diff mbox series

[v12,1/8] x86/cet/ibt: Add Kconfig option for user-mode Indirect Branch Tracking

Message ID 20200918192312.25978-2-yu-cheng.yu@intel.com
State New
Headers show
Series Control-flow Enforcement: Indirect Branch Tracking | expand

Commit Message

Yu, Yu-cheng Sept. 18, 2020, 7:23 p.m. UTC
Introduce Kconfig option X86_INTEL_BRANCH_TRACKING_USER.

Indirect Branch Tracking (IBT) provides protection against CALL-/JMP-
oriented programming attacks.  It is active when the kernel has this
feature enabled, and the processor and the application support it.
When this feature is enabled, legacy non-IBT applications continue to
work, but without IBT protection.

Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
---
v10:
- Change build-time CET check to config depends on.

 arch/x86/Kconfig | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

Comments

Randy Dunlap Sept. 18, 2020, 8:24 p.m. UTC | #1
Hi,

If you do another version of this:

On 9/18/20 12:23 PM, Yu-cheng Yu wrote:
> Introduce Kconfig option X86_INTEL_BRANCH_TRACKING_USER.
> 
> Indirect Branch Tracking (IBT) provides protection against CALL-/JMP-
> oriented programming attacks.  It is active when the kernel has this
> feature enabled, and the processor and the application support it.
> When this feature is enabled, legacy non-IBT applications continue to
> work, but without IBT protection.
> 
> Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
> ---
> v10:
> - Change build-time CET check to config depends on.
> 
>  arch/x86/Kconfig | 16 ++++++++++++++++
>  1 file changed, 16 insertions(+)
> 
> diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
> index 6b6dad011763..b047e0a8d1c2 100644
> --- a/arch/x86/Kconfig
> +++ b/arch/x86/Kconfig
> @@ -1963,6 +1963,22 @@ config X86_INTEL_SHADOW_STACK_USER
>  
>  	  If unsure, say y.
>  
> +config X86_INTEL_BRANCH_TRACKING_USER
> +	prompt "Intel Indirect Branch Tracking for user-mode"
> +	def_bool n
> +	depends on CPU_SUP_INTEL && X86_64
> +	depends on $(cc-option,-fcf-protection)
> +	select X86_INTEL_CET
> +	help
> +	  Indirect Branch Tracking (IBT) provides protection against
> +	  CALL-/JMP-oriented programming attacks.  It is active when
> +	  the kernel has this feature enabled, and the processor and
> +	  the application support it.  When this feature is enabled,
> +	  legacy non-IBT applications continue to work, but without
> +	  IBT protection.
> +
> +	  If unsure, say y

	  If unsure, say y.

> +
>  config EFI
>  	bool "EFI runtime service support"
>  	depends on ACPI
>
Pavel Machek Sept. 18, 2020, 8:59 p.m. UTC | #2
On Fri 2020-09-18 13:24:13, Randy Dunlap wrote:
> Hi,
> 
> If you do another version of this:
> 
> On 9/18/20 12:23 PM, Yu-cheng Yu wrote:
> > Introduce Kconfig option X86_INTEL_BRANCH_TRACKING_USER.
> > 
> > Indirect Branch Tracking (IBT) provides protection against CALL-/JMP-
> > oriented programming attacks.  It is active when the kernel has this
> > feature enabled, and the processor and the application support it.
> > When this feature is enabled, legacy non-IBT applications continue to
> > work, but without IBT protection.
> > 
> > Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
> > ---
> > v10:
> > - Change build-time CET check to config depends on.
> > 
> >  arch/x86/Kconfig | 16 ++++++++++++++++
> >  1 file changed, 16 insertions(+)
> > 
> > diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
> > index 6b6dad011763..b047e0a8d1c2 100644
> > --- a/arch/x86/Kconfig
> > +++ b/arch/x86/Kconfig
> > @@ -1963,6 +1963,22 @@ config X86_INTEL_SHADOW_STACK_USER
> >  
> >  	  If unsure, say y.
> >  
> > +config X86_INTEL_BRANCH_TRACKING_USER
> > +	prompt "Intel Indirect Branch Tracking for user-mode"
> > +	def_bool n
> > +	depends on CPU_SUP_INTEL && X86_64
> > +	depends on $(cc-option,-fcf-protection)
> > +	select X86_INTEL_CET
> > +	help
> > +	  Indirect Branch Tracking (IBT) provides protection against
> > +	  CALL-/JMP-oriented programming attacks.  It is active when
> > +	  the kernel has this feature enabled, and the processor and
> > +	  the application support it.  When this feature is enabled,
> > +	  legacy non-IBT applications continue to work, but without
> > +	  IBT protection.
> > +
> > +	  If unsure, say y
> 
> 	  If unsure, say y.

