linux-kernel - Re: [PATCH] x86/sev: Work around broken noinstr on GCC

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAMj1kXEBCYaPtupH67Gf3tHwoFiL7xKXbPpWbVV9zD0=bQg0Hg@mail.gmail.com>
Date: Tue, 15 Jul 2025 09:22:08 +1000
From: Ard Biesheuvel <ardb@...nel.org>
To: Borislav Petkov <bp@...en8.de>
Cc: Ard Biesheuvel <ardb+git@...gle.com>, linux-kernel@...r.kernel.org, x86@...nel.org, 
	Randy Dunlap <rdunlap@...radead.org>
Subject: Re: [PATCH] x86/sev: Work around broken noinstr on GCC

On Mon, 14 Jul 2025 at 20:27, Borislav Petkov <bp@...en8.de> wrote:
>
> On Mon, Jul 14, 2025 at 09:34:03AM +0200, Ard Biesheuvel wrote:
> > From: Ard Biesheuvel <ardb@...nel.org>
> >
> > Forcibly disable KCSAN for the sev-nmi.c source file, which only
> > contains functions annotated as 'noinstr' but is emitted with calls to
> > KCSAN instrumentation nonetheless. E.g.,
> >
> >   vmlinux.o: error: objtool: __sev_es_nmi_complete+0x58: call to __kcsan_check_access() leaves .noinstr.text section
> >   make[2]: *** [/usr/local/google/home/ardb/linux/scripts/Makefile.vmlinux_o:72: vmlinux.o] Error 1
> >
> > Reported-by: Randy Dunlap <rdunlap@...radead.org>
> > Signed-off-by: Ard Biesheuvel <ardb@...nel.org>
> > ---
> >  arch/x86/coco/sev/Makefile | 3 ++-
> >  1 file changed, 2 insertions(+), 1 deletion(-)
> >
> > diff --git a/arch/x86/coco/sev/Makefile b/arch/x86/coco/sev/Makefile
> > index db3255b979bd..342d79f0ab6a 100644
> > --- a/arch/x86/coco/sev/Makefile
> > +++ b/arch/x86/coco/sev/Makefile
> > @@ -5,5 +5,6 @@ obj-y += core.o sev-nmi.o vc-handle.o
> >  # Clang 14 and older may fail to respect __no_sanitize_undefined when inlining
> >  UBSAN_SANITIZE_sev-nmi.o     := n
> >
> > -# GCC may fail to respect __no_sanitize_address when inlining
> > +# GCC may fail to respect __no_sanitize_address or __no_kcsan when inlining
> >  KASAN_SANITIZE_sev-nmi.o     := n
> > +KCSAN_SANITIZE_sev-nmi.o     := n
> > --
>
> Hmm, so this points to the carve out:
>
> b66fcee1574e ("x86/sev: Move noinstr NMI handling code into separate source file")
>
> but then we didn't do any KCSAN exclusion to SEV code before either.
>

This is actually an oversight on my part,

Fixes: a3cbbb4717e1 ("x86/boot: Move SEV startup code into startup/")

> I guess send this to Linus now so that it is in 6.16?
>

Yes.