Re: F45 Change Proposal: Enable Shadow Stack by Default on x86_64 (system-wide)

> Have you done any comparative analysis of the performance impact of this
> change?

We expect the impact to be low since this is a CPU feature. However,
we do plan to conduct performance testing.

> > The only exception is applications that are fully Shadow Stack
> > compliant at startup and then use `dlopen` to load a shared object
> > without Shadow Stack markup at runtime. This will lead to a `dlopen`
> > failure.
>
> It looks like it can break NVIDIA cuda/drivers, Steam and other
> proprietary applications, and third-party FOSS builds.

We are exploring other compatibility mechanisms, particularly for
programs that are still single-threaded when they start dlopen'ing.
But there is certainly a compatibility cost.

> > 1. Shadow Stack hardware support is available on Intel 11th Generation
> > and newer CPUs, and AMD Zen3 and newer CPUs, so testing does not
> > require any special hardware except a recent enough x86_64 processor.
>
> What about older CPUs?

Execution on older CPUs without Shadow Stack support is completely
unaffected in any way. Fedora has been building and shipping SHSTK
enabled binaries since 2018.

-- 
_______________________________________________
devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new