[v5,09/13] gdb: Provide gdbarch hook to distinguish shadow stack backtrace elements.

Message ID 20260924083311.1961530-10-christina.joos@intel.com
State New
Headers
Series Add new command to print the shadow stack backtrace |

Checks

Context Check Description
linaro-tcwg-bot/tcwg_gdb_build--master-arm fail Patch failed to apply
linaro-tcwg-bot/tcwg_gdb_build--master-aarch64 fail Patch failed to apply

Commit Message

Joos, Christina Sept. 24, 2026, 8:33 a.m. UTC
  On x86 with CET or on ARM with GCS, there can be elements on the shadow
stack which are not return addresses.  In this case, we don't want to print
the shadow stack element, but a string instead which describes the frame
similar to the normal backtrace command for dummy frames or signals.

Provide a gdbarch hook to distinguish between return and non-return
addresses and to configure a string which is printed instead of the
shadow stack element.

Reviewed-by: Thiago Jung Bauermann <thiago.bauermann@linaro.org>
---
 gdb/doc/gdb.texinfo       | 19 +++++++++++++++++++
 gdb/gdbarch-gen.c         | 32 ++++++++++++++++++++++++++++++++
 gdb/gdbarch-gen.h         | 19 +++++++++++++++++++
 gdb/gdbarch_components.py | 25 +++++++++++++++++++++++++
 gdb/shadow-stack.c        | 36 +++++++++++++++++++++++++++++++++++-
 gdb/shadow-stack.h        | 26 ++++++++++++++++++++++++++
 6 files changed, 156 insertions(+), 1 deletion(-)
  

Comments

Eli Zaretskii Sept. 24, 2026, 9:29 a.m. UTC | #1
> From: Christina Joos <christina.joos@intel.com>
> Cc: thiago.bauermann@linaro.org, tom@tromey.com, luis.machado.foss@gmail.com
> Date: Thu, 24 Sep 2026 10:33:06 +0200
> 
> On x86 with CET or on ARM with GCS, there can be elements on the shadow
> stack which are not return addresses.  In this case, we don't want to print
> the shadow stack element, but a string instead which describes the frame
> similar to the normal backtrace command for dummy frames or signals.
> 
> Provide a gdbarch hook to distinguish between return and non-return
> addresses and to configure a string which is printed instead of the
> shadow stack element.
> 
> Reviewed-by: Thiago Jung Bauermann <thiago.bauermann@linaro.org>
> ---
>  gdb/doc/gdb.texinfo       | 19 +++++++++++++++++++
>  gdb/gdbarch-gen.c         | 32 ++++++++++++++++++++++++++++++++
>  gdb/gdbarch-gen.h         | 19 +++++++++++++++++++
>  gdb/gdbarch_components.py | 25 +++++++++++++++++++++++++
>  gdb/shadow-stack.c        | 36 +++++++++++++++++++++++++++++++++++-
>  gdb/shadow-stack.h        | 26 ++++++++++++++++++++++++++
>  6 files changed, 156 insertions(+), 1 deletion(-)

AFAIR, I've approved the gdb.texinfo part in v2, right?  And there are
no changes in that part since then, right?
  
