Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Thu, 4 Apr 2019 22:42:03 +0200 (CEST)
From:   Thomas Gleixner <tglx@linutronix.de>
To:     "Hook, Gary" <Gary.Hook@amd.com>
cc:     "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "dave.hansen@linux.intel.com" <dave.hansen@linux.intel.com>,
        "peterz@infradead.org" <peterz@infradead.org>,
        "x86@kernel.org" <x86@kernel.org>,
        "mingo@redhat.com" <mingo@redhat.com>,
        "bp@alien8.de" <bp@alien8.de>, "luto@kernel.org" <luto@kernel.org>,
        Alexander Potapenko <glider@google.com>
Subject: Re: [PATCH] x86/mm/mem_encrypt: Disable all instrumentation for SME
 early boot code
In-Reply-To: <155440965936.6194.3202659723198724589.stgit@sosrh7.amd.com>
Message-ID: <alpine.DEB.2.21.1904042237020.1802@nanos.tec.linutronix.de>
References: <155440965936.6194.3202659723198724589.stgit@sosrh7.amd.com>
User-Agent: Alpine 2.21 (DEB 202 2017-01-01)
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Thu, 4 Apr 2019, Hook, Gary wrote:

> Enablement of AMD's Secure Memory Encryption feature is determined
> very early in the boot cycle. Part of this procedure involves scanning
> the command line for the paramater 'mem_encrypt'.
> 
> To determine intended state, the function sme_enable() uses library
> functions cmdline_find_option() and strncmp().  Their use occurs early
> enough such that we can't assume that any instrumentation subsystem is
> initialized. For example, making calls to a KASAN-instrumented
> function before KASAN is set up will likely result in the use of
> uninitialized memory and a boot failure.
> 
> Avoid instrumenting these dependent functions by:
> 
> 1) Making a local, static, renamed copy of strncpy() for use solely in
> mem_encrypt_identity.c. In this file we are able to vet its few uses
> and avoid exposing the rest of the kernel to a ubiquitously used but
> un-instrumented function.
> 
> 2) Disable instrumention of arch/x86/lib/cmdline.c based on the
> assumption that the needed function (cmdline_find_option()) is vetted
> through its use to date, and contains no lurking flaws that have not
> yet been found through instrumentation such as KASAN.

Not happy about that :)

> +# SME early boot code checks the cmdline, so don't instrument
> +KCOV_INSTRUMENT_cmdline.o              := n
> +
> +KASAN_SANITIZE_cmdline.o               := n

If we can't come up with a better solution then this needs to depend on
CONFIG_MEM_ENCRYPT so we still can run KASAN on cmdline.c to catch crap
when the code is modified in the future.

Thanks,

	tglx