[PATCH v2 0/3] Noinstr fixes for K[CA]SAN with GCOV

[PATCH v2 0/3] Noinstr fixes for K[CA]SAN with GCOV

[Brendan Jackman]

Details:

 - ❯❯  clang --version
   Debian clang version 19.1.7 (3+build5)
   Target: x86_64-pc-linux-gnu
   Thread model: posix
   InstalledDir: /usr/lib/llvm-19/bin

 - Kernel config:

   https://gist.githubusercontent.com/bjackman/bbfdf4ec2e1dfd0e18657174f0537e2c/raw/a88dcc6567d14c69445e7928a7d5dfc23ca9f619/gistfile0.txt

Note I also get this error:

vmlinux.o: warning: objtool: set_ftrace_ops_ro+0x3b: relocation to !ENDBR: machine_kexec_prepare+0x810

That one's a total mystery to me. I guess it's better to "fix" the SEV
one independently rather than waiting until I know how to fix them both.

Note I also mentioned other similar errors in [0]. Those errors don't
exist in Linus' master and I didn't note down where I saw them. Either
they have since been fixed, or I observed them in Google's internal
codebase where they were instroduced downstream.

As discussed in [2], the GCOV+*SAN issue is attacked from two angles:
both adding __always_inline to the instrumentation helpers AND disabling
GCOV for noinstr.c. Only one or the other of these things is needed to
make the build error go away, but they both make sense in their own
right and both may serve to prevent other similar errors from cropping
up in future.

Signed-off-by: Brendan Jackman <jackmanb@google.com>
---
Changes in v2:
- Also disable GCOV for noinstr.c (i.e. squash in [0]).
- Link to v1: [2] 

[0] https://lore.kernel.org/all/DERNCQGNRITE.139O331ACPKZ9@google.com/
[1] https://lore.kernel.org/all/20251117-b4-sev-gcov-objtool-v1-1-54f7790d54df@google.com/
[2] https://lore.kernel.org/r/20251208-gcov-inline-noinstr-v1-0-623c48ca5714@google.com

---
Brendan Jackman (3):
      kasan: mark !__SANITIZE_ADDRESS__ stubs __always_inline
      kcsan: mark !__SANITIZE_THREAD__ stub __always_inline
      x86/sev: Disable GCOV on noinstr object

 arch/x86/coco/sev/Makefile   | 2 ++
 include/linux/kasan-checks.h | 4 ++--
 include/linux/kcsan-checks.h | 2 +-
 3 files changed, 5 insertions(+), 3 deletions(-)
---
base-commit: 8f0b4cce4481fb22653697cced8d0d04027cb1e8
change-id: 20251208-gcov-inline-noinstr-1550cfee445c

Best regards,
-- 
Brendan Jackman <jackmanb@google.com>

[PATCH v2 1/3] kasan: mark !__SANITIZE_ADDRESS__ stubs __always_inline

[Brendan Jackman]

The x86 instrumented bitops in
include/asm-generic/bitops/instrumented-non-atomic.h are
KASAN-instrumented via explicit calls to instrument_* functions from
include/linux/instrumented.h.

This bitops are used from noinstr code in __sev_es_nmi_complete(). This
code avoids noinstr violations by disabling __SANITIZE_ADDRESS__ etc for
the compilation unit.

However, when GCOV is enabled, there can still be violations caused by
the stub versions of these functions, since coverage instrumentation is
injected that causes them to be out-of-lined.

Fix this by just applying __always_inline.