Actually, it would be "If unsure, say Y.", to be consistent with the
rest of the Kconfig.

But I wonder if Yes by default is good idea. Only very new CPUs will
support this, right? Are they even available at the market? Should the
help text say "if your CPU is Whatever Lake or newer, ...." :-) ?

Best regards,
									Pavel
H.J. Lu Sept. 18, 2020, 9:08 p.m. UTC | #3
On Fri, Sep 18, 2020 at 1:59 PM Pavel Machek <pavel@ucw.cz> wrote:
>
> On Fri 2020-09-18 13:24:13, Randy Dunlap wrote:
> > Hi,
> >
> > If you do another version of this:
> >
> > On 9/18/20 12:23 PM, Yu-cheng Yu wrote:
> > > Introduce Kconfig option X86_INTEL_BRANCH_TRACKING_USER.
> > >
> > > Indirect Branch Tracking (IBT) provides protection against CALL-/JMP-
> > > oriented programming attacks.  It is active when the kernel has this
> > > feature enabled, and the processor and the application support it.
> > > When this feature is enabled, legacy non-IBT applications continue to
> > > work, but without IBT protection.
> > >
> > > Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
> > > ---
> > > v10:
> > > - Change build-time CET check to config depends on.
> > >
> > >  arch/x86/Kconfig | 16 ++++++++++++++++
> > >  1 file changed, 16 insertions(+)
> > >
> > > diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
> > > index 6b6dad011763..b047e0a8d1c2 100644
> > > --- a/arch/x86/Kconfig
> > > +++ b/arch/x86/Kconfig
> > > @@ -1963,6 +1963,22 @@ config X86_INTEL_SHADOW_STACK_USER
> > >
> > >       If unsure, say y.
> > >
> > > +config X86_INTEL_BRANCH_TRACKING_USER
> > > +   prompt "Intel Indirect Branch Tracking for user-mode"
> > > +   def_bool n
> > > +   depends on CPU_SUP_INTEL && X86_64
> > > +   depends on $(cc-option,-fcf-protection)
> > > +   select X86_INTEL_CET
> > > +   help
> > > +     Indirect Branch Tracking (IBT) provides protection against
> > > +     CALL-/JMP-oriented programming attacks.  It is active when
> > > +     the kernel has this feature enabled, and the processor and
> > > +     the application support it.  When this feature is enabled,
> > > +     legacy non-IBT applications continue to work, but without
> > > +     IBT protection.
> > > +
> > > +     If unsure, say y
> >
> >         If unsure, say y.
>
> Actually, it would be "If unsure, say Y.", to be consistent with the
> rest of the Kconfig.
>
> But I wonder if Yes by default is good idea. Only very new CPUs will
> support this, right? Are they even available at the market? Should the
> help text say "if your CPU is Whatever Lake or newer, ...." :-) ?
>

CET enabled kernel runs on all x86-64 processors.  All my machines
are running the same CET enabled kernel binary.
Pavel Machek Sept. 18, 2020, 9:24 p.m. UTC | #4
Hi!

