€•{d      Œsphinx.addnodes”Œdocument”“”)”}”(Œ	rawsource”Œ ”Œchildren”]”(Œtranslations”ŒLanguagesNode”“”)”}”(hhh]”(h Œpending_xref”“”)”}”(hhh]”Œdocutils.nodes”ŒText”“”ŒChinese (Simplified)”…””}”Œparent”hsbaŒ
attributes”}”(Œids”]”Œclasses”]”Œnames”]”Œdupnames”]”Œbackrefs”]”Œ	refdomain”Œstd”Œreftype”Œdoc”Œ	reftarget”Œ"/translations/zh_CN/arch/x86/shstk”Œmodname”NŒ	classname”NŒrefexplicit”ˆuŒtagname”hhhubh)”}”(hhh]”hŒChinese (Traditional)”…””}”hh2sbah}”(h]”h ]”h"]”h$]”h&]”Œ	refdomain”h)Œreftype”h+Œ	reftarget”Œ"/translations/zh_TW/arch/x86/shstk”Œmodname”NŒ	classname”NŒrefexplicit”ˆuh1hhhubh)”}”(hhh]”hŒItalian”…””}”hhFsbah}”(h]”h ]”h"]”h$]”h&]”Œ	refdomain”h)Œreftype”h+Œ	reftarget”Œ"/translations/it_IT/arch/x86/shstk”Œmodname”NŒ	classname”NŒrefexplicit”ˆuh1hhhubh)”}”(hhh]”hŒJapanese”…””}”hhZsbah}”(h]”h ]”h"]”h$]”h&]”Œ	refdomain”h)Œreftype”h+Œ	reftarget”Œ"/translations/ja_JP/arch/x86/shstk”Œmodname”NŒ	classname”NŒrefexplicit”ˆuh1hhhubh)”}”(hhh]”hŒKorean”…””}”hhnsbah}”(h]”h ]”h"]”h$]”h&]”Œ	refdomain”h)Œreftype”h+Œ	reftarget”Œ"/translations/ko_KR/arch/x86/shstk”Œmodname”NŒ	classname”NŒrefexplicit”ˆuh1hhhubh)”}”(hhh]”hŒSpanish”…””}”hh‚sbah}”(h]”h ]”h"]”h$]”h&]”Œ	refdomain”h)Œreftype”h+Œ	reftarget”Œ"/translations/sp_SP/arch/x86/shstk”Œmodname”NŒ	classname”NŒrefexplicit”ˆuh1hhhubeh}”(h]”h ]”h"]”h$]”h&]”Œcurrent_language”ŒEnglish”uh1h
hhŒ	_document”hŒsource”NŒline”NubhŒcomment”“”)”}”(hŒ SPDX-License-Identifier: GPL-2.0”h]”hŒ SPDX-License-Identifier: GPL-2.0”…””}”hh£sbah}”(h]”h ]”h"]”h$]”h&]”Œ	xml:space”Œpreserve”uh1h¡hhhžhhŸŒ</var/lib/git/docbuild/linux/Documentation/arch/x86/shstk.rst”h KubhŒsection”“”)”}”(hhh]”(hŒtitle”“”)”}”(hŒ6Control-flow Enforcement Technology (CET) Shadow Stack”h]”hŒ6Control-flow Enforcement Technology (CET) Shadow Stack”…””}”(hh»hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¹hh¶hžhhŸh³h Kubhµ)”}”(hhh]”(hº)”}”(hŒCET Background”h]”hŒCET Background”…””}”(hhÌhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¹hhÉhžhhŸh³h KubhŒ	paragraph”“”)”}”(hŒÉControl-flow Enforcement Technology (CET) covers several related x86 processor
features that provide protection against control flow hijacking attacks. CET
can protect both applications and the kernel.”h]”hŒÉControl-flow Enforcement Technology (CET) covers several related x86 processor
features that provide protection against control flow hijacking attacks. CET
can protect both applications and the kernel.”…””}”(hhÜhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h K
hhÉhžhubhÛ)”}”(hXÐ  CET introduces shadow stack and indirect branch tracking (IBT). A shadow stack
is a secondary stack allocated from memory which cannot be directly modified by
applications. When executing a CALL instruction, the processor pushes the
return address to both the normal stack and the shadow stack. Upon
function return, the processor pops the shadow stack copy and compares it
to the normal stack copy. If the two differ, the processor raises a
control-protection fault. IBT verifies indirect CALL/JMP targets are intended
as marked by the compiler with 'ENDBR' opcodes. Not all CPU's have both Shadow
Stack and Indirect Branch Tracking. Today in the 64-bit kernel, only userspace
shadow stack and kernel IBT are supported.”h]”hXÖ  CET introduces shadow stack and indirect branch tracking (IBT). A shadow stack
is a secondary stack allocated from memory which cannot be directly modified by
applications. When executing a CALL instruction, the processor pushes the
return address to both the normal stack and the shadow stack. Upon
