build: fail when a component does not compile

The component recipe exits 0 whatever the compiler said, deliberately: one
of 118 independent leaf targets that will not build must not stop the
other 117. It removes the target instead, so a broken component becomes
absent rather than stale and is never exercised as the last binary that
happened to compile. That left the failure for something else to notice,
and nothing did -- the orchestrator finds components by scanning the
directory, so an absent one is a smaller set reported as success. Breaking
a format string in one component leaves make, make test and make cross all
green with the binary gone.

check-components-built reads the three states the recipe already writes to
disk: a non-empty file compiled, an empty file is the architecture-gated
skip path writing a deliberate empty target, and an absent file is a
compiler failure. 109 built, 9 gated, 118 sources. No expected count is
used and none may be, a fixed number being the same rot one level up.

-Werror=format promotes the mismatch itself, now that it can be seen. The
cross build carries -Wformat already and reports none across seventeen
arches, so the promotion costs nothing and closes the case where a wrong
specifier prints a plausible address rather than failing.

kasld_logf and progress_note gain format attributes, which carry the check
to 503 call sites that a va_list had put beyond it. Every one was already
correct; the attribute enforces what the code had.

The remaining clang diagnostics were three kinds, and only one was a
defect. bcm_msg_head_struct and mincore hold deliberate constructs -- a
containing struct matching the wire format bcm_send_to_user() builds, and
a byte-stepped scan whose unaligned reads are the technique -- and needed
clang's spelling of suppressions already written for gcc. databounce's
xabort_wrapper had lost its only caller and is removed. The 31 in api.h
came from compiling the header as its own translation unit, where every
static inline is unused by construction, so check-headers alone suppresses
that.

Author: bcoles

Makefile

@@ -71,6 +71,7 @@ KASLD_WARN_FLAGS_WANTED := \
     -Werror=incompatible-pointer-types \
     -Werror=return-type \
     -Werror=format-security \
+    -Werror=format \
     -Werror=frame-larger-than=2097152
 KASLD_HARDEN_FLAGS_WANTED := -fstack-protector-strong -D_FORTIFY_SOURCE=2
 
@@ -311,10 +312,14 @@ $(OBJ_DIR):
 $(TEST_OBJ_DIR):
 	@mkdir -p "$(TEST_OBJ_DIR)"
 
-# Validate headers before building components
+# Validate headers before building components. -Wno-unused-function because the
+# point of this check is to compile the header as a translation unit of its own,
+# where every static inline it defines is unused by construction; the check stays
+# live for every real compile.
 .PHONY: check-headers
 check-headers: | $(COMP_DIR)
-	$(Q)$(CC) $(ALL_CFLAGS) -xc -fsyntax-only $(SRC_DIR)/include/kasld/api.h
+	$(Q)$(CC) $(ALL_CFLAGS) -Wno-unused-function -xc -fsyntax-only \
+	    $(SRC_DIR)/include/kasld/api.h
 
 $(COMP_DIR)/%: $(COMP_SRC_DIR)/%.c $(HDRS) | $(COMP_DIR)
 	$(call cc-component, $(CC) $(ALL_CFLAGS) $(ALL_LDFLAGS) -I$(SRC_DIR) $< -o $@)
@@ -779,6 +784,7 @@ lint :
 	    $(TEST_DIR)/check-component-output \
 	    $(TEST_DIR)/check-component-meta \
 	    $(TEST_DIR)/check-component-cap \
+	    $(TEST_DIR)/check-components-built \
 	    $(TEST_DIR)/check-log-prefixes \
 	    $(TEST_DIR)/check-live-probes \
 	    $(TEST_DIR)/check-hash-parity \

docs/testing.md

@@ -178,6 +178,7 @@ stays plain, and setting `KASLD_COLOR` non-empty or empty forces either.
 | `check-absence-vs-denial` | no component reports a denied source as an absent one — a failed probe's reason is in `errno`, and UNAVAILABLE claims the target's build while NOPERM reports its hardening |
 | `check-component-output` | components write only wire lines to stdout (stdout is the machine channel; diagnostics go to stderr) |
 | `check-component-meta` | every component declares `KASLD_META` with a `method:` key |
+| `check-components-built` | every component source produced a build artefact. The component recipe exits 0 whatever the compiler said, deliberately: with 118 independent leaf targets, one that will not compile must not stop the other 117 being built and tested. It removes the target instead, so a broken component becomes absent rather than stale and is never silently exercised as the last binary that happened to compile. That left the failure for something else to notice, and nothing did — the orchestrator finds components by scanning the directory, so an absent one is simply a smaller set reported as success, and no guard compared the build against the source. A component could stop compiling with `make`, `make test` and `make cross` all staying green. The recipe already writes the distinction to disk, so this reads it rather than tracking its own: a non-empty file compiled, an empty file is the architecture-gated skip path writing a deliberate empty target, and an absent file is a compiler failure. No expected count is used, and none may be — a fixed number rots the moment a component is added, which is this same failure one level up |
 | `check-component-cap` | `MAX_COMPONENTS` keeps a margin above the in-tree component count — a component directory that overruns it silently drops the excess |
 | `check-log-prefixes` | no diagnostic message begins with a `[.]`/`[-]`/`[+]` marker (the `kasld_info`/`kasld_err`/`kasld_found` helper already prepends one — an embedded marker doubles it) |
 | `check-live-probes` | every live probe (reads live kernel/CPU state) is tagged `live:1` and self-guards with `kasld_skip_live_probe()`, so it never runs offline against the analysis host |

