Re: [RFC][PATCH 12/24] x86/cea: Map and use FRED exception shadow stacks

[Peter Zijlstra]

On Wed, Oct 21, 2026 at 12:51:36PM -0700, Dave Hansen wrote:
> 
> FRED hardware automatically switches stacks between levels on different
> kinds of kernel entries. Each normal FRED "RSP" stack has a corresponding
> "SSP" shadow stack.
> 
> Leverage the existing CPU Entry Area infrastructure. Add shadow stacks
> for levels 1-3 right next to the existing RSP stacks. Map them with
> shadow stack permissions. Last, point the FRED SSP MSRs at the exception
> stacks.
> 
> Just like the task stacks, do not leave a guard page since regular and
> shadow stacks have mutually exclusive permissions and serve as guards
> for each other.
> 
> Nit: The "return style" of the new cea_map_stack() and wrmsr() code
> looks superficially inconsistent. But each site is consistent with the
> code around it, just not when looking at the two sites against each
> other.
> 
> == Future Work ==
> 
> The *_stack_guard[] elements could probably be removed now. When in
> use, shadow stacks serve as guard pages for the regular stacks. When
> not in use, the shadow stack region could remain unmapped and also act
> as a guard area. But that would take some more fancy dynamic mapping
> work. The existing CEA code is dirt simple and doing anything dynamic
> would add complexity. KISS. The downside is wasting three pages per
> CPU when shadow stacks support is compiled in but not used at runtime.

People were trying to *shrink* stacks ;-)