Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: [PATCH] [PATCH V2]ARM64: SCS: Add gcc plugin to support Shadow
 Call Stack
To:     Nick Desaulniers <ndesaulniers@google.com>
Cc:     Miguel Ojeda <miguel.ojeda.sandonis@gmail.com>,
        Masahiro Yamada <masahiroy@kernel.org>,
        Michal Marek <michal.lkml@markovi.net>,
        Catalin Marinas <catalin.marinas@arm.com>,
        Will Deacon <will@kernel.org>,
        Kees Cook <keescook@chromium.org>,
        Nathan Chancellor <nathan@kernel.org>,
        Thomas Gleixner <tglx@linutronix.de>,
        Andrew Morton <akpm@linux-foundation.org>,
        Sami Tolvanen <samitolvanen@google.com>, frederic@kernel.org,
        Mike Rapoport <rppt@kernel.org>,
        Mark Rutland <mark.rutland@arm.com>, yifeifz2@illinois.edu,
        Steven Rostedt <rostedt@goodmis.org>,
        Viresh Kumar <viresh.kumar@linaro.org>, andreyknvl@gmail.com,
        Colin King <colin.king@canonical.com>,
        Miguel Ojeda <ojeda@kernel.org>,
        Luc Van Oostenryck <luc.vanoostenryck@gmail.com>,
        Marco Elver <elver@google.com>,
        Arvind Sankar <nivedita@alum.mit.edu>,
        Ard Biesheuvel <ardb@kernel.org>,
        Linux Kbuild mailing list <linux-kbuild@vger.kernel.org>,
        linux-kernel <linux-kernel@vger.kernel.org>,
        Linux ARM <linux-arm-kernel@lists.infradead.org>,
        linux-hardening@vger.kernel.org,
        clang-built-linux <clang-built-linux@googlegroups.com>
References: <1633878992-32884-1-git-send-email-ashimida@linux.alibaba.com>
 <CANiq72nBqiyrcaW47ZW-6i7zJ6HrmjZWSOr==HkEuBR5rXmpdQ@mail.gmail.com>
 <a25b9286-fc1f-d398-150c-ce073eadc6c1@linux.alibaba.com>
 <CAKwvOd=D=UvGfHjEyeYPk3c=ksg9mF8nUX-9jyJhkX8QbugMSQ@mail.gmail.com>
From:   Dan Li <ashimida@linux.alibaba.com>
Message-ID: <fefdacd0-787b-d03e-2ead-ac10641b4eb2@linux.alibaba.com>
Date:   Tue, 12 Oct 2021 03:07:31 +0800
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:68.0)
 Gecko/20100101 Thunderbird/68.12.1
MIME-Version: 1.0
In-Reply-To: <CAKwvOd=D=UvGfHjEyeYPk3c=ksg9mF8nUX-9jyJhkX8QbugMSQ@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Precedence: bulk


On 10/12/21 1:23 AM, Nick Desaulniers wrote:
> On Mon, Oct 11, 2021 at 8:42 AM Dan Li <ashimida@linux.alibaba.com> wrote:
>>
>>
>>
>> On 10/10/21 11:43 PM, Miguel Ojeda wrote:
>>> On Sun, Oct 10, 2021 at 5:16 PM Dan Li <ashimida@linux.alibaba.com> wrote:
>>>>
>>>> -         This option enables Clang's Shadow Call Stack, which uses a
>>>> -         shadow stack to protect function return addresses from being
>>>> -         overwritten by an attacker. More information can be found in
>>>> -         Clang's documentation:
>>>> +         This option enables Clang/GCC plugin's Shadow Call Stack, which
>>>> +         uses a shadow stack to protect function return addresses from
>>>> +         being overwritten by an attacker. More information can be found
>>>> +         in Clang's documentation:
>>>
>>> Perhaps it could be worded in a better way? It sounds like it is a
>>> custom plugin for Clang as well, e.g.:
>>>
>>>       This option enables Shadow Call Stack (in the case of GCC, as a plugin),
>>>
>>> Cheers,
>>> Miguel
>>>
>>
>> Thanks Miguel.
>>
>> How about writing like this:
>> This option enables Shadow Call Stack (supported as a compiler option in
>> the case of clang, supported as a plugin in the case of gcc), which uses
>> a shadow stack to ...
> 
> That sounds reasonable.
> 
> One question I have Dan, what is your sense for getting this feature
> landed upstream in GCC proper?  It's neat to be able to use plugins to
> support older versions of a compiler than when the feature initially
> lands; I was curious if you're working to submit this into GCC as
> well?  I didn't see anything in GCC's bug tracker for "shadow call
> stack," but maybe there's a different feature bug tracking this?
>

Thanks Nick.

The original intention of this plugin is to provide the customer's (bsp)
kernel with the ability to enable SCS protection under gcc. It's not
always feasible to recompile gcc or convince customers to switch to a
higher version, so I implemented this feature through a plugin. For bsp,
this method could reduce its use cost.

Because my main area of concern is kernel security, I first submitted
this plugin to the community.

I think [PATCH V2] can also be submitted to the gcc mainline. This is
my next plan, and I still need some time to reorganize it into the gcc
source code.