src/components/bcm_msg_head_struct.c

@@ -68,10 +68,19 @@ KASLD_META("method:heuristic\n"
  * member, so wrapping it in a containing struct (the kernel's own pattern
  * for sending bcm_msg_head + a fixed number of frames in one buffer) is
  * flagged under -Wpedantic. The layout matches the kernel's expected wire
- * format — relied on deliberately. Suppress the pedantic warning at
- * the two declaration sites rather than hide the kernel-side shape. */
+ * format — relied on deliberately: bcm_send_to_user() allocates
+ * sizeof(*head) + datalen and appends the frames straight after the head, so a
+ * containing struct is what the socket actually reads. Suppress at the two
+ * declaration sites rather than hide the kernel-side shape.
+ *
+ * Two spellings of one complaint: gcc reports it as -Wpedantic, clang as
+ * -Wgnu-variable-sized-type-not-at-end. Naming both keeps the suppression as
+ * narrow as the construct it covers, on either compiler. */
 #pragma GCC diagnostic push
 #pragma GCC diagnostic ignored "-Wpedantic"
+#if defined(__clang__)
+#pragma GCC diagnostic ignored "-Wgnu-variable-sized-type-not-at-end"
+#endif
 
 static void rxsetup_sock(int sock) {
   struct sockaddr_can sa;

src/components/databounce.c

@@ -112,15 +112,6 @@ KASLD_META("method:timing\n"
            "discloses:virtual\n"
            "hardware:TSX required (mitigated by tsx=off)\n");
 
-/* =========================================================================
- * TSX xabort
- * =========================================================================
- */
-
-static inline __attribute__((always_inline)) void xabort_wrapper(void) {
-  __asm__ volatile(".byte 0xc6,0xf8,0x00" ::: "memory");
-}
-
 /* =========================================================================
  * Data Bounce single sweep
  * =========================================================================

src/components/mincore.c

@@ -126,7 +126,20 @@ static unsigned long get_kernel_addr_mincore(void) {
 
     unsigned long n;
     /* Slide an unsigned-long-wide window over buf; stop before the read would
-     * run past the page-sized allocation (buf[n .. n+sizeof(long)-1]). */
+     * run past the page-sized allocation (buf[n .. n+sizeof(long)-1]).
+     *
+     * The window advances one BYTE at a time, so most reads are unaligned by
+     * construction: the leaked pointer sits at an offset this side does not
+     * know, and stepping by sizeof(long) would skip three candidate positions
+     * in four. The cast therefore does increase the required alignment, which
+     * is safe only because this file refuses to compile off x86-64 (see the
+     * gate at the top), where an unaligned load is permitted. On a
+     * strict-alignment target the same scan would have to be assembled
+     * byte-wise instead. */
+#if defined(__clang__)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wcast-align"
+#endif
     for (n = 0; n + sizeof(unsigned long) <= page; n++) {
       addr = *(unsigned long *)(&buf[n]);
       /* Kernel address space */
@@ -137,6 +150,9 @@ static unsigned long get_kernel_addr_mincore(void) {
         return addr;
       }
     }
+#if defined(__clang__)
+#pragma GCC diagnostic pop
+#endif
   }
 
   if (munmap((void *)0x66000000, len))

src/include/kasld/cli.h

@@ -44,8 +44,14 @@ static inline int kasld_is_verbose(void) {
 }
 
 /* Emit `[<level>] <msg>\n` to stderr. `gated` lines print only when verbose.
- * Prefer the wrappers below; the level alphabet is closed at '.', '-', '+'. */
-static inline void kasld_logf(char level, int gated, const char *fmt, ...) {
+ * Prefer the wrappers below; the level alphabet is closed at '.', '-', '+'.
+ *
+ * The format attribute is what makes every CALLER checkable: the format reaches
+ * vfprintf through a va_list, where a compiler can no longer relate it to the
+ * arguments, so without this the check is lost at the one place a mismatch
+ * would print a plausible wrong address rather than fail. */
+__attribute__((format(printf, 3, 4))) static inline void
+kasld_logf(char level, int gated, const char *fmt, ...) {
   if (gated && !kasld_is_verbose())
     return;
   va_list ap;

src/orchestrator.c

@@ -258,8 +258,11 @@ static void progress_paint(int done, int total, int inflight) {
 }
 
