Re: [PATCH v5 06/12] gdb, gdbserver: Add support of Intel shadow stack pointer register.

H.J. Lu
2025-08-10T19:03:00Z

On Sat, Jun 28, 2025 at 1:32 AM Christina Schimpe
<christina.schimpe@intel.com> wrote:
>
> This patch adds the user mode register PL3_SSP which is part of the
> Intel(R) Control-Flow Enforcement Technology (CET) feature for support
> of shadow stack.
> For now, only native and remote debugging support for shadow stack
> userspace on amd64 linux are covered by this patch including 64 bit and
> x32 support. 32 bit support is not covered due to missing Linux kernel
> support.
>
> This patch requires fixing the test gdb.base/inline-frame-cycle-unwind
> which is failing in case the shadow stack pointer is unavailable.
> Such a state is possible if shadow stack is disabled for the current thread
> but supported by HW.
>
> This test uses the Python unwinder inline-frame-cycle-unwind.py which fakes
> the cyclic stack cycle by reading the pending frame's registers and adding
> them to the unwinder:
>
> ~~~
> for reg in pending_frame.architecture().registers("general"):
> val = pending_frame.read_register(reg)
> unwinder.add_saved_register(reg, val)
> return unwinder
> ~~~
>
> However, in case the python unwinder is used we add a register (pl3_ssp) that is
> unavailable. This leads to a NOT_AVAILABLE_ERROR caught in
> gdb/frame-unwind.c:frame_unwind_try_unwinder and it is continued with standard
> unwinders. This destroys the faked cyclic behavior and the stack is
> further unwinded after frame 5.
>
> In the working scenario an error should be triggered:
> ~~~
> bt
> 0 inline_func () at /tmp/gdb.base/inline-frame-cycle-unwind.c:49^M
> 1 normal_func () at /tmp/gdb.base/inline-frame-cycle-unwind.c:32^M
> 2 0x000055555555516e in inline_func () at /tmp/gdb.base/inline-frame-cycle-unwind.c:45^M
> 3 normal_func () at /tmp/gdb.base/inline-frame-cycle-unwind.c:32^M
> 4 0x000055555555516e in inline_func () at /tmp/gdb.base/inline-frame-cycle-unwind.c:45^M
> 5 normal_func () at /tmp/gdb.base/inline-frame-cycle-unwind.c:32^M
> Backtrace stopped: previous frame identical to this frame (corrupt stack?)
> (gdb) PASS: gdb.base/inline-frame-cycle-unwind.exp: cycle at level 5: backtrace when the unwind is broken at frame 5
> ~~~
>
> To fix the Python unwinder, we simply skip the unavailable registers.
>
> Reviewed-by: Thiago Jung Bauermann <thiago.bauermann@linaro.org>
> Reviewed-By: Eli Zaretskii <eliz@gnu.org>
> Reviewed-By: Luis Machado <luis.machado@arm.com>
> ---
> gdb/NEWS | 3 +
> gdb/amd64-linux-nat.c | 17 +++++
> gdb/amd64-linux-tdep.c | 1 +
> gdb/amd64-tdep.c | 6 +-
> gdb/amd64-tdep.h | 1 +
> gdb/arch/amd64.c | 10 +++
> gdb/arch/i386.c | 4 ++
> gdb/arch/x86-linux-tdesc-features.c | 1 +
> gdb/doc/gdb.texinfo | 4 ++
> gdb/features/Makefile | 2 +
> gdb/features/i386/32bit-ssp.c | 14 ++++
> gdb/features/i386/32bit-ssp.xml | 11 +++
> gdb/features/i386/64bit-ssp.c | 14 ++++
> gdb/features/i386/64bit-ssp.xml | 11 +++