function return, the processor pops the shadow stack copy and compares it
to the normal stack copy. If the two differ, the processor raises a
control-protection fault. IBT verifies indirect CALL/JMP targets are intended
as marked by the compiler with â€˜ENDBRâ€™ opcodes. Not all CPUâ€™s have both Shadow
Stack and Indirect Branch Tracking. Today in the 64-bit kernel, only userspace
shadow stack and kernel IBT are supported.”…””}”(hhêhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h KhhÉhžhubeh}”(h]”Œcet-background”ah ]”h"]”Œcet background”ah$]”h&]”uh1h´hh¶hžhhŸh³h Kubhµ)”}”(hhh]”(hº)”}”(hŒ Requirements to use Shadow Stack”h]”hŒ Requirements to use Shadow Stack”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¹hj   hžhhŸh³h KubhÛ)”}”(hŒTo use userspace shadow stack you need HW that supports it, a kernel
configured with it and userspace libraries compiled with it.”h]”hŒTo use userspace shadow stack you need HW that supports it, a kernel
configured with it and userspace libraries compiled with it.”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h Khj   hžhubhÛ)”}”(hŒ—The kernel Kconfig option is X86_USER_SHADOW_STACK.  When compiled in, shadow
stacks can be disabled at runtime with the kernel parameter: nousershstk.”h]”hŒ—The kernel Kconfig option is X86_USER_SHADOW_STACK.  When compiled in, shadow
stacks can be disabled at runtime with the kernel parameter: nousershstk.”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h Khj   hžhubhÛ)”}”(hŒ]To build a user shadow stack enabled kernel, Binutils v2.29 or LLVM v6 or later
are required.”h]”hŒ]To build a user shadow stack enabled kernel, Binutils v2.29 or LLVM v6 or later
are required.”…””}”(hj-  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h K"hj   hžhubhÛ)”}”(hŒ¦At run time, /proc/cpuinfo shows CET features if the processor supports
CET. "user_shstk" means that userspace shadow stack is supported on the current
kernel and HW.”h]”hŒªAt run time, /proc/cpuinfo shows CET features if the processor supports
CET. â€œuser_shstkâ€ means that userspace shadow stack is supported on the current
kernel and HW.”…””}”(hj;  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h K%hj   hžhubeh}”(h]”Œ requirements-to-use-shadow-stack”ah ]”h"]”Œ requirements to use shadow stack”ah$]”h&]”uh1h´hh¶hžhhŸh³h Kubhµ)”}”(hhh]”(hº)”}”(hŒApplication Enabling”h]”hŒApplication Enabling”…””}”(hjT  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¹hjQ  hžhhŸh³h K*ubhÛ)”}”(hŒpAn application's CET capability is marked in its ELF note and can be verified
from readelf/llvm-readelf output::”h]”hŒqAn applicationâ€™s CET capability is marked in its ELF note and can be verified
from readelf/llvm-readelf output:”…””}”(hjb  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h K,hjQ  hžhubhŒliteral_block”“”)”}”(hŒKreadelf -n <application> | grep -a SHSTK
    properties: x86 feature: SHSTK”h]”hŒKreadelf -n <application> | grep -a SHSTK
    properties: x86 feature: SHSTK”…””}”hjr  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1jp  hŸh³h K/hjQ  hžhubhÛ)”}”(hX   The kernel does not process these applications markers directly. Applications
or loaders must enable CET features using the interface described in section 4.
Typically this would be done in dynamic loader or static runtime objects, as is
the case in GLIBC.”h]”hX   The kernel does not process these applications markers directly. Applications
or loaders must enable CET features using the interface described in section 4.
