From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dave Hansen Subject: Re: [RFC PATCH v9 05/27] x86/cet/shstk: Add Kconfig option for user-mode Shadow Stack protection Date: Wed, 26 Feb 2020 17:16:27 -0800 Message-ID: <71791bbf-7ee3-fa70-b569-ae643151646e@intel.com> References: <20200205181935.3712-1-yu-cheng.yu@intel.com> <20200205181935.3712-6-yu-cheng.yu@intel.com> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Return-path: Received: from mga11.intel.com ([192.55.52.93]:43614 "EHLO mga11.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727964AbgB0BQ3 (ORCPT ); Wed, 26 Feb 2020 20:16:29 -0500 In-Reply-To: Content-Language: en-US Sender: linux-arch-owner@vger.kernel.org List-ID: To: "H.J. Lu" Cc: Yu-cheng Yu , the arch/x86 maintainers , "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar , LKML , linux-doc@vger.kernel.org, Linux-MM , linux-arch , Linux API , Arnd Bergmann , Andy Lutomirski , Balbir Singh , Borislav Petkov , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , Jann Horn , Jonathan Corbet , Kees Cook On 2/26/20 5:02 PM, H.J. Lu wrote: >> That way everybody with old toolchains can still build the kernel (and >> run/test code with your config option on, btw...). > CET requires a complete new OS image from kernel, toolchain, run-time. > CET enabled kernel without the rest of updated OS won't give you CET > at all. If you require a new toolchain, nobody even builds your fancy feature. Probably including 0day and all of the lazy maintainers with crufty old distros. The point isn't to actually run CET at all. The point is to get as many people as possible testing as much of it as possible. Testing includes compile testing, static analysis and bloat watching. It also includes functional and performance testing when you've got the feature compiled in but unavailable at runtime. Did this hurt anything even when I'm not using it? From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mga11.intel.com ([192.55.52.93]:43614 "EHLO mga11.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727964AbgB0BQ3 (ORCPT ); Wed, 26 Feb 2020 20:16:29 -0500 Subject: Re: [RFC PATCH v9 05/27] x86/cet/shstk: Add Kconfig option for user-mode Shadow Stack protection References: <20200205181935.3712-1-yu-cheng.yu@intel.com> <20200205181935.3712-6-yu-cheng.yu@intel.com> From: Dave Hansen Message-ID: <71791bbf-7ee3-fa70-b569-ae643151646e@intel.com> Date: Wed, 26 Feb 2020 17:16:27 -0800 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit Sender: linux-arch-owner@vger.kernel.org List-ID: To: "H.J. Lu" Cc: Yu-cheng Yu , the arch/x86 maintainers , "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar , LKML , linux-doc@vger.kernel.org, Linux-MM , linux-arch , Linux API , Arnd Bergmann , Andy Lutomirski , Balbir Singh , Borislav Petkov , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , Randy Dunlap , "Ravi V. Shankar" , Vedvyas Shanbhogue , Dave Martin , x86-patch-review@intel.com Message-ID: <20200227011627.6bGihzkfbNVRkb9ytJF8Ey5FlGvueoQ0VN_9pI_kM7o@z> On 2/26/20 5:02 PM, H.J. Lu wrote: >> That way everybody with old toolchains can still build the kernel (and >> run/test code with your config option on, btw...). > CET requires a complete new OS image from kernel, toolchain, run-time. > CET enabled kernel without the rest of updated OS won't give you CET > at all. If you require a new toolchain, nobody even builds your fancy feature. Probably including 0day and all of the lazy maintainers with crufty old distros. The point isn't to actually run CET at all. The point is to get as many people as possible testing as much of it as possible. Testing includes compile testing, static analysis and bloat watching. It also includes functional and performance testing when you've got the feature compiled in but unavailable at runtime. Did this hurt anything even when I'm not using it?