> > > > +   help
> > > > +     Indirect Branch Tracking (IBT) provides protection against
> > > > +     CALL-/JMP-oriented programming attacks.  It is active when
> > > > +     the kernel has this feature enabled, and the processor and
> > > > +     the application support it.  When this feature is enabled,
> > > > +     legacy non-IBT applications continue to work, but without
> > > > +     IBT protection.
> > > > +
> > > > +     If unsure, say y
> > >
> > >         If unsure, say y.
> >
> > Actually, it would be "If unsure, say Y.", to be consistent with the
> > rest of the Kconfig.
> >
> > But I wonder if Yes by default is good idea. Only very new CPUs will
> > support this, right? Are they even available at the market? Should the
> > help text say "if your CPU is Whatever Lake or newer, ...." :-) ?
> >
> 
> CET enabled kernel runs on all x86-64 processors.  All my machines
> are running the same CET enabled kernel binary.

I believe that.

But enabling CET in kernel is useless on Core 2 Duo machine, right?

									Pavel
Yu, Yu-cheng Sept. 18, 2020, 9:25 p.m. UTC | #5
On 9/18/2020 1:59 PM, Pavel Machek wrote:
> On Fri 2020-09-18 13:24:13, Randy Dunlap wrote:
>> Hi,
>>
>> If you do another version of this:
>>
>> On 9/18/20 12:23 PM, Yu-cheng Yu wrote:
>>> Introduce Kconfig option X86_INTEL_BRANCH_TRACKING_USER.
>>>
>>> Indirect Branch Tracking (IBT) provides protection against CALL-/JMP-
>>> oriented programming attacks.  It is active when the kernel has this
>>> feature enabled, and the processor and the application support it.
>>> When this feature is enabled, legacy non-IBT applications continue to
>>> work, but without IBT protection.
>>>
>>> Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
>>> ---
>>> v10:
>>> - Change build-time CET check to config depends on.
>>>
>>>   arch/x86/Kconfig | 16 ++++++++++++++++
>>>   1 file changed, 16 insertions(+)
>>>
>>> diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
>>> index 6b6dad011763..b047e0a8d1c2 100644
>>> --- a/arch/x86/Kconfig
>>> +++ b/arch/x86/Kconfig
>>> @@ -1963,6 +1963,22 @@ config X86_INTEL_SHADOW_STACK_USER
>>>   
>>>   	  If unsure, say y.
>>>   
>>> +config X86_INTEL_BRANCH_TRACKING_USER
>>> +	prompt "Intel Indirect Branch Tracking for user-mode"
>>> +	def_bool n
>>> +	depends on CPU_SUP_INTEL && X86_64
>>> +	depends on $(cc-option,-fcf-protection)
>>> +	select X86_INTEL_CET
>>> +	help
>>> +	  Indirect Branch Tracking (IBT) provides protection against
>>> +	  CALL-/JMP-oriented programming attacks.  It is active when
>>> +	  the kernel has this feature enabled, and the processor and
>>> +	  the application support it.  When this feature is enabled,
>>> +	  legacy non-IBT applications continue to work, but without
>>> +	  IBT protection.
>>> +
>>> +	  If unsure, say y
>>
>> 	  If unsure, say y.
> 
> Actually, it would be "If unsure, say Y.", to be consistent with the
> rest of the Kconfig.
> 
> But I wonder if Yes by default is good idea. Only very new CPUs will
> support this, right? Are they even available at the market? Should the
> help text say "if your CPU is Whatever Lake or newer, ...." :-) ?

I will revise the wording if there is another version.  But a 
CET-capable kernel can run on legacy systems.  We have been testing that 
combination.

Yu-cheng
H.J. Lu Sept. 18, 2020, 9:36 p.m. UTC | #6
On Fri, Sep 18, 2020 at 2:24 PM Pavel Machek <pavel@ucw.cz> wrote:
>
> Hi!
>
> > > > > +   help
> > > > > +     Indirect Branch Tracking (IBT) provides protection against
> > > > > +     CALL-/JMP-oriented programming attacks.  It is active when
> > > > > +     the kernel has this feature enabled, and the processor and
> > > > > +     the application support it.  When this feature is enabled,
> > > > > +     legacy non-IBT applications continue to work, but without
> > > > > +     IBT protection.
> > > > > +
> > > > > +     If unsure, say y
> > > >
> > > >         If unsure, say y.
> > >
> > > Actually, it would be "If unsure, say Y.", to be consistent with the
> > > rest of the Kconfig.
> > >
> > > But I wonder if Yes by default is good idea. Only very new CPUs will
> > > support this, right? Are they even available at the market? Should the
> > > help text say "if your CPU is Whatever Lake or newer, ...." :-) ?
> > >
> >
> > CET enabled kernel runs on all x86-64 processors.  All my machines
> > are running the same CET enabled kernel binary.
>
> I believe that.
>
> But enabling CET in kernel is useless on Core 2 Duo machine, right?
>

