RE: [PATCH 00/12] Add CET shadow stack support

["Schimpe, Christina" <christina.schimpe@intel.com>]

> -----Original Message-----
> From: Thiago Jung Bauermann <thiago.bauermann@linaro.org>
> Sent: Tuesday, February 4, 2025 4:58 AM
> To: Schimpe, Christina <christina.schimpe@intel.com>
> Cc: Guinevere Larsen <guinevere@redhat.com>; gdb-patches@sourceware.org
> Subject: Re: [PATCH 00/12] Add CET shadow stack support
> 
> 
> Hello Christina,
> 
> "Schimpe, Christina" <christina.schimpe@intel.com> writes:
> 
> >> -----Original Message-----
> >> From: Guinevere Larsen <guinevere@redhat.com>
> >> Sent: Thursday, January 30, 2025 4:01 PM
> >> To: Schimpe, Christina <christina.schimpe@intel.com>; gdb-
> >> patches@sourceware.org
> >> Subject: Re: [PATCH 00/12] Add CET shadow stack support
> >>
> >> On 12/20/24 5:04 PM, Schimpe, Christina wrote:
> >> > Hi all,
> >> >
> >> > this is a series to add amd64 shadow stack support to GDB on linux.
> >> > Shadow stack is part of the Control-flow Enforcement Technology
> >> > (CET) by Intel.
> >> >
> >> > Intel's CET  provides the two capabilities to defend against
> >> > ROP/COP/JOP style control-flow subversion attacks: shadow stack and
> >> > indirect branch tracking (IBT).
> >> >
> >> > While there is linux kernel support for CET shadow stack in
> >> > userspace, there is no linux kernel support available for userspace IBT, yet.
> >> > This series therefore focuses on CET shadow stack only.
> >> >
> >> > I am looking forward to your feedback!
> >>
> >> Hi Christina, thanks for the incredible work in this series!
> >>
> >> I looked over all the patches, and sent all my comments inlined, the
> >> other patches look alright to me. I don't know if I understand enough
> >> of the code to give a review tag, and I don't have a machine with
> >> shadow stack support to test the series, so I hope this series gets
> >> some attention from global maintainers soon, I'd love to see this work merged!
> >
> > Hi Guinivere,
> >
> > Thanks a lot for looking at this !
> >
> > My plan is to wait until I receive bit more feedback for this series
> > and until patch #1 is merged, which I posted now separately.
> 
> I'm almost finished reviewing this patch series. I think I'll be able to send some
> review comments tomorrow.
> 
> In the meantime, one question: do you still plan to add a "bt -shadow"
> command, or any other shadow stack related command as discussed in the
> thread below?
> 
> https://inbox.sourceware.org/gdb/SN7PR11MB7638DE1337F8F0F0282EBD56F99
> 6A@SN7PR11MB7638.namprd11.prod.outlook.com/
> 
> I ask because for AArch64 Guarded Control Stack (which is equivalent to Intel
> Shadow Stack) I'll need to add commands to enable/disable shadow stacks, and
> also to see which GCS-specific features are enabled and locked in the inferior.

Hi Thiago, 

Thanks a lot for looking at this. 

Yes, I implemented "bt shadow" as subcommand of the ordinary backtrace command.
I planned to submit it as follow up series once this one is merged.

If you already want to have a look, the most important commits are:
https://github.com/intel/gdb/commit/7fbb0757af87d490225f91d3950eee7180acf6ad
https://github.com/intel/gdb/commit/e10103076ef3e4c75df91e2246637c2af3ba870a
https://github.com/intel/gdb/commit/c3386a341940e34263e7c396143d784d7fe924be
https://github.com/intel/gdb/commit/16c22643967e1b9d41a317b0bd02d3530f5d9f70

But it also required  a number of commits to refactor the backtrace command in general,
which is the reason why I split it up in 2 series.

Christina
Intel Deutschland GmbH
Registered Address: Am Campeon 10, 85579 Neubiberg, Germany
Tel: +49 89 99 8853-0, www.intel.de
Managing Directors: Sean Fennelly, Jeffrey Schneiderman, Tiffany Doon Silva
Chairperson of the Supervisory Board: Nicole Lau
Registered Office: Munich
Commercial Register: Amtsgericht Muenchen HRB 186928