[PATCH v4 11/13] gdb: Enable inferior calls in the shadow stack backtrace.

[Christina Schimpe <christina.schimpe@intel.com>]

Similar to the normal backtrace display <function called from gdb>
in the shadow stack backtrace for inferior function calls.

Example for a nested inferior call:
~~~
(gdb) bt -shadow
\#0  <function called from gdb>
\#1  <function called from gdb>
\#2  0x000000000040045a in call1 at /tmp/amd64-shadow-stack.c:27
\#3  0x0000000000400466 in main at /tmp/amd64-shadow-stack.c:38
(gdb) bt
\#0  call2 () at /tmp/amd64-shadow-stack.c:21
\#1  <function called from gdb>
\#2  call2 () at /tmp/amd64-shadow-stack.c:21
\#3  <function called from gdb>
\#4  call2 () at /tmp/amd64-shadow-stack.c:21
\#5  0x000000000040045a in call1 () at /tmp/amd64-shadow-stack.c:27
\#6  0x0000000000400466 in main () at /tmp/amd64-shadow-stack.c:38
~~~
---
 gdb/shadow-stack.c                            | 36 +++++++++++++++++++
 gdb/shadow-stack.h                            |  4 +++
 .../gdb.arch/amd64-shadow-stack-cmds.exp      | 24 +++++++++++++
 3 files changed, 64 insertions(+)

diff --git a/gdb/shadow-stack.c b/gdb/shadow-stack.c
index dbd8959753d..94062034bd3 100644
--- a/gdb/shadow-stack.c
+++ b/gdb/shadow-stack.c
@@ -215,6 +215,29 @@ find_pc_funname (CORE_ADDR pc)
   return funname;
 }
 
+/* Check if the shadow stack frame's value VAL is an inferior call
+   return address.  */
+
+static bool
+is_infcall_return_address (const CORE_ADDR val)
+{
+  const int inf_thread_num = inferior_thread ()->global_num;
+
+  for (breakpoint &b : all_breakpoints ())
+    {
+      if (b.type != bp_call_dummy
+	  || b.thread != inf_thread_num
+	  || b.frame_id.code_addr != val)
+	continue;
+
+      for (bp_location &bl : b.locations ())
+	if (bl.pspace == current_program_space)
+	  return true;
+    }
+
+  return false;
+}
+
 /* Print information of shadow stack frame info FRAME.  The output is
    formatted according to PRINT_WHAT.  For the meaning of PRINT_WHAT, see
    enum print_what comments in frame.h.  Note that PRINT_WHAT is overridden,
@@ -242,6 +265,8 @@ do_print_shadow_stack_frame_info
 	   gdb_assert (frame.non_return_description.has_value ());
 	   str = frame.non_return_description.value ();
 	}
+      else if (frame.type == ssp_frame_type::dummy_frame)
+	str = "<function called from gdb>";
       else
 	gdb_assert_not_reached ("Invalid shadow stack frame type.");
 
@@ -430,6 +455,17 @@ get_shadow_stack_frame_info
 	return *no_return_frame;
     }
 
+  if (is_infcall_return_address (value))
+    {
+      /* If VALUE belongs to a dummy call breakpoint get_sal_arch won't
+	 return a valid gdbarch and we can assign the current gdbarch
+	 here.  We also don't show any SAL information, so we can set it
+	 to an empty optional.  */
+      return std::optional<shadow_stack_frame_info>
+	({ssp, value, level, fallback_arch, {}, ssp_frame_type::dummy_frame,
+	  {}, ssp_unwind_stop_reason::no_error});
+    }
+
   /* At this point, we know that SSP points to VALUE which is a return
      address.  In contrast to find_frame_sal which is used for the normal
      backtrace command, VALUE always points at the return instruction
diff --git a/gdb/shadow-stack.h b/gdb/shadow-stack.h
index 4278620c70c..225fd3996cd 100644
--- a/gdb/shadow-stack.h
+++ b/gdb/shadow-stack.h
@@ -76,6 +76,10 @@ enum class ssp_frame_type
      This frame type is configured in the target specific implementation
      of is_no_return_shadow_stack_address.  */
   non_return_frame,
+
+  /* A fake frame, created by GDB when performing an inferior function
+     call.  */
+  dummy_frame,
 };
 
 /* Information of a shadow stack frame belonging to a shadow stack element
diff --git a/gdb/testsuite/gdb.arch/amd64-shadow-stack-cmds.exp b/gdb/testsuite/gdb.arch/amd64-shadow-stack-cmds.exp
index 0347313b647..3259fd2f918 100644
--- a/gdb/testsuite/gdb.arch/amd64-shadow-stack-cmds.exp
+++ b/gdb/testsuite/gdb.arch/amd64-shadow-stack-cmds.exp
@@ -167,6 +167,30 @@ save_vars { ::env(GLIBC_TUNABLES) } {
 	gdb_continue_to_end
     }
 
+    with_test_prefix "test inferior call shadow stack backtrace" {
+	restart_and_run_infcall_call2
+	gdb_test "bt -shadow" \
+	    [multi_line \
+		"#0\[ \t\]*<function called from gdb>" \
+		"#1\[ \t\]*$hex in \[^\r\n\]+" \
+		"#2\[ \t\]*$hex in \[^\r\n\]+" ] \
+	    "Test shadow stack backtrace for inferior calls."
+
+	set inside_infcall_str \
+	    "The program being debugged stopped while in a function called from GDB"
+	gdb_test "call (int) call2()" \
+	    "Breakpoint \[0-9\]*, call2.*$inside_infcall_str.*" \
+	    "Execute an inferior call inside an inferior call."
+
+	gdb_test "bt -shadow" \
+	    [multi_line \
+		"#0\[ \t\]*<function called from gdb>" \
+		"#1\[ \t\]*<function called from gdb>" \
+		"#2\[ \t\]*$hex in \[^\r\n\]+" \
+		"#3\[ \t\]*$hex in \[^\r\n\]+" ] \
+	    "Test shadow stack backtrace for nested inferior calls."
+    }
+
     clean_restart ${::testfile}
     if { ![runto_main] } {
 	return
-- 
2.34.1

Intel Deutschland GmbH

Registered Address: Dornacher Strasse 1, 85622 Feldkirchen, Germany
Tel: +49 89 991 430, www.intel.de
Managing Directors: Harry Demas, Jeffrey Schneiderman, Yin Chong Sorrell
Chairperson of the Supervisory Board: Nicole Lau
Registered Seat: Munich
Commercial Register: Amtsgericht Muenchen HRB 186928