This is very important for CET kernel to run on Core 2 Duo machine.
Otherwise, a distro needs to provide 2 kernel binaries, one for CET
CPU and one for non-CET CPU.
Pavel Machek Sept. 18, 2020, 9:40 p.m. UTC | #7
On Fri 2020-09-18 14:25:12, Yu, Yu-cheng wrote:
> On 9/18/2020 1:59 PM, Pavel Machek wrote:
> > On Fri 2020-09-18 13:24:13, Randy Dunlap wrote:
> > > Hi,
> > > 
> > > If you do another version of this:
> > > 
> > > On 9/18/20 12:23 PM, Yu-cheng Yu wrote:
> > > > Introduce Kconfig option X86_INTEL_BRANCH_TRACKING_USER.
> > > > 
> > > > Indirect Branch Tracking (IBT) provides protection against CALL-/JMP-
> > > > oriented programming attacks.  It is active when the kernel has this
> > > > feature enabled, and the processor and the application support it.
> > > > When this feature is enabled, legacy non-IBT applications continue to
> > > > work, but without IBT protection.
> > > > 
> > > > Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
> > > > ---
> > > > v10:
> > > > - Change build-time CET check to config depends on.
> > > > 
> > > >   arch/x86/Kconfig | 16 ++++++++++++++++
> > > >   1 file changed, 16 insertions(+)
> > > > 
> > > > diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
> > > > index 6b6dad011763..b047e0a8d1c2 100644
> > > > --- a/arch/x86/Kconfig
> > > > +++ b/arch/x86/Kconfig
> > > > @@ -1963,6 +1963,22 @@ config X86_INTEL_SHADOW_STACK_USER
> > > >   	  If unsure, say y.
> > > > +config X86_INTEL_BRANCH_TRACKING_USER
> > > > +	prompt "Intel Indirect Branch Tracking for user-mode"
> > > > +	def_bool n
> > > > +	depends on CPU_SUP_INTEL && X86_64
> > > > +	depends on $(cc-option,-fcf-protection)
> > > > +	select X86_INTEL_CET
> > > > +	help
> > > > +	  Indirect Branch Tracking (IBT) provides protection against
> > > > +	  CALL-/JMP-oriented programming attacks.  It is active when
> > > > +	  the kernel has this feature enabled, and the processor and
> > > > +	  the application support it.  When this feature is enabled,
> > > > +	  legacy non-IBT applications continue to work, but without
> > > > +	  IBT protection.
> > > > +
> > > > +	  If unsure, say y
> > > 
> > > 	  If unsure, say y.
> > 
> > Actually, it would be "If unsure, say Y.", to be consistent with the
> > rest of the Kconfig.
> > 
> > But I wonder if Yes by default is good idea. Only very new CPUs will
> > support this, right? Are they even available at the market? Should the
> > help text say "if your CPU is Whatever Lake or newer, ...." :-) ?
> 
> I will revise the wording if there is another version.  But a CET-capable
> kernel can run on legacy systems.  We have been testing that combination.

Yes, but enabling CET is unneccessary overhead on older systems. And
Kconfig is great place to explain that.

