Re: [PATCH 00/12] Add CET shadow stack support

[Thiago Jung Bauermann <thiago.bauermann@linaro.org>]

Hello Christina,

"Schimpe, Christina" <christina.schimpe@intel.com> writes:

>> -----Original Message-----
>> From: Guinevere Larsen <guinevere@redhat.com>
>> Sent: Thursday, January 30, 2025 4:01 PM
>> To: Schimpe, Christina <christina.schimpe@intel.com>; gdb-
>> patches@sourceware.org
>> Subject: Re: [PATCH 00/12] Add CET shadow stack support
>>
>> On 12/20/24 5:04 PM, Schimpe, Christina wrote:
>> > Hi all,
>> >
>> > this is a series to add amd64 shadow stack support to GDB on linux.
>> > Shadow stack is part of the Control-flow Enforcement Technology (CET)
>> > by Intel.
>> >
>> > Intel's CET  provides the two capabilities to defend against
>> > ROP/COP/JOP style control-flow subversion attacks: shadow stack and
>> > indirect branch tracking (IBT).
>> >
>> > While there is linux kernel support for CET shadow stack in userspace,
>> > there is no linux kernel support available for userspace IBT, yet.
>> > This series therefore focuses on CET shadow stack only.
>> >
>> > I am looking forward to your feedback!
>>
>> Hi Christina, thanks for the incredible work in this series!
>>
>> I looked over all the patches, and sent all my comments inlined, the other patches
>> look alright to me. I don't know if I understand enough of the code to give a
>> review tag, and I don't have a machine with shadow stack support to test the
>> series, so I hope this series gets some attention from global maintainers soon, I'd
>> love to see this work merged!
>
> Hi Guinivere,
>
> Thanks a lot for looking at this !
>
> My plan is to wait until I receive bit more feedback for this series
> and until patch #1 is merged, which I posted now separately.

I'm almost finished reviewing this patch series. I think I'll be able to
send some review comments tomorrow.

In the meantime, one question: do you still plan to add a "bt -shadow"
command, or any other shadow stack related command as discussed in the
thread below?

https://inbox.sourceware.org/gdb/SN7PR11MB7638DE1337F8F0F0282EBD56F996A@SN7PR11MB7638.namprd11.prod.outlook.com/

I ask because for AArch64 Guarded Control Stack (which is equivalent to
Intel Shadow Stack) I'll need to add commands to enable/disable shadow
stacks, and also to see which GCS-specific features are enabled and
locked in the inferior.

--
Thiago