From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f43.google.com (mail-wm1-f43.google.com [209.85.128.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BC0BF33F8D9 for ; Thu, 2 Apr 2026 17:01:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.43 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775149273; cv=none; b=aRdNWXg123LpQYMfGriW6mdaG6SSUs1CTZ3tn1pTnwhbZhBkiK+405HW7qfCnTOkWFgbXvlJON6zm0xjO3vwXwg5iSWXpjEb9/BqTD361jq9lyIZo07IsITveP4Y/TgaWeNg0HcMSaYHgOVRJrhULPYoBaKOtQ87DN4ifDNBVyA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775149273; c=relaxed/simple; bh=FpJw22L1vQKg9Wlil2ZjpuIY0YCOZ9rtIU5I/U1xHJc=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=n30ksyNM8MOur4UDn0FeAIeJWzEDy8oVqBvlmLEVvoSUJV0kN58nXf+FfvG8ikHHblyO1cZXsocf1uGDTmDbprUoO2OGOb0a/90dk0B5/ziUpGRbwYv68w1QHP0e8lu/l3/ii+ppWUYU9qYU1aHdnfnGbz8hp6POKgkfyE1Xm7w= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=grsecurity.net; spf=pass smtp.mailfrom=opensrcsec.com; dkim=pass (2048-bit key) header.d=grsecurity.net header.i=@grsecurity.net header.b=ZDPUCbu9; arc=none smtp.client-ip=209.85.128.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=grsecurity.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=opensrcsec.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=grsecurity.net header.i=@grsecurity.net header.b="ZDPUCbu9" Received: by mail-wm1-f43.google.com with SMTP id 5b1f17b1804b1-486fe36cfabso14532085e9.1 for ; Thu, 02 Apr 2026 10:01:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=grsecurity.net; s=grsec; t=1775149262; x=1775754062; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:autocrypt:from :content-language:references:cc:to:subject:user-agent:mime-version :date:message-id:from:to:cc:subject:date:message-id:reply-to; bh=8wMc+mzPOJg+TreWn83ukeRGZnYjY01pn+A409sW6Rs=; b=ZDPUCbu9wQeUJR3C1hL9hCnMvRpRmU+8qU6++IdkR/N1N7blqmme3nqHVeQ+8neEbJ vmSzQ7IbmKFU6isVX6vuMPZIixXe9uMteFH/EhT6vW9y+1ev51PY1+GI3gIsOBPaMcze DrOgjcnaIdXEJNbNmiImfh5VO/zt5xiboMFU5nUS09kkVov/ZS9ZH5kg9jqEOk4Wqc7P zlo8npi+DZknxm9cvFLGC4Fkzyj7mjRj5JZyH+ny3nqy/UybMjZ+Z7yG7p2whGoQwhfi 4mFlJuEuEqVxEyn1e4QlI2kqKa442+PgujOkGT37pr5PL6ZR/0ZOt6+cenax2o7j59h1 sjow== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1775149262; x=1775754062; h=content-transfer-encoding:in-reply-to:autocrypt:from :content-language:references:cc:to:subject:user-agent:mime-version :date:message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=8wMc+mzPOJg+TreWn83ukeRGZnYjY01pn+A409sW6Rs=; b=LrMf3si9e4Dt0mHp4zTMfzf4MGfMAKAqFW7bbzgVsasAkVRwbGna9kijk4w76nmfES EfGb89PQC9K66QWFYkSIdg8/ssKf1dDkUZ5RQbrJtuZoBglwgylwKfu2NMcbg4dqpMmB h2ttxXu/nkNczOFR+CJAlOAceF0/py7cxlI2tC0iBQba6Jjbt+uHkSdPmSFNhPLl/Dzc 0bqEhEH8KdJTJr53Rad2Ie51LBRne6lEQH35wAB+Nq3ez0BOfs2OiP1+0B+iqolNMGWI 3tDBXyuHBRyxw+9/XipakeBARja3NHm1ZzR3ESwlyqRjwFY/+k3bYAxxQGz1ciHoMiEK