enable Intel CET #22128

Open
opened 2026-01-31 08:04:18 +00:00 by claunia · 3 comments
Owner

Originally created by @Andarwinux on GitHub (Aug 22, 2024).

Description of the new feature/enhancement

Compile Windows Terminal with /guard:ehcont and link with /guard:ehcont /cetcompat

Proposed technical implementation details (optional)

Originally created by @Andarwinux on GitHub (Aug 22, 2024). <!-- 🚨🚨🚨🚨🚨🚨🚨🚨🚨🚨 I ACKNOWLEDGE THE FOLLOWING BEFORE PROCEEDING: 1. If I delete this entire template and go my own path, the core team may close my issue without further explanation or engagement. 2. If I list multiple bugs/concerns in this one issue, the core team may close my issue without further explanation or engagement. 3. If I write an issue that has many duplicates, the core team may close my issue without further explanation or engagement (and without necessarily spending time to find the exact duplicate ID number). 4. If I leave the title incomplete when filing the issue, the core team may close my issue without further explanation or engagement. 5. If I file something completely blank in the body, the core team may close my issue without further explanation or engagement. All good? Then proceed! --> # Description of the new feature/enhancement Compile Windows Terminal with `/guard:ehcont` and link with `/guard:ehcont /cetcompat` <!-- A clear and concise description of what the problem is that the new feature would solve. Describe why and how a user would use this new functionality (if applicable). --> # Proposed technical implementation details (optional) <!-- A clear and concise description of what you want to happen. -->
claunia added the Issue-TaskProduct-MetaArea-CodeHealth labels 2026-01-31 08:04:19 +00:00
Author
Owner

@lhecker commented on GitHub (Aug 22, 2024):

These flags are used by default for other system binaries (including inbox conhost). It may be worth checking how much these flags cost us in performance and/or binary size and to enable them.

@lhecker commented on GitHub (Aug 22, 2024): These flags are used by default for other system binaries (including inbox conhost). It may be worth checking how much these flags cost us in performance and/or binary size and to enable them.
Author
Owner

@DHowett commented on GitHub (Aug 22, 2024):

For what it's worth, we're building with the security configuration baseline established by Windows Undocked.
The build system we're using enforces that baseline and does not seem to be signaling us as out-of-compliance.

@DHowett commented on GitHub (Aug 22, 2024): For what it's worth, we're building with the security configuration baseline established by Windows Undocked. The build system we're using enforces that baseline and does not seem to be signaling us as out-of-compliance.
Author
Owner

@Andarwinux commented on GitHub (Aug 30, 2024):

I can't test ehcont, but cetcompat seems to be fine, I forced hardware-enforced stack protection for Windows Terminal via WD on tigerlake and znver4 and didn't notice any performance impact.

@Andarwinux commented on GitHub (Aug 30, 2024): I can't test ehcont, but cetcompat seems to be fine, I forced hardware-enforced stack protection for Windows Terminal via WD on tigerlake and znver4 and didn't notice any performance impact.
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/terminal#22128