Re: [PATCH] x86/Kconfig: make CFI_AUTO_DEFAULT depend on !RUST

[Peter Zijlstra]

On Wed, Apr 16, 2025 at 02:51:55PM -0700, Kees Cook wrote:
> On Wed, Apr 16, 2025 at 10:20:40PM +0200, Peter Zijlstra wrote:
> > On Tue, Apr 15, 2025 at 05:15:31PM +0200, Miguel Ojeda wrote:
> > > On Thu, Apr 10, 2025 at 4:00 PM Alice Ryhl <aliceryhl@xxxxxxxxxx> wrote:
> > > >
> > > > I submitted a PR that I believe should fix it:
> > > > https://github.com/rust-lang/rust/pull/139632
> > > 
> > > This landed, scheduled for Rust 1.88 (2025-06-26) if all goes well.
> > > 
> > > Peter: are you OK with landing a patch like this? Well, modified to
> > > look like this now that we know the version:
> > > 
> > >     depends on FINEIBT
> > >     depends on !RUST || RUSTC_VERSION >= 108800
> > > 
> > > (assuming we confirm the nightly build works properly)
> > 
> > I don't much like it -- disabling FineIBT at config time like this also
> > kills the CFI type rehash.
> 
> This isn't disabling CONFIG_FINEIBT (which gates cfi_rand), it's making
> FineIBT not enabled by default at boot time. This is actually when I
> created CONFIG_CFI_AUTO_DEFAULT: to be able to have kCFI _with_ type
> rehashing still enabled.

Urgh, yeah, reading hard :-/

OK, Ack