> gdb/i386-tdep.c | 22 +++++-
> gdb/i386-tdep.h | 4 ++
> gdb/nat/x86-linux-tdesc.c | 2 +
> gdb/nat/x86-linux.c | 57 +++++++++++++++
> gdb/nat/x86-linux.h | 4 ++
> gdb/testsuite/gdb.arch/amd64-shadow-stack.c | 22 ++++++
> gdb/testsuite/gdb.arch/amd64-ssp.exp | 50 +++++++++++++
> .../gdb.base/inline-frame-cycle-unwind.py | 4 ++
> gdb/testsuite/lib/gdb.exp | 70 +++++++++++++++++++
> gdb/x86-linux-nat.c | 49 +++++++++++--
> gdb/x86-linux-nat.h | 11 +++
> gdb/x86-tdep.c | 21 ++++++
> gdb/x86-tdep.h | 9 +++
> gdbserver/linux-x86-low.cc | 28 +++++++-
> gdbsupport/x86-xstate.h | 5 +-
> 29 files changed, 447 insertions(+), 10 deletions(-)
> create mode 100644 gdb/features/i386/32bit-ssp.c
> create mode 100644 gdb/features/i386/32bit-ssp.xml
> create mode 100644 gdb/features/i386/64bit-ssp.c
> create mode 100644 gdb/features/i386/64bit-ssp.xml
> create mode 100644 gdb/testsuite/gdb.arch/amd64-shadow-stack.c
> create mode 100644 gdb/testsuite/gdb.arch/amd64-ssp.exp
>
> diff --git a/gdb/NEWS b/gdb/NEWS
> index 6c8a008d39d..ba555f0dea1 100644
> --- a/gdb/NEWS
> +++ b/gdb/NEWS
> @@ -3,6 +3,9 @@
>
> *** Changes since GDB 16
>
> +* Support for the shadow stack pointer register on x86-64 or x86-64 with
> + 32-bit pointer size (X32) GNU/Linux.
> +
> * Debugger Adapter Protocol changes
>
> ** GDB now supports the "completions" request.
> diff --git a/gdb/amd64-linux-nat.c b/gdb/amd64-linux-nat.c
> index dbb9b3223cb..4df99ccca54 100644
> --- a/gdb/amd64-linux-nat.c
> +++ b/gdb/amd64-linux-nat.c
> @@ -32,6 +32,7 @@
> #include "amd64-tdep.h"
> #include "amd64-linux-tdep.h"
> #include "i386-linux-tdep.h"
> +#include "x86-tdep.h"
> #include "gdbsupport/x86-xstate.h"
>
> #include "x86-linux-nat.h"
> @@ -237,6 +238,14 @@ amd64_linux_nat_target::fetch_registers (struct regcache *regcache, int regnum)
>
> if (have_ptrace_getregset == TRIBOOL_TRUE)
> {
> + if ((regnum == -1 && tdep->ssp_regnum > 0)
> + || (regnum != -1 && regnum == tdep->ssp_regnum))
> + {
> + x86_linux_fetch_ssp (regcache, tid);
> + if (regnum != -1)
> + return;
> + }
> +
> /* Pre-4.14 kernels have a bug (fixed by commit 0852b374173b
> "x86/fpu: Add FPU state copying quirk to handle XRSTOR failure on
> Intel Skylake CPUs") that sometimes causes the mxcsr location in
> @@ -302,6 +311,14 @@ amd64_linux_nat_target::store_registers (struct regcache *regcache, int regnum)
> if (have_ptrace_getregset == TRIBOOL_TRUE)
> {
> gdb::byte_vector xstateregs (tdep->xsave_layout.sizeof_xsave);
> + if ((regnum == -1 && tdep->ssp_regnum > 0)
> + || (regnum != -1 && regnum == tdep->ssp_regnum))
> + {
> + x86_linux_store_ssp (regcache, tid);
> + if (regnum != -1)
> + return;
> + }
> +
> struct iovec iov;
>
> iov.iov_base = xstateregs.data ();
> diff --git a/gdb/amd64-linux-tdep.c b/gdb/amd64-linux-tdep.c
> index 13e9c0e86ea..edb7d8da6ab 100644
> --- a/gdb/amd64-linux-tdep.c
> +++ b/gdb/amd64-linux-tdep.c
> @@ -108,6 +108,7 @@ int amd64_linux_gregset_reg_offset[] =
> -1, -1, -1, -1, -1, -1, -1, -1,
