Re: [PATCH v3] x86/cpufeatures: Make X86_FEATURE_SHSTK clearcpuid-able

[Edgecombe, Rick P]

On Thu, 2026-05-14 at 18:59 +0200, Borislav Petkov wrote:
> On Thu, May 14, 2026 at 06:09:32PM +0200, Mathias Krause wrote:
> > Allow X86_FEATURE_SHST to be disabled through the kernel commandline via
> > 'clearcpuid=shstk' as 'nousershstk' would still enable CR4.CET even if
> > no CET features are in use.
> 
> clearcpuid= taints the kernel because that cmdline option is not supposed to
> be used except for debugging crap... and alas people are still using it. No
> wonder... :-\

Do we want a non-taint version of this capability? That was Mathias' original
approach, but his use was just debugging. So hence, this.

Also, have you ever thought about keeping a list of approved clearcpuid values
that are supported for normal runtime. People could use it to turn off features
without picking up a taint? Like maybe people want to turn off something for
performance reasons or something. Then we can have one interface for it all,
instead of various nousershstk-like flags. Not sure if it's a good.

> 
> Anyway, "nousershstk" should disable the CR4 bit too.

Mathias, I can send a patch for this if you want to be done with this.