Best regards,
									Pavel
H.J. Lu Sept. 18, 2020, 9:46 p.m. UTC | #8
On Fri, Sep 18, 2020 at 2:40 PM Pavel Machek <pavel@ucw.cz> wrote:
>
> On Fri 2020-09-18 14:25:12, Yu, Yu-cheng wrote:
> > On 9/18/2020 1:59 PM, Pavel Machek wrote:
> > > On Fri 2020-09-18 13:24:13, Randy Dunlap wrote:
> > > > Hi,
> > > >
> > > > If you do another version of this:
> > > >
> > > > On 9/18/20 12:23 PM, Yu-cheng Yu wrote:
> > > > > Introduce Kconfig option X86_INTEL_BRANCH_TRACKING_USER.
> > > > >
> > > > > Indirect Branch Tracking (IBT) provides protection against CALL-/JMP-
> > > > > oriented programming attacks.  It is active when the kernel has this
> > > > > feature enabled, and the processor and the application support it.
> > > > > When this feature is enabled, legacy non-IBT applications continue to
> > > > > work, but without IBT protection.
> > > > >
> > > > > Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
> > > > > ---
> > > > > v10:
> > > > > - Change build-time CET check to config depends on.
> > > > >
> > > > >   arch/x86/Kconfig | 16 ++++++++++++++++
> > > > >   1 file changed, 16 insertions(+)
> > > > >
> > > > > diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
> > > > > index 6b6dad011763..b047e0a8d1c2 100644
> > > > > --- a/arch/x86/Kconfig
> > > > > +++ b/arch/x86/Kconfig
> > > > > @@ -1963,6 +1963,22 @@ config X86_INTEL_SHADOW_STACK_USER
> > > > >           If unsure, say y.
> > > > > +config X86_INTEL_BRANCH_TRACKING_USER
> > > > > +       prompt "Intel Indirect Branch Tracking for user-mode"
> > > > > +       def_bool n
> > > > > +       depends on CPU_SUP_INTEL && X86_64
> > > > > +       depends on $(cc-option,-fcf-protection)
> > > > > +       select X86_INTEL_CET
> > > > > +       help
> > > > > +         Indirect Branch Tracking (IBT) provides protection against
> > > > > +         CALL-/JMP-oriented programming attacks.  It is active when
> > > > > +         the kernel has this feature enabled, and the processor and
> > > > > +         the application support it.  When this feature is enabled,
> > > > > +         legacy non-IBT applications continue to work, but without
> > > > > +         IBT protection.
> > > > > +
> > > > > +         If unsure, say y
> > > >
> > > >     If unsure, say y.
> > >
> > > Actually, it would be "If unsure, say Y.", to be consistent with the
> > > rest of the Kconfig.
> > >
> > > But I wonder if Yes by default is good idea. Only very new CPUs will
> > > support this, right? Are they even available at the market? Should the
> > > help text say "if your CPU is Whatever Lake or newer, ...." :-) ?
> >
> > I will revise the wording if there is another version.  But a CET-capable
> > kernel can run on legacy systems.  We have been testing that combination.
>
> Yes, but enabling CET is unneccessary overhead on older systems. And
> Kconfig is great place to explain that.
>

