[PATCH v5 07/12] gdb: amd64 linux coredump support with shadow stack.

Christina Schimpe
2025-06-28T08:33:46Z

Intel's Control-Flow Enforcement Technology (CET) provides the shadow
stack feature for the x86 architecture.

This commit adds support to write and read the shadow-stack node in
corefiles. This helps debugging return address violations post-mortem.
The format is synced with the linux kernel commit "x86: Add PTRACE
interface for shadow stack". As the linux kernel restricts shadow
stack support to 64-bit, apply the fix for amd64 only.

Co-Authored-By: Christina Schimpe <christina.schimpe@intel.com>

Reviewed-by: Thiago Jung Bauermann <thiago.bauermann@linaro.org>
---
gdb/amd64-linux-tdep.c | 57 ++++++++-
.../gdb.arch/amd64-shadow-stack-corefile.c | 42 +++++++
.../gdb.arch/amd64-shadow-stack-corefile.exp | 110 ++++++++++++++++++
3 files changed, 205 insertions(+), 4 deletions(-)
create mode 100644 gdb/testsuite/gdb.arch/amd64-shadow-stack-corefile.c
create mode 100644 gdb/testsuite/gdb.arch/amd64-shadow-stack-corefile.exp

diff --git a/gdb/amd64-linux-tdep.c b/gdb/amd64-linux-tdep.c
index edb7d8da6ab..9af7a41ea26 100644
--- a/gdb/amd64-linux-tdep.c
+++ b/gdb/amd64-linux-tdep.c
@@ -47,6 +47,7 @@
#include "expop.h"
#include "arch/amd64-linux-tdesc.h"
#include "inferior.h"
+#include "x86-tdep.h"

/* The syscall's XML filename for i386. */
#define XML_SYSCALL_FILENAME_AMD64 "syscalls/amd64-linux.xml"
@@ -1593,6 +1594,14 @@ amd64_linux_record_signal (struct gdbarch *gdbarch,
return 0;
}

+/* Get shadow stack pointer state from core dump. */
+
+static bool
+amd64_linux_core_read_ssp_state_p (bfd *abfd)
+{
+ return bfd_get_section_by_name (abfd, ".reg-ssp") != nullptr;
+}
+
/* Get Linux/x86 target description from core dump. */

static const struct target_desc *
@@ -1602,11 +1611,14 @@ amd64_linux_core_read_description (struct gdbarch *gdbarch,
{
/* Linux/x86-64. */
x86_xsave_layout layout;
- uint64_t xcr0 = i386_linux_core_read_xsave_info (abfd, layout);
- if (xcr0 == 0)
- xcr0 = X86_XSTATE_SSE_MASK;
+ uint64_t xstate_bv_mask = i386_linux_core_read_xsave_info (abfd, layout);
+ if (xstate_bv_mask == 0)
+ xstate_bv_mask = X86_XSTATE_SSE_MASK;
+
+ if (amd64_linux_core_read_ssp_state_p (abfd))
+ xstate_bv_mask |= X86_XSTATE_CET_U;

- return amd64_linux_read_description (xcr0 & X86_XSTATE_ALL_MASK,
+ return amd64_linux_read_description (xstate_bv_mask & X86_XSTATE_ALL_MASK,
gdbarch_ptr_bit (gdbarch) == 32);
}

@@ -1637,6 +1649,35 @@ static const struct regset amd64_linux_xstateregset =
amd64_linux_collect_xstateregset
};

+/* Supply shadow stack pointer register from SSP to the register cache
+ REGCACHE. */
+
+static void
+amd64_linux_supply_ssp (const regset *regset,
+ regcache *regcache, int regnum,
+ const void *ssp, size_t len)
+{
+ x86_supply_ssp (regcache, *static_cast<const uint64_t *> (ssp));
+}
+
+/* Collect the shadow stack pointer register from the register cache
+ REGCACHE and store it in SSP. */
+
+static void
+amd64_linux_collect_ssp (const regset *regset,
+ const regcache *regcache, int regnum,
+ void *ssp, size_t len)
+{
+ x86_collect_ssp (regcache, *static_cast<uint64_t *> (ssp));
+}
+
+/* Shadow stack pointer register. */
+
+static const struct regset amd64_linux_ssp_register
+ {
+ NULL, amd64_linux_supply_ssp, amd64_linux_collect_ssp
+ };
+
/* Iterate over core file register note sections. */

static void
@@ -1653,6 +1694,14 @@ amd64_linux_iterate_over_regset_sections (struct gdbarch *gdbarch,
cb (".reg-xstate", tdep->xsave_layout.sizeof_xsave,
tdep->xsave_layout.sizeof_xsave, &amd64_linux_xstateregset,
"XSAVE extended state", cb_data);
+
+ /* SSP can be unavailable. Thus, we need to check the register status
+ in case we write a core file (regcache != nullptr). */
+ if (tdep->ssp_regnum > 0
+ && (regcache == nullptr
+ || REG_VALID == regcache->get_register_status (tdep->ssp_regnum)))
+ cb (".reg-ssp", 8, 8, &amd64_linux_ssp_register,
+ "shadow stack pointer", cb_data);
}

