[00/12] Add CET shadow stack support

Message ID	20241220200501.324191-1-christina.schimpe@intel.com
Headers	DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org DC8DB3858D26 From: "Schimpe, Christina" <christina.schimpe@intel.com> To: gdb-patches@sourceware.org Subject: [PATCH 00/12] Add CET shadow stack support Date: Fri, 20 Dec 2024 20:04:49 +0000 Message-Id: <20241220200501.324191-1-christina.schimpe@intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Precedence: list Errors-To: gdb-patches-bounces~patchwork=sourceware.org@sourceware.org
Series	Add CET shadow stack support \| [00/12] Add CET shadow stack support [01/12] gdb, testsuite: Rename set_sanitizer_default to append_environment. [02/12] gdbserver: Add optional runtime register set type. [03/12] gdbserver: Add assert in x86_linux_read_description. [04/12] gdb: Sync up x86-gcc-cpuid.h with cpuid.h from gcc 14 branch. [05/12] gdb, gdbserver: Use xstate_bv for target description creation on x86. [06/12] gdb, gdbserver: Add support of Intel shadow stack pointer register. [07/12] gdb, bfd: amd64 linux coredump support with shadow stack. [08/12] gdb: Handle shadow stack pointer register unwinding for amd64 linux. [09/12] gdb, gdbarch: Enable inferior calls for shadow stack support. [10/12] gdb: Implement amd64 linux shadow stack support for inferior calls. [11/12] gdb, gdbarch: Introduce gdbarch method to get the shadow stack pointer. [12/12] gdb: Enable displaced stepping with shadow stack on amd64 linux.

Message ID

20241220200501.324191-1-christina.schimpe@intel.com

Headers

DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org DC8DB3858D26
From: "Schimpe, Christina" <christina.schimpe@intel.com>
To: gdb-patches@sourceware.org
Subject: [PATCH 00/12] Add CET shadow stack support
Date: Fri, 20 Dec 2024 20:04:49 +0000
Message-Id: <20241220200501.324191-1-christina.schimpe@intel.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Precedence: list
Errors-To: gdb-patches-bounces~patchwork=sourceware.org@sourceware.org

Series

Add CET shadow stack support |

Message

Schimpe, Christina Dec. 20, 2024, 8:04 p.m. UTC

  Hi all,

this is a series to add amd64 shadow stack support to GDB on linux.  
Shadow stack is part of the Control-flow Enforcement Technology (CET) by
Intel.

Intel's CET  provides the two capabilities to defend against ROP/COP/JOP
style control-flow subversion attacks: shadow stack and indirect branch
tracking (IBT).

While there is linux kernel support for CET shadow stack in userspace,
there is no linux kernel support available for userspace IBT, yet.
This series therefore focuses on CET shadow stack only.

I am looking forward to your feedback!

Regards,
Christina


Felix Willgerodt (1):
  gdb, bfd: amd64 linux coredump support with shadow stack.

Schimpe, Christina (11):
  gdb, testsuite: Rename set_sanitizer_default to append_environment.
  gdbserver: Add optional runtime register set type.
  gdbserver: Add assert in x86_linux_read_description.
  gdb: Sync up x86-gcc-cpuid.h with cpuid.h from gcc 14 branch.
  gdb, gdbserver: Use xstate_bv for target description creation on x86.
  gdb, gdbserver: Add support of Intel shadow stack pointer register.
  gdb: Handle shadow stack pointer register unwinding for amd64 linux.
  gdb, gdbarch: Enable inferior calls for shadow stack support.
  gdb: Implement amd64 linux shadow stack support for inferior calls.
  gdb, gdbarch: Introduce gdbarch method to get the shadow stack
    pointer.
  gdb: Enable displaced stepping with shadow stack on amd64 linux.