I can't tell any visible CET kernel overhead on my non-CET machines.
Pavel Machek Sept. 18, 2020, 10:03 p.m. UTC | #9
On Fri 2020-09-18 14:46:12, H.J. Lu wrote:
> On Fri, Sep 18, 2020 at 2:40 PM Pavel Machek <pavel@ucw.cz> wrote:
> >
> > On Fri 2020-09-18 14:25:12, Yu, Yu-cheng wrote:
> > > On 9/18/2020 1:59 PM, Pavel Machek wrote:
> > > > On Fri 2020-09-18 13:24:13, Randy Dunlap wrote:
> > > > > Hi,
> > > > >
> > > > > If you do another version of this:
> > > > >
> > > > > On 9/18/20 12:23 PM, Yu-cheng Yu wrote:
> > > > > > Introduce Kconfig option X86_INTEL_BRANCH_TRACKING_USER.
> > > > > >
> > > > > > Indirect Branch Tracking (IBT) provides protection against CALL-/JMP-
> > > > > > oriented programming attacks.  It is active when the kernel has this
> > > > > > feature enabled, and the processor and the application support it.
> > > > > > When this feature is enabled, legacy non-IBT applications continue to
> > > > > > work, but without IBT protection.
> > > > > >
> > > > > > Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
> > > > > > ---
> > > > > > v10:
> > > > > > - Change build-time CET check to config depends on.
> > > > > >
> > > > > >   arch/x86/Kconfig | 16 ++++++++++++++++
> > > > > >   1 file changed, 16 insertions(+)
> > > > > >
> > > > > > diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
> > > > > > index 6b6dad011763..b047e0a8d1c2 100644
> > > > > > --- a/arch/x86/Kconfig
> > > > > > +++ b/arch/x86/Kconfig
> > > > > > @@ -1963,6 +1963,22 @@ config X86_INTEL_SHADOW_STACK_USER
> > > > > >           If unsure, say y.
> > > > > > +config X86_INTEL_BRANCH_TRACKING_USER
> > > > > > +       prompt "Intel Indirect Branch Tracking for user-mode"
> > > > > > +       def_bool n
> > > > > > +       depends on CPU_SUP_INTEL && X86_64
> > > > > > +       depends on $(cc-option,-fcf-protection)
> > > > > > +       select X86_INTEL_CET
> > > > > > +       help
> > > > > > +         Indirect Branch Tracking (IBT) provides protection against
> > > > > > +         CALL-/JMP-oriented programming attacks.  It is active when
> > > > > > +         the kernel has this feature enabled, and the processor and
> > > > > > +         the application support it.  When this feature is enabled,
> > > > > > +         legacy non-IBT applications continue to work, but without
> > > > > > +         IBT protection.
> > > > > > +
> > > > > > +         If unsure, say y
> > > > >
> > > > >     If unsure, say y.
> > > >
> > > > Actually, it would be "If unsure, say Y.", to be consistent with the
> > > > rest of the Kconfig.
> > > >
> > > > But I wonder if Yes by default is good idea. Only very new CPUs will
> > > > support this, right? Are they even available at the market? Should the
> > > > help text say "if your CPU is Whatever Lake or newer, ...." :-) ?
> > >
> > > I will revise the wording if there is another version.  But a CET-capable
> > > kernel can run on legacy systems.  We have been testing that combination.
> >
> > Yes, but enabling CET is unneccessary overhead on older systems. And
> > Kconfig is great place to explain that.
> >
> 
> I can't tell any visible CET kernel overhead on my non-CET machines.

I assume you are not a troll but you sound a bit like one.

Please list kernel size before and after enabling
X86_INTEL_CET option(s).

That's the overhead I'm talking about, and that's why Kconfig should
explain what machines this is useful on.

Best regards,
									Pavel
Yu, Yu-cheng Sept. 21, 2020, 10:30 p.m. UTC | #10
On 9/18/2020 2:40 PM, Pavel Machek wrote:
> On Fri 2020-09-18 14:25:12, Yu, Yu-cheng wrote:
>> On 9/18/2020 1:59 PM, Pavel Machek wrote:
>>> On Fri 2020-09-18 13:24:13, Randy Dunlap wrote:
>>>> Hi,
>>>>
>>>> If you do another version of this:
>>>>
>>>> On 9/18/20 12:23 PM, Yu-cheng Yu wrote:
>>>>> Introduce Kconfig option X86_INTEL_BRANCH_TRACKING_USER.
>>>>>
>>>>> Indirect Branch Tracking (IBT) provides protection against CALL-/JMP-
>>>>> oriented programming attacks.  It is active when the kernel has this
>>>>> feature enabled, and the processor and the application support it.
>>>>> When this feature is enabled, legacy non-IBT applications continue to
>>>>> work, but without IBT protection.
>>>>>
>>>>> Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
>>>>> ---
>>>>> v10:
>>>>> - Change build-time CET check to config depends on.
>>>>>
>>>>>    arch/x86/Kconfig | 16 ++++++++++++++++
>>>>>    1 file changed, 16 insertions(+)
>>>>>
>>>>> diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
>>>>> index 6b6dad011763..b047e0a8d1c2 100644
>>>>> --- a/arch/x86/Kconfig
>>>>> +++ b/arch/x86/Kconfig
>>>>> @@ -1963,6 +1963,22 @@ config X86_INTEL_SHADOW_STACK_USER
>>>>>    	  If unsure, say y.
>>>>> +config X86_INTEL_BRANCH_TRACKING_USER
>>>>> +	prompt "Intel Indirect Branch Tracking for user-mode"
>>>>> +	def_bool n
>>>>> +	depends on CPU_SUP_INTEL && X86_64
>>>>> +	depends on $(cc-option,-fcf-protection)
>>>>> +	select X86_INTEL_CET
>>>>> +	help
>>>>> +	  Indirect Branch Tracking (IBT) provides protection against
>>>>> +	  CALL-/JMP-oriented programming attacks.  It is active when
>>>>> +	  the kernel has this feature enabled, and the processor and
>>>>> +	  the application support it.  When this feature is enabled,
>>>>> +	  legacy non-IBT applications continue to work, but without
>>>>> +	  IBT protection.
>>>>> +
>>>>> +	  If unsure, say y
>>>>
>>>> 	  If unsure, say y.
>>>
>>> Actually, it would be "If unsure, say Y.", to be consistent with the
>>> rest of the Kconfig.
>>>
>>> But I wonder if Yes by default is good idea. Only very new CPUs will
>>> support this, right? Are they even available at the market? Should the
>>> help text say "if your CPU is Whatever Lake or newer, ...." :-) ?
>>
>> I will revise the wording if there is another version.  But a CET-capable
>> kernel can run on legacy systems.  We have been testing that combination.
> 
> Yes, but enabling CET is unneccessary overhead on older systems. And
> Kconfig is great place to explain that.