Ol3Q== X-Forwarded-Encrypted: i=1; AJvYcCU/4W9ZO5MSA4SU3a2TpL52MCFI2Vc1n2y+EFQIcVIaf2kS7uZ6Sw5SkSvN8eOha35nzOQsQrPSIjhRWU8=@vger.kernel.org X-Gm-Message-State: AOJu0YyKoD/IKYA1xMtjvtGJH11GLw5ZCgL5JLzVqRKpW1iyltLtKgZX Ajm95Leli5C0kd4cFj2cBDpz4a1YUAq9LYF/3zXNlX+2qKwquweF4iNlZKb1QWI41IE= X-Gm-Gg: AeBDiet/IFUxF/E57+HIXAkCVXQXQxCp8a5U+KOFFirJT7I/5Ob4unW/bMT3WLLZigz JDOXbzkHmFKoe0iu5ND3cINYLTOPVaGACyrS5NNm11HaNG+LPNWRlVhcnePUhIbrIiTLOtZRyzl 6a0l7EMIDhVTiRhf4Por/2m0wyqgHl8NwI4OY9VI/4iV+0pieNNAMIB/W0ykoyqqw3iD4hoYkFA eNCSqwINwe93gZfon5vnaKVmJpYreR1ubbKcYirmYy5PGmZj88ejqZc6G0/X8gX8mmx8Mvsmy4u N3w6VcqI5PKKaRn62lIGuAKFKZiL9TCtpL2OblSe4oO2UxMvpvLzm8tkmBwj2Qe0zhYweCly1FR mZcU3if8CpkZNC5SLj0Zgp0jhdA7fNFqsNnNpgHX0tKZsJUakFh6hq+IceNQvkluC518vLml17T TkDqn86qzY2aW196Kipu+zKEJcgC27OgQp7JHEjQgepm0dYsVjUddTnR9UzMZ4CcMdVjdNPlSic 7DXijvH3PmGJ1wnc1Zvh9oRiiptlvOAg165V7mYIoNP9rd7ct5bI5kZ X-Received: by 2002:a5d:5d83:0:b0:43b:4312:2cbb with SMTP id ffacd0b85a97d-43d211c500cmr5865320f8f.17.1775149261946; Thu, 02 Apr 2026 10:01:01 -0700 (PDT) Received: from ?IPV6:2003:fa:af26:200:51a:ef03:a698:a1fc? (p200300faaf260200051aef03a698a1fc.dip0.t-ipconnect.de. [2003:fa:af26:200:51a:ef03:a698:a1fc]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-43d1e4e6224sm9883429f8f.25.2026.04.02.10.01.01 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 02 Apr 2026 10:01:01 -0700 (PDT) Message-ID: <8c068e7c-714c-49ad-a251-3aa921368128@grsecurity.net> Date: Thu, 2 Apr 2026 19:01:00 +0200 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] x86/shstk: Provide kernel command line knob to disable To: "Edgecombe, Rick P" , "peterz@infradead.org" Cc: "x86@kernel.org" , "mingo@redhat.com" , "tglx@kernel.org" , "linux-kernel@vger.kernel.org" , "bp@alien8.de" , "dave.hansen@linux.intel.com" References: <20260402154405.1090935-1-minipli@grsecurity.net> <20260402155452.GD3739027@noisy.programming.kicks-ass.net> <20260402160448.GD3738786@noisy.programming.kicks-ass.net> Content-Language: en-US, de-DE From: Mathias Krause Autocrypt: addr=minipli@grsecurity.net; keydata= xsDNBF4u6F8BDAC1kCIyATzlCiDBMrbHoxLywJSUJT9pTbH9MIQIUW8K1m2Ney7a0MTKWQXp 64/YTQNzekOmta1eZFQ3jqv+iSzfPR/xrDrOKSPrw710nVLC8WL993DrCfG9tm4z3faBPHjp zfXBIOuVxObXqhFGvH12vUAAgbPvCp9wwynS1QD6RNUNjnnAxh3SNMxLJbMofyyq5bWK/FVX 897HLrg9bs12d9b48DkzAQYxcRUNfL9VZlKq1fRbMY9jAhXTV6lcgKxGEJAVqXqOxN8DgZdU aj7sMH8GKf3zqYLDvndTDgqqmQe/RF/hAYO+pg7yY1UXpXRlVWcWP7swp8OnfwcJ+PiuNc7E gyK2QEY3z5luqFfyQ7308bsawvQcFjiwg+0aPgWawJ422WG8bILV5ylC8y6xqYUeSKv/KTM1 4zq2vq3Wow63Cd/qyWo6S4IVaEdfdGKVkUFn6FihJD/GxnDJkYJThwBYJpFAqJLj7FtDEiFz LXAkv0VBedKwHeBaOAVH6QEAEQEAAc0nTWF0aGlhcyBLcmF1c2UgPG1pbmlwbGlAZ3JzZWN1 cml0eS5uZXQ+wsERBBMBCgA7AhsDBQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAFiEEd7J359B9 wKgGsB94J4hPxYYBGYYFAmBbH/cCGQEACgkQJ4hPxYYBGYaX/gv/WYhaehD88XjpEO+yC6x7 