Re: [PATCH 01/65] x86: Introduce support for CET-IBT

[Jan Beulich <jbeulich@xxxxxxxx>]

On 10.12.2021 15:20, Andrew Cooper wrote:
> On 29/11/2021 09:21, Jan Beulich wrote:
>> On 26.11.2021 16:21, Andrew Cooper wrote:
>>> On 26/11/2021 14:10, Jan Beulich wrote:
>>>> On 26.11.2021 13:33, Andrew Cooper wrote:
>>>>> @@ -124,6 +129,18 @@ config XEN_SHSTK
>>>>>     When CET-SS is active, 32bit PV guests cannot be used.  Backwards
>>>>>     compatiblity can be provided via the PV Shim mechanism.
>>>>>  
>>>>> +config XEN_IBT
>>>>> + bool "Supervisor Indirect Branch Tracking"
>>>>> + depends on HAS_CC_CET_IBT
>>>>> + default y
>>>>> + help
>>>>> +   Control-flow Enforcement Technology (CET) is a set of features in
>>>>> +   hardware designed to combat Return-oriented Programming (ROP, also
>>>>> +   call/jump COP/JOP) attacks.  Indirect Branch Tracking is one CET
>>>>> +   feature designed to provide function pointer protection.
>>>>> +
>>>>> +   This option arranges for Xen to use CET-IBT for its own protection.
>>>> Shouldn't this depend on BROKEN until it's actually functional?
>>> It compiles fine right from now, and making it BROKEN would inhibit
>>> bisection through the series.
>>>
>>> Nothing actually matters until patch 65 turns on MSR_S_CET.ENDBR_EN.
>> "Nothing" except that until then the promised extra security isn't
>> there.
> 
> The series is very likely to be committed in one fell swoop, but even
> that aside, it really doesn't matter until 4.17-rc1
> 
> As it stands, this is ~65 patches of incremental changes to the binary,
> and oughtn't to be 65 nops and a massive switch at the end.

Well, I'm not convinced, but I can live with it being the way you have it.

Jan