[RFC][PATCH 12/24] x86/cea: Map and use FRED exception shadow stacks

[Dave Hansen]

FRED hardware automatically switches stacks between levels on different
kinds of kernel entries. Each normal FRED "RSP" stack has a corresponding
"SSP" shadow stack.

Leverage the existing CPU Entry Area infrastructure. Add shadow stacks
for levels 1-3 right next to the existing RSP stacks. Map them with
shadow stack permissions. Last, point the FRED SSP MSRs at the exception
stacks.

Just like the task stacks, do not leave a guard page since regular and
shadow stacks have mutually exclusive permissions and serve as guards
for each other.

Nit: The "return style" of the new cea_map_stack() and wrmsr() code
looks superficially inconsistent. But each site is consistent with the
code around it, just not when looking at the two sites against each
other.

== Future Work ==

The *_stack_guard[] elements could probably be removed now. When in
use, shadow stacks serve as guard pages for the regular stacks. When
not in use, the shadow stack region could remain unmapped and also act
as a guard area. But that would take some more fancy dynamic mapping
work. The existing CEA code is dirt simple and doing anything dynamic
would add complexity. KISS. The downside is wasting three pages per
CPU when shadow stacks support is compiled in but not used at runtime.

---

 b/arch/x86/include/asm/cpu_entry_area.h |   15 +++++++++++++++
 b/arch/x86/kernel/fred.c                |   14 ++++++++++++++
 b/arch/x86/mm/cpu_entry_area.c          |    5 +++++
 3 files changed, 34 insertions(+)

diff -puN arch/x86/include/asm/cpu_entry_area.h~cea-estacks-shadows-1 arch/x86/include/asm/cpu_entry_area.h
--- a/arch/x86/include/asm/cpu_entry_area.h~cea-estacks-shadows-1	2026-10-21 12:36:38.292881759 -0700
+++ b/arch/x86/include/asm/cpu_entry_area.h	2026-10-21 12:36:38.320881812 -0700
@@ -10,6 +10,12 @@
 
 #ifdef CONFIG_X86_64
 
+#ifdef CONFIG_X86_KERN_SHADOW_STACK
+#define EXCEPTION_SHADOW_STKSZ	PAGE_SIZE
+#else
+#define EXCEPTION_SHADOW_STKSZ	0
+#endif
+
 #ifdef CONFIG_AMD_MEM_ENCRYPT
 #define VC_EXCEPTION_STKSZ	EXCEPTION_STKSZ
 #else
@@ -19,10 +25,13 @@
 /* Macro to enforce the same ordering and stack sizes */
 #define ESTACKS_MEMBERS(guardsize, optional_stack_size)		\
 	char	DF_stack_guard[guardsize];			\
+	char	DF_shadow_stack[EXCEPTION_SHADOW_STKSZ];	\
 	char	DF_stack[EXCEPTION_STKSZ];			\
 	char	NMI_stack_guard[guardsize];			\
+	char	NMI_shadow_stack[EXCEPTION_SHADOW_STKSZ];	\
 	char	NMI_stack[EXCEPTION_STKSZ];			\
 	char	DB_stack_guard[guardsize];			\
+	char	DB_shadow_stack[EXCEPTION_SHADOW_STKSZ];	\
 	char	DB_stack[EXCEPTION_STKSZ];			\
 	char	MCE_stack_guard[guardsize];			\
 	char	MCE_stack[EXCEPTION_STKSZ];			\
@@ -151,4 +160,10 @@ static __always_inline struct entry_stac
 #define __this_cpu_ist_bottom_va(name)					\
 	CEA_ESTACK_BOT(__this_cpu_read(cea_exception_stacks), name, stack)
 
+#define __this_cpu_shadow_bottom_va(name)				\
+	CEA_ESTACK_BOT(__this_cpu_read(cea_exception_stacks), name, shadow_stack)
+
+#define __this_cpu_shadow_top_va(name)					\
+	CEA_ESTACK_TOP(__this_cpu_read(cea_exception_stacks), name, shadow_stack)
+
 #endif
diff -puN arch/x86/kernel/fred.c~cea-estacks-shadows-1 arch/x86/kernel/fred.c
--- a/arch/x86/kernel/fred.c~cea-estacks-shadows-1	2026-10-21 12:36:38.294881762 -0700
+++ b/arch/x86/kernel/fred.c	2026-10-21 12:36:38.320881812 -0700
@@ -87,4 +87,18 @@ void cpu_init_fred_rsps(void)
 	wrmsrq(MSR_IA32_FRED_RSP1, __this_cpu_ist_top_va(DB));
 	wrmsrq(MSR_IA32_FRED_RSP2, __this_cpu_ist_top_va(NMI));
 	wrmsrq(MSR_IA32_FRED_RSP3, __this_cpu_ist_top_va(DF));
+
+	if (!cpu_has(&boot_cpu_data, X86_FEATURE_SHSTK))
+		return;
+
+	/*
+	 * ...and the FRED shadow stacks when supported by the CPU.
+	 *
+	 * Note that this is strictly checking CPU support, not the
+	 * kernel feature flag: X86_FEATURE_KERN_SHSTK. These MSRs
+	 * may get set and then never used.
+	 */
+	wrmsrq(MSR_IA32_FRED_SSP1, __this_cpu_shadow_top_va(DB));
+	wrmsrq(MSR_IA32_FRED_SSP2, __this_cpu_shadow_top_va(NMI));
+	wrmsrq(MSR_IA32_FRED_SSP3, __this_cpu_shadow_top_va(DF));
 }
diff -puN arch/x86/mm/cpu_entry_area.c~cea-estacks-shadows-1 arch/x86/mm/cpu_entry_area.c
--- a/arch/x86/mm/cpu_entry_area.c~cea-estacks-shadows-1	2026-10-21 12:36:38.318881808 -0700
+++ b/arch/x86/mm/cpu_entry_area.c	2026-10-21 12:36:38.321881814 -0700
@@ -162,6 +162,11 @@ static void __init percpu_setup_exceptio
 			cea_map_stack(VC2, stack, PAGE_KERNEL);
 		}
 	}
+
+	/* Map the per-CPU exception shadow stacks: */
+	cea_map_stack(DB,  shadow_stack, PAGE_KERNEL_SHSTK);
+	cea_map_stack(NMI, shadow_stack, PAGE_KERNEL_SHSTK);
+	cea_map_stack(DF,  shadow_stack, PAGE_KERNEL_SHSTK);
 }
 #else
 static void __init percpu_setup_exception_stacks(unsigned int cpu)
_