From: Peter Zijlstra <peterz@infradead.org>
To: Kees Cook <kees@kernel.org>
Cc: x86@kernel.org, linux-kernel@vger.kernel.org,
alyssa.milburn@intel.com, scott.d.constable@intel.com,
joao@overdrivepizza.com, andrew.cooper3@citrix.com,
jpoimboe@kernel.org, jose.marchesi@oracle.com,
hjl.tools@gmail.com, ndesaulniers@google.com,
samitolvanen@google.com, nathan@kernel.org, ojeda@kernel.org,
alexei.starovoitov@gmail.com, mhiramat@kernel.org
Subject: Re: [PATCH 11/11] x86/fineibt: Add FineIBT+BHI mitigation
Date: Sat, 15 Feb 2025 11:40:35 +0100 [thread overview]
Message-ID: <20250215104035.GA13198@noisy.programming.kicks-ass.net> (raw)
In-Reply-To: <202502140957.FE93863F@keescook>
On Fri, Feb 14, 2025 at 10:02:12AM -0800, Kees Cook wrote:
> On Fri, Feb 07, 2025 at 01:15:40PM +0100, Peter Zijlstra wrote:
> > Due to FineIBT weakness, add an additional mitigation for BHI.
> > [...]
> > @@ -1020,6 +1036,8 @@ static __init int cfi_parse_cmdline(char
> > cfi_mode = CFI_KCFI;
> > } else if (!strcmp(str, "fineibt")) {
> > cfi_mode = CFI_FINEIBT;
> > + } else if (IS_ENABLED(CONFIG_FINEIBT_BHI) && !strcmp(str, "fineibt+bhi")) {
> > + cfi_mode = CFI_FINEIBT_BHI;
> > } else if (!strcmp(str, "norand")) {
> > cfi_rand = false;
> > } else {
>
> While looking at FineIBT vs entry, I noticed that FineIBT+BHI must be
> explicitly selected at boot. Did you want it to be enabled automatically
> when the compiler supports it and FineIBT is enabled? Does there need to
> be a check for BHI added?
Yes, it needs to be tied in with the whole speculation mitigation crap.
Didn't want to bother with all that just yet though.
next prev parent reply other threads:[~2025-02-15 10:40 UTC|newest]
Thread overview: 29+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-02-07 12:15 [PATCH 00/11] x86/ibt: FineIBT-BHI Peter Zijlstra
2025-02-07 12:15 ` [PATCH 01/11] objtool: Move dodgy linker warn to verbose Peter Zijlstra
2025-02-07 12:15 ` [PATCH 02/11] x86/ibt: Clean up is_endbr() Peter Zijlstra
2025-02-15 10:56 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2025-02-07 12:15 ` [PATCH 03/11] x86,kcfi: Fix EXPORT_SYMBOL vs kCFI Peter Zijlstra
2025-02-15 10:56 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2025-02-07 12:15 ` [PATCH 04/11] x86/cfi: Clean up linkage Peter Zijlstra
2025-02-15 10:56 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2025-02-07 12:15 ` [PATCH 05/11] x86/boot: Mark start_secondary() with __noendbr Peter Zijlstra
2025-02-15 10:56 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2025-02-07 12:15 ` [PATCH 06/11] x86/alternative: Simplify callthunk patching Peter Zijlstra
2025-02-07 17:23 ` Josh Poimboeuf
2025-02-15 10:56 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2025-02-07 12:15 ` [PATCH 07/11] x86/traps: Cleanup and robustify decode_bug() Peter Zijlstra
2025-02-15 10:56 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2025-02-07 12:15 ` [PATCH 08/11] x86/ibt: Clean up poison_endbr() Peter Zijlstra
2025-02-15 10:56 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2025-02-07 12:15 ` [PATCH 09/11] x86/early_printk: Harden early_serial Peter Zijlstra
2025-02-15 10:56 ` [tip: x86/core] " tip-bot2 for Peter Zijlstra
2025-02-07 12:15 ` [PATCH 10/11] x86: BHI stubs Peter Zijlstra
2025-02-07 12:15 ` [PATCH 11/11] x86/fineibt: Add FineIBT+BHI mitigation Peter Zijlstra
2025-02-14 18:02 ` Kees Cook
2025-02-15 10:40 ` Peter Zijlstra [this message]
2025-02-10 18:29 ` [PATCH 00/11] x86/ibt: FineIBT-BHI Sami Tolvanen
2025-02-13 10:48 ` Peter Zijlstra
2025-02-13 11:45 ` Peter Zijlstra
2025-02-13 19:12 ` Sami Tolvanen
2025-02-14 9:26 ` Peter Zijlstra
2025-02-15 10:56 ` [tip: x86/core] x86/ibt: Handle FineIBT in handle_cfi_failure() tip-bot2 for Peter Zijlstra
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250215104035.GA13198@noisy.programming.kicks-ass.net \
--to=peterz@infradead.org \
--cc=alexei.starovoitov@gmail.com \
--cc=alyssa.milburn@intel.com \
--cc=andrew.cooper3@citrix.com \
--cc=hjl.tools@gmail.com \
--cc=joao@overdrivepizza.com \
--cc=jose.marchesi@oracle.com \
--cc=jpoimboe@kernel.org \
--cc=kees@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mhiramat@kernel.org \
--cc=nathan@kernel.org \
--cc=ndesaulniers@google.com \
--cc=ojeda@kernel.org \
--cc=samitolvanen@google.com \
--cc=scott.d.constable@intel.com \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox