On Thu, Apr 23, 2026 at 09:23:12AM -0700, Josh Poimboeuf wrote: > On Thu, Apr 23, 2026 at 05:19:25PM +0200, Peter Zijlstra wrote: > > On Thu, Apr 23, 2026 at 08:16:08AM -0700, Josh Poimboeuf wrote: > > > On Thu, Apr 23, 2026 at 10:47:58AM +0200, Peter Zijlstra wrote: > > > > On Wed, Apr 22, 2026 at 09:04:13PM -0700, Josh Poimboeuf wrote: > > > > > PREFIX_SYMBOLS has a !CFI dependency because the compiler already > > > > > generates __cfi_ prefix symbols for kCFI builds, so objtool-generated > > > > > __pfx_ symbols were considered redundant. > > > > > > > > > > However, the __cfi_ symbols only cover the 5-byte kCFI type hash. > > > > > With > > > > > FUNCTION_CALL_PADDING, there are also 11 bytes of NOP padding between > > > > > the hash and the function entry which have no symbol to claim them. > > > > > > > > If you force the function alignment to 64 bytes, the prefix will also be > > > > 64bytes, rather than the normal 16. > > > > > > Sorry, how do you get 64 here? > > > > DEBUG_FORCE_FUNCTION_ALIGNMENT_64B=y > > Ok, so in that case it would be 5-byte cfi symbol and 59-byte NOP gap. > Or a 64-byte pfx for the !CFI case. > > > > > > The NOPs can be rewritten with call depth tracking thunks at runtime. > > > > > Without a symbol, unwinders and other tools that symbolize code > > > > > locations misattribute those bytes. > > > > > > > > > > Remove the !CFI guard so objtool creates __pfx_ symbols for all > > > > > CALL_PADDING configs, covering the full padding area regardless of > > > > > whether there's also a __cfi_ symbol. > > > > > > > > Egads, that a ton of symbols :/ Does it not make sense to 'fix' up the > > > > __cfi_ symbols to cover the whole prefix? > > > > > > Yeah, I suppose that would be better, via objtool I presume. > > > > Yup.
From: Josh Poimboeuf <[email protected]> Subject: [PATCH] objtool: Grow __cfi_* symbols for FineIBT For FineIBT, the __cfi_ symbols only cover the 5-byte kCFI type hash. After that there also N bytes of NOP padding between the hash and the function entry which aren't associated with any symbol. The NOPs can be replaced with actual code at runtime. Without a symbol, unwinders, objtool, and other tools have no way of knowing where those bytes belong. Grow the existing __cfi_* symbols to fill that gap. Signed-off-by: Josh Poimboeuf <[email protected]> --- scripts/Makefile.lib | 2 +- tools/objtool/check.c | 13 ++++++++++++- tools/objtool/elf.c | 20 ++++++++++++++++++++ tools/objtool/include/objtool/elf.h | 1 + 4 files changed, 34 insertions(+), 2 deletions(-) diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib index 0718e39cedda..baaf9f6c6bb5 100644 --- a/scripts/Makefile.lib +++ b/scripts/Makefile.lib @@ -187,7 +187,7 @@ objtool-args-$(CONFIG_HAVE_JUMP_LABEL_HACK) += --hacks=jump_label objtool-args-$(CONFIG_HAVE_NOINSTR_HACK) += --hacks=noinstr objtool-args-$(CONFIG_MITIGATION_CALL_DEPTH_TRACKING) += --hacks=skylake objtool-args-$(CONFIG_X86_KERNEL_IBT) += --ibt -objtool-args-$(CONFIG_FINEIBT) += --cfi +objtool-args-$(CONFIG_FINEIBT) += --cfi --prefix=$(CONFIG_FUNCTION_PADDING_BYTES) objtool-args-$(CONFIG_FTRACE_MCOUNT_USE_OBJTOOL) += --mcount ifdef CONFIG_FTRACE_MCOUNT_USE_OBJTOOL objtool-args-$(CONFIG_HAVE_OBJTOOL_NOP_MCOUNT) += --mnop diff --git a/tools/objtool/check.c b/tools/objtool/check.c index 410061aeed26..fb24fd284e09 100644 --- a/tools/objtool/check.c +++ b/tools/objtool/check.c @@ -923,6 +923,17 @@ static int create_cfi_sections(struct objtool_file *file) return -1; idx++; + + /* + * Grow the __cfi_ symbol to fill the NOP gap between the + * 'mov <hash>, %rax' and the start of the function. + */ + if (sym->len == 5) { + sym->len += opts.prefix; + sym->sym.st_size = sym->len; + if (elf_write_symbol(file->elf, sym)) + return -1; + } } return 0; @@ -4927,7 +4938,7 @@ int check(struct objtool_file *file) goto out; } - if (opts.prefix) { + if (opts.prefix && !opts.cfi) { ret = create_prefix_symbols(file); if (ret) goto out; diff --git a/tools/objtool/elf.c b/tools/objtool/elf.c index 2ca1151de815..ede87dd9644c 100644 --- a/tools/objtool/elf.c +++ b/tools/objtool/elf.c @@ -983,6 +983,26 @@ struct symbol *elf_create_symbol(struct elf *elf, const char *name, return sym; } +int elf_write_symbol(struct elf *elf, struct symbol *sym) +{ + struct section *symtab, *symtab_shndx; + + symtab = find_section_by_name(elf, ".symtab"); + if (!symtab) { + ERROR("no .symtab"); + return -1; + } + + symtab_shndx = find_section_by_name(elf, ".symtab_shndx"); + + if (elf_update_symbol(elf, symtab, symtab_shndx, sym)) + return -1; + + mark_sec_changed(elf, symtab, true); + + return 0; +} + struct symbol *elf_create_section_symbol(struct elf *elf, struct section *sec) { struct symbol *sym = calloc(1, sizeof(*sym)); diff --git a/tools/objtool/include/objtool/elf.h b/tools/objtool/include/objtool/elf.h index 0fd1a9b563e9..4c8a67a68063 100644 --- a/tools/objtool/include/objtool/elf.h +++ b/tools/objtool/include/objtool/elf.h @@ -199,6 +199,7 @@ struct reloc *elf_init_reloc_data_sym(struct elf *elf, struct section *sec, struct symbol *sym, s64 addend); +int elf_write_symbol(struct elf *elf, struct symbol *sym); int elf_write_insn(struct elf *elf, struct section *sec, unsigned long offset, unsigned int len, const char *insn); -- 2.53.0