Maybe I'll add:

If the kernel is to be used only on older systems that do not support 
IBT, and the size of the binary is important, you can save 900 KB by 
disabling this feature.

Otherwise, if unsure, say Y.

How is that?

Thanks,
Yu-cheng
Dave Hansen Sept. 21, 2020, 10:41 p.m. UTC | #11
On 9/21/20 3:30 PM, Yu, Yu-cheng wrote:
> +config X86_INTEL_BRANCH_TRACKING_USER
> +    prompt "Intel Indirect Branch Tracking for user-mode" 

Take the "Intel " and "INTEL_" out, please.  It will only cause us all
pain later if some of our x86 compatriots decide to implement this.

> If the kernel is to be used only on older systems that do not support
> IBT, and the size of the binary is important, you can save 900 KB by
> disabling this feature.
> 
> Otherwise, if unsure, say Y.

900k seems like a *lot*.  Where the heck does that come from?

Also, comments like that don't age very well.  Consider:

	Support for this feature is only known to be present on Intel
	processors released in 2020 or later.  This feature is also
	known to increase kernel text size substantially.

	If unsure, say N.

The 900KB is probably wrong today in a lot of configurations, and will;
only get *more* wrong over time.
Yu, Yu-cheng Sept. 21, 2020, 10:47 p.m. UTC | #12
On 9/21/2020 3:41 PM, Dave Hansen wrote:
> On 9/21/20 3:30 PM, Yu, Yu-cheng wrote:
>> +config X86_INTEL_BRANCH_TRACKING_USER
>> +    prompt "Intel Indirect Branch Tracking for user-mode"
> 
> Take the "Intel " and "INTEL_" out, please.  It will only cause us all
> pain later if some of our x86 compatriots decide to implement this.
> 
>> If the kernel is to be used only on older systems that do not support
>> IBT, and the size of the binary is important, you can save 900 KB by
>> disabling this feature.
>>
>> Otherwise, if unsure, say Y.
> 
> 900k seems like a *lot*.  Where the heck does that come from?
> 
> Also, comments like that don't age very well.  Consider:
> 
> 	Support for this feature is only known to be present on Intel
> 	processors released in 2020 or later.  This feature is also
> 	known to increase kernel text size substantially.
> 
> 	If unsure, say N.
> 

Thanks!

> The 900KB is probably wrong today in a lot of configurations, and will;
> only get *more* wrong over time.
> 

I was talking about the vmlinux file, and probably should have said 
bzImage size, which has 14 KB increase when CET is enabled.

Yu-cheng
Pavel Machek Sept. 21, 2020, 10:52 p.m. UTC | #13
Hi!

> > +config X86_INTEL_BRANCH_TRACKING_USER
> > +    prompt "Intel Indirect Branch Tracking for user-mode" 
> 
> Take the "Intel " and "INTEL_" out, please.  It will only cause us all
> pain later if some of our x86 compatriots decide to implement this.