Signed-off-by: Brendan Jackman <jackmanb@google.com>
---
 include/linux/kasan-checks.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/linux/kasan-checks.h b/include/linux/kasan-checks.h
index 3d6d22a25bdc391c0015a6daf2249d6bea752dcb..9aa0f1cc90133ca334afa478b5f762aef9e5d79c 100644
--- a/include/linux/kasan-checks.h
+++ b/include/linux/kasan-checks.h
@@ -37,11 +37,11 @@ static inline bool __kasan_check_write(const volatile void *p, unsigned int size
 #define kasan_check_read __kasan_check_read
 #define kasan_check_write __kasan_check_write
 #else
-static inline bool kasan_check_read(const volatile void *p, unsigned int size)
+static __always_inline bool kasan_check_read(const volatile void *p, unsigned int size)
 {
 	return true;
 }
-static inline bool kasan_check_write(const volatile void *p, unsigned int size)
+static __always_inline bool kasan_check_write(const volatile void *p, unsigned int size)
 {
 	return true;
 }

-- 
2.50.1

[PATCH v2 2/3] kcsan: mark !__SANITIZE_THREAD__ stub __always_inline

[Brendan Jackman]

The x86 instrumented bitops in
include/asm-generic/bitops/instrumented-non-atomic.h are
KCSAN-instrumented via explicit calls to instrument_* functions from
include/linux/instrumented.h.

This bitops are used from noinstr code in __sev_es_nmi_complete(). This
code avoids noinstr violations by disabling __SANITIZE_THREAD__ etc for
the compilation unit.

However, when GCOV is enabled, there can still be violations caused by
the stub versions of these functions, since coverage instrumentation is
injected that causes them to be out-of-lined.

Fix this by just applying __always_inline.

Signed-off-by: Brendan Jackman <jackmanb@google.com>
---
 include/linux/kcsan-checks.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/kcsan-checks.h b/include/linux/kcsan-checks.h
index 92f3843d9ebb8177432bb4eccc151ea66d3dcbb7..cabb2ae46bdc0963bd89533777cab586ab4d5a1b 100644
--- a/include/linux/kcsan-checks.h
+++ b/include/linux/kcsan-checks.h
@@ -226,7 +226,7 @@ static inline void kcsan_end_scoped_access(struct kcsan_scoped_access *sa) { }
 #define __kcsan_disable_current kcsan_disable_current
 #define __kcsan_enable_current kcsan_enable_current_nowarn
 #else /* __SANITIZE_THREAD__ */
-static inline void kcsan_check_access(const volatile void *ptr, size_t size,
+static __always_inline void kcsan_check_access(const volatile void *ptr, size_t size,
 				      int type) { }
 static inline void __kcsan_enable_current(void)  { }
 static inline void __kcsan_disable_current(void) { }

-- 
2.50.1

[PATCH v2 3/3] x86/sev: Disable GCOV on noinstr object

[Brendan Jackman]

With Debian clang version 19.1.7 (3+build5) there are calls to
kasan_check_write() from __sev_es_nmi_complete, which violates noinstr.
Fix it by disabling GCOV for the noinstr object, as has been done for
previous such instrumentation issues.

Note that this file already disables __SANITIZE_ADDRESS__ and
__SANITIZE_THREAD__, thus calls like kasan_check_write() ought to be
nops regardless of GCOV. This has been fixed in other patches. However,
to avoid any other accidental instrumentation showing up, (and since, in
principle GCOV is instrumentation and hence should be disabled for
noinstr code anyway), disable GCOV overall as well.

Signed-off-by: Brendan Jackman <jackmanb@google.com>
---
 arch/x86/coco/sev/Makefile | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/x86/coco/sev/Makefile b/arch/x86/coco/sev/Makefile
index 3b8ae214a6a64de6bb208eb3b7c8bf12007ccc2c..b2e9ec2f69014fa3507d40c6c266f1b74d634fcb 100644
--- a/arch/x86/coco/sev/Makefile
+++ b/arch/x86/coco/sev/Makefile
@@ -8,3 +8,5 @@ UBSAN_SANITIZE_noinstr.o	:= n
 # GCC may fail to respect __no_sanitize_address or __no_kcsan when inlining
 KASAN_SANITIZE_noinstr.o	:= n
 KCSAN_SANITIZE_noinstr.o	:= n
+
+GCOV_PROFILE_noinstr.o		:= n

