On Fri, Sep 18, 2020 at 2:40 PM Pavel Machek [off-list ref] wrote:

On Fri 2020-09-18 14:25:12, Yu, Yu-cheng wrote:

quoted

On 9/18/2020 1:59 PM, Pavel Machek wrote:

quoted

On Fri 2020-09-18 13:24:13, Randy Dunlap wrote:

quoted

Hi,

If you do another version of this:

On 9/18/20 12:23 PM, Yu-cheng Yu wrote:

quoted

Introduce Kconfig option X86_INTEL_BRANCH_TRACKING_USER.

Indirect Branch Tracking (IBT) provides protection against CALL-/JMP-
oriented programming attacks.  It is active when the kernel has this
feature enabled, and the processor and the application support it.
When this feature is enabled, legacy non-IBT applications continue to
work, but without IBT protection.

Signed-off-by: Yu-cheng Yu <redacted>
---
v10:
- Change build-time CET check to config depends on.

  arch/x86/Kconfig | 16 ++++++++++++++++
  1 file changed, 16 insertions(+)

diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 6b6dad011763..b047e0a8d1c2 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig

@@ -1963,6 +1963,22 @@ config X86_INTEL_SHADOW_STACK_USER
          If unsure, say y.
+config X86_INTEL_BRANCH_TRACKING_USER
+       prompt "Intel Indirect Branch Tracking for user-mode"
+       def_bool n
+       depends on CPU_SUP_INTEL && X86_64
+       depends on $(cc-option,-fcf-protection)
+       select X86_INTEL_CET
+       help
+         Indirect Branch Tracking (IBT) provides protection against
+         CALL-/JMP-oriented programming attacks.  It is active when
+         the kernel has this feature enabled, and the processor and
+         the application support it.  When this feature is enabled,
+         legacy non-IBT applications continue to work, but without
+         IBT protection.
+
+         If unsure, say y

    If unsure, say y.

Actually, it would be "If unsure, say Y.", to be consistent with the
rest of the Kconfig.

But I wonder if Yes by default is good idea. Only very new CPUs will
support this, right? Are they even available at the market? Should the
help text say "if your CPU is Whatever Lake or newer, ...." :-) ?

I will revise the wording if there is another version.  But a CET-capable
kernel can run on legacy systems.  We have been testing that combination.

Yes, but enabling CET is unneccessary overhead on older systems. And
Kconfig is great place to explain that.

I can't tell any visible CET kernel overhead on my non-CET machines.

-- 
H.J.