RE: [PATCH 0/9] Add new command to print the shadow stack backtrace

["Schimpe, Christina" <christina.schimpe@intel.com>]

> -----Original Message-----
> From: Schimpe, Christina
> Sent: Monday, October 13, 2025 8:35 AM
> To: Thiago Jung Bauermann <thiago.bauermann@linaro.org>
> Cc: gdb-patches@sourceware.org
> Subject: RE: [PATCH 0/9] Add new command to print the shadow stack
> backtrace
> 
> > -----Original Message-----
> > From: Thiago Jung Bauermann <thiago.bauermann@linaro.org>
> > Sent: Monday, October 13, 2025 3:19 AM
> > To: Schimpe, Christina <christina.schimpe@intel.com>
> > Cc: gdb-patches@sourceware.org
> > Subject: Re: [PATCH 0/9] Add new command to print the shadow stack
> > backtrace
> >
> > Thiago Jung Bauermann <thiago.bauermann@linaro.org> writes:
> >
> > > I tested your patches and there's a bug unfortunately:
> > >
> > > FAIL: gdb.arch/aarch64-gcs-disp-step.exp: continue to breakpoint at
> > > blr
> > > FAIL: gdb.arch/aarch64-gcs-disp-step.exp: continue until exit
> > > FAIL: gdb.arch/aarch64-gcs.exp: call inferior function
> > > FAIL: gdb.arch/aarch64-gcs-return.exp: test inferior call and
> > > continue: call (int) call2()
> > > FAIL: gdb.arch/aarch64-gcs-return.exp: test inferior call and
> > > continue: continue until exit
> > > FAIL: gdb.arch/aarch64-gcs-return.exp: test frame level update:
> > > check gcspr of frame 1
> > > FAIL: gdb.arch/aarch64-gcs-return.exp: test frame level update:
> > > check gcspr of frame 2
> > > FAIL: gdb.arch/aarch64-gcs-return.exp: test return from current frame:
> > > continue until exit
> > >
> > > In each FAIL above a GCS error happens unexpectedly in the inferior.
> > > It appears that GDB isn't updating the shadow stack correctly. I
> > > still have to see what exactly is the problem.
> >
> > The problem turned out to be simple. I just had to set the regnum for
> > the GCSPR in the gdbarch:
> >
> > diff --git a/gdb/aarch64-tdep.c b/gdb/aarch64-tdep.c index
> > 95af82c26327..9e866fc319d4 100644
> > --- a/gdb/aarch64-tdep.c
> > +++ b/gdb/aarch64-tdep.c
> > @@ -4780,6 +4780,10 @@ aarch64_gdbarch_init (struct gdbarch_info
> info,
> > struct gdbarch_list *arches)
> >    /* Register a hook for converting a memory tag to a string.  */
> >    set_gdbarch_memtag_to_string (gdbarch, aarch64_memtag_to_string);
> >
> > +  if (tdep->has_gcs ())
> > +    /* AArch64's shadow stack pointer is the GCSPR.  */
> > +    set_gdbarch_ssp_regnum (gdbarch, tdep->gcs_reg_base);
> > +
> >    /* ABI */
> >    set_gdbarch_short_bit (gdbarch, 16);
> >    set_gdbarch_int_bit (gdbarch, 32);
> >
> > --
> > Thiago
> 
> Ah, I forgot about that. Cool that it works now. 😊
> 
> Thanks,
> Christina

Hi Thiago,

I thought about this again. In addition to setting the regnum for the shadow stack pointer,
I would have expected that you also have to implement the gdbarch hook
top_addr_empty_shadow_stack to make GCS work for shadow stack pointer unwinding
and the shadow stack backtrace, or am I missing something?

Both, the aarch64 implememtation for top_addr_empty_shadow_stack and ssp regnum
configuration, should then be part the first patch "Generalize handling ...".
Does that make sense to you?

Also I should probably add proper error messages when the configuration of ssp_regnum is missing,
and improve the documentation for required gdbarch hooks to properly implement "bt shadow" in
gdbarch_components.py.

Kind Regards,
Christina




Intel Deutschland GmbH
Registered Address: Dornacher Straße 1, 85622 Feldkirchen, Germany
Tel: +49 89 991 430, www.intel.de
Managing Directors: Harry Demas, Jeffrey Schneiderman, Yin Chong Sorrell
Chairperson of the Supervisory Board: Nicole Lau
Registered Seat: Munich
Commercial Register: Amtsgericht München HRB 186928