 bfd/elf.c                                     |  24 +++
 gdb/amd64-linux-nat.c                         |  17 ++
 gdb/amd64-linux-tdep.c                        | 197 +++++++++++++++++-
 gdb/amd64-tdep.c                              |  32 ++-
 gdb/amd64-tdep.h                              |   9 +-
 gdb/arch-utils.c                              |   8 +
 gdb/arch-utils.h                              |   5 +
 gdb/arch/amd64-linux-tdesc.c                  |  33 +--
 gdb/arch/amd64-linux-tdesc.h                  |   7 +-
 gdb/arch/amd64.c                              |  25 ++-
 gdb/arch/amd64.h                              |  10 +-
 gdb/arch/i386-linux-tdesc.c                   |  29 +--
 gdb/arch/i386-linux-tdesc.h                   |   5 +-
 gdb/arch/i386.c                               |  19 +-
 gdb/arch/i386.h                               |   8 +-
 gdb/arch/x86-linux-tdesc-features.c           |  56 ++---
 gdb/arch/x86-linux-tdesc-features.h           |  25 ++-
 gdb/doc/gdb.texinfo                           |  42 ++++
 gdb/features/Makefile                         |   2 +
 gdb/features/i386/32bit-ssp.c                 |  14 ++
 gdb/features/i386/32bit-ssp.xml               |  11 +
 gdb/features/i386/64bit-ssp.c                 |  14 ++
 gdb/features/i386/64bit-ssp.xml               |  11 +
 gdb/gdbarch-gen.c                             |  54 +++++
 gdb/gdbarch-gen.h                             |  20 ++
 gdb/gdbarch_components.py                     |  26 +++
 gdb/i386-tdep.c                               |  44 +++-
 gdb/i386-tdep.h                               |  11 +-
 gdb/infcall.c                                 |   6 +
 gdb/linux-tdep.c                              |  47 +++++
 gdb/linux-tdep.h                              |   7 +
 gdb/nat/x86-gcc-cpuid.h                       | 153 +++++++++++---
 gdb/nat/x86-linux-tdesc.c                     |  20 +-
 gdb/nat/x86-linux-tdesc.h                     |   7 +-
 gdb/nat/x86-linux.c                           |  55 +++++
 gdb/nat/x86-linux.h                           |   4 +
 .../gdb.arch/amd64-shadow-stack-cmds.exp      | 141 +++++++++++++
 .../gdb.arch/amd64-shadow-stack-corefile.exp  |  50 +++++
 .../gdb.arch/amd64-shadow-stack-disp-step.exp |  84 ++++++++
 gdb/testsuite/gdb.arch/amd64-shadow-stack.c   |  35 ++++
 gdb/testsuite/gdb.arch/amd64-ssp.exp          |  50 +++++
 .../gdb.base/inline-frame-cycle-unwind.py     |   4 +
 gdb/testsuite/gdb.base/libsegfault.exp        |   2 +-
 .../gdb.threads/attach-slow-waitpid.exp       |   2 +-
 gdb/testsuite/lib/gdb.exp                     |  77 ++++++-
 gdb/x86-linux-nat.c                           |  51 ++++-
 gdb/x86-linux-nat.h                           |  11 +
 gdb/x86-tdep.c                                |  22 ++
 gdb/x86-tdep.h                                |   9 +
 gdbserver/i387-fp.cc                          |  40 ++--
 gdbserver/linux-amd64-ipa.cc                  |  10 +-
 gdbserver/linux-i386-ipa.cc                   |   6 +-
 gdbserver/linux-low.cc                        |  40 ++--
 gdbserver/linux-low.h                         |   7 +-
 gdbserver/linux-x86-low.cc                    |  44 +++-
 gdbsupport/x86-xstate.h                       |   7 +-
 56 files changed, 1537 insertions(+), 212 deletions(-)
 create mode 100644 gdb/features/i386/32bit-ssp.c
 create mode 100644 gdb/features/i386/32bit-ssp.xml
 create mode 100644 gdb/features/i386/64bit-ssp.c
 create mode 100644 gdb/features/i386/64bit-ssp.xml
 create mode 100644 gdb/testsuite/gdb.arch/amd64-shadow-stack-cmds.exp
 create mode 100644 gdb/testsuite/gdb.arch/amd64-shadow-stack-corefile.exp
 create mode 100644 gdb/testsuite/gdb.arch/amd64-shadow-stack-disp-step.exp
 create mode 100644 gdb/testsuite/gdb.arch/amd64-shadow-stack.c
 create mode 100644 gdb/testsuite/gdb.arch/amd64-ssp.exp

