CHAIN_NOTES or something similar?

>
> > +KBUILD_CFLAGS        += $(call cc-option, -fdiagnostics-show-inlining-chain)
> > +endif
> > +
> >  # Clear used registers at func exit (to reduce data lifetime and ROP gadgets).
> >  ifdef CONFIG_ZERO_CALL_USED_REGS
> >  KBUILD_CFLAGS        += -fzero-call-used-regs=used-gpr
> >
> > ---
> > base-commit: 7df48e36313029e4c0907b2023905dd7213fd678
> > change-id: 20260327-kbuild-show-inlining-557d31d2293a
> >
> > Best regards,
> > --
> > Justin Stitt <justinstitt@xxxxxxxxxx>
> >

Justin