On Fri, Sep 18, 2020 at 1:59 PM Pavel Machek <pavel@xxxxxx> wrote: > > On Fri 2020-09-18 13:24:13, Randy Dunlap wrote: > > Hi, > > > > If you do another version of this: > > > > On 9/18/20 12:23 PM, Yu-cheng Yu wrote: > > > Introduce Kconfig option X86_INTEL_BRANCH_TRACKING_USER. > > > > > > Indirect Branch Tracking (IBT) provides protection against CALL-/JMP- > > > oriented programming attacks. It is active when the kernel has this > > > feature enabled, and the processor and the application support it. > > > When this feature is enabled, legacy non-IBT applications continue to > > > work, but without IBT protection. > > > > > > Signed-off-by: Yu-cheng Yu <yu-cheng.yu@xxxxxxxxx> > > > --- > > > v10: > > > - Change build-time CET check to config depends on. > > > > > > arch/x86/Kconfig | 16 ++++++++++++++++ > > > 1 file changed, 16 insertions(+) > > > > > > diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig > > > index 6b6dad011763..b047e0a8d1c2 100644 > > > --- a/arch/x86/Kconfig > > > +++ b/arch/x86/Kconfig > > > @@ -1963,6 +1963,22 @@ config X86_INTEL_SHADOW_STACK_USER > > > > > > If unsure, say y. > > > > > > +config X86_INTEL_BRANCH_TRACKING_USER > > > + prompt "Intel Indirect Branch Tracking for user-mode" > > > + def_bool n > > > + depends on CPU_SUP_INTEL && X86_64 > > > + depends on $(cc-option,-fcf-protection) > > > + select X86_INTEL_CET > > > + help > > > + Indirect Branch Tracking (IBT) provides protection against > > > + CALL-/JMP-oriented programming attacks. It is active when > > > + the kernel has this feature enabled, and the processor and > > > + the application support it. When this feature is enabled, > > > + legacy non-IBT applications continue to work, but without > > > + IBT protection. > > > + > > > + If unsure, say y > > > > If unsure, say y. > > Actually, it would be "If unsure, say Y.", to be consistent with the > rest of the Kconfig. > > But I wonder if Yes by default is good idea. Only very new CPUs will > support this, right? Are they even available at the market? Should the > help text say "if your CPU is Whatever Lake or newer, ...." :-) ? > CET enabled kernel runs on all x86-64 processors. All my machines are running the same CET enabled kernel binary. -- H.J.
