Messages in this thread | | | Date | Tue, 18 Oct 2022 16:31:48 -0700 | From | Josh Poimboeuf <> | Subject | Re: [PATCH] x86/ibt: Implement FineIBT |
| |
On Tue, Oct 18, 2022 at 09:56:36PM +0200, Peter Zijlstra wrote: > On Tue, Oct 18, 2022 at 11:09:13AM -0700, Kees Cook wrote: > > > +config FINEIBT > > > + def_bool y > > > + depends on X86_KERNEL_IBT && CFI_CLANG > > > + select CALL_PADDING > > > > To that end, can we please make this a prompted choice? > > How about something like so instead? > > --- > Subject: x86/cfi: Boot time selection of CFI scheme > From: Peter Zijlstra <peterz@infradead.org> > Date: Tue Oct 18 21:50:54 CEST 2022 > > Add the "cfi=" boot parameter to allow users to select a scheme at > boot time. > > Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> > --- > arch/x86/kernel/alternative.c | 103 +++++++++++++++++++++++++++++++++--------- > 1 file changed, 83 insertions(+), 20 deletions(-) > > --- a/arch/x86/kernel/alternative.c > +++ b/arch/x86/kernel/alternative.c > @@ -702,6 +702,47 @@ void __init_or_module noinline apply_ibt > #endif /* CONFIG_X86_KERNEL_IBT */ > > #ifdef CONFIG_FINEIBT > + > +enum cfi_mode { > + CFI_DEFAULT, > + CFI_OFF, > + CFI_KCFI, > + CFI_FINEIBT, > +};
Is there a reason not to default to FineIBT if the hardware supports it?
If we're going to give the user choices then my previous rant about documentation still applies:
https://lkml.kernel.org/lkml/20220503220244.vyz5flk3gg3y6rbw@treble
-- Josh
| |