[v4,11/13] gdb: Enable inferior calls in the shadow stack backtrace.
Checks
| Context |
Check |
Description |
| linaro-tcwg-bot/tcwg_gdb_build--master-aarch64 |
success
|
Build passed
|
| linaro-tcwg-bot/tcwg_gdb_build--master-arm |
success
|
Build passed
|
| linaro-tcwg-bot/tcwg_gdb_check--master-arm |
success
|
Test passed
|
| linaro-tcwg-bot/tcwg_gdb_check--master-aarch64 |
success
|
Test passed
|
Commit Message
Similar to the normal backtrace display <function called from gdb>
in the shadow stack backtrace for inferior function calls.
Example for a nested inferior call:
~~~
(gdb) bt -shadow
\#0 <function called from gdb>
\#1 <function called from gdb>
\#2 0x000000000040045a in call1 at /tmp/amd64-shadow-stack.c:27
\#3 0x0000000000400466 in main at /tmp/amd64-shadow-stack.c:38
(gdb) bt
\#0 call2 () at /tmp/amd64-shadow-stack.c:21
\#1 <function called from gdb>
\#2 call2 () at /tmp/amd64-shadow-stack.c:21
\#3 <function called from gdb>
\#4 call2 () at /tmp/amd64-shadow-stack.c:21
\#5 0x000000000040045a in call1 () at /tmp/amd64-shadow-stack.c:27
\#6 0x0000000000400466 in main () at /tmp/amd64-shadow-stack.c:38
~~~
---
gdb/shadow-stack.c | 36 +++++++++++++++++++
gdb/shadow-stack.h | 4 +++
.../gdb.arch/amd64-shadow-stack-cmds.exp | 24 +++++++++++++
3 files changed, 64 insertions(+)
Comments
Christina Schimpe <christina.schimpe@intel.com> writes:
> Similar to the normal backtrace display <function called from gdb>
> in the shadow stack backtrace for inferior function calls.
>
> Example for a nested inferior call:
> ~~~
> (gdb) bt -shadow
> \#0 <function called from gdb>
> \#1 <function called from gdb>
> \#2 0x000000000040045a in call1 at /tmp/amd64-shadow-stack.c:27
> \#3 0x0000000000400466 in main at /tmp/amd64-shadow-stack.c:38
> (gdb) bt
> \#0 call2 () at /tmp/amd64-shadow-stack.c:21
> \#1 <function called from gdb>
> \#2 call2 () at /tmp/amd64-shadow-stack.c:21
> \#3 <function called from gdb>
> \#4 call2 () at /tmp/amd64-shadow-stack.c:21
> \#5 0x000000000040045a in call1 () at /tmp/amd64-shadow-stack.c:27
> \#6 0x0000000000400466 in main () at /tmp/amd64-shadow-stack.c:38
> ~~~
> ---
> gdb/shadow-stack.c | 36 +++++++++++++++++++
> gdb/shadow-stack.h | 4 +++
> .../gdb.arch/amd64-shadow-stack-cmds.exp | 24 +++++++++++++
> 3 files changed, 64 insertions(+)
Nice!
Reviewed-by: Thiago Jung Bauermann <thiago.bauermann@linaro.org>
@@ -215,6 +215,29 @@ find_pc_funname (CORE_ADDR pc)
return funname;
}
+/* Check if the shadow stack frame's value VAL is an inferior call
+ return address. */
+
+static bool
+is_infcall_return_address (const CORE_ADDR val)
+{
+ const int inf_thread_num = inferior_thread ()->global_num;
+
+ for (breakpoint &b : all_breakpoints ())
+ {
+ if (b.type != bp_call_dummy
+ || b.thread != inf_thread_num
+ || b.frame_id.code_addr != val)
+ continue;
+
+ for (bp_location &bl : b.locations ())
+ if (bl.pspace == current_program_space)
+ return true;
+ }
+
+ return false;
+}
+
/* Print information of shadow stack frame info FRAME. The output is
formatted according to PRINT_WHAT. For the meaning of PRINT_WHAT, see
enum print_what comments in frame.h. Note that PRINT_WHAT is overridden,
@@ -242,6 +265,8 @@ do_print_shadow_stack_frame_info
gdb_assert (frame.non_return_description.has_value ());
str = frame.non_return_description.value ();
}
+ else if (frame.type == ssp_frame_type::dummy_frame)
+ str = "<function called from gdb>";
else
gdb_assert_not_reached ("Invalid shadow stack frame type.");
@@ -430,6 +455,17 @@ get_shadow_stack_frame_info
return *no_return_frame;
}
+ if (is_infcall_return_address (value))
+ {
+ /* If VALUE belongs to a dummy call breakpoint get_sal_arch won't
+ return a valid gdbarch and we can assign the current gdbarch
+ here. We also don't show any SAL information, so we can set it
+ to an empty optional. */
+ return std::optional<shadow_stack_frame_info>
+ ({ssp, value, level, fallback_arch, {}, ssp_frame_type::dummy_frame,
+ {}, ssp_unwind_stop_reason::no_error});
+ }
+
/* At this point, we know that SSP points to VALUE which is a return
address. In contrast to find_frame_sal which is used for the normal
backtrace command, VALUE always points at the return instruction
@@ -76,6 +76,10 @@ enum class ssp_frame_type
This frame type is configured in the target specific implementation
of is_no_return_shadow_stack_address. */
non_return_frame,
+
+ /* A fake frame, created by GDB when performing an inferior function
+ call. */
+ dummy_frame,
};
/* Information of a shadow stack frame belonging to a shadow stack element
@@ -167,6 +167,30 @@ save_vars { ::env(GLIBC_TUNABLES) } {
gdb_continue_to_end
}
+ with_test_prefix "test inferior call shadow stack backtrace" {
+ restart_and_run_infcall_call2
+ gdb_test "bt -shadow" \
+ [multi_line \
+ "#0\[ \t\]*<function called from gdb>" \
+ "#1\[ \t\]*$hex in \[^\r\n\]+" \
+ "#2\[ \t\]*$hex in \[^\r\n\]+" ] \
+ "Test shadow stack backtrace for inferior calls."
+
+ set inside_infcall_str \
+ "The program being debugged stopped while in a function called from GDB"
+ gdb_test "call (int) call2()" \
+ "Breakpoint \[0-9\]*, call2.*$inside_infcall_str.*" \
+ "Execute an inferior call inside an inferior call."
+
+ gdb_test "bt -shadow" \
+ [multi_line \
+ "#0\[ \t\]*<function called from gdb>" \
+ "#1\[ \t\]*<function called from gdb>" \
+ "#2\[ \t\]*$hex in \[^\r\n\]+" \
+ "#3\[ \t\]*$hex in \[^\r\n\]+" ] \
+ "Test shadow stack backtrace for nested inferior calls."
+ }
+
clean_restart ${::testfile}
if { ![runto_main] } {
return