Re: [PATCH] x86/Kconfig: make CFI_AUTO_DEFAULT depend on !RUST

[Kees Cook]

On Wed, Apr 16, 2025 at 10:20:40PM +0200, Peter Zijlstra wrote:
> On Tue, Apr 15, 2025 at 05:15:31PM +0200, Miguel Ojeda wrote:
> > On Thu, Apr 10, 2025 at 4:00 PM Alice Ryhl <aliceryhl@xxxxxxxxxx> wrote:
> > >
> > > I submitted a PR that I believe should fix it:
> > > https://github.com/rust-lang/rust/pull/139632
> > 
> > This landed, scheduled for Rust 1.88 (2025-06-26) if all goes well.
> > 
> > Peter: are you OK with landing a patch like this? Well, modified to
> > look like this now that we know the version:
> > 
> >     depends on FINEIBT
> >     depends on !RUST || RUSTC_VERSION >= 108800
> > 
> > (assuming we confirm the nightly build works properly)
> 
> I don't much like it -- disabling FineIBT at config time like this also
> kills the CFI type rehash.

This isn't disabling CONFIG_FINEIBT (which gates cfi_rand), it's making
FineIBT not enabled by default at boot time. This is actually when I
created CONFIG_CFI_AUTO_DEFAULT: to be able to have kCFI _with_ type
rehashing still enabled.

> Not to mention that FineIBT is a Spectre-BHI
> mitigation, esp. with that arity thing on top.

That's certainly true, but the needed overlapping corner cases seem to
make this tolerable?

> I don't suppose we can simply mandate this rust version?

Perhaps capture the needed version in the Kconfig change at least, so it
becomes self-documenting.

-Kees

-- 
Kees Cook