From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f41.google.com (mail-wm1-f41.google.com [209.85.128.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CA08B280318 for ; Thu, 2 Apr 2026 15:59:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.41 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775145591; cv=none; b=eAoYUbejDRiX7AxWRY/G1kxkhgBr5HeVD2V9ATMMRx+MiPq7jOovDFFg/NOpNOJY+5UZQ0W8iBhyFLb63OU6C2bbmR7eSmVaIt06MqsSP5vM3FgDXytNS3P3P2pjtwzudqY0W1MzNeKTDkzoj54+qW08HTapKy73ha9Uj23KY/g= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775145591; c=relaxed/simple; bh=V66YhGj20kOkNVUnaTPHWK8fSeNj7bCOiV6OEAng2Uw=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=Yuw9IEeFsBXB6g+3xWbuREjB2RTn6kXWPU0owoKGtqA1gGolHYpyb0kFTy51fE/YBNh3OBaegmiGLWxImhRtrVmthZkHOP/gUF5CoHZFbt4qurFF1EYxK2dsuE6/bjVxzF/YUMU1kEPc8MaodP0ktEdTLR00TnoMZFdpMPiVpLQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=grsecurity.net; spf=pass smtp.mailfrom=opensrcsec.com; dkim=pass (2048-bit key) header.d=grsecurity.net header.i=@grsecurity.net header.b=aoDSyQEr; arc=none smtp.client-ip=209.85.128.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=grsecurity.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=opensrcsec.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=grsecurity.net header.i=@grsecurity.net header.b="aoDSyQEr" Received: by mail-wm1-f41.google.com with SMTP id 5b1f17b1804b1-482f454be5bso23408535e9.0 for ; Thu, 02 Apr 2026 08:59:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=grsecurity.net; s=grsec; t=1775145588; x=1775750388; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:autocrypt:from :content-language:references:cc:to:subject:user-agent:mime-version :date:message-id:from:to:cc:subject:date:message-id:reply-to; bh=vt9Li83W9lvl4RZEIpwMhOPavSsdD3D+4XgNJmGwT68=; b=aoDSyQErXGxSVVknxejD0+nZlWN8yimA87/g6yYKsOdD2xIk/u8UWb+KKInueB6f4r Vuqfl0YHTMNjRblygpLf0Q+Q1l+ia3h39LtHLX6VNpc9qGPVqPZhemk7wEBwNOfLUFnP DFjllgBhdwInbpmllUjcYhvXjtLx4ti4qMs+rAbIhrIVIuY74iOks7vyulMPgLBW25Nm gjBZCbsrvgGN+5XYKlSBxOD9Z10VrKY5iycoI7wAPQgFqHo9/QA88Mfb6v9ADrRkx5e0 XF77rRW9MoZsfm/buVx8dvgbjZV/XQPS+ehh+hAqskUowD2jdVcBqC2GbiZEoxiuBDE8 q6Ww== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1775145588; x=1775750388; h=content-transfer-encoding:in-reply-to:autocrypt:from :content-language:references:cc:to:subject:user-agent:mime-version :date:message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=vt9Li83W9lvl4RZEIpwMhOPavSsdD3D+4XgNJmGwT68=; b=G+yiEOtjo8r0dBiB0Birh6scA58a7BABISxlzYciQkT6MWU33VPLMWBDOCtQxibImU 3IQ3W5XflJhMNkNmrCQlOK3Ch4bdhxr9dUUT8aNjdryu0MXcohbctT80+dVhCG726DGH 3YiALQ66rGTdM0/sODWZh73L1pFgGZH01tf+yWnU/ExLlw/UaG8L/+a53TWdtz2TJJwy