Re: [RFC PATCH 2/7] mangle: Introduce C typeinfo mangling API

[Peter Zijlstra <peterz@infradead.org>]

On Fri, Aug 22, 2025 at 03:29:11PM -0700, Kees Cook wrote:
> On Fri, Aug 22, 2025 at 08:29:16PM +0000, Qing Zhao wrote:
> > > On Aug 22, 2025, at 15:02, Kees Cook <kees@kernel.org> wrote:
> > > Right, and sometimes we have to explicitly perform a no-op
> > > address-taking to make sure a symbol gets generated:
> > > 
> > > /*
> > > * Force the compiler to emit 'sym' as a symbol, so that we can reference
> > > * it from inline assembler. Necessary in case 'sym' could be inlined
> > > * otherwise, or eliminated entirely due to lack of references that are
> > > * visible to the compiler.
> > > */
> > > #define ___ADDRESSABLE(sym, __attrs)                                            \
> > >        static void * __used __attrs                                            \
> > >        __UNIQUE_ID(__PASTE(__addressable_,sym)) = (void *)(uintptr_t)&sym;
> > > 
> > > #define __ADDRESSABLE(sym) \
> > >        ___ADDRESSABLE(sym, __section(".discard.addressable"))
> > > 
> > > $ git grep KCFI_REFERENCE
> > > include/linux/compiler.h:#define KCFI_REFERENCE(sym) __ADDRESSABLE(sym)
> > > arch/x86/include/asm/page_64.h:KCFI_REFERENCE(copy_page);
> > > arch/x86/include/asm/string_64.h:KCFI_REFERENCE(__memset);
> > > arch/x86/include/asm/string_64.h:KCFI_REFERENCE(__memmove);
> > > arch/x86/kernel/alternative.c:KCFI_REFERENCE(__bpf_prog_runX);
> > > arch/x86/kernel/alternative.c:KCFI_REFERENCE(__bpf_callback_fn);
> > 
> > I am curious on why the compiler eliminates an external routine completely in the file if it's address-taken in that file. 
> > Why an additional no-op address-taken is needed here. 
> 
> If I am remembering correctly this is needed for rare cases where
> a function built without a C definition is being used in Linux's
> self-patching "alternatives" code swaps in one function for another,
> and is being used indirectly. These cases end up not being visible to
> compiler (so no address-taken), but the indirect call site is still
> being instrumented. And the above list is the _entire_ list of such
> corner cases: all really low-level things.
> 
> Peter may remember this better than me...

The above are all functions from assembly and JITs, the C compiler
simply never sees the function definition, only the declaration. The
above is used to force emit the __typeid symbol, such that assembly can
reference it and it all links correctly.