Hi! There's a problem with FineIBT and eBPF using __nocfi when CONFIG_BPF_JIT_ALWAYS_ON=n, in which case the __nocfi indirect call can target a normal function like __bpf_prog_run32(). Specifically the various preambles look like: FineIBT JIT __cfi_foo: endbr64 subl $hash, %r10d jz 1f ud2 1: nop foo: foo: osp nop3 endbr64 ... ... So while bpf_dispatcher_*_func() does a __nocfi call to foo()+0 and this matches what the JIT generates, it does not work for regular FineIBT functions, since their +0 endbr got poisoned and things go *boom*. Cure this by teaching the BPF JIT about all the various CFI forms. Notably this removes the last __nocfi call on x86. If the BPF folks agree (and the robots don't find fail) I'd like to take this through the x86 tree, because I have a few more patches that turn the non-fatal 'osp nop3' poison into a 4 byte ud1 instruction which is rather fatal. As a result this problem will also surface on !IBT hardware. Changes since v1: - added wee comment to asm/cfi.h (ast) - added asm comments to bytecode (ast) - renamed bpf_func_proto() to __bpf_prog_runX() (ast) - added bpf_prog_aux::ksym_prefix (ast)