X79Xu9gGmMyfJ/66IMoKqsa6X4Ng0I1jNOD/58IYIzd7ldhrGyRkI6fAmVtdfJeqGj9U X33AYZwLtl8yWMcJXE9yZF8qc7OkFktQvavp+1WnVB58Qk0ZbiFD6mg6l+H/Qzse0YGc j50A== X-Forwarded-Encrypted: i=1; AJvYcCVxY08VjJNhTH37wE/Kyy8Sd7GcQSapLEKSpP29CvVKMtSLBHmV6xuAwu5jRiyLjGa1wOQB65UaOhWptxQ=@vger.kernel.org X-Gm-Message-State: AOJu0Yxa2H3zNatYhSCblUhvzDw7177OYX8qfOIJbc6pgqfzGmqTKu45 3Ng2JKcN180ju0UzXZsuQ1eUSoyloSm7dAO6oRy/X2xfJDWsCRnbBLmnf7l97XZXK7I= X-Gm-Gg: ATEYQzzxUD6/8hdjLYM0W6vainDtd2Bv1XX+T06wBkriOPcFLQ7r7FMqDxaONyOn8Bv +yYMJ9k5r5pcp1z/fJE5Tmg4RdHlnEUuVcakBLd6vgkLFDthFQs+TSJQZw9RGqVv6tktAMK2Tpo iuvzhuFDU7RU2ybcHWoXncSEQIRFiC6A7MUTbb/vFodFDjHxfxUgit/vM6uI5uF0QOslg6I1auW 373FAjPN1Eg05PXXFdQksqHA30eumfBE5wBklYWb8/i7zA6IkHljWbhFv1MJxroVmfLqyp8vbdg hG2Ol4CYwoIWa95h6p7hRXpNsAs3Avw16aY34SNvQ5NYqhd/mPgGqA6YNg9fQaTVQ0T0cRNWQby Rd1qPBSIgPS2lV5ANrextTGv9onou+bnqG4XPbHlzLvMwqOD+2jG5HoFHpLV/yuZ/dxqyXPGCVe 3vzx/THFKB97rfvDijZMgEk8cCQ8CBotno8tkKGzc+2B0R3Nw07nKLc7xxOFOTJGHhdH9VFVgUN JlF/knCspG4MoWxyHP7mUcJCnCyPpb+wYwMI/aR3FWni7/jNGj+6Dil X-Received: by 2002:a05:600c:4ece:b0:485:3428:774c with SMTP id 5b1f17b1804b1-4888e04f610mr43831945e9.4.1775145587961; Thu, 02 Apr 2026 08:59:47 -0700 (PDT) Received: from ?IPV6:2003:fa:af26:200:51a:ef03:a698:a1fc? (p200300faaf260200051aef03a698a1fc.dip0.t-ipconnect.de. [2003:fa:af26:200:51a:ef03:a698:a1fc]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4887a630922sm255941265e9.0.2026.04.02.08.59.47 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 02 Apr 2026 08:59:47 -0700 (PDT) Message-ID: Date: Thu, 2 Apr 2026 17:59:46 +0200 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] x86/shstk: Provide kernel command line knob to disable To: Peter Zijlstra Cc: Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org, Rick Edgecombe , linux-kernel@vger.kernel.org References: <20260402154405.1090935-1-minipli@grsecurity.net> <20260402155452.GD3739027@noisy.programming.kicks-ass.net> Content-Language: en-US, de-DE From: Mathias Krause Autocrypt: addr=minipli@grsecurity.net; keydata= xsDNBF4u6F8BDAC1kCIyATzlCiDBMrbHoxLywJSUJT9pTbH9MIQIUW8K1m2Ney7a0MTKWQXp 64/YTQNzekOmta1eZFQ3jqv+iSzfPR/xrDrOKSPrw710nVLC8WL993DrCfG9tm4z3faBPHjp zfXBIOuVxObXqhFGvH12vUAAgbPvCp9wwynS1QD6RNUNjnnAxh3SNMxLJbMofyyq5bWK/FVX 897HLrg9bs12d9b48DkzAQYxcRUNfL9VZlKq1fRbMY9jAhXTV6lcgKxGEJAVqXqOxN8DgZdU aj7sMH8GKf3zqYLDvndTDgqqmQe/RF/hAYO+pg7yY1UXpXRlVWcWP7swp8OnfwcJ+PiuNc7E gyK2QEY3z5luqFfyQ7308bsawvQcFjiwg+0aPgWawJ422WG8bILV5ylC8y6xqYUeSKv/KTM1 4zq2vq3Wow63Cd/qyWo6S4IVaEdfdGKVkUFn6FihJD/GxnDJkYJThwBYJpFAqJLj7FtDEiFz LXAkv0VBedKwHeBaOAVH6QEAEQEAAc0nTWF0aGlhcyBLcmF1c2UgPG1pbmlwbGlAZ3JzZWN1 cml0eS5uZXQ+wsERBBMBCgA7AhsDBQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAFiEEd7J359B9 