Joos, Christina Sept. 24, 2026, 1:10 p.m. UTC | #2
> -----Original Message-----
> From: Eli Zaretskii <eliz@gnu.org>
> Sent: Donnerstag, 24. September 2026 11:30
> To: Joos, Christina <christina.joos@intel.com>
> Cc: gdb-patches@sourceware.org; thiago.bauermann@linaro.org;
> tom@tromey.com; luis.machado.foss@gmail.com
> Subject: Re: [PATCH v5 09/13] gdb: Provide gdbarch hook to distinguish
> shadow stack backtrace elements.
> 
> > From: Christina Joos <christina.joos@intel.com>
> > Cc: thiago.bauermann@linaro.org, tom@tromey.com,
> > luis.machado.foss@gmail.com
> > Date: Thu, 24 Sep 2026 10:33:06 +0200
> >
> > On x86 with CET or on ARM with GCS, there can be elements on the
> > shadow stack which are not return addresses.  In this case, we don't
> > want to print the shadow stack element, but a string instead which
> > describes the frame similar to the normal backtrace command for dummy
> frames or signals.
> >
> > Provide a gdbarch hook to distinguish between return and non-return
> > addresses and to configure a string which is printed instead of the
> > shadow stack element.
> >
> > Reviewed-by: Thiago Jung Bauermann <thiago.bauermann@linaro.org>
> > ---
> >  gdb/doc/gdb.texinfo       | 19 +++++++++++++++++++
> >  gdb/gdbarch-gen.c         | 32 ++++++++++++++++++++++++++++++++
> >  gdb/gdbarch-gen.h         | 19 +++++++++++++++++++
> >  gdb/gdbarch_components.py | 25 +++++++++++++++++++++++++
> >  gdb/shadow-stack.c        | 36 +++++++++++++++++++++++++++++++++++-
> >  gdb/shadow-stack.h        | 26 ++++++++++++++++++++++++++
> >  6 files changed, 156 insertions(+), 1 deletion(-)
> 
> AFAIR, I've approved the gdb.texinfo part in v2, right?  And there are no
> changes in that part since then, right?

Hi Eli, 

Thanks a lot for the quick feedback. Yes, you reviewed this patch in v2 already.
And I just double-checked - the gdb.texinfo part did not change for this patch.
I will add your review tag, sorry for missing it.

The gdb.texinfo part did change a bit since v2 for
- "gdb: Add command option 'bt -shadow' to print the shadow stack backtrace"
- "gdb, mi: Add -shadow-stack-list-frames command"

But I saw that you just reviewed the 2 patches again (thanks!).

Christina

________________________________________
Intel Deutschland GmbH 

Registered Address: Dornacher Strasse 1, 85622 Feldkirchen, Germany 

Tel: +49 (89) 99143-0 

www.intel.de 

Managing Directors: Candice Moore, Jeffrey Schneiderman, Ramachandran Sitaraman

Chairperson of the Supervisory Board: Sonja Pierer

Registered Seat: Munich Commercial Register B: Amtsgericht Munich HRB 186928

This e-mail and any attachments may contain confidential material for
the sole use of the intended recipient(s). Any review or distribution
by others is strictly prohibited. If you are not the intended
recipient, please contact the sender and delete all copies.
  

Patch

diff --git a/gdb/doc/gdb.texinfo b/gdb/doc/gdb.texinfo
index 418c83224e8..c2f9474b4de 100644
--- a/gdb/doc/gdb.texinfo
+++ b/gdb/doc/gdb.texinfo
@@ -8811,6 +8811,25 @@  This is how a shadow stack backtrace looks like on amd64:
 @end group
 @end smallexample
 
+There can be elements on the shadow stack which are not return addresses,
+for example on x86 with the Intel Control-Flow Enforcement Technology
+(@xref{CET}).  In case of signals, the old shadow stack pointer is pushed
+in a special format with bit 63 set.  See @url{https://docs.kernel.org/arch/x86/shstk.html}
+for more details.  For such shadow stack elements, the shadow stack
+frame just contains the level and a string describing the shadow stack
+element:
+
+@smallexample
+@group
+(gdb) bt -shadow 4
+#0  0x00007ffff7c45330 in __restore_rt from /lib/x86_64-linux-gnu/libc.so.6
+#1  <sigframe token>
+#2  0x00007ffff7c4527e in __GI_raise at ../sysdeps/posix/raise.c:26
+#3  0x000055555555519d in main at tmp/amd64-shadow-stack-signal.c:29
+(More shadow stack frames follow...)
+@end group
+@end smallexample
+
 @end table
 
