From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f47.google.com (mail-wr1-f47.google.com [209.85.221.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 967CD3BADA9 for ; Thu, 7 May 2026 13:39:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.47 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778161147; cv=none; b=T4oPx3ntfZVMTFm6b2iCE+Eq4rhjlYO+X7mKl2wiQIhpi69beNHBgKMiBQmUxMn+hNF1JPUYE6t8oXPXU3uI8dNd6V5I0QhumglplEGcpTQ4mWEZ214I02xjdcZpdBmj6A7KAcgQYLwNG+OwtUrAD9vv89GahepOXKJxs0yscF0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778161147; c=relaxed/simple; bh=aze3AVzKBYWjW9VRkpjTnAkLdARLlZlUmXF4diXz0JM=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=rTM+y+HTDtmTxVNrMwXY0APlO2Ljm6cDdfNx8B9+w7d5OnTIUzHCXuWOEMp/QnOKmcCE5HqNpFZXu675mGwJMheOcSW6irvm73PAyoc9zvXUPxR/ZoV2Z51xxeAOmzNmaglzq449koIJNdB7sx+Tzibe5wuyru+K0npEdL3H8EQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=grsecurity.net; spf=pass smtp.mailfrom=opensrcsec.com; dkim=pass (2048-bit key) header.d=grsecurity.net header.i=@grsecurity.net header.b=C0cR1+wz; arc=none smtp.client-ip=209.85.221.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=grsecurity.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=opensrcsec.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=grsecurity.net header.i=@grsecurity.net header.b="C0cR1+wz" Received: by mail-wr1-f47.google.com with SMTP id ffacd0b85a97d-441209fb77eso580037f8f.1 for ; Thu, 07 May 2026 06:39:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=grsecurity.net; s=grsec; t=1778161144; x=1778765944; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:autocrypt:from :content-language:references:cc:to:subject:user-agent:mime-version :date:message-id:from:to:cc:subject:date:message-id:reply-to; bh=GnkXJ4zq8dqrsJSFH2wSu0/tijWOYXDBaNzHAKDA4Pc=; b=C0cR1+wzykIUdHZLRHOUxMxOIz0lwV/GQXHlItI7tu0obfGEJVGjIZ3ZVP/gfGLhqL STWs6L/gLjWsXN1lfzbgoPgaA3yiA8suMEMI72Xhx4YMrEUMgkJz5uvhH+tMKPf8XSdK +M3o+N1t+e8Ks4/JdKbcFyYhZMRoQXAqxURF+jiB3CthUeRMkgRm+UrV2qnCBaYj2uYA Ccj4oDp8W8Fz/sFxPD+m8kP81bb2HdPHgxiXZ3B2A/F9Wc68bd6pPDXDSGjrosh57KVW ezcRptc1uhmWg36thZjIJF14+3LZMC5hJnryBFcMkEO6aaeg1dTFasjh27RW2JEEiTET 7IwA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778161144; x=1778765944; h=content-transfer-encoding:in-reply-to:autocrypt:from :content-language:references:cc:to:subject:user-agent:mime-version :date:message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=GnkXJ4zq8dqrsJSFH2wSu0/tijWOYXDBaNzHAKDA4Pc=; b=hThrmsMGr/HEG38YI0F9kvL2cag/ebdFLT9M7MghMdl9fHfmHfCLjXyPJVQQyi6OJ2 2S2kkPCNJDJFfkaj1deZOrqPr64QorMjSx33HV8HdzR65ti2778Z/6LCmwzjc/esePzQ c7uML2DlTfxA682xPR6dLs7aevuNYMcXT2f9XqxpUK1f9tnJpIHebnEmvIgK5YcYuXYs 7EFgROnRR0V+pth4pgRsKsER5yfqr0NSoP1nbWAQ55fxAghwAD2A8K3/ItGuNaTN4HCe ymRrtcC+NIvOnqeD5WaVdXJyRHN28kLRg0AlxL6abWZ9BXqUeUh1Unn9gHZYshYI9Hma c/oA== X-Gm-Message-State: AOJu0YxyPT9uLFLxg65bVu5HQ3dKRCzpE/S0l6lXAgr3UqR+umoD7OtE R2IpYpNu/AFr6Qm6DP+T/h7na2iHg5dHi+ss8o9YCcwFrHFmxYLNvOInR+4iOTR+1i0= X-Gm-Gg: AeBDies+2VXJuHryTSnhLl2FjadoN6JJFjtE8L80Vz6AK25wF9XpoqPTGhYoFLZDe+L +eSsxNEWIA4x29VcmxphhYVjnPvwKGBkKHVXDnkkonWQY2oyEwJGOAmHKz9HFHKQGGgKEA+R6YC t+dQIBiRwfqKF8B7fnwtB3MTDmXe3wOdMeyhHqnStEzvEmEEQcnu62Kr92UGDa71KhYlRqK1vkD