Re: [RFC][PATCH 20/24] x86/entry: Stash kernel SSP on FRED entry

[Andrew Cooper <andrew.cooper3@citrix.com>]

On 21/10/2026 8:51 pm, Dave Hansen wrote:
> Kernel shadow stacks are intended to preserve control flow integrity
> across all kinds of RIP transitions, not just strict CALLs. One of
> those transitions is when there is a kernel interrupt or exception
> and the kernel stops what it was doing and jumps over to
> asm_fred_entrypoint_kernel.
>
> On those jumps, FRED hardware writes a special frame to the shadow
> stack. That frame includes the return address of the interrupted
> kernel code. When returning from the event via ERETS, the hardware
> compares this shadow stack frame with the return address on the
> regular stack to ensure that they match.
>
> The kernel munges event return addresses for lots of reasons. But,
> with shadow stacks, it also needs to munge the corresponding
> shadow stack frame contents.
>
> Make it easy for RIP-munging code to locate the shadow stack frame.
> Stash off the shadow stack pointer so it sits adjacent to pt_regs.
> Without this, anything wishing to locate the special shadow stack
> frame would need to walk up the stack. I'm not opposed to doing
> it that way, this just seemed simpler for now.
>
> Note, since RDSSPQ is a NOP with shadow stacks off, this assembly
> is safe either way, although it does a unnecessary push/pop.

It's not unnecessary.  The data layout must match what Linux is compiled
with, which is an extra register by pt_regs, even if running on hardware
without shstk.

>
> ---
>
>  b/arch/x86/entry/entry_64_fred.S |   22 ++++++++++++++++++++++
>  1 file changed, 22 insertions(+)
>
> diff -puN arch/x86/entry/entry_64_fred.S~fred-entry-ssp-stash arch/x86/entry/entry_64_fred.S
> --- a/arch/x86/entry/entry_64_fred.S~fred-entry-ssp-stash	2026-10-21 12:36:42.552889917 -0700
> +++ b/arch/x86/entry/entry_64_fred.S	2026-10-21 12:36:42.555889923 -0700
> @@ -16,6 +16,26 @@
>  	.code64
>  	.section .noinstr.text, "ax"
>  
> +/*
> + * Kernel-mode events: save the SSP of the shadow stack frame FRED
> + * pushed (old SSP, LIP, CS) just below pt_regs. See struct
> + * fred_kernel_frame.
> + */
> +.macro PUSH_KERNEL_EVENT_SSP
> +#ifdef CONFIG_X86_USER_SHADOW_STACK
> +	xorl	%eax, %eax
> +	rdsspq	%rax		/* nop if shadow stacks are off  */
> +	pushq	%rax
> +	UNWIND_HINT_REGS offset=8
> +#endif
> +.endm
> +
> +.macro POP_KERNEL_EVENT_SSP
> +#ifdef CONFIG_X86_USER_SHADOW_STACK
> +	addq	$8, %rsp
> +#endif
> +.endm
> +
>  .macro FRED_ENTER
>  	UNWIND_HINT_END_OF_STACK
>  	ANNOTATE_NOENDBR
> @@ -54,7 +74,9 @@ SYM_CODE_END(asm_fred_entrypoint_user)
>  	.org asm_fred_entrypoint_user + 256, 0xcc
>  SYM_CODE_START_NOALIGN(asm_fred_entrypoint_kernel)
>  	FRED_ENTER
> +	PUSH_KERNEL_EVENT_SSP
>  	call	fred_entry_from_kernel
> +	POP_KERNEL_EVENT_SSP
>  	FRED_EXIT
>  	ERETS
>  SYM_CODE_END(asm_fred_entrypoint_kernel)
> _

This only works because FRED_ENTER loads %rsp into %rdi before
PUSH_KERNEL_EVENT_SSP pushes SSP, and having that all hidden is rather rude.

Also, you mean X86_KERN_SHADOW_STACK here, rather than USER.

Personally, I'd suggest:

diff --git a/arch/x86/entry/entry_64_fred.S b/arch/x86/entry/entry_64_fred.S
index b98f8945dfff..9a17dd7e2a96 100644
--- a/arch/x86/entry/entry_64_fred.S
+++ b/arch/x86/entry/entry_64_fred.S
@@ -16,15 +16,27 @@
        .code64
        .section .noinstr.text, "ax"
 
-.macro FRED_ENTER
+.macro FRED_ENTER ssp=0
        UNWIND_HINT_END_OF_STACK
        ANNOTATE_NOENDBR
        PUSH_AND_CLEAR_REGS
        ENCODE_FRAME_POINTER
        movq    %rsp, %rdi      /* %rdi -> pt_regs */
+
+#ifdef CONFIG_X86_KERN_SHADOW_STACK
+       .if \ssp
+       rdsspq  %rax /* NOP if SHSTK is off.  Pre-zeroed. */
+       push    %rax
+       .endif
+#endif
 .endm
 
-.macro FRED_EXIT
+.macro FRED_EXIT ssp=0
+#ifdef CONFIG_X86_KERN_SHADOW_STACK
+       .if \ssp
+       pop     %rax /* Any dead register */
+       .endif
+#endif
        UNWIND_HINT_REGS
        POP_REGS
 .endm
@@ -53,9 +65,9 @@ SYM_CODE_END(asm_fred_entrypoint_user)
  */
        .org asm_fred_entrypoint_user + 256, 0xcc
 SYM_CODE_START_NOALIGN(asm_fred_entrypoint_kernel)
-       FRED_ENTER
+       FRED_ENTER ssp=1
        call    fred_entry_from_kernel
-       FRED_EXIT
+       FRED_EXIT ssp=1
        ERETS
 SYM_CODE_END(asm_fred_entrypoint_kernel)
 

This at least lets you see the relationship between %rdi and what's on
the stack.

Of note,

* You don't need to re-zero the GPR.  They're all 0.
*  You want to use POP rather than ADD %rsp to avoid taking a stack
engine stall in FRED_EXIT.

~Andrew