x86/shstk: Add Kconfig option for shadow stack

[tomoyo/tomoyo-test1.git] / arch / x86 / Kconfig

diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 7422db4..e860f80 100644 (file)
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -1849,6 +1849,11 @@ config CC_HAS_IBT
                  (CC_IS_CLANG && CLANG_VERSION >= 140000)) && \
                  $(as-instr,endbr64)
 
+config X86_CET
+       def_bool n
+       help
+         CET features configured (Shadow stack or IBT)
+
 config X86_KERNEL_IBT
        prompt "Indirect Branch Tracking"
        def_bool y
@@ -1856,6 +1861,7 @@ config X86_KERNEL_IBT
        # https://github.com/llvm/llvm-project/commit/9d7001eba9c4cb311e03cd8cdc231f9e579f2d0f
        depends on !LD_IS_LLD || LLD_VERSION >= 140000
        select OBJTOOL
+       select X86_CET
        help
          Build the kernel with support for Indirect Branch Tracking, a
          hardware support course-grain forward-edge Control Flow Integrity
@@ -1949,6 +1955,24 @@ config X86_SGX
 
          If unsure, say N.
 
+config X86_USER_SHADOW_STACK
+       bool "X86 userspace shadow stack"
+       depends on AS_WRUSS
+       depends on X86_64
+       select ARCH_USES_HIGH_VMA_FLAGS
+       select X86_CET
+       help
+         Shadow stack protection is a hardware feature that detects function
+         return address corruption.  This helps mitigate ROP attacks.
+         Applications must be enabled to use it, and old userspace does not
+         get protection "for free".
+
+         CPUs supporting shadow stacks were first released in 2020.
+
+         See Documentation/x86/shstk.rst for more information.
+
+         If unsure, say N.
+
 config EFI
        bool "EFI runtime service support"
        depends on ACPI