C/2YiITcqhvD+JCsFR+x6rFoMASJsoSgpiat99sx237L1rhN2iyaZnce580gC+yxZsjvhoQ7X77 gSzLkNpzX4bb9/o48uwuZTrMIWzPqIpTWSXfx8mOmHYSRYHrPzJrEx6k6fmqRmmlivjbdHaMfSa nLLYFf8iUrQIABwgfPRkJk+JP9M4gs6XSZsJq/R+kfQozicoCT+YLaf1BdjeGHE+TYSjv8esA4U f1jx0FuyBSfy8HXbu286BthS87SDtnhmFJk+IxaRoEISw5j7YJojtOAa8Qz3kZnP0QKzTEkJkFy bQzJ5KmXC1lwYJUm2f0sVEEtizteFveNY8QPR5uFQS3+UUDC4OaOyGi02QWWIzo/Up9SZyeKgtC bw== X-Received: by 2002:a05:6000:2d09:b0:450:aa3f:9cda with SMTP id ffacd0b85a97d-452e7e7eaa0mr3282021f8f.7.1778161143421; Thu, 07 May 2026 06:39:03 -0700 (PDT) Received: from ?IPV6:2003:fa:af26:200:51a:ef03:a698:a1fc? (p200300faaf260200051aef03a698a1fc.dip0.t-ipconnect.de. [2003:fa:af26:200:51a:ef03:a698:a1fc]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-45055d36dacsm20164606f8f.32.2026.05.07.06.39.02 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 07 May 2026 06:39:02 -0700 (PDT) Message-ID: <457a77eb-2a77-4873-b2a1-24f5110a0393@grsecurity.net> Date: Thu, 7 May 2026 15:39:01 +0200 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v2] x86/shstk: Provide kernel command line knob to disable To: "Edgecombe, Rick P" , "Hansen, Dave" , "x86@kernel.org" , "dave.hansen@linux.intel.com" , "peterz@infradead.org" , "bp@alien8.de" , "mingo@redhat.com" , "tglx@kernel.org" Cc: "linux-kernel@vger.kernel.org" References: <20260402173606.1096172-1-minipli@grsecurity.net> <3d7c8d26-558d-40ef-9ad9-3a5100eed9e5@grsecurity.net> <739e4dd0-84a3-4b37-8cc3-b7ec59737010@intel.com> <4cffee5d2886129e621d3011db1d00a236869d1d.camel@intel.com> Content-Language: en-US, de-DE From: Mathias Krause Autocrypt: addr=minipli@grsecurity.net; keydata= xsDNBF4u6F8BDAC1kCIyATzlCiDBMrbHoxLywJSUJT9pTbH9MIQIUW8K1m2Ney7a0MTKWQXp 64/YTQNzekOmta1eZFQ3jqv+iSzfPR/xrDrOKSPrw710nVLC8WL993DrCfG9tm4z3faBPHjp zfXBIOuVxObXqhFGvH12vUAAgbPvCp9wwynS1QD6RNUNjnnAxh3SNMxLJbMofyyq5bWK/FVX 897HLrg9bs12d9b48DkzAQYxcRUNfL9VZlKq1fRbMY9jAhXTV6lcgKxGEJAVqXqOxN8DgZdU aj7sMH8GKf3zqYLDvndTDgqqmQe/RF/hAYO+pg7yY1UXpXRlVWcWP7swp8OnfwcJ+PiuNc7E gyK2QEY3z5luqFfyQ7308bsawvQcFjiwg+0aPgWawJ422WG8bILV5ylC8y6xqYUeSKv/KTM1 4zq2vq3Wow63Cd/qyWo6S4IVaEdfdGKVkUFn6FihJD/GxnDJkYJThwBYJpFAqJLj7FtDEiFz LXAkv0VBedKwHeBaOAVH6QEAEQEAAc0nTWF0aGlhcyBLcmF1c2UgPG1pbmlwbGlAZ3JzZWN1 cml0eS5uZXQ+wsERBBMBCgA7AhsDBQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAFiEEd7J359B9 wKgGsB94J4hPxYYBGYYFAmBbH/cCGQEACgkQJ4hPxYYBGYaX/gv/WYhaehD88XjpEO+yC6x7 bNWQbk7ea+m82fU2x/x6A9L4DN/BXIxqlONzk3ehvW3wt1hcHeF43q1M/z6IthtxSRi059RO SarzX3xfXC1pc5YMgCozgE0VRkxH4KXcijLyFFjanXe0HzlnmpIJB6zTT2jgI70q0FvbRpgc rs3VKSFb+yud17KSSN/ir1W2LZPK6er6actK03L92A+jaw+F8fJ9kJZfhWDbXNtEE0+94bMa cdDWTaZfy6XJviO3ymVe3vBnSDakVE0HwLyIKvfAEok+YzuSYm1Nbd2T0UxgSUZHYlrUUH0y tVxjEFyA+iJRSdm0rbAvzpwau5FOgxRQDa9GXH6ie6/ke2EuZc3STNS6EBciJm1qJ7xb2DTf SNyOiWdvop+eQZoznJJte931pxkRaGwV+JXDM10jGTfyV7KT9751xdn6b6QjQANTgNnGP3qs TO5oU3KukRHgDcivzp6CWb0X/WtKy0Y/54bTJvI0e5KsAz/0iwH19IB0vpYLzsDNBF4u6F8B DADwcu4TPgD5aRHLuyGtNUdhP9fqhXxUBA7MMeQIY1kLYshkleBpuOpgTO/ikkQiFdg13yIv q69q/feicsjaveIEe7hUI9lbWcB9HKgVXW3SCLXBMjhCGCNLsWQsw26gRxDy62UXRCTCT3iR qHP82dxPdNwXuOFG7IzoGBMm3vZbBeKn0pYYWz2MbTeyRHn+ZubNHqM0cv5gh0FWsQxrg1ss pnhcd+qgoynfuWAhrPD2YtNB7s1Vyfk3OzmL7DkSDI4+SzS56cnl9Q4mmnsVh9eyae74pv5w