Messages in this thread | | | Subject | Re: [PATCH v12 1/8] x86/cet/ibt: Add Kconfig option for user-mode Indirect Branch Tracking | From | "Yu, Yu-cheng" <> | Date | Fri, 18 Sep 2020 14:25:12 -0700 |
| |
On 9/18/2020 1:59 PM, Pavel Machek wrote: > On Fri 2020-09-18 13:24:13, Randy Dunlap wrote: >> Hi, >> >> If you do another version of this: >> >> On 9/18/20 12:23 PM, Yu-cheng Yu wrote: >>> Introduce Kconfig option X86_INTEL_BRANCH_TRACKING_USER. >>> >>> Indirect Branch Tracking (IBT) provides protection against CALL-/JMP- >>> oriented programming attacks. It is active when the kernel has this >>> feature enabled, and the processor and the application support it. >>> When this feature is enabled, legacy non-IBT applications continue to >>> work, but without IBT protection. >>> >>> Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com> >>> --- >>> v10: >>> - Change build-time CET check to config depends on. >>> >>> arch/x86/Kconfig | 16 ++++++++++++++++ >>> 1 file changed, 16 insertions(+) >>> >>> diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig >>> index 6b6dad011763..b047e0a8d1c2 100644 >>> --- a/arch/x86/Kconfig >>> +++ b/arch/x86/Kconfig >>> @@ -1963,6 +1963,22 @@ config X86_INTEL_SHADOW_STACK_USER >>> >>> If unsure, say y. >>> >>> +config X86_INTEL_BRANCH_TRACKING_USER >>> + prompt "Intel Indirect Branch Tracking for user-mode" >>> + def_bool n >>> + depends on CPU_SUP_INTEL && X86_64 >>> + depends on $(cc-option,-fcf-protection) >>> + select X86_INTEL_CET >>> + help >>> + Indirect Branch Tracking (IBT) provides protection against >>> + CALL-/JMP-oriented programming attacks. It is active when >>> + the kernel has this feature enabled, and the processor and >>> + the application support it. When this feature is enabled, >>> + legacy non-IBT applications continue to work, but without >>> + IBT protection. >>> + >>> + If unsure, say y >> >> If unsure, say y. > > Actually, it would be "If unsure, say Y.", to be consistent with the > rest of the Kconfig. > > But I wonder if Yes by default is good idea. Only very new CPUs will > support this, right? Are they even available at the market? Should the > help text say "if your CPU is Whatever Lake or newer, ...." :-) ?
I will revise the wording if there is another version. But a CET-capable kernel can run on legacy systems. We have been testing that combination.
Yu-cheng
| |