Typically this would be done in dynamic loader or static runtime objects, as is
the case in GLIBC.”…””}”(hj€  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h K2hjQ  hžhubeh}”(h]”Œapplication-enabling”ah ]”h"]”Œapplication enabling”ah$]”h&]”uh1h´hh¶hžhhŸh³h K*ubhµ)”}”(hhh]”(hº)”}”(hŒEnabling arch_prctl()'s”h]”hŒEnabling arch_prctl()â€™s”…””}”(hj™  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¹hj–  hžhhŸh³h K8ubhÛ)”}”(hXD  Elf features should be enabled by the loader using the below arch_prctl's. They
are only supported in 64 bit user applications. These operate on the features
on a per-thread basis. The enablement status is inherited on clone, so if the
feature is enabled on the first thread, it will propagate to all the thread's
in an app.”h]”hXH  Elf features should be enabled by the loader using the below arch_prctlâ€™s. They
are only supported in 64 bit user applications. These operate on the features
on a per-thread basis. The enablement status is inherited on clone, so if the
feature is enabled on the first thread, it will propagate to all the threadâ€™s
in an app.”…””}”(hj§  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h K:hj–  hžhubhŒdefinition_list”“”)”}”(hhh]”(hŒdefinition_list_item”“”)”}”(hŒarch_prctl(ARCH_SHSTK_ENABLE, unsigned long feature)
Enable a single feature specified in 'feature'. Can only operate on
one feature at a time.
”h]”(hŒterm”“”)”}”(hŒ4arch_prctl(ARCH_SHSTK_ENABLE, unsigned long feature)”h]”hŒ4arch_prctl(ARCH_SHSTK_ENABLE, unsigned long feature)”…””}”(hjÂ  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1jÀ  hŸh³h KBhj¼  ubhŒ
definition”“”)”}”(hhh]”hÛ)”}”(hŒZEnable a single feature specified in 'feature'. Can only operate on
one feature at a time.”h]”hŒ^Enable a single feature specified in â€˜featureâ€™. Can only operate on
one feature at a time.”…””}”(hjÕ  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h KAhjÒ  ubah}”(h]”h ]”h"]”h$]”h&]”uh1jÐ  hj¼  ubeh}”(h]”h ]”h"]”h$]”h&]”uh1jº  hŸh³h KBhj·  ubj»  )”}”(hŒ’arch_prctl(ARCH_SHSTK_DISABLE, unsigned long feature)
Disable a single feature specified in 'feature'. Can only operate on
one feature at a time.
”h]”(jÁ  )”}”(hŒ5arch_prctl(ARCH_SHSTK_DISABLE, unsigned long feature)”h]”hŒ5arch_prctl(ARCH_SHSTK_DISABLE, unsigned long feature)”…””}”(hjó  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1jÀ  hŸh³h KFhjï  ubjÑ  )”}”(hhh]”hÛ)”}”(hŒ[Disable a single feature specified in 'feature'. Can only operate on
one feature at a time.”h]”hŒ_Disable a single feature specified in â€˜featureâ€™. Can only operate on
one feature at a time.”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h KEhj  ubah}”(h]”h ]”h"]”h$]”h&]”uh1jÐ  hjï  ubeh}”(h]”h ]”h"]”h$]”h&]”uh1jº  hŸh³h KFhj·  hžhubj»  )”}”(hXE  arch_prctl(ARCH_SHSTK_LOCK, unsigned long features)
Lock in features at their current enabled or disabled status. 'features'
is a mask of all features to lock. All bits set are processed, unset bits
are ignored. The mask is ORed with the existing value. So any feature bits
set here cannot be enabled or disabled afterwards.
