RE: Shadow stack backtrace command name

Schimpe, Christina via Gdb
2024-07-09T14:51:27Z

> * Christina via Gdb Schimpe:
>
> > However, based on the use cases that I am aware of, I am not sure if
> > the user wants to always see the shadow stack bt in the ordinary bt
> > output (if shadow stack is enabled).
>
> Based on my experiments, Linux currently does not push the instruction
> pointer onto the shadow stack if code is interrupted by a signal. It still works
> because the return mechanism is different. This would be a very visible
> difference between ordinary backtraces and shadow stack based backtraces.
> As far as I understand it, the kernel could change, and it may still be early
> enough to make this change.

Could you explain a bit why and what you think the kernel will change ?

Just to be sure that I understand correctly:
Do you think that this different display for the ordinary and shadow stack bt in
case of signals is one argument more for displaying the stacks together?
How would this look like?

> By the way, is there a way to tell if a process is in shadow stack mode using
> upstream GDB today? Preferably something that does not rely on glibc
> internals?

You can run "info proc status" and check for "shstk" in x86_Thread_features, see
https://docs.kernel.org/arch/x86/shstk.html.

Christina
Intel Deutschland GmbH
Registered Address: Am Campeon 10, 85579 Neubiberg, Germany
Tel: +49 89 99 8853-0, www.intel.de
Managing Directors: Sean Fennelly, Jeffrey Schneiderman, Tiffany Doon Silva
Chairperson of the Supervisory Board: Nicole Lau
Registered Office: Munich
Commercial Register: Amtsgericht Muenchen HRB 186928