/* The instruction sequences used in x86_64 machines for a
diff --git a/gdb/testsuite/gdb.arch/amd64-shadow-stack-corefile.c b/gdb/testsuite/gdb.arch/amd64-shadow-stack-corefile.c
new file mode 100644
index 00000000000..f078e33810d
--- /dev/null
+++ b/gdb/testsuite/gdb.arch/amd64-shadow-stack-corefile.c
@@ -0,0 +1,42 @@
+/* This test program is part of GDB, the GNU debugger.
+
+ Copyright 2025 Free Software Foundation, Inc.
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <http://www.gnu.org/licenses/>. */
+
+#include <stdio.h>
+
+/* Call the return instruction before function epilogue to trigger a
+ control-flow exception. */
+void
+function ()
+{
+ unsigned long ssp;
+ asm volatile("xor %0, %0; rdsspq %0" : "=r" (ssp));
+
+ /* Print ssp to stdout so that the testcase can capture it. */
+ printf ("%p\n", (void *) ssp);
+ fflush (stdout);
+
+ /* Manually cause a control-flow exception by executing a return
+ instruction before function epilogue, so the address atop the stack
+ is not the return instruction. */
+ __asm__ volatile ("ret\n");
+}
+
+int
+main (void)
+{
+ function (); /* Break here. */
+}
diff --git a/gdb/testsuite/gdb.arch/amd64-shadow-stack-corefile.exp b/gdb/testsuite/gdb.arch/amd64-shadow-stack-corefile.exp
new file mode 100644
index 00000000000..8784fc3622c
--- /dev/null
+++ b/gdb/testsuite/gdb.arch/amd64-shadow-stack-corefile.exp
@@ -0,0 +1,110 @@
+# Copyright 2021-2024 Free Software Foundation, Inc.
+
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+# Test the shadow stack pointer note in core dumps.
+
+require allow_ssp_tests
+
+standard_testfile
+
+proc check_core_file {core_filename saved_pl3_ssp} {
+ global decimal
+
+ # Load the core file.
+ if [gdb_test "core $core_filename" \
+ [multi_line \
+ "Core was generated by .*\\." \
+ "Program terminated with signal SIGSEGV, Segmentation fault.*" \
+ "#0 function \\(\\) at .*amd64-shadow-stack-corefile.c:$decimal" \
+ "$decimal.*__asm__ volatile \\(\"ret\\\\n\"\\);"] \
+ "load core file"] {
+ return
+ }
+
+ # Check the value of ssp in the core file.
+ gdb_test "print/x \$pl3_ssp" "\\$\[0-9\]+ = $saved_pl3_ssp" \
+ "pl3_ssp contents from core file $saved_pl3_ssp"
+}
+
+save_vars { ::env(GLIBC_TUNABLES) } {
+
+ append_environment GLIBC_TUNABLES "glibc.cpu.hwcaps" "SHSTK"
+
+ if { [prepare_for_testing "failed to prepare" $testfile $srcfile \
+ {debug additional_flags="-fcf-protection=return"}] } {
+ return
+ }
+
+ set linespec ${srcfile}:[gdb_get_line_number "Break here"]
+
+ if ![runto $linespec] {
+ return
+ }
+
+ # Continue until a crash. The line with the hex number is optional because
+ # it's printed by the test program, and doesn't appear in the Expect buffer
+ # when testing a remote target.
+ gdb_test "continue" \
+ [multi_line \
+ "Continuing\\." \
+ "($hex\r\n)?" \
+ "Program received signal SIGSEGV, Segmentation fault.*" \
+ "function \\(\\) at .*amd64-shadow-stack-corefile.c:$decimal" \
+ {.*__asm__ volatile \("ret\\n"\);}] \
+ "continue to SIGSEGV"
+
+ set ssp_in_gcore [get_valueof "/x" "\$pl3_ssp" "*unknown*"]
+
+ # Generate the gcore core file.
+ set gcore_filename [standard_output_file "${testfile}.gcore"]
+ set gcore_generated [gdb_gcore_cmd "$gcore_filename" "generate gcore file"]
+
+ # Obtain an OS-generated core file. Save test program output to
+ # ${binfile}.out.
+ set core_filename [core_find $binfile {} {} "${binfile}.out"]
+ set core_generated [expr {$core_filename != ""}]
+ set os_core_name "${binfile}.core"
+ remote_exec build "mv $core_filename $os_core_name"
+ set core_filename $os_core_name
+
+ # At this point we have a couple of core files, the gcore one generated by
+ # GDB and the one generated by the operating system. Make sure GDB can
+ # read both correctly.
+
+ if {$gcore_generated} {
+ clean_restart $binfile
+
+ with_test_prefix "gcore corefile" {
+ check_core_file $gcore_filename $ssp_in_gcore
+ }
+ } else {
+ fail "gcore corefile not generated"
+ }
+
+ if {$core_generated} {
+ clean_restart $binfile
+
+ with_test_prefix "OS corefile" {
+ # Read ssp value from saved output of the test program.
+ set out_id [open ${binfile}.out "r"]
+ set ssp_in_gcore [gets $out_id]
+
+ close $out_id
+ check_core_file $core_filename $ssp_in_gcore
+ }
+ } else {
+ untested "OS corefile not generated"
+ }
+}
--
2.43.0