”h]”(jÁ  )”}”(hŒ3arch_prctl(ARCH_SHSTK_LOCK, unsigned long features)”h]”hŒ3arch_prctl(ARCH_SHSTK_LOCK, unsigned long features)”…””}”(hj"  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1jÀ  hŸh³h KLhj  ubjÑ  )”}”(hhh]”hÛ)”}”(hX  Lock in features at their current enabled or disabled status. 'features'
is a mask of all features to lock. All bits set are processed, unset bits
are ignored. The mask is ORed with the existing value. So any feature bits
set here cannot be enabled or disabled afterwards.”h]”hX  Lock in features at their current enabled or disabled status. â€˜featuresâ€™
is a mask of all features to lock. All bits set are processed, unset bits
are ignored. The mask is ORed with the existing value. So any feature bits
set here cannot be enabled or disabled afterwards.”…””}”(hj3  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h KIhj0  ubah}”(h]”h ]”h"]”h$]”h&]”uh1jÐ  hj  ubeh}”(h]”h ]”h"]”h$]”h&]”uh1jº  hŸh³h KLhj·  hžhubj»  )”}”(hŒÂarch_prctl(ARCH_SHSTK_UNLOCK, unsigned long features)
Unlock features. 'features' is a mask of all features to unlock. All
bits set are processed, unset bits are ignored. Only works via ptrace.
”h]”(jÁ  )”}”(hŒ5arch_prctl(ARCH_SHSTK_UNLOCK, unsigned long features)”h]”hŒ5arch_prctl(ARCH_SHSTK_UNLOCK, unsigned long features)”…””}”(hjQ  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1jÀ  hŸh³h KPhjM  ubjÑ  )”}”(hhh]”hÛ)”}”(hŒ‹Unlock features. 'features' is a mask of all features to unlock. All
bits set are processed, unset bits are ignored. Only works via ptrace.”h]”hŒUnlock features. â€˜featuresâ€™ is a mask of all features to unlock. All
bits set are processed, unset bits are ignored. Only works via ptrace.”…””}”(hjb  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h KOhj_  ubah}”(h]”h ]”h"]”h$]”h&]”uh1jÐ  hjM  ubeh}”(h]”h ]”h"]”h$]”h&]”uh1jº  hŸh³h KPhj·  hžhubj»  )”}”(hŒÅarch_prctl(ARCH_SHSTK_STATUS, unsigned long addr)
Copy the currently enabled features to the address passed in addr. The
features are described using the bits passed into the others in
'features'.
”h]”(jÁ  )”}”(hŒ1arch_prctl(ARCH_SHSTK_STATUS, unsigned long addr)”h]”hŒ1arch_prctl(ARCH_SHSTK_STATUS, unsigned long addr)”…””}”(hj€  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1jÀ  hŸh³h KUhj|  ubjÑ  )”}”(hhh]”hÛ)”}”(hŒ’Copy the currently enabled features to the address passed in addr. The
features are described using the bits passed into the others in
'features'.”h]”hŒ–Copy the currently enabled features to the address passed in addr. The
features are described using the bits passed into the others in
â€˜featuresâ€™.”…””}”(hj‘  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h KShjŽ  ubah}”(h]”h ]”h"]”h$]”h&]”uh1jÐ  hj|  ubeh}”(h]”h ]”h"]”h$]”h&]”uh1jº  hŸh³h KUhj·  hžhubeh}”(h]”h ]”h"]”h$]”h&]”uh1jµ  hj–  hžhhŸh³h NubhÛ)”}”(hŒPThe return values are as follows. On success, return 0. On error, errno can
be::”h]”hŒOThe return values are as follows. On success, return 0. On error, errno can
be:”…””}”(hj±  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h KWhj–  hžhubjq  )”}”(hŒÛ-EPERM if any of the passed feature are locked.
-ENOTSUPP if the feature is not supported by the hardware or
 kernel.
-EINVAL arguments (non existing feature, etc)
-EFAULT if could not copy information back to userspace”h]”hŒÛ-EPERM if any of the passed feature are locked.
-ENOTSUPP if the feature is not supported by the hardware or
 kernel.
