Re: [RFC][PATCH 00/24] x86 Kernel Shadow Stacks

[Edgecombe, Rick P]

On Fri, 2026-10-23 at 03:21 +0100, Andrew Cooper wrote:
> >   * Add a "warn on #CP and continue". Good for debugging. But, bad
> >     for security. Ideally, a secure kernel would have no easy to
> >     reach gadgets to disable shadow stacks.
> 
> This looks attractive at first glance, but it's really not.  There is no
> safe way to turn CET-SS off.
> 
> WRSS, RSTORSSP and INCSSP will #UD when you turn CET-SS off, and even
> logic such as
> 
>     if (!ssef)
>         return;
>     wrss(ip, &ssef->ssef_lip);
> 
> in regs_set_return_ip() will die with a #UD as you're attempting to not
> die from a #CP.

Yea.

> 
> I suggest just leave CET-SS on and power through the reports.  It will
> probably be faster overall, and it will definitely be a better end result.

It still can't remove all side effects though. Like if your shadow stack issue
is causing underflowing the shadow stack you will get a #PF instead of #CP.

I think there is just various levels of best efforts you can do to keep things
functional.