Control-flow Enforcement Technology (CET), published by Intel, introduces shadow stack feature aiming to ensure a return from a function is directed to where the function was called.
In a CET enabled system, each function call will push return address into normal stack and shadow stack, when the function returns, the address stored in shadow stack will be popped and compared with the return address, program will fail if the 2 addresses don't match.
In exception handling, the control flow may skip some stack frames and we must adjust shadow stack to avoid violating CET restriction.
In order to achieve this, we count the number of stack frames skipped and adjust shadow stack by this number before jumping to landing pad.
We have run libcxx, libcxxabi, libunwind tests with this patch in a CET enabled Fedora34 system, no failed tests found.
To build an application with CET enabled. we need to ensure:
- build the source code with "-fcf-protection=full"
- all the libraries linked with .o files must be CET enabled too
To run libcxx and libcxxabi tests with libunwind in a CET enabled system, we built libc++ and libc++abi.so with "-fcf-protection". Another patch has been uploaded for review to enable building llvm toolchian with CET enabled: https://reviews.llvm.org/D105603 This patch is not enough to enable all components but it does build libcxx, libcxxabi with CET enabled.