Comments

Schimpe, Christina Jan. 16, 2025, 2:01 p.m. UTC | #1

> -----Original Message-----
> From: Schimpe, Christina <christina.schimpe@intel.com>
> Sent: Friday, December 20, 2024 9:05 PM
> To: gdb-patches@sourceware.org
> Subject: [PATCH 00/12] Add CET shadow stack support
> 
> Hi all,
> 
> this is a series to add amd64 shadow stack support to GDB on linux.
> Shadow stack is part of the Control-flow Enforcement Technology (CET) by Intel.
> 
> Intel's CET  provides the two capabilities to defend against ROP/COP/JOP style
> control-flow subversion attacks: shadow stack and indirect branch tracking (IBT).
> 
> While there is linux kernel support for CET shadow stack in userspace, there is no
> linux kernel support available for userspace IBT, yet.
> This series therefore focuses on CET shadow stack only.
> 
> I am looking forward to your feedback!
> 
> Regards,
> Christina
> 
> 
> Felix Willgerodt (1):
>   gdb, bfd: amd64 linux coredump support with shadow stack.
> 
> Schimpe, Christina (11):
>   gdb, testsuite: Rename set_sanitizer_default to append_environment.
>   gdbserver: Add optional runtime register set type.
>   gdbserver: Add assert in x86_linux_read_description.
>   gdb: Sync up x86-gcc-cpuid.h with cpuid.h from gcc 14 branch.
>   gdb, gdbserver: Use xstate_bv for target description creation on x86.
>   gdb, gdbserver: Add support of Intel shadow stack pointer register.
>   gdb: Handle shadow stack pointer register unwinding for amd64 linux.
>   gdb, gdbarch: Enable inferior calls for shadow stack support.
>   gdb: Implement amd64 linux shadow stack support for inferior calls.
>   gdb, gdbarch: Introduce gdbarch method to get the shadow stack
>     pointer.
>   gdb: Enable displaced stepping with shadow stack on amd64 linux.
> 
>  bfd/elf.c                                     |  24 +++
>  gdb/amd64-linux-nat.c                         |  17 ++
>  gdb/amd64-linux-tdep.c                        | 197 +++++++++++++++++-
>  gdb/amd64-tdep.c                              |  32 ++-
>  gdb/amd64-tdep.h                              |   9 +-
>  gdb/arch-utils.c                              |   8 +
>  gdb/arch-utils.h                              |   5 +
>  gdb/arch/amd64-linux-tdesc.c                  |  33 +--
>  gdb/arch/amd64-linux-tdesc.h                  |   7 +-
>  gdb/arch/amd64.c                              |  25 ++-
>  gdb/arch/amd64.h                              |  10 +-
>  gdb/arch/i386-linux-tdesc.c                   |  29 +--
>  gdb/arch/i386-linux-tdesc.h                   |   5 +-
>  gdb/arch/i386.c                               |  19 +-
>  gdb/arch/i386.h                               |   8 +-
>  gdb/arch/x86-linux-tdesc-features.c           |  56 ++---
>  gdb/arch/x86-linux-tdesc-features.h           |  25 ++-
>  gdb/doc/gdb.texinfo                           |  42 ++++
>  gdb/features/Makefile                         |   2 +
>  gdb/features/i386/32bit-ssp.c                 |  14 ++
>  gdb/features/i386/32bit-ssp.xml               |  11 +
>  gdb/features/i386/64bit-ssp.c                 |  14 ++
>  gdb/features/i386/64bit-ssp.xml               |  11 +
>  gdb/gdbarch-gen.c                             |  54 +++++
>  gdb/gdbarch-gen.h                             |  20 ++
>  gdb/gdbarch_components.py                     |  26 +++
>  gdb/i386-tdep.c                               |  44 +++-
>  gdb/i386-tdep.h                               |  11 +-
>  gdb/infcall.c                                 |   6 +
>  gdb/linux-tdep.c                              |  47 +++++
>  gdb/linux-tdep.h                              |   7 +
>  gdb/nat/x86-gcc-cpuid.h                       | 153 +++++++++++---
>  gdb/nat/x86-linux-tdesc.c                     |  20 +-
>  gdb/nat/x86-linux-tdesc.h                     |   7 +-
>  gdb/nat/x86-linux.c                           |  55 +++++
>  gdb/nat/x86-linux.h                           |   4 +
>  .../gdb.arch/amd64-shadow-stack-cmds.exp      | 141 +++++++++++++
>  .../gdb.arch/amd64-shadow-stack-corefile.exp  |  50 +++++
> .../gdb.arch/amd64-shadow-stack-disp-step.exp |  84 ++++++++
>  gdb/testsuite/gdb.arch/amd64-shadow-stack.c   |  35 ++++
>  gdb/testsuite/gdb.arch/amd64-ssp.exp          |  50 +++++
>  .../gdb.base/inline-frame-cycle-unwind.py     |   4 +
>  gdb/testsuite/gdb.base/libsegfault.exp        |   2 +-
>  .../gdb.threads/attach-slow-waitpid.exp       |   2 +-
>  gdb/testsuite/lib/gdb.exp                     |  77 ++++++-
>  gdb/x86-linux-nat.c                           |  51 ++++-
>  gdb/x86-linux-nat.h                           |  11 +
>  gdb/x86-tdep.c                                |  22 ++
>  gdb/x86-tdep.h                                |   9 +
>  gdbserver/i387-fp.cc                          |  40 ++--
>  gdbserver/linux-amd64-ipa.cc                  |  10 +-
>  gdbserver/linux-i386-ipa.cc                   |   6 +-
>  gdbserver/linux-low.cc                        |  40 ++--
>  gdbserver/linux-low.h                         |   7 +-
>  gdbserver/linux-x86-low.cc                    |  44 +++-
>  gdbsupport/x86-xstate.h                       |   7 +-
>  56 files changed, 1537 insertions(+), 212 deletions(-)  create mode 100644
> gdb/features/i386/32bit-ssp.c  create mode 100644 gdb/features/i386/32bit-
> ssp.xml  create mode 100644 gdb/features/i386/64bit-ssp.c  create mode 100644
> gdb/features/i386/64bit-ssp.xml  create mode 100644
> gdb/testsuite/gdb.arch/amd64-shadow-stack-cmds.exp
>  create mode 100644 gdb/testsuite/gdb.arch/amd64-shadow-stack-corefile.exp
>  create mode 100644 gdb/testsuite/gdb.arch/amd64-shadow-stack-disp-
> step.exp
>  create mode 100644 gdb/testsuite/gdb.arch/amd64-shadow-stack.c
>  create mode 100644 gdb/testsuite/gdb.arch/amd64-ssp.exp
> 
> --
> 2.34.1
> 
> Intel Deutschland GmbH
> Registered Address: Am Campeon 10, 85579 Neubiberg, Germany
> Tel: +49 89 99 8853-0, www.intel.de
> Managing Directors: Sean Fennelly, Jeffrey Schneiderman, Tiffany Doon Silva
> Chairperson of the Supervisory Board: Nicole Lau Registered Office: Munich
> Commercial Register: Amtsgericht Muenchen HRB 186928