> -1, -1, -1, -1, -1, -1, -1, -1,
> -1, /* PKEYS register pkru */
> + -1, /* CET user mode register PL3_SSP. */
>
> /* End of hardware registers */
> 21 * 8, 22 * 8, /* fs_base and gs_base. */
> diff --git a/gdb/amd64-tdep.c b/gdb/amd64-tdep.c
> index 04539dd288a..450dbc38047 100644
> --- a/gdb/amd64-tdep.c
> +++ b/gdb/amd64-tdep.c
> @@ -3395,6 +3395,9 @@ amd64_init_abi (struct gdbarch_info info, struct gdbarch *gdbarch,
> tdep->num_pkeys_regs = 1;
> }
>
> + if (tdesc_find_feature (tdesc, "org.gnu.gdb.i386.pl3_ssp") != nullptr)
> + tdep->ssp_regnum = AMD64_PL3_SSP_REGNUM;
> +
> tdep->num_byte_regs = 20;
> tdep->num_word_regs = 16;
> tdep->num_dword_regs = 16;
> @@ -3557,12 +3560,13 @@ const struct target_desc *
> amd64_target_description (uint64_t xstate_bv_mask, bool segments)
> {
> static target_desc *amd64_tdescs \
> - [2/*AVX*/][2/*AVX512*/][2/*PKRU*/][2/*segments*/] = {};
> + [2/*AVX*/][2/*AVX512*/][2/*PKRU*/][2/*CET_U*/][2/*segments*/] = {};
> target_desc **tdesc;
>
> tdesc = &amd64_tdescs[(xstate_bv_mask & X86_XSTATE_AVX) ? 1 : 0]
> [(xstate_bv_mask & X86_XSTATE_AVX512) ? 1 : 0]
> [(xstate_bv_mask & X86_XSTATE_PKRU) ? 1 : 0]
> + [(xstate_bv_mask & X86_XSTATE_CET_U) ? 1 : 0]
> [segments ? 1 : 0];
>
> if (*tdesc == NULL)
> diff --git a/gdb/amd64-tdep.h b/gdb/amd64-tdep.h
> index 82f781bf404..eb294f3dfbe 100644
> --- a/gdb/amd64-tdep.h
> +++ b/gdb/amd64-tdep.h
> @@ -81,6 +81,7 @@ enum amd64_regnum
> AMD64_ZMM0H_REGNUM,
> AMD64_ZMM31H_REGNUM = AMD64_ZMM0H_REGNUM + 31,
> AMD64_PKRU_REGNUM,
> + AMD64_PL3_SSP_REGNUM,
> AMD64_FSBASE_REGNUM,
> AMD64_GSBASE_REGNUM
> };
> diff --git a/gdb/arch/amd64.c b/gdb/arch/amd64.c
> index 3181f827356..c9925fa6b66 100644
> --- a/gdb/arch/amd64.c
> +++ b/gdb/arch/amd64.c
> @@ -28,6 +28,8 @@
> #include "../features/i386/64bit-sse.c"
> #include "../features/i386/pkeys.c"
>
> +#include "../features/i386/64bit-ssp.c"
> +#include "../features/i386/32bit-ssp.c"
> #include "../features/i386/x32-core.c"
>
> /* See arch/amd64.h. */
> @@ -68,5 +70,13 @@ amd64_create_target_description (uint64_t xstate_bv_mask, bool is_x32,
> if (xstate_bv_mask & X86_XSTATE_PKRU)
> regnum = create_feature_i386_pkeys (tdesc.get (), regnum);
>
> + if (xstate_bv_mask & X86_XSTATE_CET_U)
> + {
> + if (!is_x32)
> + regnum = create_feature_i386_64bit_ssp (tdesc.get (), regnum);
> + else
> + regnum = create_feature_i386_32bit_ssp (tdesc.get (), regnum);
> + }
> +
> return tdesc.release ();
> }
> diff --git a/gdb/arch/i386.c b/gdb/arch/i386.c
> index e04d8c5dd94..87058e32dcb 100644
> --- a/gdb/arch/i386.c
> +++ b/gdb/arch/i386.c
> @@ -28,6 +28,7 @@
> #include "../features/i386/32bit-avx512.c"
> #include "../features/i386/32bit-segments.c"
> #include "../features/i386/pkeys.c"
> +#include "../features/i386/32bit-ssp.c"
>
> /* See arch/i386.h. */
>
> @@ -66,5 +67,8 @@ i386_create_target_description (uint64_t xstate_bv_mask, bool is_linux,
> if (xstate_bv_mask & X86_XSTATE_PKRU)
> regnum = create_feature_i386_pkeys (tdesc.get (), regnum);
