[PATCH v5 11/13] gdb: Enable inferior calls in the shadow stack backtrace.

[Christina Joos <christina.joos@intel.com>]

Similar to the normal backtrace display <function called from gdb>
in the shadow stack backtrace for inferior function calls.

Example for a nested inferior call:
~~~
(gdb) bt -shadow
\#0  <function called from gdb>
\#1  <function called from gdb>
\#2  0x000000000040045a in call1 at /tmp/amd64-shadow-stack.c:27
\#3  0x0000000000400466 in main at /tmp/amd64-shadow-stack.c:38
(gdb) bt
\#0  call2 () at /tmp/amd64-shadow-stack.c:21
\#1  <function called from gdb>
\#2  call2 () at /tmp/amd64-shadow-stack.c:21
\#3  <function called from gdb>
\#4  call2 () at /tmp/amd64-shadow-stack.c:21
\#5  0x000000000040045a in call1 () at /tmp/amd64-shadow-stack.c:27
\#6  0x0000000000400466 in main () at /tmp/amd64-shadow-stack.c:38
~~~

Reviewed-by: Thiago Jung Bauermann <thiago.bauermann@linaro.org>
---
 gdb/shadow-stack.c                            | 36 +++++++++++++++++++
 gdb/shadow-stack.h                            |  4 +++
 .../gdb.arch/amd64-shadow-stack-cmds.exp      | 24 +++++++++++++
 3 files changed, 64 insertions(+)

diff --git a/gdb/shadow-stack.c b/gdb/shadow-stack.c
index 75d9e0597ac..a31bb02bceb 100644
--- a/gdb/shadow-stack.c
+++ b/gdb/shadow-stack.c
@@ -215,6 +215,29 @@ find_pc_funname (CORE_ADDR pc)
   return funname;
 }
 
+/* Check if the shadow stack frame's value VAL is an inferior call
+   return address.  */
+
+static bool
+is_infcall_return_address (const CORE_ADDR val)
+{
+  const int inf_thread_num = inferior_thread ()->global_num;
+
+  for (breakpoint &b : all_breakpoints ())
+    {
+      if (b.type != bp_call_dummy
+	  || b.thread != inf_thread_num
+	  || b.frame_id.code_addr != val)
+	continue;
+
+      for (bp_location &bl : b.locations ())
+	if (bl.pspace == current_program_space)
+	  return true;
+    }
+
+  return false;
+}
+
 /* Print information of shadow stack frame info FRAME.  The output is
    formatted according to PRINT_WHAT.  For the meaning of PRINT_WHAT, see
    enum print_what comments in frame.h.  Note that PRINT_WHAT is overridden,
@@ -242,6 +265,8 @@ do_print_shadow_stack_frame_info
 	   gdb_assert (frame.non_return_description.has_value ());
 	   str = frame.non_return_description.value ();
 	}
+      else if (frame.type == ssp_frame_type::dummy_frame)
+	str = "<function called from gdb>";
       else
 	gdb_assert_not_reached ("Invalid shadow stack frame type.");
 
@@ -430,6 +455,17 @@ get_shadow_stack_frame_info
 	return *no_return_frame;
     }
 
+  if (is_infcall_return_address (value))
+    {
+      /* If VALUE belongs to a dummy call breakpoint get_sal_arch won't
+	 return a valid gdbarch and we can assign the current gdbarch
+	 here.  We also don't show any SAL information, so we can set it
+	 to an empty optional.  */
+      return std::optional<shadow_stack_frame_info>
+	({ssp, value, level, fallback_arch, {}, ssp_frame_type::dummy_frame,
+	  {}, ssp_unwind_stop_reason::no_error});
+    }
+
   /* At this point, we know that SSP points to VALUE which is a return
      address.  In contrast to find_frame_sal which is used for the normal
      backtrace command, VALUE always points at the return instruction
diff --git a/gdb/shadow-stack.h b/gdb/shadow-stack.h
index 4278620c70c..225fd3996cd 100644
--- a/gdb/shadow-stack.h
+++ b/gdb/shadow-stack.h
@@ -76,6 +76,10 @@ enum class ssp_frame_type
      This frame type is configured in the target specific implementation
      of is_no_return_shadow_stack_address.  */
   non_return_frame,
+
+  /* A fake frame, created by GDB when performing an inferior function
+     call.  */
+  dummy_frame,
 };
 
 /* Information of a shadow stack frame belonging to a shadow stack element
diff --git a/gdb/testsuite/gdb.arch/amd64-shadow-stack-cmds.exp b/gdb/testsuite/gdb.arch/amd64-shadow-stack-cmds.exp
index 0347313b647..3259fd2f918 100644
--- a/gdb/testsuite/gdb.arch/amd64-shadow-stack-cmds.exp
+++ b/gdb/testsuite/gdb.arch/amd64-shadow-stack-cmds.exp
@@ -167,6 +167,30 @@ save_vars { ::env(GLIBC_TUNABLES) } {
 	gdb_continue_to_end
     }
 
+    with_test_prefix "test inferior call shadow stack backtrace" {
+	restart_and_run_infcall_call2
+	gdb_test "bt -shadow" \
+	    [multi_line \
+		"#0\[ \t\]*<function called from gdb>" \
+		"#1\[ \t\]*$hex in \[^\r\n\]+" \
+		"#2\[ \t\]*$hex in \[^\r\n\]+" ] \
+	    "Test shadow stack backtrace for inferior calls."
+
+	set inside_infcall_str \
+	    "The program being debugged stopped while in a function called from GDB"
+	gdb_test "call (int) call2()" \
+	    "Breakpoint \[0-9\]*, call2.*$inside_infcall_str.*" \
+	    "Execute an inferior call inside an inferior call."
+
+	gdb_test "bt -shadow" \
+	    [multi_line \
+		"#0\[ \t\]*<function called from gdb>" \
+		"#1\[ \t\]*<function called from gdb>" \
+		"#2\[ \t\]*$hex in \[^\r\n\]+" \
+		"#3\[ \t\]*$hex in \[^\r\n\]+" ] \
+	    "Test shadow stack backtrace for nested inferior calls."
+    }
+
     clean_restart ${::testfile}
     if { ![runto_main] } {
 	return
-- 
2.53.0

________________________________________
Intel Deutschland GmbH 

Registered Address: Dornacher Strasse 1, 85622 Feldkirchen, Germany 

Tel: +49 (89) 99143-0 

www.intel.de 

Managing Directors: Candice Moore, Jeffrey Schneiderman, Ramachandran Sitaraman

Chairperson of the Supervisory Board: Sonja Pierer

Registered Seat: Munich Commercial Register B: Amtsgericht Munich HRB 186928

This e-mail and any attachments may contain confidential material for
the sole use of the intended recipient(s). Any review or distribution
by others is strictly prohibited. If you are not the intended
recipient, please contact the sender and delete all copies.