| From | Andy Lutomirski <> | Date | Thu, 7 Jun 2018 11:48:35 -0700 | Subject | Re: [PATCH 06/10] x86/cet: Add arch_prctl functions for shadow stack |
| |
On Thu, Jun 7, 2018 at 7:41 AM Yu-cheng Yu <yu-cheng.yu@intel.com> wrote: > > The following operations are provided. > > ARCH_CET_STATUS: > return the current CET status > > ARCH_CET_DISABLE: > disable CET features > > ARCH_CET_LOCK: > lock out CET features > > ARCH_CET_EXEC: > set CET features for exec() > > ARCH_CET_ALLOC_SHSTK: > allocate a new shadow stack > > ARCH_CET_PUSH_SHSTK: > put a return address on shadow stack > > ARCH_CET_ALLOC_SHSTK and ARCH_CET_PUSH_SHSTK are intended only for > the implementation of GLIBC ucontext related APIs.
Please document exactly what these all do and why. I don't understand what purpose ARCH_CET_LOCK and ARCH_CET_EXEC serve. CET is opt in for each ELF program, so I think there should be no need for a magic override.
|