>
> + if (xstate_bv_mask & X86_XSTATE_CET_U)
> + regnum = create_feature_i386_32bit_ssp (tdesc.get (), regnum);
> +
> return tdesc.release ();
> }
> diff --git a/gdb/arch/x86-linux-tdesc-features.c b/gdb/arch/x86-linux-tdesc-features.c
> index 68f37fccaef..f288f120cfb 100644
> --- a/gdb/arch/x86-linux-tdesc-features.c
> +++ b/gdb/arch/x86-linux-tdesc-features.c
> @@ -65,6 +65,7 @@ struct x86_xstate_feature {
>
> static constexpr x86_xstate_feature x86_linux_all_xstate_features[] = {
> /* Feature, i386, amd64, x32. */
> + { X86_XSTATE_CET_U, false, true, true },
> { X86_XSTATE_PKRU, true, true, true },
> { X86_XSTATE_AVX512, true, true, true },
> { X86_XSTATE_AVX, true, true, true },
> diff --git a/gdb/doc/gdb.texinfo b/gdb/doc/gdb.texinfo
> index 4ef640698bd..0881ac4aee5 100644
> --- a/gdb/doc/gdb.texinfo
> +++ b/gdb/doc/gdb.texinfo
> @@ -49959,6 +49959,10 @@ The @samp{org.gnu.gdb.i386.pkeys} feature is optional. It should
> describe a single register, @samp{pkru}. It is a 32-bit register
> valid for i386 and amd64.
>
> +The @samp{org.gnu.gdb.i386.pl3_ssp} feature is optional. It should describe the
> +user mode register @samp{pl3_ssp} which has 64 bits on amd64. Following the
> +restriction of the Linux kernel, only amd64 is supported for now.
> +
> @node LoongArch Features
> @subsection LoongArch Features
> @cindex target descriptions, LoongArch Features
> diff --git a/gdb/features/Makefile b/gdb/features/Makefile
> index 7a8c7999733..2afda1ccd00 100644
> --- a/gdb/features/Makefile
> +++ b/gdb/features/Makefile
> @@ -225,6 +225,7 @@ FEATURE_XMLFILES = aarch64-core.xml \
> i386/32bit-avx.xml \
> i386/32bit-avx512.xml \
> i386/32bit-segments.xml \
> + i386/32bit-ssp.xml \
> i386/64bit-avx512.xml \
> i386/64bit-core.xml \
> i386/64bit-segments.xml \
> @@ -232,6 +233,7 @@ FEATURE_XMLFILES = aarch64-core.xml \
> i386/64bit-linux.xml \
> i386/64bit-sse.xml \
> i386/pkeys.xml \
> + i386/64bit-ssp.xml \
> i386/x32-core.xml \
> loongarch/base32.xml \
> loongarch/base64.xml \
> diff --git a/gdb/features/i386/32bit-ssp.c b/gdb/features/i386/32bit-ssp.c
> new file mode 100644
> index 00000000000..991bae3c1e6
> --- /dev/null
> +++ b/gdb/features/i386/32bit-ssp.c
> @@ -0,0 +1,14 @@
> +/* THIS FILE IS GENERATED. -*- buffer-read-only: t -*- vi:set ro:
> + Original: 32bit-ssp.xml */
> +
> +#include "gdbsupport/tdesc.h"
> +
> +static int
> +create_feature_i386_32bit_ssp (struct target_desc *result, long regnum)
> +{
> + struct tdesc_feature *feature;
> +
> + feature = tdesc_create_feature (result, "org.gnu.gdb.i386.pl3_ssp");
> + tdesc_create_reg (feature, "pl3_ssp", regnum++, 1, NULL, 32, "data_ptr");
> + return regnum;
> +}
> diff --git a/gdb/features/i386/32bit-ssp.xml b/gdb/features/i386/32bit-ssp.xml
> new file mode 100644
> index 00000000000..d17e7004eec
> --- /dev/null
> +++ b/gdb/features/i386/32bit-ssp.xml
> @@ -0,0 +1,11 @@
> +<?xml version="1.0"?>
> +<!-- Copyright (C) 2022-2024 Free Software Foundation, Inc.
