On Fri, Sep 18, 2020 at 2:40 PM Pavel Machek <pavel@xxxxxx> wrote: > > On Fri 2020-09-18 14:25:12, Yu, Yu-cheng wrote: > > On 9/18/2020 1:59 PM, Pavel Machek wrote: > > > On Fri 2020-09-18 13:24:13, Randy Dunlap wrote: > > > > Hi, > > > > > > > > If you do another version of this: > > > > > > > > On 9/18/20 12:23 PM, Yu-cheng Yu wrote: > > > > > Introduce Kconfig option X86_INTEL_BRANCH_TRACKING_USER. > > > > > > > > > > Indirect Branch Tracking (IBT) provides protection against CALL-/JMP- > > > > > oriented programming attacks. It is active when the kernel has this > > > > > feature enabled, and the processor and the application support it. > > > > > When this feature is enabled, legacy non-IBT applications continue to > > > > > work, but without IBT protection. > > > > > > > > > > Signed-off-by: Yu-cheng Yu <yu-cheng.yu@xxxxxxxxx> > > > > > --- > > > > > v10: > > > > > - Change build-time CET check to config depends on. > > > > > > > > > > arch/x86/Kconfig | 16 ++++++++++++++++ > > > > > 1 file changed, 16 insertions(+) > > > > > > > > > > diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig > > > > > index 6b6dad011763..b047e0a8d1c2 100644 > > > > > --- a/arch/x86/Kconfig > > > > > +++ b/arch/x86/Kconfig > > > > > @@ -1963,6 +1963,22 @@ config X86_INTEL_SHADOW_STACK_USER > > > > > If unsure, say y. > > > > > +config X86_INTEL_BRANCH_TRACKING_USER > > > > > + prompt "Intel Indirect Branch Tracking for user-mode" > > > > > + def_bool n > > > > > + depends on CPU_SUP_INTEL && X86_64 > > > > > + depends on $(cc-option,-fcf-protection) > > > > > + select X86_INTEL_CET > > > > > + help > > > > > + Indirect Branch Tracking (IBT) provides protection against > > > > > + CALL-/JMP-oriented programming attacks. It is active when > > > > > + the kernel has this feature enabled, and the processor and > > > > > + the application support it. When this feature is enabled, > > > > > + legacy non-IBT applications continue to work, but without > > > > > + IBT protection. > > > > > + > > > > > + If unsure, say y > > > > > > > > If unsure, say y. > > > > > > Actually, it would be "If unsure, say Y.", to be consistent with the > > > rest of the Kconfig. > > > > > > But I wonder if Yes by default is good idea. Only very new CPUs will > > > support this, right? Are they even available at the market? Should the > > > help text say "if your CPU is Whatever Lake or newer, ...." :-) ? > > > > I will revise the wording if there is another version. But a CET-capable > > kernel can run on legacy systems. We have been testing that combination. > > Yes, but enabling CET is unneccessary overhead on older systems. And > Kconfig is great place to explain that. > I can't tell any visible CET kernel overhead on my non-CET machines. -- H.J.
