* Andrew Cooper: > You don't actually need a hole to create a guard. Any mapping of type > != shstk will do. > > If you've got a load of threads, you can tightly pack stack / shstk / > stack / shstk with no holes, and they each act as each other guard pages. Can userspace read the shadow stack directly? Writing is obviously blocked, but reading? GCC's stack-clash probing uses OR instructions, so it would be fine with a readable mapping. POSIX does not appear to require PROT_NONE mappings for the stack guard region, either. However, the pthread_attr_setguardsize manual page pretty clearly says that it's got to be unreadable and unwriteable. Hence my question. Thanks, Florian