-EINVAL arguments (non existing feature, etc)
-EFAULT if could not copy information back to userspace”…””}”hj¿  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1jp  hŸh³h KZhj–  hžhubhÛ)”}”(hŒ"The feature's bits supported are::”h]”hŒ#The featureâ€™s bits supported are:”…””}”(hjÍ  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h K`hj–  hžhubjq  )”}”(hŒ7ARCH_SHSTK_SHSTK - Shadow stack
ARCH_SHSTK_WRSS  - WRSS”h]”hŒ7ARCH_SHSTK_SHSTK - Shadow stack
ARCH_SHSTK_WRSS  - WRSS”…””}”hjÛ  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1jp  hŸh³h Kbhj–  hžhubhÛ)”}”(hŒ¨Currently shadow stack and WRSS are supported via this interface. WRSS
can only be enabled with shadow stack, and is automatically disabled
if shadow stack is disabled.”h]”hŒ¨Currently shadow stack and WRSS are supported via this interface. WRSS
can only be enabled with shadow stack, and is automatically disabled
if shadow stack is disabled.”…””}”(hjé  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h Kehj–  hžhubeh}”(h]”Œenabling-arch-prctl-s”ah ]”h"]”Œenabling arch_prctl()'s”ah$]”h&]”uh1h´hh¶hžhhŸh³h K8ubhµ)”}”(hhh]”(hº)”}”(hŒProc Status”h]”hŒProc Status”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¹hjÿ  hžhhŸh³h KjubhÛ)”}”(hŒÄTo check if an application is actually running with shadow stack, the
user can read the /proc/$PID/status. It will report "wrss" or "shstk"
depending on what is enabled. The lines look like this::”h]”hŒËTo check if an application is actually running with shadow stack, the
user can read the /proc/$PID/status. It will report â€œwrssâ€ or â€œshstkâ€
depending on what is enabled. The lines look like this:”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h Kkhjÿ  hžhubjq  )”}”(hŒFx86_Thread_features: shstk wrss
x86_Thread_features_locked: shstk wrss”h]”hŒFx86_Thread_features: shstk wrss
x86_Thread_features_locked: shstk wrss”…””}”hj  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1jp  hŸh³h Kohjÿ  hžhubeh}”(h]”Œproc-status”ah ]”h"]”Œproc status”ah$]”h&]”uh1h´hh¶hžhhŸh³h Kjubhµ)”}”(hhh]”(hº)”}”(hŒ"Implementation of the Shadow Stack”h]”hŒ"Implementation of the Shadow Stack”…””}”(hj7  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¹hj4  hžhhŸh³h Ksubhµ)”}”(hhh]”(hº)”}”(hŒShadow Stack Size”h]”hŒShadow Stack Size”…””}”(hjH  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¹hjE  hžhhŸh³h KvubhÛ)”}”(hX:  A task's shadow stack is allocated from memory to a fixed size of
MIN(RLIMIT_STACK, 4 GB). In other words, the shadow stack is allocated to
the maximum size of the normal stack, but capped to 4 GB. In the case
of the clone3 syscall, there is a stack size passed in and shadow stack
uses this instead of the rlimit.”h]”hX<  A taskâ€™s shadow stack is allocated from memory to a fixed size of
MIN(RLIMIT_STACK, 4 GB). In other words, the shadow stack is allocated to
the maximum size of the normal stack, but capped to 4 GB. In the case
of the clone3 syscall, there is a stack size passed in and shadow stack
uses this instead of the rlimit.”…””}”(hjV  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h KxhjE  hžhubeh}”(h]”Œshadow-stack-size”ah ]”h"]”Œshadow stack size”ah$]”h&]”uh1h´hj4  hžhhŸh³h Kvubhµ)”}”(hhh]”(hº)”}”(hŒSignal”h]”hŒSignal”…””}”(hjo  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¹hjl  hžhhŸh³h KubhÛ)”}”(hŒèThe main program and its signal handlers use the same shadow stack. Because
the shadow stack stores only return addresses, a large shadow stack covers
the condition that both the program stack and the signal alternate stack run
out.”h]”hŒèThe main program and its signal handlers use the same shadow stack. Because
the shadow stack stores only return addresses, a large shadow stack covers
the condition that both the program stack and the signal alternate stack run
out.”…””}”(hj}  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h Khjl  hžhubhÛ)”}”(hX  When a signal happens, the old pre-signal state is pushed on the stack. When
