[RFC][PATCH 08/24] x86/cpu: Add basic x86 kernel shadow stack infrastructure
From: Dave Hansen
Date: Wed Oct 21 2026 - 15:52:20 EST
Add a kernel shadow stack CPU feature and Kconfig option. Enable it
to help compile testing during development. This polarity will be
flipped in the eventual merge-ready code. TODO/FIXME.
Add the feature bit next to the userspace one. This requires a
minor amount of reshuffling of software bits.
On the naming, use "KERN" to make for nice natural vertical alignment
with "USER".
The Kconfig dependencies are not "real" yet. They represent the
dependencies present in the coming implementation.
---
b/arch/x86/Kconfig | 9 +++++++++
b/arch/x86/Kconfig.cpufeatures | 5 +++++
b/arch/x86/include/asm/cpufeatures.h | 9 +++++----
b/arch/x86/kernel/cpu/common.c | 14 ++++++++++----
4 files changed, 29 insertions(+), 8 deletions(-)
diff -puN arch/x86/include/asm/cpufeatures.h~x86-kernel-shadow-stacks-base arch/x86/include/asm/cpufeatures.h
--- a/arch/x86/include/asm/cpufeatures.h~x86-kernel-shadow-stacks-base 2026-10-21 12:36:36.156877670 -0700
+++ b/arch/x86/include/asm/cpufeatures.h 2026-10-21 12:36:36.187877729 -0700
@@ -309,10 +309,10 @@
#define X86_FEATURE_SMBA (11*32+21) /* Slow Memory Bandwidth Allocation */
#define X86_FEATURE_BMEC (11*32+22) /* Bandwidth Monitoring Event Configuration */
#define X86_FEATURE_USER_SHSTK (11*32+23) /* "user_shstk" Shadow stack support for user mode applications */
-#define X86_FEATURE_SRSO (11*32+24) /* AMD BTB untrain RETs */
-#define X86_FEATURE_SRSO_ALIAS (11*32+25) /* AMD BTB untrain RETs through aliasing */
-#define X86_FEATURE_IBPB_ON_VMEXIT (11*32+26) /* Issue an IBPB only on VMEXIT */
-#define X86_FEATURE_APIC_MSRS_FENCE (11*32+27) /* IA32_TSC_DEADLINE and X2APIC MSRs need fencing */
+#define X86_FEATURE_KERN_SHSTK (11*32+24) /* Kernel Shadow stack support */
+#define X86_FEATURE_SRSO (11*32+25) /* AMD BTB untrain RETs */
+#define X86_FEATURE_SRSO_ALIAS (11*32+26) /* AMD BTB untrain RETs through aliasing */
+#define X86_FEATURE_IBPB_ON_VMEXIT (11*32+27) /* Issue an IBPB only on VMEXIT */
#define X86_FEATURE_ZEN2 (11*32+28) /* CPU based on Zen2 microarchitecture */
#define X86_FEATURE_ZEN3 (11*32+29) /* CPU based on Zen3 microarchitecture */
#define X86_FEATURE_ZEN4 (11*32+30) /* CPU based on Zen4 microarchitecture */
@@ -430,6 +430,7 @@
#define X86_FEATURE_SUCCOR (17*32+ 1) /* "succor" Uncorrectable error containment and recovery */
#define X86_FEATURE_CPPC_PERF_PRIO (17*32+ 2) /* CPPC Floor Perf support */
#define X86_FEATURE_SMCA (17*32+ 3) /* "smca" Scalable MCA */
+#define X86_FEATURE_APIC_MSRS_FENCE (17*32+ 4) /* IA32_TSC_DEADLINE and X2APIC MSRs need fencing */
/* Intel-defined CPU features, CPUID level 0x00000007:0 (EDX), word 18 */
#define X86_FEATURE_AVX512_4VNNIW (18*32+ 2) /* "avx512_4vnniw" AVX-512 Neural Network Instructions */
diff -puN arch/x86/Kconfig~x86-kernel-shadow-stacks-base arch/x86/Kconfig
--- a/arch/x86/Kconfig~x86-kernel-shadow-stacks-base 2026-10-21 12:36:36.166877689 -0700
+++ b/arch/x86/Kconfig 2026-10-21 12:36:36.189877733 -0700
@@ -1865,6 +1865,15 @@ config X86_USER_SHADOW_STACK
If unsure, say N.
+config X86_KERN_SHADOW_STACK
+ bool "X86 kernel shadow stack"
+ depends on X86_FRED # implies X86_64
+ # Shadow stacks are allocated next to the
+ # regular stack in the VMAP area:
+ depends on VMAP_STACK
+ depends on AS_WRUSS
+ select X86_CET
+
config INTEL_TDX_HOST
bool "Intel Trust Domain Extensions (TDX) host support"
depends on CPU_SUP_INTEL
diff -puN arch/x86/Kconfig.cpufeatures~x86-kernel-shadow-stacks-base arch/x86/Kconfig.cpufeatures
--- a/arch/x86/Kconfig.cpufeatures~x86-kernel-shadow-stacks-base 2026-10-21 12:36:36.168877693 -0700
+++ b/arch/x86/Kconfig.cpufeatures 2026-10-21 12:36:36.189877733 -0700
@@ -205,3 +205,8 @@ config X86_DISABLED_FEATURE_SEV_SNP
config X86_DISABLED_FEATURE_INVLPGB
def_bool y
depends on !BROADCAST_TLB_FLUSH
+
+config X86_DISABLED_FEATURE_KERN_SHSTK
+ def_bool y
+ depends on !X86_KERN_SHADOW_STACK
+
diff -puN arch/x86/kernel/cpu/common.c~x86-kernel-shadow-stacks-base arch/x86/kernel/cpu/common.c
--- a/arch/x86/kernel/cpu/common.c~x86-kernel-shadow-stacks-base 2026-10-21 12:36:36.184877724 -0700
+++ b/arch/x86/kernel/cpu/common.c 2026-10-21 12:36:36.189877733 -0700
@@ -634,20 +634,26 @@ __noendbr void ibt_restore(u64 save)
static __always_inline void setup_cet(struct cpuinfo_x86 *c)
{
- bool user_shstk, kernel_ibt;
+ bool user_shstk = 0;
+ bool kern_shstk = 0;
+ bool kernel_ibt;
if (!IS_ENABLED(CONFIG_X86_CET))
return;
kernel_ibt = HAS_KERNEL_IBT && cpu_feature_enabled(X86_FEATURE_IBT);
- user_shstk = cpu_feature_enabled(X86_FEATURE_SHSTK) &&
- IS_ENABLED(CONFIG_X86_USER_SHADOW_STACK);
+ if (cpu_feature_enabled(X86_FEATURE_SHSTK)) {
+ user_shstk = IS_ENABLED(CONFIG_X86_USER_SHADOW_STACK);
+ kern_shstk = IS_ENABLED(CONFIG_X86_KERN_SHADOW_STACK);
+ }
- if (!kernel_ibt && !user_shstk)
+ if (!kernel_ibt && !user_shstk && !kern_shstk)
return;
if (user_shstk)
set_cpu_cap(c, X86_FEATURE_USER_SHSTK);
+ if (kern_shstk)
+ set_cpu_cap(c, X86_FEATURE_KERN_SHSTK);
if (kernel_ibt)
wrmsrq(MSR_IA32_S_CET, CET_ENDBR_EN);
_