-- 
2.50.1

Re: [PATCH v2 2/3] kcsan: mark !__SANITIZE_THREAD__ stub __always_inline

[Marco Elver]

On Mon, 15 Dec 2025 at 11:12, Brendan Jackman <jackmanb@google.com> wrote:
>
> The x86 instrumented bitops in
> include/asm-generic/bitops/instrumented-non-atomic.h are
> KCSAN-instrumented via explicit calls to instrument_* functions from
> include/linux/instrumented.h.
>
> This bitops are used from noinstr code in __sev_es_nmi_complete(). This
> code avoids noinstr violations by disabling __SANITIZE_THREAD__ etc for
> the compilation unit.
>
> However, when GCOV is enabled, there can still be violations caused by
> the stub versions of these functions, since coverage instrumentation is
> injected that causes them to be out-of-lined.
>
> Fix this by just applying __always_inline.
>
> Signed-off-by: Brendan Jackman <jackmanb@google.com>
> ---
>  include/linux/kcsan-checks.h | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/include/linux/kcsan-checks.h b/include/linux/kcsan-checks.h
> index 92f3843d9ebb8177432bb4eccc151ea66d3dcbb7..cabb2ae46bdc0963bd89533777cab586ab4d5a1b 100644
> --- a/include/linux/kcsan-checks.h
> +++ b/include/linux/kcsan-checks.h
> @@ -226,7 +226,7 @@ static inline void kcsan_end_scoped_access(struct kcsan_scoped_access *sa) { }
>  #define __kcsan_disable_current kcsan_disable_current
>  #define __kcsan_enable_current kcsan_enable_current_nowarn
>  #else /* __SANITIZE_THREAD__ */
> -static inline void kcsan_check_access(const volatile void *ptr, size_t size,
> +static __always_inline void kcsan_check_access(const volatile void *ptr, size_t size,
>                                       int type) { }
>  static inline void __kcsan_enable_current(void)  { }
>  static inline void __kcsan_disable_current(void) { }

It wouldn't be wrong to apply __always_inline to these 2 stub
functions as well, but I think it's fair if you just limit this to the
ones used from <linux/instrumented.h>. Either way, please
double-check.

Re: [PATCH v2 0/3] Noinstr fixes for K[CA]SAN with GCOV

[Marco Elver]

On Mon, 15 Dec 2025 at 11:12, Brendan Jackman <jackmanb@google.com> wrote:
>
> Details:
>
>  - ❯❯  clang --version
>    Debian clang version 19.1.7 (3+build5)
>    Target: x86_64-pc-linux-gnu
>    Thread model: posix
>    InstalledDir: /usr/lib/llvm-19/bin
>
>  - Kernel config:
>
>    https://gist.githubusercontent.com/bjackman/bbfdf4ec2e1dfd0e18657174f0537e2c/raw/a88dcc6567d14c69445e7928a7d5dfc23ca9f619/gistfile0.txt
>
> Note I also get this error:
>
> vmlinux.o: warning: objtool: set_ftrace_ops_ro+0x3b: relocation to !ENDBR: machine_kexec_prepare+0x810
>
> That one's a total mystery to me. I guess it's better to "fix" the SEV
> one independently rather than waiting until I know how to fix them both.
>
> Note I also mentioned other similar errors in [0]. Those errors don't
> exist in Linus' master and I didn't note down where I saw them. Either
> they have since been fixed, or I observed them in Google's internal
> codebase where they were instroduced downstream.
>
> As discussed in [2], the GCOV+*SAN issue is attacked from two angles:
> both adding __always_inline to the instrumentation helpers AND disabling
> GCOV for noinstr.c. Only one or the other of these things is needed to
> make the build error go away, but they both make sense in their own
> right and both may serve to prevent other similar errors from cropping
> up in future.
>
> Signed-off-by: Brendan Jackman <jackmanb@google.com>
> ---
> Changes in v2:
> - Also disable GCOV for noinstr.c (i.e. squash in [0]).
> - Link to v1: [2]
>
> [0] https://lore.kernel.org/all/DERNCQGNRITE.139O331ACPKZ9@google.com/
> [1] https://lore.kernel.org/all/20251117-b4-sev-gcov-objtool-v1-1-54f7790d54df@google.com/
> [2] https://lore.kernel.org/r/20251208-gcov-inline-noinstr-v1-0-623c48ca5714@google.com
>
> ---
> Brendan Jackman (3):
>       kasan: mark !__SANITIZE_ADDRESS__ stubs __always_inline
>       kcsan: mark !__SANITIZE_THREAD__ stub __always_inline
>       x86/sev: Disable GCOV on noinstr object