 /* Emit a diagnostic on its own line without corrupting the bar. Safe from any
- * thread, and a plain stderr write when no bar is drawn. */
-static void progress_note(const char *fmt, ...) {
+ * thread, and a plain stderr write when no bar is drawn. The format attribute
+ * carries the check to the callers, which is the only place it can happen once
+ * the format has entered a va_list. */
+__attribute__((format(printf, 1, 2))) static void progress_note(const char *fmt,
+                                                                ...) {
   va_list ap;
   RESULT_LOCK();
   int inflight = progress_inflight;

tests/check-components-built

@@ -0,0 +1,90 @@
+#!/bin/sh
+# This file is part of KASLD - https://github.com/bcoles/kasld
+#
+# check-components-built — every component source produced a build artefact.
+#
+# The component recipe exits 0 whatever the compiler said, on purpose: with 118
+# independent leaf targets, one that will not compile must not stop the other
+# 117 from being built and tested. What it does instead is REMOVE the target, so
+# a broken component becomes absent rather than stale and is not silently
+# exercised as the last binary that happened to compile.
+#
+# That leaves the failure to be noticed by something. Nothing noticed it. The
+# orchestrator finds components by scanning the directory, so an absent one is
+# simply a smaller set -- 117 components, reported as success -- and no guard
+# compared what was built against what exists in source. A component could stop
+# compiling and `make`, `make test` and `make cross` would all stay green.
+#
+# The recipe already writes the distinction to disk, so this reads it rather
+# than tracking anything of its own:
+#
+#   non-empty file  compiled
+#   empty file      arch-gated, skipped by the `#error "Architecture is not
+#                   supported"` path, which writes an empty target deliberately
+#   absent          the compiler failed
+#
+# A count is not used and must not be: a fixed expected number rots the moment a
+# component is added, which is the failure mode this file exists to prevent, one
+# level up. The source directory is the inventory and the build answers to it.
+#
+# Usage: tests/check-components-built   (also run by `make test`)
+# ---
+# <bcoles@gmail.com>
+
+set -u
+ROOT=$(CDPATH='' cd -- "$(dirname -- "$0")/.." && pwd)
+# shellcheck source=tests/lib/guard-scope.sh
+. "$ROOT/tests/lib/guard-scope.sh"
+
+if [ -t 2 ] || [ -n "${KASLD_COLOR:-}" ]; then
+  RED=$(printf '\033[31m'); GREEN=$(printf '\033[32m')
+  YELLOW=$(printf '\033[33m'); RESET=$(printf '\033[0m')
+else
+  RED=; GREEN=; YELLOW=; RESET=
+fi
+
+# The native triple, resolved the same way the build resolves it. Probing
+# build/*/ and taking the first that exists would pick a cross directory --
+# i686 sorts before x86_64 -- and check a set this host never built.
+COMP=
+for t in "$(cc -dumpmachine 2>/dev/null)" "$(${CC:-cc} -dumpmachine 2>/dev/null)"; do
+  [ -n "$t" ] || continue
+  if [ -d "$ROOT/build/$t/components" ]; then
+    COMP=$ROOT/build/$t/components
+    break
+  fi
+done
+[ -n "$COMP" ] || {
+  printf '%scheck-components-built: SKIP%s (no native component build; run make first)\n' \
+    "$YELLOW" "$RESET"
+  exit 0
+}
+
+missing=; nsrc=0; nbuilt=0; nskipped=0
+for src in "$ROOT"/src/components/*.c; do
+  [ -f "$src" ] || continue
+  nsrc=$((nsrc + 1))
+  name=$(basename "$src" .c)
+  if [ ! -e "$COMP/$name" ]; then
+    missing="$missing $name"
+  elif [ -s "$COMP/$name" ]; then
+    nbuilt=$((nbuilt + 1))
+  else
+    nskipped=$((nskipped + 1))
+  fi
+done
+
+if [ -n "$missing" ]; then
+  printf '%scheck-components-built: FAIL%s (component source with no build artefact)\n' \
+    "$RED" "$RESET" >&2
+  for m in $missing; do printf '  %s\n' "$m" >&2; done
+  printf 'The compile failed and the recipe removed the target. Re-run make and\n' >&2
+  printf 'read the CC line for that component; the diagnostic is printed there even\n' >&2
+  printf 'though the build reports success.\n' >&2
+  exit 1
+fi
+
+guard_scope "check-components-built" "$nsrc" 50
+
+printf '%scheck-components-built: OK%s (%s built, %s architecture-gated, %s sources)\n' \
+  "$GREEN" "$RESET" "$nbuilt" "$nskipped" "$nsrc"