 The optional @var{qualifier} is maintained for backward compatibility.
diff --git a/gdb/gdbarch-gen.c b/gdb/gdbarch-gen.c
index f5f85ba1f63..894522a7243 100644
--- a/gdb/gdbarch-gen.c
+++ b/gdb/gdbarch-gen.c
@@ -256,6 +256,7 @@  struct gdbarch
   gdbarch_address_in_shadow_stack_memory_range_ftype *address_in_shadow_stack_memory_range = nullptr;
   gdbarch_top_addr_empty_shadow_stack_ftype *top_addr_empty_shadow_stack = nullptr;
   int shadow_stack_element_size_aligned = 8;
+  gdbarch_is_no_return_shadow_stack_address_ftype *is_no_return_shadow_stack_address = nullptr;
 };
 
 /* Create a new ``struct gdbarch'' based on information provided by
@@ -519,6 +520,7 @@  verify_gdbarch (struct gdbarch *gdbarch)
   /* Skip verify of address_in_shadow_stack_memory_range, has predicate.  */
   /* Skip verify of top_addr_empty_shadow_stack, has predicate.  */
   /* Skip verify of shadow_stack_element_size_aligned, invalid_p == 0.  */
+  /* Skip verify of is_no_return_shadow_stack_address, has predicate.  */
   if (!log.empty ())
     internal_error (_("verify_gdbarch: the following are invalid ...%s"),
 		    log.c_str ());
@@ -1357,6 +1359,12 @@  gdbarch_dump (struct gdbarch *gdbarch, struct ui_file *file)
   gdb_printf (file,
 	      "gdbarch_dump: shadow_stack_element_size_aligned = %s\n",
 	      plongest (gdbarch->shadow_stack_element_size_aligned));
+  gdb_printf (file,
+	      "gdbarch_dump: gdbarch_is_no_return_shadow_stack_address_p() = %d\n",
+	      gdbarch_is_no_return_shadow_stack_address_p (gdbarch));
+  gdb_printf (file,
+	      "gdbarch_dump: is_no_return_shadow_stack_address = <%s>\n",
+	      host_address_to_string (gdbarch->is_no_return_shadow_stack_address));
   if (gdbarch->dump_tdep != nullptr)
     gdbarch->dump_tdep (gdbarch, file);
 }
@@ -5362,3 +5370,27 @@  set_gdbarch_shadow_stack_element_size_aligned (struct gdbarch *gdbarch,
 {
   gdbarch->shadow_stack_element_size_aligned = shadow_stack_element_size_aligned;
 }
+
+bool
+gdbarch_is_no_return_shadow_stack_address_p (struct gdbarch *gdbarch)
+{
+  gdb_assert (gdbarch != nullptr);
+  return gdbarch->is_no_return_shadow_stack_address != nullptr;
+}
+
+std::optional<shadow_stack_frame_info>
+gdbarch_is_no_return_shadow_stack_address (struct gdbarch *gdbarch, const CORE_ADDR ssp, const CORE_ADDR value, const unsigned long level)
+{
+  gdb_assert (gdbarch != nullptr);
+  gdb_assert (gdbarch->is_no_return_shadow_stack_address != nullptr);
+  if (gdbarch_debug >= 2)
+    gdb_printf (gdb_stdlog, "gdbarch_is_no_return_shadow_stack_address called\n");
+  return gdbarch->is_no_return_shadow_stack_address (gdbarch, ssp, value, level);
+}
+
+void
+set_gdbarch_is_no_return_shadow_stack_address (struct gdbarch *gdbarch,
+					       gdbarch_is_no_return_shadow_stack_address_ftype is_no_return_shadow_stack_address)
+{
+  gdbarch->is_no_return_shadow_stack_address = is_no_return_shadow_stack_address;
+}
diff --git a/gdb/gdbarch-gen.h b/gdb/gdbarch-gen.h
index 75a867ee8f5..08358b18fcf 100644
--- a/gdb/gdbarch-gen.h
+++ b/gdb/gdbarch-gen.h
@@ -1795,3 +1795,22 @@  void set_gdbarch_top_addr_empty_shadow_stack (struct gdbarch *gdbarch, gdbarch_t
 
