Re: Shadow stack backtrace command name

[Luis Machado <luis.machado@arm.com>]

Hi,

On 12/20/23 09:42, Schimpe, Christina via Gdb wrote:
> Hi all, 
> 
> I am writing to you to collect feedback for the name of a new command, we would
> like to introduce.  The command shall be used to print the shadow stack backtrace.
> 
> A shadow stack is a second stack for a program introduced in the Intel (R)
> Control-Flow Enforcement Technology (CET).  The shadow stack is used for
> control transfer operations to store the return addresses.
> 
> This is an example command name and output for the shadow stack backtrace:
> ~~~~
> (gdb) info shadow-stack bt
>    Address            Symbol
> #0 0x0000000000401131 call1
> #1 0x0000000000401145 main
> #2 0x00007ffff7c3fe70 __libc_start_call_main
> #3 0x00007ffff7c3ff20 __libc_start_main_impl
> (gdb) set print symbol-filename on
> (gdb) info shadow-stack bt
>    Address            Symbol
> #0 0x0000000000401131 call1 at amd64-shstk.c:51
> #1 0x0000000000401145 main at amd64-shstk.c:56
> #2 0x00007ffff7c3fe70 __libc_start_call_main
> #3 0x00007ffff7c3ff20 __libc_start_main_impl
> (gdb) help info shadow-stack bt
> info shadow-stack backtrace, info shadow-stack bt
> Print the entire backtrace of shadow stack,
> or the innermost [COUNT | -COUNT] addresses for the current process.
> To print the source filename and line number in the backtrace,
> the "symbol-filename" option of the print command should be toggled on.
> (See "show print symbol-filename")
> ~~~
> 
> It is configurable using "print symbol-filename" and COUNT.
> The command can be called by the following names:
> - "info shadow-stack bt", "info shadow-stack backtrace"
> 
>>From my perspective, the command name has the following pros and cons:
> (+) Easy to understand by just looking at the command name.
> (-) Rather long syntax
> 
> We also considered other command names such as 
> 
> - "info cet bt", "info cet backtrace"
> (+) Short syntax possible
> (-) Not so easy to understand by just looking at the command name. I miss the
> name "shadow stack".
> 
> - "info shstk bt", "info shstk backtrace"
> (+) Short syntax possible
> (-) "shstk" ist not an official abbreviation (in contrast to "cet"). "shstk" is
> mostly used by the linux kernel and might not be known by the user.
> 
> - "info shstk", "info shadow-stack"
> (+) short syntax possible
> (-) Without "backtrace" in the name, it might not be so easy to understand.
> 
> Having in mind that that the shadow stack is not only a x86-specific feature
> but can be seen as a generic concept we also considered that it could be
> part of the existing backtrace command, e.g.:
> - "bt -shadow"
> (+) Short syntax
> (+/-) Most of the settings of the bt command don't apply to the shadow
> stack (frame arguments and info). This might cause confusion.
> 
> For this option, it might make sense to introduce a new setting for the bt
> command which is for shadow stack only, e.g. "-symbol-filename [on|off]".
> 
> What are your thoughts on this topic? Any feedback and new ideas are welcome.

I like the option of reusing whatever is possible to reuse from the current backtrace command, so "bt -shadow" seems like a sensible option.

It doesn't seem to me like this command will be used a lot. I expect it will be useful only when we catch a fault due to a corrupt stack trace, so
putting it within the more general "backtrace" option would accomplish that.

With that said, depending on how shadow stack support is implemented in gdb, I expect gdb will automatically validate the stack trace against the
shadow stack (maybe on a fault), and complain if they go out of sync. Does that sound reasonable? Maybe even display where the flow veered off course.

AArch64 will have a counterpart of this, with the Guarded Control Stack (GCS) feature, so the more generic we make this, the better.