Kindly pinging for feedback.

Best Regards,
Christina

Intel Deutschland GmbH
Registered Address: Am Campeon 10, 85579 Neubiberg, Germany
Tel: +49 89 99 8853-0, www.intel.de
Managing Directors: Sean Fennelly, Jeffrey Schneiderman, Tiffany Doon Silva
Chairperson of the Supervisory Board: Nicole Lau
Registered Office: Munich
Commercial Register: Amtsgericht Muenchen HRB 186928

Schimpe, Christina Jan. 27, 2025, 9:44 a.m. UTC | #2

> -----Original Message-----
> From: Schimpe, Christina
> Sent: Thursday, January 16, 2025 3:02 PM
> To: Schimpe, Christina <christina.schimpe@intel.com>; gdb-
> patches@sourceware.org
> Subject: RE: [PING][PATCH 00/12] Add CET shadow stack support
> 
> > -----Original Message-----
> > From: Schimpe, Christina <christina.schimpe@intel.com>
> > Sent: Friday, December 20, 2024 9:05 PM
> > To: gdb-patches@sourceware.org
> > Subject: [PATCH 00/12] Add CET shadow stack support
> >
> > Hi all,
> >
> > this is a series to add amd64 shadow stack support to GDB on linux.
> > Shadow stack is part of the Control-flow Enforcement Technology (CET) by Intel.
> >
> > Intel's CET  provides the two capabilities to defend against
> > ROP/COP/JOP style control-flow subversion attacks: shadow stack and indirect
> branch tracking (IBT).
> >
> > While there is linux kernel support for CET shadow stack in userspace,
> > there is no linux kernel support available for userspace IBT, yet.
> > This series therefore focuses on CET shadow stack only.
> >
> > I am looking forward to your feedback!
> >
> > Regards,
> > Christina
> >
> >
> > Felix Willgerodt (1):
> >   gdb, bfd: amd64 linux coredump support with shadow stack.
> >
> > Schimpe, Christina (11):
> >   gdb, testsuite: Rename set_sanitizer_default to append_environment.
> >   gdbserver: Add optional runtime register set type.
> >   gdbserver: Add assert in x86_linux_read_description.
> >   gdb: Sync up x86-gcc-cpuid.h with cpuid.h from gcc 14 branch.
> >   gdb, gdbserver: Use xstate_bv for target description creation on x86.
> >   gdb, gdbserver: Add support of Intel shadow stack pointer register.
> >   gdb: Handle shadow stack pointer register unwinding for amd64 linux.
> >   gdb, gdbarch: Enable inferior calls for shadow stack support.
> >   gdb: Implement amd64 linux shadow stack support for inferior calls.
> >   gdb, gdbarch: Introduce gdbarch method to get the shadow stack
> >     pointer.
> >   gdb: Enable displaced stepping with shadow stack on amd64 linux.
> >
> >  bfd/elf.c                                     |  24 +++
> >  gdb/amd64-linux-nat.c                         |  17 ++
> >  gdb/amd64-linux-tdep.c                        | 197 +++++++++++++++++-
> >  gdb/amd64-tdep.c                              |  32 ++-
> >  gdb/amd64-tdep.h                              |   9 +-
> >  gdb/arch-utils.c                              |   8 +
> >  gdb/arch-utils.h                              |   5 +
> >  gdb/arch/amd64-linux-tdesc.c                  |  33 +--
> >  gdb/arch/amd64-linux-tdesc.h                  |   7 +-
> >  gdb/arch/amd64.c                              |  25 ++-
> >  gdb/arch/amd64.h                              |  10 +-
> >  gdb/arch/i386-linux-tdesc.c                   |  29 +--
> >  gdb/arch/i386-linux-tdesc.h                   |   5 +-
> >  gdb/arch/i386.c                               |  19 +-
> >  gdb/arch/i386.h                               |   8 +-
> >  gdb/arch/x86-linux-tdesc-features.c           |  56 ++---
> >  gdb/arch/x86-linux-tdesc-features.h           |  25 ++-