Are other x86 manufacturers legally allowed to implement that?

> > If the kernel is to be used only on older systems that do not support
> > IBT, and the size of the binary is important, you can save 900 KB by
> > disabling this feature.
> > 
> > Otherwise, if unsure, say Y.
> 
> 900k seems like a *lot*.  Where the heck does that come from?
> 
> Also, comments like that don't age very well.  Consider:
> 
> 	Support for this feature is only known to be present on Intel
> 	processors released in 2020 or later.  This feature is also
> 	known to increase kernel text size substantially.
> 
> 	If unsure, say N.

That is much better, thanks.
									Pavel
Dave Hansen Sept. 21, 2020, 10:54 p.m. UTC | #14
On 9/21/20 3:47 PM, Yu, Yu-cheng wrote:
>> The 900KB is probably wrong today in a lot of configurations, and will;
>> only get *more* wrong over time.
> 
> I was talking about the vmlinux file, and probably should have said
> bzImage size, which has 14 KB increase when CET is enabled.

Well, vmlinux size is important too.  1 page of vmlinux size means one
fewer page of memory available for real use.

I would really encourage you when you write to try to be specific and
use as much plain language as possible without being verbose.  Most
people understand things like "this feature increases kernel text size".
 I wouldn't expect most folks who can type "make oldconfig; make
install" to understands the difference between vmlinux and bzImage.
Dave Hansen Sept. 21, 2020, 10:58 p.m. UTC | #15
On 9/21/20 3:52 PM, Pavel Machek wrote:
>>> +config X86_INTEL_BRANCH_TRACKING_USER
>>> +    prompt "Intel Indirect Branch Tracking for user-mode" 
>> Take the "Intel " and "INTEL_" out, please.  It will only cause us all
>> pain later if some of our x86 compatriots decide to implement this.
> Are other x86 manufacturers legally allowed to implement that?
I don't know and frankly don't want to know.

We've seen AMD and Intel both implement plenty of features from the
other.  Protection Keys for Userspace is the most recent example.

Unless there's evidence to the contrary, I think the best thing for the
kernel is to assume that any feature can show up on any vendor's CPU.
Yu, Yu-cheng Sept. 21, 2020, 11:27 p.m. UTC | #16
On 9/21/2020 3:54 PM, Dave Hansen wrote:
> On 9/21/20 3:47 PM, Yu, Yu-cheng wrote:
>>> The 900KB is probably wrong today in a lot of configurations, and will;
>>> only get *more* wrong over time.
>>
>> I was talking about the vmlinux file, and probably should have said
>> bzImage size, which has 14 KB increase when CET is enabled.
> 
> Well, vmlinux size is important too.  1 page of vmlinux size means one
> fewer page of memory available for real use.
> 
> I would really encourage you when you write to try to be specific and
> use as much plain language as possible without being verbose.  Most
> people understand things like "this feature increases kernel text size".
>   I wouldn't expect most folks who can type "make oldconfig; make
> install" to understands the difference between vmlinux and bzImage.
> 

Ok, thanks!

Yu-cheng
diff mbox series

Patch

diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 6b6dad011763..b047e0a8d1c2 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -1963,6 +1963,22 @@  config X86_INTEL_SHADOW_STACK_USER
 
 	  If unsure, say y.
 
+config X86_INTEL_BRANCH_TRACKING_USER
+	prompt "Intel Indirect Branch Tracking for user-mode"
+	def_bool n
+	depends on CPU_SUP_INTEL && X86_64
+	depends on $(cc-option,-fcf-protection)
+	select X86_INTEL_CET
+	help
+	  Indirect Branch Tracking (IBT) provides protection against
+	  CALL-/JMP-oriented programming attacks.  It is active when
+	  the kernel has this feature enabled, and the processor and
+	  the application support it.  When this feature is enabled,
+	  legacy non-IBT applications continue to work, but without
+	  IBT protection.
+
+	  If unsure, say y
+
 config EFI
 	bool "EFI runtime service support"
 	depends on ACPI