-O3 Compiler Optimization Level Still Deemed Too Unsafe For The Linux Kernel

Due to not too old versions of the GNU Compiler Collection (GCC) possibly generating bad code with the "-O3" compiler optimization level and sometimes there not being performance benefits, Linus Torvalds remains against using this optimization flag when compiling the Linux kernel.

Sent in this week as part of the networking fixes for the Linux 5.13 kernel were WireGuard fixes that among them dropped compiling the WireGuard module with the "-O3" C flag.

WireGuard lead developer Jason Donenfeld had been building WireGuard with the "-O3" optimization level since the project's inception and has studied the generated code in the past. While he hasn't witnessed cases of bad code being generated from the "-O3" usage, due to guidance from Linus Torvalds, he has dropped the option moving forward.

The "-O3 in general is unsafe" guidance from Torvalds stems from this recent kernel thread where some developers had been discussing -O3 usage but passing as well "-fnotree-loop-vectorize" to workaround some versions of GCC possibly generating bad code at the higher optimization level.

In that recent email post Torvalds summed up his current -O3 perspective:

It has historically been horribly buggy. It's gotten better, but this case clearly shows that "gotten better" really isn't that high of a bar.

Very few projects use -O3, which is obviously part of why it's buggy. But the other part of why it's buggy is that vectorization is simply very complicated, and honestly, judging by the last report the gcc people don't care about being careful. They literally are ok with knowingly generating an off-by-one range check, because "it's undefined behavior".

With that kind of mentality, I'm not personally all that inclined to say "sure, use -O3". We know it has bugs even for the well-defined cases.

So WireGuard's kernel module moving forward will not be built at -O3. LZ4 and Zstd remain the only other known users of kernel code being compiled with -O3.

Given the slow cadence of many vendors moving to new compiler versions and even longer before the kernel maintainers are comfortable dropping old compiler version support, it will likely be years before the Linux kernel finds it safe to use "-O3" by default -- short of version checking or just enabling it for Clang or other conditions deemed safe.