shadow stack is enabled, the shadow stack specific state is pushed onto the
shadow stack. Today this is only the old SSP (shadow stack pointer), pushed
in a special format with bit 63 set. On sigreturn this old SSP token is
verified and restored by the kernel. The kernel will also push the normal
restorer address to the shadow stack to help userspace avoid a shadow stack
violation on the sigreturn path that goes through the restorer.”h]”hX  When a signal happens, the old pre-signal state is pushed on the stack. When
shadow stack is enabled, the shadow stack specific state is pushed onto the
shadow stack. Today this is only the old SSP (shadow stack pointer), pushed
in a special format with bit 63 set. On sigreturn this old SSP token is
verified and restored by the kernel. The kernel will also push the normal
restorer address to the shadow stack to help userspace avoid a shadow stack
violation on the sigreturn path that goes through the restorer.”…””}”(hj‹  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h K†hjl  hžhubhÛ)”}”(hŒ7So the shadow stack signal frame format is as follows::”h]”hŒ6So the shadow stack signal frame format is as follows:”…””}”(hj™  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h KŽhjl  hžhubjq  )”}”(hŒŸ|1...old SSP| - Pointer to old pre-signal ssp in sigframe token format
                (bit 63 set to 1)
|        ...| - Other state may be added in the future”h]”hŒŸ|1...old SSP| - Pointer to old pre-signal ssp in sigframe token format
                (bit 63 set to 1)
|        ...| - Other state may be added in the future”…””}”hj§  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1jp  hŸh³h Khjl  hžhubhÛ)”}”(hXé  32 bit ABI signals are not supported in shadow stack processes. Linux prevents
32 bit execution while shadow stack is enabled by the allocating shadow stacks
outside of the 32 bit address space. When execution enters 32 bit mode, either
via far call or returning to userspace, a #GP is generated by the hardware
which, will be delivered to the process as a segfault. When transitioning to
userspace the register's state will be as if the userspace ip being returned to
caused the segfault.”h]”hXë  32 bit ABI signals are not supported in shadow stack processes. Linux prevents
32 bit execution while shadow stack is enabled by the allocating shadow stacks
outside of the 32 bit address space. When execution enters 32 bit mode, either
via far call or returning to userspace, a #GP is generated by the hardware
which, will be delivered to the process as a segfault. When transitioning to
userspace the registerâ€™s state will be as if the userspace ip being returned to
caused the segfault.”…””}”(hjµ  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h K•hjl  hžhubeh}”(h]”Œsignal”ah ]”h"]”Œsignal”ah$]”h&]”uh1h´hj4  hžhhŸh³h Kubhµ)”}”(hhh]”(hº)”}”(hŒFork”h]”hŒFork”…””}”(hjÎ  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¹hjË  hžhhŸh³h KžubhÛ)”}”(hŒûThe shadow stack's vma has VM_SHADOW_STACK flag set; its PTEs are required
to be read-only and dirty. When a shadow stack PTE is not RO and dirty, a
shadow access triggers a page fault with the shadow stack access bit set
in the page fault error code.”h]”hŒýThe shadow stackâ€™s vma has VM_SHADOW_STACK flag set; its PTEs are required
to be read-only and dirty. When a shadow stack PTE is not RO and dirty, a
shadow access triggers a page fault with the shadow stack access bit set
in the page fault error code.”…””}”(hjÜ  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h K hjË  hžhubhÛ)”}”(hŒúWhen a task forks a child, its shadow stack PTEs are copied and both the
parent's and the child's shadow stack PTEs are cleared of the dirty bit.
Upon the next shadow stack access, the resulting shadow stack page fault
is handled by page copy/re-use.”h]”hŒþWhen a task forks a child, its shadow stack PTEs are copied and both the
parentâ€™s and the childâ€™s shadow stack PTEs are cleared of the dirty bit.
