Agner`s CPU blog

The principle is simple: require that the instruction immediately following a jump is an ENDBRANCH instruction (a NOP on current systems). There are also a series of extensions to enable the shadow stack to be manipulated by debuggers and the like. It seems like a reasonable model of how someone would go about exposing and managing a second return call stack.

With regards to supporting two operating modes (with and without a second stack). My thoughts here are that it is simply not worth it. If your platform does not support some sort of hardware functionality to prevent these ROP type attacks then compilers will kludge around it on your behalf. Case in point are the stack smashing protection technologies which are present in many compilers. Obviously, system developers feel that the impact on performance is more than offset by the resulting improvements in security.