> >  gdb/doc/gdb.texinfo                           |  42 ++++
> >  gdb/features/Makefile                         |   2 +
> >  gdb/features/i386/32bit-ssp.c                 |  14 ++
> >  gdb/features/i386/32bit-ssp.xml               |  11 +
> >  gdb/features/i386/64bit-ssp.c                 |  14 ++
> >  gdb/features/i386/64bit-ssp.xml               |  11 +
> >  gdb/gdbarch-gen.c                             |  54 +++++
> >  gdb/gdbarch-gen.h                             |  20 ++
> >  gdb/gdbarch_components.py                     |  26 +++
> >  gdb/i386-tdep.c                               |  44 +++-
> >  gdb/i386-tdep.h                               |  11 +-
> >  gdb/infcall.c                                 |   6 +
> >  gdb/linux-tdep.c                              |  47 +++++
> >  gdb/linux-tdep.h                              |   7 +
> >  gdb/nat/x86-gcc-cpuid.h                       | 153 +++++++++++---
> >  gdb/nat/x86-linux-tdesc.c                     |  20 +-
> >  gdb/nat/x86-linux-tdesc.h                     |   7 +-
> >  gdb/nat/x86-linux.c                           |  55 +++++
> >  gdb/nat/x86-linux.h                           |   4 +
> >  .../gdb.arch/amd64-shadow-stack-cmds.exp      | 141 +++++++++++++
> >  .../gdb.arch/amd64-shadow-stack-corefile.exp  |  50 +++++
> > .../gdb.arch/amd64-shadow-stack-disp-step.exp |  84 ++++++++
> >  gdb/testsuite/gdb.arch/amd64-shadow-stack.c   |  35 ++++
> >  gdb/testsuite/gdb.arch/amd64-ssp.exp          |  50 +++++
> >  .../gdb.base/inline-frame-cycle-unwind.py     |   4 +
> >  gdb/testsuite/gdb.base/libsegfault.exp        |   2 +-
> >  .../gdb.threads/attach-slow-waitpid.exp       |   2 +-
> >  gdb/testsuite/lib/gdb.exp                     |  77 ++++++-
> >  gdb/x86-linux-nat.c                           |  51 ++++-
> >  gdb/x86-linux-nat.h                           |  11 +
> >  gdb/x86-tdep.c                                |  22 ++
> >  gdb/x86-tdep.h                                |   9 +
> >  gdbserver/i387-fp.cc                          |  40 ++--
> >  gdbserver/linux-amd64-ipa.cc                  |  10 +-
> >  gdbserver/linux-i386-ipa.cc                   |   6 +-
> >  gdbserver/linux-low.cc                        |  40 ++--
> >  gdbserver/linux-low.h                         |   7 +-
> >  gdbserver/linux-x86-low.cc                    |  44 +++-
> >  gdbsupport/x86-xstate.h                       |   7 +-
> >  56 files changed, 1537 insertions(+), 212 deletions(-)  create mode
> > 100644 gdb/features/i386/32bit-ssp.c  create mode 100644
> > gdb/features/i386/32bit- ssp.xml  create mode 100644
> > gdb/features/i386/64bit-ssp.c  create mode 100644
> > gdb/features/i386/64bit-ssp.xml  create mode 100644
> > gdb/testsuite/gdb.arch/amd64-shadow-stack-cmds.exp
> >  create mode 100644
> > gdb/testsuite/gdb.arch/amd64-shadow-stack-corefile.exp
> >  create mode 100644 gdb/testsuite/gdb.arch/amd64-shadow-stack-disp-
> > step.exp
> >  create mode 100644 gdb/testsuite/gdb.arch/amd64-shadow-stack.c
> >  create mode 100644 gdb/testsuite/gdb.arch/amd64-ssp.exp
> >
> > --
> > 2.34.1
> >
> > Intel Deutschland GmbH
> > Registered Address: Am Campeon 10, 85579 Neubiberg, Germany
> > Tel: +49 89 99 8853-0, www.intel.de
> > Managing Directors: Sean Fennelly, Jeffrey Schneiderman, Tiffany Doon
> > Silva Chairperson of the Supervisory Board: Nicole Lau Registered
> > Office: Munich Commercial Register: Amtsgericht Muenchen HRB 186928
> 
> Kindly pinging for feedback.
> 
> Best Regards,
> Christina