kJXy3grazD1lLp+Fq60Iilc09FtWKOg/2JlGD6ZreSnECLrawMPTnHQZEIBHx/VLsoyCFMmO 5P6gU0a9sQWG3F2MLwjnQ5yDPS4IRvLB0aCu+zRfx6mz1zYbcVToVxQqWsz2HTqlP2ZE5cdy BGrQZUkKkNH7oQYXAQyZh42WJo6UFesaRAPc3KCOCFAsDXz19cc9l6uvHnSo/OAazf/RKtTE 0xGB6mQN34UAEQEAAcLA9gQYAQoAIAIbDBYhBHeyd+fQfcCoBrAfeCeIT8WGARmGBQJeORkW AAoJECeIT8WGARmGXtgL/jM4NXaPxaIptPG6XnVWxhAocjk4GyoUx14nhqxHmFi84DmHUpMz 8P0AEACQ8eJb3MwfkGIiauoBLGMX2NroXcBQTi8gwT/4u4Gsmtv6P27Isn0hrY7hu7AfgvnK owfBV796EQo4i26ZgfSPng6w7hzCR+6V2ypdzdW8xXZlvA1D+gLHr1VGFA/ZCXvVcN1lQvIo S9yXo17bgy+/Xxi2YZGXf9AZ9C+g/EvPgmKrUPuKi7ATNqloBaN7S2UBJH6nhv618bsPgPqR SV11brVF8s5yMiG67WsogYl/gC2XCj5qDVjQhs1uGgSc9LLVdiKHaTMuft5gSR9hS5sMb/cL zz3lozuC5nsm1nIbY62mR25Kikx7N6uL7TAZQWazURzVRe1xq2MqcF+18JTDdjzn53PEbg7L VeNDGqQ5lJk+rATW2VAy8zasP2/aqCPmSjlCogC6vgCot9mj+lmMkRUxspxCHDEms13K41tH RzDVkdgPJkL/NFTKZHo5foFXNi89kA== In-Reply-To: <4cffee5d2886129e621d3011db1d00a236869d1d.camel@intel.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit On 07.05.26 00:45, Edgecombe, Rick P wrote: > On Wed, 2026-05-06 at 12:03 -0700, Dave Hansen wrote: >> Is there a reason that clearcpuid=shstk doesn't work in this case? I >> guess shstk and ibt are peers, but I was kinda hoping we'd stop adding >> these for every single CPU feature at _some_ point. > > Oh yea, for the reason of "debugging related issues during early boot" > clearcpuid of shstk and ibt should be fine. It taints the kernel, but should be > fine for debugging? If I'm reading this right, the kernel does the clearcpuid > processing before setting up CET bits. Unfortunately, neither 'clearcpuid=shstk' nor 'clearcpuid=user_shstk' are of any help. The former doesn't work because X86_FEATURE_SHSTK has no procfs-visible string attached, therefore no entry in x86_cap_flags[] and therefore can't be found via "shstk" in parse_set_clear_cpuid(). The latter only clears X86_FEATURE_USER_SHSTK which is a synthetic feature bit but setup_cet() only looks for X86_FEATURE_SHSTK. > > I'm remembering we actually already have a "nousershstk" too, which covers the > "userspace init cet violations break boot" usage. Oh, interesting. That'd be the equivalent of 'clearcpuid=user_shstk', right? > > What that doesn't do though, is clear CR4.CET. With nousershstk, KVM can still > use CET. So that is what is missing. A way to clear CR4.CET without tainting the > kernel when HW supports CET. Do we need it? > Right! Clearing, or, moreover, not setting CR4.CET=1 is what I need for the debugging use cases I have in mind and had to hack around a few times in the past. Case in point, the last debugging session involved a bug with CPU hotplug where the E-cores did not reset their IA32_S_CET MSR on #INIT but the P-cores did (which wasn't the bug, as that's perfectly fine SDM-documented behaviour (not resetting, that is)). I had a system with CPU hotplug working on the P-cores but not on the E-cores which took a while to debug because the E-cores died hard very early on. CET was in effect way too early (not only in CR4 but also all features via the (stale) MSR), calling a function that didn't had the required ENDBR, causing an early, unhandled #CP. So, a way to prevent CR4.CET enabling from happening would be nice to have for future debugging sessions. Thanks, Mathias