Upon the next shadow stack access, the resulting shadow stack page fault
is handled by page copy/re-use.”…””}”(hjê  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h K¥hjË  hžhubhÛ)”}”(hŒêWhen a pthread child is created, the kernel allocates a new shadow stack
for the new thread. New shadow stack creation behaves like mmap() with respect
to ASLR behavior. Similarly, on thread exit the thread's shadow stack is
disabled.”h]”hŒìWhen a pthread child is created, the kernel allocates a new shadow stack
for the new thread. New shadow stack creation behaves like mmap() with respect
to ASLR behavior. Similarly, on thread exit the threadâ€™s shadow stack is
disabled.”…””}”(hjø  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h KªhjË  hžhubeh}”(h]”Œfork”ah ]”h"]”Œfork”ah$]”h&]”uh1h´hj4  hžhhŸh³h Kžubhµ)”}”(hhh]”(hº)”}”(hŒExec”h]”hŒExec”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¹hj  hžhhŸh³h K°ubhÛ)”}”(hŒ{On exec, shadow stack features are disabled by the kernel. At which point,
userspace can choose to re-enable, or lock them.”h]”hŒ{On exec, shadow stack features are disabled by the kernel. At which point,
userspace can choose to re-enable, or lock them.”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÚhŸh³h K²hj  hžhubeh}”(h]”Œexec”ah ]”h"]”Œexec”ah$]”h&]”uh1h´hj4  hžhhŸh³h K°ubeh}”(h]”Œ"implementation-of-the-shadow-stack”ah ]”h"]”Œ"implementation of the shadow stack”ah$]”h&]”uh1h´hh¶hžhhŸh³h Ksubeh}”(h]”Œ4control-flow-enforcement-technology-cet-shadow-stack”ah ]”h"]”Œ6control-flow enforcement technology (cet) shadow stack”ah$]”h&]”uh1h´hhhžhhŸh³h Kubeh}”(h]”h ]”h"]”h$]”h&]”Œsource”h³uh1hŒcurrent_source”NŒcurrent_line”NŒsettings”Œdocutils.frontend”ŒValues”“”)”}”(h¹NŒ	generator”NŒ	datestamp”NŒsource_link”NŒ
source_url”NŒtoc_backlinks”Œentry”Œfootnote_backlinks”KŒsectnum_xform”KŒstrip_comments”NŒstrip_elements_with_classes”NŒstrip_classes”NŒreport_level”KŒ
halt_level”KŒexit_status_level”KŒdebug”NŒwarning_stream”NŒ	traceback”ˆŒinput_encoding”Œ	utf-8-sig”Œinput_encoding_error_handler”Œstrict”Œoutput_encoding”Œutf-8”Œoutput_encoding_error_handler”jh  Œerror_encoding”Œutf-8”Œerror_encoding_error_handler”Œbackslashreplace”Œlanguage_code”Œen”Œrecord_dependencies”NŒconfig”NŒ	id_prefix”hŒauto_id_prefix”Œid”Œdump_settings”NŒdump_internals”NŒdump_transforms”NŒdump_pseudo_xml”NŒexpose_internals”NŒstrict_visitor”NŒ_disable_config”NŒ_source”h³Œ_destination”NŒ_config_files”]”Œ7/var/lib/git/docbuild/linux/Documentation/docutils.conf”aŒfile_insertion_enabled”ˆŒraw_enabled”KŒline_length_limit”M'Œpep_references”NŒpep_base_url”Œhttps://peps.python.org/”Œpep_file_url_template”Œpep-%04d”Œrfc_references”NŒrfc_base_url”Œ&https://datatracker.ietf.org/doc/html/”Œ	tab_width”KŒtrim_footnote_reference_space”‰Œsyntax_highlight”Œlong”Œsmart_quotes”ˆŒsmartquotes_locales”]”Œcharacter_level_inline_markup”‰Œdoctitle_xform”‰Œdocinfo_xform”KŒsectsubtitle_xform”‰Œimage_loading”Œlink”Œembed_stylesheet”‰Œcloak_email_addresses”ˆŒsection_self_link”‰Œenv”NubŒreporter”NŒindirect_targets”]”Œsubstitution_defs”}”Œsubstitution_names”}”Œrefnames”}”Œrefids”}”Œnameids”}”(jB  j?  hýhújN  jK  j“  j  jü  jù  j1  j.  j:  j7  ji  jf  jÈ  jÅ  j  j  j2  j/  uŒ	nametypes”}”(jB  ‰hý‰jN  ‰j“  ‰jü  ‰j1  ‰j:  ‰ji  ‰jÈ  ‰j  ‰j2  ‰uh}”(j?  h¶húhÉjK  j   j  jQ  jù  j–  j.  jÿ  j7  j4  jf  jE  jÅ  jl  j  jË  j/  j  uŒfootnote_refs”}”Œcitation_refs”}”Œautofootnotes”]”Œautofootnote_refs”]”Œsymbol_footnotes”]”Œsymbol_footnote_refs”]”Œ	footnotes”]”Œ	citations”]”Œautofootnote_start”KŒsymbol_footnote_start”K Œ
id_counter”Œcollections”ŒCounter”“”}”…”R”Œparse_messages”]”Œtransform_messages”]”Œtransformer”NŒinclude_log”]”Œ
decoration”Nhžhub.