Hi all, On Mon, Mar 07, 2022 at 11:07:01AM -0800, H.J. Lu wrote: > On Mon, Mar 7, 2022 at 10:57 AM Mike Rapoport <rppt@xxxxxxxxxx> wrote: > > > > On Fri, Mar 04, 2022 at 11:13:19AM -0800, Andy Lutomirski wrote: > > > On 3/3/22 17:30, Edgecombe, Rick P wrote: > > Here is the CET ptrace patch on CET 5.16 kernel branch: > > https://github.com/hjl-tools/linux/commit/3a43ec29ddac56f87807161b5aeafa80f632363d It took me a while, but at last I have a version of CRIU that knows how to handle shadow stack. For the shadow stack manipulation during dump and for the creation of the sigframe for sigreturn I used the CET ptrace patch for 5.16 (thanks H.J). For the restore I had to add two modifications to the kernel APIs on top of this version of the shadow stack series: * add address parameter to map_shadow_stack() so that it'll call mmap() with MAP_FIXED if the address is requested. This is required to restore the shadow stack at the same address as it was at dump time. * add ability to unlock shadow stack features using ptrace. This is required because the current glibc (or at least in the version I used for tests) locks shadow stack state when it loads a program. This locking means that a process will either have shadow stack disabled without an ability to enable it or it will have shadow stack enabled with WRSS disabled and again, there is no way to re-enable WRSS. With that, ptrace looked like the most sensible interface to interfere with the shadow stack locking. I've pushed the kernel modifications here: https://git.kernel.org/pub/scm/linux/kernel/git/rppt/linux.git/log/?h=cet/kvm and CRIU modifications here: https://github.com/rppt/criu/tree/cet/v0.1 -- Sincerely yours, Mike.