 Kindly pinging ^2. 
 
Best Regards,
Christina
Intel Deutschland GmbH
Registered Address: Am Campeon 10, 85579 Neubiberg, Germany
Tel: +49 89 99 8853-0, www.intel.de
Managing Directors: Sean Fennelly, Jeffrey Schneiderman, Tiffany Doon Silva
Chairperson of the Supervisory Board: Nicole Lau
Registered Office: Munich
Commercial Register: Amtsgericht Muenchen HRB 186928

Guinevere Larsen Jan. 30, 2025, 3:01 p.m. UTC | #3

On 12/20/24 5:04 PM, Schimpe, Christina wrote:
> Hi all,
>
> this is a series to add amd64 shadow stack support to GDB on linux.
> Shadow stack is part of the Control-flow Enforcement Technology (CET) by
> Intel.
>
> Intel's CET  provides the two capabilities to defend against ROP/COP/JOP
> style control-flow subversion attacks: shadow stack and indirect branch
> tracking (IBT).
>
> While there is linux kernel support for CET shadow stack in userspace,
> there is no linux kernel support available for userspace IBT, yet.
> This series therefore focuses on CET shadow stack only.
>
> I am looking forward to your feedback!

Hi Christina, thanks for the incredible work in this series!

I looked over all the patches, and sent all my comments inlined, the 
other patches look alright to me. I don't know if I understand enough of 
the code to give a review tag, and I don't have a machine with shadow 
stack support to test the series, so I hope this series gets some 
attention from global maintainers soon, I'd love to see this work merged!

Schimpe, Christina Jan. 30, 2025, 5:46 p.m. UTC | #4

> -----Original Message-----
> From: Guinevere Larsen <guinevere@redhat.com>
> Sent: Thursday, January 30, 2025 4:01 PM
> To: Schimpe, Christina <christina.schimpe@intel.com>; gdb-
> patches@sourceware.org
> Subject: Re: [PATCH 00/12] Add CET shadow stack support
> 
> On 12/20/24 5:04 PM, Schimpe, Christina wrote:
> > Hi all,
> >
> > this is a series to add amd64 shadow stack support to GDB on linux.
> > Shadow stack is part of the Control-flow Enforcement Technology (CET)
> > by Intel.
> >
> > Intel's CET  provides the two capabilities to defend against
> > ROP/COP/JOP style control-flow subversion attacks: shadow stack and
> > indirect branch tracking (IBT).
> >
> > While there is linux kernel support for CET shadow stack in userspace,
> > there is no linux kernel support available for userspace IBT, yet.
> > This series therefore focuses on CET shadow stack only.
> >
> > I am looking forward to your feedback!
> 
> Hi Christina, thanks for the incredible work in this series!
> 
> I looked over all the patches, and sent all my comments inlined, the other patches
> look alright to me. I don't know if I understand enough of the code to give a
> review tag, and I don't have a machine with shadow stack support to test the
> series, so I hope this series gets some attention from global maintainers soon, I'd
> love to see this work merged!

Hi Guinivere, 

Thanks a lot for looking at this ! 

My plan is to wait until I receive  bit more feedback for this series and until patch #1 is merged, 
which I posted now separately.

