[RFC][PATCH 21/24] x86/extable: Update shadow stack entry frame during RIP overwrites

[Dave Hansen]

Previous work stashed the entry SSP value on the regular (RSP) stack.
Use that stashed value to locate the FRED entry frame on the shadow
stack. Update the "LIP" value in that frame to match the updated
regs->rip value.

The now-matching values will keep FRED happy during ERETS.

Also include a stub function for non-CET builds.

This "rewrite rip" infrastructure will get used in quite a few other
locations. The extable site is the most critical. Do it first. A
normal kernel won't boot without it because it allows kernel
exceptions to be "stepped over" for "safe" variants like wrmsr_safe().

---

 b/arch/x86/include/asm/insn-eval.h     |   12 +++++++
 b/arch/x86/include/asm/special_insns.h |    7 ++++
 b/arch/x86/kernel/cet.c                |   54 +++++++++++++++++++++++++++++++++
 b/arch/x86/mm/extable.c                |    2 -
 4 files changed, 74 insertions(+), 1 deletion(-)

diff -puN arch/x86/include/asm/insn-eval.h~fred-entry-ssp-muck arch/x86/include/asm/insn-eval.h
--- a/arch/x86/include/asm/insn-eval.h~fred-entry-ssp-muck	2026-10-21 12:36:43.032890836 -0700
+++ b/arch/x86/include/asm/insn-eval.h	2026-10-21 12:36:43.041890854 -0700
@@ -82,4 +82,16 @@ static inline void insn_assign_reg(unsig
 	}
 }
 
+#ifdef CONFIG_X86_CET
+void regs_set_return_ip(struct pt_regs *regs, unsigned long ip);
+#else
+static inline void regs_set_return_ip(struct pt_regs *regs, unsigned long ip)
+{
+	/* This is only for changing kernel return addresses: */
+	WARN_ON_ONCE(user_mode(regs));
+
+	regs->ip = ip;
+}
+#endif
+
 #endif /* _ASM_X86_INSN_EVAL_H */
diff -puN arch/x86/include/asm/special_insns.h~fred-entry-ssp-muck arch/x86/include/asm/special_insns.h
--- a/arch/x86/include/asm/special_insns.h~fred-entry-ssp-muck	2026-10-21 12:36:43.034890840 -0700
+++ b/arch/x86/include/asm/special_insns.h	2026-10-21 12:36:43.042890856 -0700
@@ -303,6 +303,13 @@ static __always_inline void tile_release
 	asm volatile(".byte 0xc4, 0xe2, 0x78, 0x49, 0xc0");
 }
 
+static __always_inline void wrss(u64 val, u64 *addr)
+{
+	asm volatile("wrssq %[val], %[addr]"
+		     : [addr] "=m" (*addr)
+		     : [val] "r" (val));
+}
+
 #endif /* __KERNEL__ */
 
 #endif /* _ASM_X86_SPECIAL_INSNS_H */
diff -puN arch/x86/kernel/cet.c~fred-entry-ssp-muck arch/x86/kernel/cet.c
--- a/arch/x86/kernel/cet.c~fred-entry-ssp-muck	2026-10-21 12:36:43.036890844 -0700
+++ b/arch/x86/kernel/cet.c	2026-10-21 12:36:43.042890856 -0700
@@ -4,6 +4,8 @@
 #include <asm/bugs.h>
 #include <asm/msr.h>
 #include <asm/traps.h>
+#include <asm/insn-eval.h>
+#include <asm/special_insns.h>
 
 enum cp_error_code {
 	CP_EC        = (1 << 15) - 1,
@@ -160,3 +162,55 @@ DEFINE_IDTENTRY_ERRORCODE(exc_control_pr
 			do_unexpected_cp(regs, error_code);
 	}
 }
+
+/*
+ * FRED hardware pushes this frame on to the shadow stack for
+ * kernel=>kernel entry. First (lowest address) in this struct
+ * is the last entry pushed by the hardware.
+ */
+struct fred_shstk_entry_frame {
+	u64 ssef_ssp;
+	u64 ssef_lip;
+	u64 ssef_cs;
+};
+
+/*
+ * The kernel=>kernel entry code pushes SSP on to the entry stack.
+ * This only occurs for kernel=>kernel entry. Not userspace.
+ *
+ * SSP is pushed on to the frame below pt_regs. At the point it is
+ * pushed, it points to a special FRED entry frame.
+ */
+struct fred_kernel_frame {
+	struct fred_shstk_entry_frame *ssef;
+	struct pt_regs regs;
+};
+
+/*
+ * Change the return IP of an event. Use this instead of directly
+ * manipulating regs->ip.
+ *
+ * The hardware saves a special FRED entry frame on to the shadow
+ * stack. It contains the RIP of the interrupted context. ERETS
+ * ensures that this matches regs->ip.
+ *
+ * Update the FRED entry frame in addition to regs->ip.
+ */
+void regs_set_return_ip(struct pt_regs *regs, unsigned long ip)
+{
+	struct fred_shstk_entry_frame *ssef;
+
+	regs->ip = ip;
+
+	if (!cpu_feature_enabled(X86_FEATURE_KERN_SHSTK))
+		return;
+
+	/* Only kernel-mode events save the 'ssef' pointer. */
+	WARN_ON_ONCE(user_mode(regs));
+
+	ssef = container_of(regs, struct fred_kernel_frame, regs)->ssef;
+	if (!ssef)
+		return;
+
+	wrss(ip, &ssef->ssef_lip);
+}
diff -puN arch/x86/mm/extable.c~fred-entry-ssp-muck arch/x86/mm/extable.c
--- a/arch/x86/mm/extable.c~fred-entry-ssp-muck	2026-10-21 12:36:43.039890850 -0700
+++ b/arch/x86/mm/extable.c	2026-10-21 12:36:43.042890856 -0700
@@ -38,7 +38,7 @@ static bool ex_handler_default(const str
 	if (e->data & EX_FLAG_CLEAR_DX)
 		regs->dx = 0;
 
-	regs->ip = ex_fixup_addr(e);
+	regs_set_return_ip(regs, ex_fixup_addr(e));
 	return true;
 }
 
_