Acked-by: Marco Elver <elver@google.com>

But please double check if you missed any __always_inline on stubs
(see my comment in "kcsan: mark !__SANITIZE_THREAD__ stub
__always_inline").

I don't know which tree this should go through, but since it deals
with KASAN and GCOV, perhaps -mm would be appropriate (also for the
KCSAN patch this time). There shouldn't be any conflicts with other
patches AFAIK.

Thanks,
  -- Marco

Re: [PATCH v2 2/3] kcsan: mark !__SANITIZE_THREAD__ stub __always_inline

[Brendan Jackman]

On Mon Dec 15, 2025 at 12:11 PM UTC, Marco Elver wrote:
> On Mon, 15 Dec 2025 at 11:12, Brendan Jackman <jackmanb@google.com> wrote:
>>
>> The x86 instrumented bitops in
>> include/asm-generic/bitops/instrumented-non-atomic.h are
>> KCSAN-instrumented via explicit calls to instrument_* functions from
>> include/linux/instrumented.h.
>>
>> This bitops are used from noinstr code in __sev_es_nmi_complete(). This
>> code avoids noinstr violations by disabling __SANITIZE_THREAD__ etc for
>> the compilation unit.
>>
>> However, when GCOV is enabled, there can still be violations caused by
>> the stub versions of these functions, since coverage instrumentation is
>> injected that causes them to be out-of-lined.
>>
>> Fix this by just applying __always_inline.
>>
>> Signed-off-by: Brendan Jackman <jackmanb@google.com>
>> ---
>>  include/linux/kcsan-checks.h | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/include/linux/kcsan-checks.h b/include/linux/kcsan-checks.h
>> index 92f3843d9ebb8177432bb4eccc151ea66d3dcbb7..cabb2ae46bdc0963bd89533777cab586ab4d5a1b 100644
>> --- a/include/linux/kcsan-checks.h
>> +++ b/include/linux/kcsan-checks.h
>> @@ -226,7 +226,7 @@ static inline void kcsan_end_scoped_access(struct kcsan_scoped_access *sa) { }
>>  #define __kcsan_disable_current kcsan_disable_current
>>  #define __kcsan_enable_current kcsan_enable_current_nowarn
>>  #else /* __SANITIZE_THREAD__ */
>> -static inline void kcsan_check_access(const volatile void *ptr, size_t size,
>> +static __always_inline void kcsan_check_access(const volatile void *ptr, size_t size,
>>                                       int type) { }
>>  static inline void __kcsan_enable_current(void)  { }
>>  static inline void __kcsan_disable_current(void) { }
>
> It wouldn't be wrong to apply __always_inline to these 2 stub
> functions as well, but I think it's fair if you just limit this to the
> ones used from <linux/instrumented.h>. Either way, please
> double-check.

I was thinking here that it's a bug to call these from noinstr code,
regardless of your ambient instrumentation settings.

But yeah, on second thoughts... says who? I don't think that _has_ to be
a bug, we could totally mark them __always_inline.