Best Regards,
Christina
Intel Deutschland GmbH
Registered Address: Am Campeon 10, 85579 Neubiberg, Germany
Tel: +49 89 99 8853-0, www.intel.de
Managing Directors: Sean Fennelly, Jeffrey Schneiderman, Tiffany Doon Silva
Chairperson of the Supervisory Board: Nicole Lau
Registered Office: Munich
Commercial Register: Amtsgericht Muenchen HRB 186928

Thiago Jung Bauermann Feb. 4, 2025, 3:57 a.m. UTC | #5

Hello Christina,

"Schimpe, Christina" <christina.schimpe@intel.com> writes:

>> -----Original Message-----
>> From: Guinevere Larsen <guinevere@redhat.com>
>> Sent: Thursday, January 30, 2025 4:01 PM
>> To: Schimpe, Christina <christina.schimpe@intel.com>; gdb-
>> patches@sourceware.org
>> Subject: Re: [PATCH 00/12] Add CET shadow stack support
>>
>> On 12/20/24 5:04 PM, Schimpe, Christina wrote:
>> > Hi all,
>> >
>> > this is a series to add amd64 shadow stack support to GDB on linux.
>> > Shadow stack is part of the Control-flow Enforcement Technology (CET)
>> > by Intel.
>> >
>> > Intel's CET  provides the two capabilities to defend against
>> > ROP/COP/JOP style control-flow subversion attacks: shadow stack and
>> > indirect branch tracking (IBT).
>> >
>> > While there is linux kernel support for CET shadow stack in userspace,
>> > there is no linux kernel support available for userspace IBT, yet.
>> > This series therefore focuses on CET shadow stack only.
>> >
>> > I am looking forward to your feedback!
>>
>> Hi Christina, thanks for the incredible work in this series!
>>
>> I looked over all the patches, and sent all my comments inlined, the other patches
>> look alright to me. I don't know if I understand enough of the code to give a
>> review tag, and I don't have a machine with shadow stack support to test the
>> series, so I hope this series gets some attention from global maintainers soon, I'd
>> love to see this work merged!
>
> Hi Guinivere,
>
> Thanks a lot for looking at this !
>
> My plan is to wait until I receive bit more feedback for this series
> and until patch #1 is merged, which I posted now separately.

I'm almost finished reviewing this patch series. I think I'll be able to
send some review comments tomorrow.

In the meantime, one question: do you still plan to add a "bt -shadow"
command, or any other shadow stack related command as discussed in the
thread below?

https://inbox.sourceware.org/gdb/SN7PR11MB7638DE1337F8F0F0282EBD56F996A@SN7PR11MB7638.namprd11.prod.outlook.com/

I ask because for AArch64 Guarded Control Stack (which is equivalent to
Intel Shadow Stack) I'll need to add commands to enable/disable shadow
stacks, and also to see which GCS-specific features are enabled and
locked in the inferior.

--
Thiago

Schimpe, Christina Feb. 4, 2025, 9:40 a.m. UTC | #6

> -----Original Message-----
> From: Thiago Jung Bauermann <thiago.bauermann@linaro.org>
> Sent: Tuesday, February 4, 2025 4:58 AM
> To: Schimpe, Christina <christina.schimpe@intel.com>
> Cc: Guinevere Larsen <guinevere@redhat.com>; gdb-patches@sourceware.org
> Subject: Re: [PATCH 00/12] Add CET shadow stack support
> 
> 
> Hello Christina,
> 
> "Schimpe, Christina" <christina.schimpe@intel.com> writes:
> 
> >> -----Original Message-----
> >> From: Guinevere Larsen <guinevere@redhat.com>
> >> Sent: Thursday, January 30, 2025 4:01 PM
> >> To: Schimpe, Christina <christina.schimpe@intel.com>; gdb-
> >> patches@sourceware.org
> >> Subject: Re: [PATCH 00/12] Add CET shadow stack support
> >>
> >> On 12/20/24 5:04 PM, Schimpe, Christina wrote:
> >> > Hi all,
> >> >
> >> > this is a series to add amd64 shadow stack support to GDB on linux.
> >> > Shadow stack is part of the Control-flow Enforcement Technology
> >> > (CET) by Intel.
> >> >
> >> > Intel's CET  provides the two capabilities to defend against
> >> > ROP/COP/JOP style control-flow subversion attacks: shadow stack and
> >> > indirect branch tracking (IBT).
> >> >
> >> > While there is linux kernel support for CET shadow stack in
> >> > userspace, there is no linux kernel support available for userspace IBT, yet.
> >> > This series therefore focuses on CET shadow stack only.
> >> >
> >> > I am looking forward to your feedback!
> >>
> >> Hi Christina, thanks for the incredible work in this series!
> >>
> >> I looked over all the patches, and sent all my comments inlined, the
> >> other patches look alright to me. I don't know if I understand enough
> >> of the code to give a review tag, and I don't have a machine with
> >> shadow stack support to test the series, so I hope this series gets
> >> some attention from global maintainers soon, I'd love to see this work merged!
> >
> > Hi Guinivere,
> >
> > Thanks a lot for looking at this !
> >
> > My plan is to wait until I receive bit more feedback for this series
> > and until patch #1 is merged, which I posted now separately.
> 
> I'm almost finished reviewing this patch series. I think I'll be able to send some
> review comments tomorrow.
> 
> In the meantime, one question: do you still plan to add a "bt -shadow"
> command, or any other shadow stack related command as discussed in the
> thread below?
> 
> https://inbox.sourceware.org/gdb/SN7PR11MB7638DE1337F8F0F0282EBD56F99
> 6A@SN7PR11MB7638.namprd11.prod.outlook.com/
> 
> I ask because for AArch64 Guarded Control Stack (which is equivalent to Intel
> Shadow Stack) I'll need to add commands to enable/disable shadow stacks, and
> also to see which GCS-specific features are enabled and locked in the inferior.

