Feature #22308
closed
Implement SHSTK support for AMD64 coroutines.
Description
CRuby’s native AMD64 coroutine backend does not currently support Intel CET Shadow Stack (SHSTK).
When SHSTK is active, coroutine transfers must switch both the regular stack pointer (SP) and shadow stack pointer (SSP). Each coroutine also requires its own shadow-stack allocation. Without this support, Fiber switching can trigger control-protection faults.
Distributions currently need to build with --with-coroutine=ucontext or avoid enabling SHSTK. The ucontext backend has significant performance overhead compared with the native coroutine implementation.
An implementation is being developed here:
https://github.com/ruby/ruby/pull/5895
The proposed implementation:
- Detects whether SHSTK is active at runtime.
- Allocates and releases a shadow stack for each coroutine.
- Initializes new shadow stacks with a valid return address.
- Saves and restores SSP during coroutine transfers.
- Advertises SHSTK support through the GNU property note.
- Adds CI coverage that verifies SHSTK is genuinely active before running Fiber and continuation tests.
IBT support has already been implemented separately; this issue concerns SHSTK support only.
Updated by