 int gdbarch_shadow_stack_element_size_aligned (struct gdbarch *gdbarch);
 void set_gdbarch_shadow_stack_element_size_aligned (struct gdbarch *gdbarch, int shadow_stack_element_size_aligned);
+
+/* There can be elements on the shadow stack which are not return addresses.
+   This happens for example on x86 with CET in case of signals.
+   If an architecture implements the command option 'backtrace -shadow' and
+   the shadow stack can contain elements which are not return addresses, this
+   function has to be provided.
+   Return a shadow stack frame info with frame type
+   ssp_frame_type::non_return_frame, if the shadow stack pointer SSP belongs
+   to a valid shadow stack frame while the element on the shadow stack
+   VALUE does not refer to a return address.  In that case, also the frame's
+   attribute non_return_description has to be set to a string which is
+   displayed instead of the element on the shadow stack in the shadow stack
+   backtrace.  Otherwise, return an empty optional. */
+
+bool gdbarch_is_no_return_shadow_stack_address_p (struct gdbarch *gdbarch);
+
+using gdbarch_is_no_return_shadow_stack_address_ftype = std::optional<shadow_stack_frame_info> (struct gdbarch *gdbarch, const CORE_ADDR ssp, const CORE_ADDR value, const unsigned long level);
+std::optional<shadow_stack_frame_info> gdbarch_is_no_return_shadow_stack_address (struct gdbarch *gdbarch, const CORE_ADDR ssp, const CORE_ADDR value, const unsigned long level);
+void set_gdbarch_is_no_return_shadow_stack_address (struct gdbarch *gdbarch, gdbarch_is_no_return_shadow_stack_address_ftype *is_no_return_shadow_stack_address);
diff --git a/gdb/gdbarch_components.py b/gdb/gdbarch_components.py
index 26d104e841f..e8677d641bb 100644
--- a/gdb/gdbarch_components.py
+++ b/gdb/gdbarch_components.py
@@ -2847,3 +2847,28 @@  this value.
     # linux starting with Linux kernel v6.6.
     unused=True,
 )
+
+Method(
+    comment="""
+There can be elements on the shadow stack which are not return addresses.
+This happens for example on x86 with CET in case of signals.
+If an architecture implements the command option 'backtrace -shadow' and
+the shadow stack can contain elements which are not return addresses, this
+function has to be provided.
+Return a shadow stack frame info with frame type
+ssp_frame_type::non_return_frame, if the shadow stack pointer SSP belongs
+to a valid shadow stack frame while the element on the shadow stack
+VALUE does not refer to a return address.  In that case, also the frame's
+attribute non_return_description has to be set to a string which is
+displayed instead of the element on the shadow stack in the shadow stack
+backtrace.  Otherwise, return an empty optional.
+""",
+    type="std::optional<shadow_stack_frame_info>",
+    name="is_no_return_shadow_stack_address",
+    params=[
+        ("const CORE_ADDR", "ssp"),
+        ("const CORE_ADDR", "value"),
+        ("const unsigned long", "level"),
+    ],
+    predicate=True,
+)
diff --git a/gdb/shadow-stack.c b/gdb/shadow-stack.c
index 0f6bba148ac..75d9e0597ac 100644
--- a/gdb/shadow-stack.c
+++ b/gdb/shadow-stack.c
@@ -233,6 +233,29 @@  do_print_shadow_stack_frame_info
   const int element_size
     = gdbarch_shadow_stack_element_size_aligned (frame.arch);
 