Hi Thiago, 

Thanks a lot for looking at this. 

Yes, I implemented "bt shadow" as subcommand of the ordinary backtrace command.
I planned to submit it as follow up series once this one is merged.

If you already want to have a look, the most important commits are:
https://github.com/intel/gdb/commit/7fbb0757af87d490225f91d3950eee7180acf6ad
https://github.com/intel/gdb/commit/e10103076ef3e4c75df91e2246637c2af3ba870a
https://github.com/intel/gdb/commit/c3386a341940e34263e7c396143d784d7fe924be
https://github.com/intel/gdb/commit/16c22643967e1b9d41a317b0bd02d3530f5d9f70

But it also required  a number of commits to refactor the backtrace command in general,
which is the reason why I split it up in 2 series.

Christina
Intel Deutschland GmbH
Registered Address: Am Campeon 10, 85579 Neubiberg, Germany
Tel: +49 89 99 8853-0, www.intel.de
Managing Directors: Sean Fennelly, Jeffrey Schneiderman, Tiffany Doon Silva
Chairperson of the Supervisory Board: Nicole Lau
Registered Office: Munich
Commercial Register: Amtsgericht Muenchen HRB 186928

Thiago Jung Bauermann Feb. 6, 2025, 3:44 a.m. UTC | #7

"Schimpe, Christina" <christina.schimpe@intel.com> writes:

>> -----Original Message-----
>> From: Thiago Jung Bauermann <thiago.bauermann@linaro.org>
>> Sent: Tuesday, February 4, 2025 4:58 AM
>> To: Schimpe, Christina <christina.schimpe@intel.com>
>> Cc: Guinevere Larsen <guinevere@redhat.com>; gdb-patches@sourceware.org
>> Subject: Re: [PATCH 00/12] Add CET shadow stack support
>>
>> In the meantime, one question: do you still plan to add a "bt -shadow"
>> command, or any other shadow stack related command as discussed in the
>> thread below?
>>
>> https://inbox.sourceware.org/gdb/SN7PR11MB7638DE1337F8F0F0282EBD56F99
>> 6A@SN7PR11MB7638.namprd11.prod.outlook.com/
>>
>> I ask because for AArch64 Guarded Control Stack (which is equivalent to Intel
>> Shadow Stack) I'll need to add commands to enable/disable shadow stacks, and
>> also to see which GCS-specific features are enabled and locked in the inferior.
>
> Hi Thiago,
>
> Thanks a lot for looking at this.
>
> Yes, I implemented "bt shadow" as subcommand of the ordinary backtrace command.
> I planned to submit it as follow up series once this one is merged.
>
> If you already want to have a look, the most important commits are:
> https://github.com/intel/gdb/commit/7fbb0757af87d490225f91d3950eee7180acf6ad
> https://github.com/intel/gdb/commit/e10103076ef3e4c75df91e2246637c2af3ba870a
> https://github.com/intel/gdb/commit/c3386a341940e34263e7c396143d784d7fe924be
> https://github.com/intel/gdb/commit/16c22643967e1b9d41a317b0bd02d3530f5d9f70

Thank you for the references. I'll look into those commits.

> But it also required a number of commits to refactor the backtrace command in general,
> which is the reason why I split it up in 2 series.

Good idea.

--
Thiago