From: Peter Zijlstra <peterz@infradead.org>
To: cyridge@proton.me
Cc: x86@kernel.org, Thomas Gleixner <tglx@kernel.org>,
Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>,
Dave Hansen <dave.hansen@linux.intel.com>,
Chris Li <sparse@chrisli.org>,
Nick Desaulniers <ndesaulniers@google.com>,
Bill Wendling <morbo@google.com>,
Justin Stitt <justinstitt@google.com>,
"H. Peter Anvin" <hpa@zytor.com>,
Nathan Chancellor <nathan@kernel.org>,
Sami Tolvanen <samitolvanen@google.com>,
Kees Cook <kees@kernel.org>,
llvm@lists.linux.dev, linux-kernel@vger.kernel.org,
linux-sparse@vger.kernel.org
Subject: Re: [PATCH] x86/kcfi: Don't emit KCFI_REFERENCE() in modules
Date: Mon, 26 Oct 2026 11:37:43 +0100 [thread overview]
Message-ID: <20261026103743.GD2668200@noisy.programming.kicks-ass.net> (raw)
In-Reply-To: <20261024-kcfi-reference-modules-v1-1-43c2a4a9e657@proton.me>
On Sat, Oct 24, 2026 at 06:46:33PM -0700, Cytops via B4 Relay wrote:
> From: Cytops <cyridge@proton.me>
>
> KCFI_REFERENCE() takes the address of a symbol so that the compiler
> emits its __kcfi_typeid_ symbol, which the SYM_TYPED_FUNC_START()
> assembly implementing it needs. It is used from arch/x86 headers for
> __clear_pages_unrolled(), copy_page(), __memset() and __memmove(), and
> all of that assembly is built into vmlinux.
>
> Modules include the same headers, so with CONFIG_CFI=y every module
> also gets an __ADDRESSABLE() reference to each of these symbols in
> .discard.addressable. This serves no purpose there, and since
> __clear_pages_unrolled() is EXPORT_SYMBOL_GPL, modpost now rejects any
> GPL-incompatible module that includes <linux/mm.h>:
>
> ERROR: modpost: GPL-incompatible module repro.ko uses GPL-only
> symbol '__clear_pages_unrolled'
>
> even though the module never uses the symbol. This makes OpenZFS
> impossible to build against CFI kernels; its configure checks fail
> in the same way and are misreported as CONFIG_DEBUG_LOCK_ALLOC.
>
> Only emit the reference when building vmlinux.
>
> Tested on x86_64 with clang 23.1.3, CONFIG_CFI=y and
> CONFIG_LTO_CLANG_FULL=y (the configuration from the Fixes: commit):
> vmlinux links without warnings and still contains
> __kcfi_typeid___clear_pages_unrolled, __kcfi_typeid_copy_page,
> __kcfi_typeid___memset and __kcfi_typeid___memmove. It boots in QEMU
> with no CFI failures. A minimal module with MODULE_LICENSE("Proprietary")
> including <linux/mm.h> fails modpost before this change and builds and
> loads after it. OpenZFS builds against a CFI kernel with this change,
> and its pool, encryption, checksum and send/recv operations run with
> CONFIG_CFI_PERMISSIVE=y without CFI failures.
>
> Fixes: 9b041a4b66b3 ("x86/mm: Ensure clear_page() variants always have __kcfi_typeid_ symbols")
> Link: https://github.com/openzfs/zfs/issues/18092
> Assisted-by: LLM
> Signed-off-by: Cytops <cyridge@proton.me>
Yeah, I suppose this will do. Thanks.
next prev parent reply other threads:[~2026-10-26 10:37 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-25 1:46 [PATCH] x86/kcfi: Don't emit KCFI_REFERENCE() in modules Cytops
2026-10-25 1:46 ` Cytops via B4 Relay
2026-10-26 10:37 ` Peter Zijlstra [this message]
2026-10-27 10:02 ` Peter Zijlstra
2026-10-26 21:43 ` Nathan Chancellor
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261026103743.GD2668200@noisy.programming.kicks-ass.net \
--to=peterz@infradead.org \
--cc=bp@alien8.de \
--cc=cyridge@proton.me \
--cc=dave.hansen@linux.intel.com \
--cc=hpa@zytor.com \
--cc=justinstitt@google.com \
--cc=kees@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-sparse@vger.kernel.org \
--cc=llvm@lists.linux.dev \
--cc=mingo@redhat.com \
--cc=morbo@google.com \
--cc=nathan@kernel.org \
--cc=ndesaulniers@google.com \
--cc=samitolvanen@google.com \
--cc=sparse@chrisli.org \
--cc=tglx@kernel.org \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.