Re: [PATCH v4 08/13] gdb: Add command option 'bt -shadow' to print the shadow stack backtrace.

[Thiago Jung Bauermann <thiago.bauermann@linaro.org>]

Hello Christina,

"Joos, Christina" <christina.joos@intel.com> writes:

>> -----Original Message-----
>> From: Thiago Jung Bauermann <thiago.bauermann@linaro.org>
>> Sent: Donnerstag, 3. September 2026 09:38
>> To: Joos, Christina <christina.joos@intel.com>
>> Cc: gdb-patches@sourceware.org; tom@tromey.com
>> Subject: Re: [PATCH v4 08/13] gdb: Add command option 'bt -shadow' to print
>> the shadow stack backtrace.
>> 
>> Christina Schimpe <christina.schimpe@intel.com> writes:
>> 
>> > +/* If possible, get shadow stack frame info for the shadow stack pointer
>> > +   SSP and its current frame LEVEL.  Pass FALLBACK_ARCH which can be used
>> > +   as fallback gdbarch in case the gdbarch cannot be extracted from the
>> > +   SAL.  Usually this is the gdbarch of the previous frame.  */
>> > +
>> > +static std::optional<shadow_stack_frame_info>
>> > +get_shadow_stack_frame_info
>> > +  (gdbarch *fallback_arch, const CORE_ADDR ssp, unsigned long level)
>> > +{
>> > +  CORE_ADDR value;
>> > +  if (!read_shadow_stack_memory (fallback_arch, ssp, value))
>> > +    return {};
>> > +
>> > +  /* At this point, we know that SSP points to VALUE which is a return
>> > +     address.  In contrast to find_frame_sal which is used for the normal
>> > +     backtrace command, VALUE always points at the return instruction
>> > +     (which is *after* the call instruction).  Since we want to get the
>> > +     line containing the call (because the call is where the user thinks
>> > +     the program is), we pass 1 here as second argument.  */
>> > + symtab_and_line sal = find_sal_for_pc (value, 1);  struct gdbarch
>> > + *sal_arch = get_sal_arch (sal);
>> 
>> Nit: remove unnecessary struct keyword.
>> 
>> Also just FYI I'm encountering a snag here in the case of aarch64, which I'm still
>> looking into:
>> 
>> The gdbarch returned by get_sal_arch here doesn't have the shadow stack
>> hooks set. This causes "bt -shadow" from a signal handler not to show
>> "<sigframe token>", because this "simpler" gdbarch will get passed as
>> fallback_arch in the next call to get_shadow_stack_frame_info by
>> shadow_stack_frame_info::unwind_prev_shadow_stack_frame_info, and then
>> gdbarch_is_no_return_shadow_stack_address_p (fallback_arch) will be false
>> and the corresponding aarch64 hook won't get a change to identify the
>> sigframe token.
>> 
>> I think get_sal_arch is returning a gdbarch that was created before the inferior
>> was started, and at that time GDB couldn't know that GCS would be enabled.
>> 
>> In any case, if this is working fine for x86 then don't worry about it. I can fix it
>> when posting the aarch64 support for "bt -shadow".
>
> I don't remember seeing something like this, but I also posted this some time
> ago.... Maybe something changed in between in upstream.
> Did this happen with a specific linux kernel/OS version or a specific testprogram?
> Then I can double check to verify this.

This is on Ubuntu 26.04, with a new testcase for GCS that does exactly
the same things as gdb.arch/amd64-shadow-stack-backtrace-signal.exp.

I had more time to dig into this today. Now understood what's going on
and I don't think x86 is affected.

The problem is that aarch64_gdbarch_init and aarch64_linux_init_abi only
install the shadow stack gdbarch hooks if GCS is enabled. So for a
gdbarch initialized before the inferior is running, GDB can't know
whether GCS will be enabled or not and the shadow stack gdbarch hooks
aren't installed in that gdbarch.

This isn't really necessary though because the hooks check at runtime if
GCS is enabled and it's harmless to call them on an inferior that
doesn't have GCS. If I unconditionally install the shadow stack hooks as
the patch at the end of this email does, then everything works fine.

One of the changes below would be on patch 2 of this series. I'll reply
to it. The other is a local patch I haven't submitted yet.

-- 
Thiago
(he/him)


diff --git a/gdb/aarch64-linux-tdep.c b/gdb/aarch64-linux-tdep.c
index e2a25086d169..390bec441bf9 100644
--- a/gdb/aarch64-linux-tdep.c
+++ b/gdb/aarch64-linux-tdep.c
@@ -3229,14 +3229,11 @@ aarch64_linux_init_abi (struct gdbarch_info info, struct gdbarch *gdbarch)
   set_gdbarch_use_target_description_from_corefile_notes (gdbarch,
 			    aarch64_use_target_description_from_corefile_notes);
 
-  if (tdep->has_gcs_linux ())
-    {
-      set_gdbarch_get_shadow_stack_pointer (gdbarch,
+  set_gdbarch_get_shadow_stack_pointer (gdbarch,
 					aarch64_linux_get_shadow_stack_pointer);
-      set_gdbarch_is_no_return_shadow_stack_address (gdbarch,
-			      aarch64_linux_is_no_return_shadow_stack_address);
-      tdep->fn_prev_gcspr = dwarf2_prev_ssp;
-    }
+  set_gdbarch_is_no_return_shadow_stack_address (gdbarch,
+						 aarch64_linux_is_no_return_shadow_stack_address);
+  tdep->fn_prev_gcspr = dwarf2_prev_ssp;
 }
 
 #if GDB_SELF_TEST
diff --git a/gdb/aarch64-tdep.c b/gdb/aarch64-tdep.c
index d789b8569d22..7e16d821ff7c 100644
--- a/gdb/aarch64-tdep.c
+++ b/gdb/aarch64-tdep.c
@@ -4804,12 +4804,10 @@ aarch64_gdbarch_init (struct gdbarch_info info, struct gdbarch_list *arches)
   set_gdbarch_memtag_to_string (gdbarch, aarch64_memtag_to_string);
 
   if (tdep->has_gcs ())
-    {
-      /* AArch64's shadow stack pointer is the GCSPR.  */
-      set_gdbarch_ssp_regnum (gdbarch, tdep->gcs_reg_base);
-      set_gdbarch_top_addr_empty_shadow_stack
-	(gdbarch, aarch64_top_addr_empty_shadow_stack);
-    }
+    /* AArch64's shadow stack pointer is the GCSPR.  */
+    set_gdbarch_ssp_regnum (gdbarch, tdep->gcs_reg_base);
+  set_gdbarch_top_addr_empty_shadow_stack (gdbarch,
+					   aarch64_top_addr_empty_shadow_stack);
 
   /* ABI */
   set_gdbarch_short_bit (gdbarch, 16);