+  if (frame.type != ssp_frame_type::normal_frame)
+    {
+      std::string str;
+      if (frame.type == ssp_frame_type::non_return_frame)
+	{
+	  /* For non-return frames, the string must have a value.  */
+	   gdb_assert (frame.non_return_description.has_value ());
+	   str = frame.non_return_description.value ();
+	}
+      else
+	gdb_assert_not_reached ("Invalid shadow stack frame type.");
+
+      ui_out_emit_tuple tuple_emitter (uiout, "shadow-stack-frame");
+      uiout->text ("#");
+      uiout->field_fmt_signed (2, ui_left, "level", frame.level);
+
+      uiout->field_string ("func", str, metadata_style.style ());
+
+      uiout->text ("\n");
+      gdb_flush (gdb_stdout);
+      return;
+    }
+
   if (fp_opts.print_frame_info != print_frame_info_auto)
     {
       /* Use the specific frame information desired by the user.  */
@@ -398,6 +421,15 @@  get_shadow_stack_frame_info
   if (!read_shadow_stack_memory (fallback_arch, ssp, value))
     return {};
 
+  if (gdbarch_is_no_return_shadow_stack_address_p (fallback_arch))
+    {
+      std::optional<shadow_stack_frame_info> no_return_frame
+	= gdbarch_is_no_return_shadow_stack_address (fallback_arch, ssp,
+						     value, level);
+      if (no_return_frame.has_value ())
+	return *no_return_frame;
+    }
+
   /* At this point, we know that SSP points to VALUE which is a return
      address.  In contrast to find_frame_sal which is used for the normal
      backtrace command, VALUE always points at the return instruction
@@ -414,6 +446,7 @@  get_shadow_stack_frame_info
 
   return std::optional<shadow_stack_frame_info>
     ({ssp, value, level, sal_arch, sal,
+      ssp_frame_type::normal_frame, {},
       ssp_unwind_stop_reason::no_error});
 }
 
@@ -421,7 +454,8 @@  std::optional<shadow_stack_frame_info>
 shadow_stack_frame_info::unwind_prev_shadow_stack_frame_info
   (std::pair<CORE_ADDR, CORE_ADDR> range)
 {
-  if (!user_set_backtrace_options.backtrace_past_main
+  if (this->type == ssp_frame_type::normal_frame
+      && !user_set_backtrace_options.backtrace_past_main
       && this->inside_main_func ())
     {
       /* Don't unwind past main().  */
diff --git a/gdb/shadow-stack.h b/gdb/shadow-stack.h
index 5c89aee70bb..4278620c70c 100644
--- a/gdb/shadow-stack.h
+++ b/gdb/shadow-stack.h
@@ -63,6 +63,21 @@  enum class ssp_unwind_stop_reason
   memory_read_error,
 };
 
+enum class ssp_frame_type
+{
+  /* A normal shadow stack frame which belongs to a return address of the
+     program execution flow.  */
+  normal_frame,
+
+  /* A shadow stack frame which does not belong to a return address.
+     It is possible, on x86 for instance, that an element on the shadow
+     stack is not a return address.  We don't want to print the address
+     in that case but only a string describing that specific frame type.
+     This frame type is configured in the target specific implementation
+     of is_no_return_shadow_stack_address.  */
+  non_return_frame,
+};
+
 /* Information of a shadow stack frame belonging to a shadow stack element
    at shadow stack pointer SSP.  */
 
@@ -92,6 +107,17 @@  class shadow_stack_frame_info
   /* Optional SAL object of the current shadow stack frame.  */
   std::optional<symtab_and_line> sal;
 
+  /* The shadow stack frame type.  */
+  ssp_frame_type type;
+
+  /* If this is not a normal shadow stack frame belonging to a return
+     address of the program execution flow then the frame will have the
+     type ssp_frame_type::non_return_frame.  In this case, this string
+     is configured to describe this specific frame type and it will
+     be printed in the shadow stack backtrace instead of the element on
+     the shadow stack.  */
+  std::optional<std::string> non_return_description;
+
   /* If unwinding of the previous frame info fails assign this value to a
      matching condition ssp_unwind_stop_reason
      > ssp_unwind_stop_reason::no_error.  */