Intel Submits Long-Awaited Shadow Stack Support For Linux 6.4

[phoronix]

Phoronix: Intel Submits Long-Awaited Shadow Stack Support For Linux 6.4

While Intel Shadow Stack support has been around since Tiger Lake CPUs as part of Intel's Control-flow Enforcement Technology (CET), finally for the Linux 6.4 kernel is this security feature being enabled with the mainline Linux kernel...

https://www.phoronix.com/news/Shadow-Stack-PR-For-Linux-6.4

[NotMine999]

The words "Intel" and "security" used together sends cold shivers down my spine.

[MadWatch]

Does this protect only the kernel or also user space applications?

[xorbe]

Does this protect only the kernel or also user space applications?

I believe it is intended to be active at all times, as it has separate shadows for each, iirc. What I want to see is the final performance hit.

[arjan_intel]

Does this protect only the kernel or also user space applications?

This specifically is for protecting userspace applications. Note that another part of CET called IBT is already in use by the kernel today (it got added around 5.19) for kernel side protection
(assuming you select the KConfig for it but I suspect all distros do that by now)

[ssokolow]

I believe it is intended to be active at all times, as it has separate shadows for each, iirc. What I want to see is the final performance hit.

Hopefully, negligible, since it should just be adding a second push to a different stack to CALL and a branch-predictable comparison to RET... both implemented in the CPU itself where it can be tuned for them.