Intel Shadow Stack Finally Merged For Linux 6.6

The Intel Shadow Stack support that is part of their Control-flow Enforcement Technology (CET) has finally been merged for the Linux 6.6 kernel after it was previously rejected by Linus Torvalds.

For years Intel has been working on CET / Shadow Stack support for Linux for defending against return-oriented programming (ROP) attacks with Tiger Lake processors and newer.

Intel engineers had submitted Shadow Stack for Linux 6.4 but then it was ultimately rejected by Linus Torvalds. When reviewing the code, the Linux creator found various issues with it and decided against accepting it for the v6.4 merge window.

Now after the code was cleaned up and further iterated, it was re-submitted for the Linux 6.6 cycle. Intel's Dave Hansen explained in the pull request:

"This is the long awaited x86 shadow stack support. We first sent this your way for 6.4 in a form that was harder to review.

Since then, the main deltas addressed concerns around pte_mkwrite() and the Dirty bit shifting logic. These are mostly unchanged from the v9 version of the patchset in June.

There is one last-minute fix in here to clean up a sparse warnings, but it should not even affect code generation."

Linus Torvalds today decided to merge the Shadow Stack (shstk) code for this merge window. Thus this security feature contributed by Intel for their modern CPUs as well as newer AMD CPUs is ready to go with Linux 6.6+.