bNWQbk7ea+m82fU2x/x6A9L4DN/BXIxqlONzk3ehvW3wt1hcHeF43q1M/z6IthtxSRi059RO SarzX3xfXC1pc5YMgCozgE0VRkxH4KXcijLyFFjanXe0HzlnmpIJB6zTT2jgI70q0FvbRpgc rs3VKSFb+yud17KSSN/ir1W2LZPK6er6actK03L92A+jaw+F8fJ9kJZfhWDbXNtEE0+94bMa cdDWTaZfy6XJviO3ymVe3vBnSDakVE0HwLyIKvfAEok+YzuSYm1Nbd2T0UxgSUZHYlrUUH0y tVxjEFyA+iJRSdm0rbAvzpwau5FOgxRQDa9GXH6ie6/ke2EuZc3STNS6EBciJm1qJ7xb2DTf SNyOiWdvop+eQZoznJJte931pxkRaGwV+JXDM10jGTfyV7KT9751xdn6b6QjQANTgNnGP3qs TO5oU3KukRHgDcivzp6CWb0X/WtKy0Y/54bTJvI0e5KsAz/0iwH19IB0vpYLzsDNBF4u6F8B DADwcu4TPgD5aRHLuyGtNUdhP9fqhXxUBA7MMeQIY1kLYshkleBpuOpgTO/ikkQiFdg13yIv q69q/feicsjaveIEe7hUI9lbWcB9HKgVXW3SCLXBMjhCGCNLsWQsw26gRxDy62UXRCTCT3iR qHP82dxPdNwXuOFG7IzoGBMm3vZbBeKn0pYYWz2MbTeyRHn+ZubNHqM0cv5gh0FWsQxrg1ss pnhcd+qgoynfuWAhrPD2YtNB7s1Vyfk3OzmL7DkSDI4+SzS56cnl9Q4mmnsVh9eyae74pv5w kJXy3grazD1lLp+Fq60Iilc09FtWKOg/2JlGD6ZreSnECLrawMPTnHQZEIBHx/VLsoyCFMmO 5P6gU0a9sQWG3F2MLwjnQ5yDPS4IRvLB0aCu+zRfx6mz1zYbcVToVxQqWsz2HTqlP2ZE5cdy BGrQZUkKkNH7oQYXAQyZh42WJo6UFesaRAPc3KCOCFAsDXz19cc9l6uvHnSo/OAazf/RKtTE 0xGB6mQN34UAEQEAAcLA9gQYAQoAIAIbDBYhBHeyd+fQfcCoBrAfeCeIT8WGARmGBQJeORkW AAoJECeIT8WGARmGXtgL/jM4NXaPxaIptPG6XnVWxhAocjk4GyoUx14nhqxHmFi84DmHUpMz 8P0AEACQ8eJb3MwfkGIiauoBLGMX2NroXcBQTi8gwT/4u4Gsmtv6P27Isn0hrY7hu7AfgvnK owfBV796EQo4i26ZgfSPng6w7hzCR+6V2ypdzdW8xXZlvA1D+gLHr1VGFA/ZCXvVcN1lQvIo S9yXo17bgy+/Xxi2YZGXf9AZ9C+g/EvPgmKrUPuKi7ATNqloBaN7S2UBJH6nhv618bsPgPqR SV11brVF8s5yMiG67WsogYl/gC2XCj5qDVjQhs1uGgSc9LLVdiKHaTMuft5gSR9hS5sMb/cL zz3lozuC5nsm1nIbY62mR25Kikx7N6uL7TAZQWazURzVRe1xq2MqcF+18JTDdjzn53PEbg7L VeNDGqQ5lJk+rATW2VAy8zasP2/aqCPmSjlCogC6vgCot9mj+lmMkRUxspxCHDEms13K41tH RzDVkdgPJkL/NFTKZHo5foFXNi89kA== In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit On 02.04.26 18:53, Edgecombe, Rick P wrote: > On Thu, 2026-04-02 at 18:04 +0200, Peter Zijlstra wrote: >>> However, in at least one case the UEFI firmware was involved and I >>> had to test&debug on bare metal. Having such a knob allows ruling >>> out or pin-pointing CET as the cause more easily. >> >> Fair enough, although this should probably have made it in the >> Changelog. >> >> Other than that, > > Some firmwares use supervisor shadow stack in SMM and have had issues > with CR4.CET set. But these were BIOS crashes. TIL! :D > > The other usefulness could be recovering from shadow stack crashes in > early userspace that block boot. Jepp. A chicken-bit is always nice to have, IMHO. > > Acked-by: Rick Edgecombe > > Could we add something to the docs though? As the 'ibt=off' commandline option lacks documentation as well, I don't think it's needed. There are other parameters, e.g. "debug-alternative", that are useful debugging tools but also lack documentation. The reason for that is likely that these switches are meant for developers and these can 'git grep -w __setup' easily to hunt for these. Thanks, Mathias