wKgGsB94J4hPxYYBGYYFAmBbH/cCGQEACgkQJ4hPxYYBGYaX/gv/WYhaehD88XjpEO+yC6x7 bNWQbk7ea+m82fU2x/x6A9L4DN/BXIxqlONzk3ehvW3wt1hcHeF43q1M/z6IthtxSRi059RO SarzX3xfXC1pc5YMgCozgE0VRkxH4KXcijLyFFjanXe0HzlnmpIJB6zTT2jgI70q0FvbRpgc rs3VKSFb+yud17KSSN/ir1W2LZPK6er6actK03L92A+jaw+F8fJ9kJZfhWDbXNtEE0+94bMa cdDWTaZfy6XJviO3ymVe3vBnSDakVE0HwLyIKvfAEok+YzuSYm1Nbd2T0UxgSUZHYlrUUH0y tVxjEFyA+iJRSdm0rbAvzpwau5FOgxRQDa9GXH6ie6/ke2EuZc3STNS6EBciJm1qJ7xb2DTf SNyOiWdvop+eQZoznJJte931pxkRaGwV+JXDM10jGTfyV7KT9751xdn6b6QjQANTgNnGP3qs TO5oU3KukRHgDcivzp6CWb0X/WtKy0Y/54bTJvI0e5KsAz/0iwH19IB0vpYLzsDNBF4u6F8B DADwcu4TPgD5aRHLuyGtNUdhP9fqhXxUBA7MMeQIY1kLYshkleBpuOpgTO/ikkQiFdg13yIv q69q/feicsjaveIEe7hUI9lbWcB9HKgVXW3SCLXBMjhCGCNLsWQsw26gRxDy62UXRCTCT3iR qHP82dxPdNwXuOFG7IzoGBMm3vZbBeKn0pYYWz2MbTeyRHn+ZubNHqM0cv5gh0FWsQxrg1ss pnhcd+qgoynfuWAhrPD2YtNB7s1Vyfk3OzmL7DkSDI4+SzS56cnl9Q4mmnsVh9eyae74pv5w kJXy3grazD1lLp+Fq60Iilc09FtWKOg/2JlGD6ZreSnECLrawMPTnHQZEIBHx/VLsoyCFMmO 5P6gU0a9sQWG3F2MLwjnQ5yDPS4IRvLB0aCu+zRfx6mz1zYbcVToVxQqWsz2HTqlP2ZE5cdy BGrQZUkKkNH7oQYXAQyZh42WJo6UFesaRAPc3KCOCFAsDXz19cc9l6uvHnSo/OAazf/RKtTE 0xGB6mQN34UAEQEAAcLA9gQYAQoAIAIbDBYhBHeyd+fQfcCoBrAfeCeIT8WGARmGBQJeORkW AAoJECeIT8WGARmGXtgL/jM4NXaPxaIptPG6XnVWxhAocjk4GyoUx14nhqxHmFi84DmHUpMz 8P0AEACQ8eJb3MwfkGIiauoBLGMX2NroXcBQTi8gwT/4u4Gsmtv6P27Isn0hrY7hu7AfgvnK owfBV796EQo4i26ZgfSPng6w7hzCR+6V2ypdzdW8xXZlvA1D+gLHr1VGFA/ZCXvVcN1lQvIo S9yXo17bgy+/Xxi2YZGXf9AZ9C+g/EvPgmKrUPuKi7ATNqloBaN7S2UBJH6nhv618bsPgPqR SV11brVF8s5yMiG67WsogYl/gC2XCj5qDVjQhs1uGgSc9LLVdiKHaTMuft5gSR9hS5sMb/cL zz3lozuC5nsm1nIbY62mR25Kikx7N6uL7TAZQWazURzVRe1xq2MqcF+18JTDdjzn53PEbg7L VeNDGqQ5lJk+rATW2VAy8zasP2/aqCPmSjlCogC6vgCot9mj+lmMkRUxspxCHDEms13K41tH RzDVkdgPJkL/NFTKZHo5foFXNi89kA== In-Reply-To: <20260402155452.GD3739027@noisy.programming.kicks-ass.net> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit On 02.04.26 17:54, Peter Zijlstra wrote: > On Thu, Apr 02, 2026 at 05:44:05PM +0200, Mathias Krause wrote: >> Provide a kernel command line option 'shstk=off' to disable CET shadow >> stacks, much like 'ibt=off' can be used to disable CET IBT. >> >> With both set to off, it avoids setting CR4.CET on capable hardware to >> allow debugging related issues during early boot. > > Why though? I ran into related issues three times in the past now, where the lack of early exception handling and the lack of a knob to disable CR4.CET=1 enabling made debugging this a real PITA. Now, with QEMU having gained CET virtualization support, that may be less of an issue. However, in at least one case the UEFI firmware was involved and I had to test&debug on bare metal. Having such a knob allows ruling out or pin-pointing CET as the cause more easily. Thanks, Mathias