From: Arnd Bergmann <arnd@arndb.de>

When the compiler chooses to not inline sha256_choose_blocks() in
the purgatory code, it fails to link against the missing CPU
specific version:

x86_64-linux-ld: arch/x86/purgatory/purgatory.ro: in function `sha256_choose_blocks.part.0':
sha256.c:(.text+0x6a6): undefined reference to `irq_fpu_usable'
sha256.c:(.text+0x6c7): undefined reference to `sha256_blocks_arch'
sha256.c:(.text+0x6cc): undefined reference to `sha256_blocks_simd'

Mark this function as __always_inline to prevent this, same as sha256_finup().

Fixes: ff8f037d394f ("crypto: sha256 - Use the partial block API for generic")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
---
This is likely compiler specific, I found it in randconfig testing using
gcc-9.5 on x86.
---
 include/crypto/internal/sha2.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/crypto/internal/sha2.h b/include/crypto/internal/sha2.h
index b9bccd3ff57f..21a27fd5e198 100644
--- a/include/crypto/internal/sha2.h
+++ b/include/crypto/internal/sha2.h
@@ -25,7 +25,7 @@ void sha256_blocks_arch(u32 state[SHA256_STATE_WORDS],
 void sha256_blocks_simd(u32 state[SHA256_STATE_WORDS],
 			const u8 *data, size_t nblocks);
 
-static inline void sha256_choose_blocks(
+static __always_inline void sha256_choose_blocks(
 	u32 state[SHA256_STATE_WORDS], const u8 *data, size_t nblocks,
 	bool force_generic, bool force_simd)
 {
-- 
2.39.5

On Fri, Jun 20, 2025 at 09:19:40PM +0200, Arnd Bergmann wrote:
> From: Arnd Bergmann <arnd@arndb.de>
> 
> When the compiler chooses to not inline sha256_choose_blocks() in
> the purgatory code, it fails to link against the missing CPU
> specific version:
> 
> x86_64-linux-ld: arch/x86/purgatory/purgatory.ro: in function `sha256_choose_blocks.part.0':
> sha256.c:(.text+0x6a6): undefined reference to `irq_fpu_usable'
> sha256.c:(.text+0x6c7): undefined reference to `sha256_blocks_arch'
> sha256.c:(.text+0x6cc): undefined reference to `sha256_blocks_simd'
> 
> Mark this function as __always_inline to prevent this, same as sha256_finup().
> 
> Fixes: ff8f037d394f ("crypto: sha256 - Use the partial block API for generic")
> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
> ---
> This is likely compiler specific, I found it in randconfig testing using
> gcc-9.5 on x86.
> ---
>  include/crypto/internal/sha2.h | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Thanks, applied to
https://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux.git/log/?h=libcrypto-fixes

I have some additional cleanups to SHA-256 planned, which will supersede the odd
sha256_choose_blocks() thing which shouldn't have been pushed out in the first
place.  For 6.16 I'll take this straightforward fix though.

I don't think the Fixes commit you gave is quite correct.  I revised it to:

    Fixes: 5b90a779bc54 ("crypto: lib/sha256 - Add helpers for block-based shash")

I also adjusted the commit title to be consistent with what I'm planning to use
for lib/crypto changes:

    lib/crypto: sha256: Mark sha256_choose_blocks as __always_inline

Thanks!

- Eric