Re: [PATCH v2] x86/kcfi: Don't emit KCFI_REFERENCE() in modules

[Peter Zijlstra]

On Tue, Oct 27, 2026 at 03:29:21PM -0700, Ridge Lomont via B4 Relay wrote:
> From: Ridge Lomont <cyridge@xxxxxxxxx>
> 
> KCFI_REFERENCE() takes the address of a symbol so that the compiler
> emits its __kcfi_typeid_ symbol, which the SYM_TYPED_FUNC_START()
> assembly implementing it needs. It is used from arch/x86 headers for
> __clear_pages_unrolled(), copy_page(), __memset() and __memmove(), and
> all of that assembly is built into vmlinux.
> 
> Modules include the same headers, so with CONFIG_CFI=y every module
> also gets an __ADDRESSABLE() reference to each of these symbols in
> .discard.addressable. This serves no purpose there, and since
> __clear_pages_unrolled() is EXPORT_SYMBOL_GPL, modpost now rejects any
> GPL-incompatible module that includes <linux/mm.h>:
> 
>   ERROR: modpost: GPL-incompatible module repro.ko uses GPL-only
>   symbol '__clear_pages_unrolled'
> 
> even though the module never uses the symbol. This makes OpenZFS
> impossible to build against CFI kernels; its configure checks fail
> in the same way and are misreported as CONFIG_DEBUG_LOCK_ALLOC.
> 
> scripts/module.lds.S does not help here: modpost checks <module>.o
> before the final link, and even after it the discarded section only
> loses its relocations, the undefined symbols stay in .symtab, where
> the module loader resolves them with the same license check.
> 
> Only emit the reference when building vmlinux.
> 
> Tested on x86_64 with clang 23.1.3 and CONFIG_CFI=y, with both
> CONFIG_LTO_CLANG_FULL=y (the configuration from the Fixes: commit) and
> CONFIG_LTO_CLANG_THIN=y: vmlinux links without warnings and still contains
> __kcfi_typeid___clear_pages_unrolled, __kcfi_typeid_copy_page,
> __kcfi_typeid___memset and __kcfi_typeid___memmove. It boots in QEMU
> with no CFI failures. A minimal module with MODULE_LICENSE("Proprietary")
> including <linux/mm.h> fails modpost before this change and builds and
> loads after it. OpenZFS builds against a CFI kernel with this change,
> and its pool, encryption, checksum and send/recv operations run
> without CFI failures, in QEMU and on a desktop with CFI enforcing.
> 
> Fixes: 9b041a4b66b3 ("x86/mm: Ensure clear_page() variants always have __kcfi_typeid_ symbols")
> Link: https://github.com/openzfs/zfs/issues/18092
> Assisted-by: LLM
> Signed-off-by: Ridge Lomont <cyridge@xxxxxxxxx>
> Acked-by: Nathan Chancellor <nathan@xxxxxxxxxx>

Thanks!