> +
> + Copying and distribution of this file, with or without modification,
> + are permitted in any medium without royalty provided the copyright
> + notice and this notice are preserved. -->
> +
> +
> +<feature name="org.gnu.gdb.i386.pl3_ssp">
> + <reg name="pl3_ssp" bitsize="32" type="data_ptr"/>
> +</feature>
> diff --git a/gdb/features/i386/64bit-ssp.c b/gdb/features/i386/64bit-ssp.c
> new file mode 100644
> index 00000000000..5468099ddf6
> --- /dev/null
> +++ b/gdb/features/i386/64bit-ssp.c
> @@ -0,0 +1,14 @@
> +/* THIS FILE IS GENERATED. -*- buffer-read-only: t -*- vi:set ro:
> + Original: 64bit-ssp.xml */
> +
> +#include "gdbsupport/tdesc.h"
> +
> +static int
> +create_feature_i386_64bit_ssp (struct target_desc *result, long regnum)
> +{
> + struct tdesc_feature *feature;
> +
> + feature = tdesc_create_feature (result, "org.gnu.gdb.i386.pl3_ssp");
> + tdesc_create_reg (feature, "pl3_ssp", regnum++, 1, NULL, 64, "data_ptr");
> + return regnum;
> +}
> diff --git a/gdb/features/i386/64bit-ssp.xml b/gdb/features/i386/64bit-ssp.xml
> new file mode 100644
> index 00000000000..a0688d018a5
> --- /dev/null
> +++ b/gdb/features/i386/64bit-ssp.xml
> @@ -0,0 +1,11 @@
> +<?xml version="1.0"?>
> +<!-- Copyright (C) 2022-2024 Free Software Foundation, Inc.
> +
> + Copying and distribution of this file, with or without modification,
> + are permitted in any medium without royalty provided the copyright
> + notice and this notice are preserved. -->
> +
> +
> +<feature name="org.gnu.gdb.i386.pl3_ssp">
> + <reg name="pl3_ssp" bitsize="64" type="data_ptr"/>
> +</feature>
> diff --git a/gdb/i386-tdep.c b/gdb/i386-tdep.c
> index 90ff0c5c706..8eb5b4fac86 100644
> --- a/gdb/i386-tdep.c
> +++ b/gdb/i386-tdep.c
> @@ -8403,7 +8403,8 @@ i386_validate_tdesc_p (i386_gdbarch_tdep *tdep,
> const struct tdesc_feature *feature_core;
>
> const struct tdesc_feature *feature_sse, *feature_avx, *feature_avx512,
> - *feature_pkeys, *feature_segments;
> + *feature_pkeys, *feature_segments,
> + *feature_pl3_ssp;
> int i, num_regs, valid_p;
>
> if (! tdesc_has_registers (tdesc))
> @@ -8429,6 +8430,9 @@ i386_validate_tdesc_p (i386_gdbarch_tdep *tdep,
> /* Try PKEYS */
> feature_pkeys = tdesc_find_feature (tdesc, "org.gnu.gdb.i386.pkeys");
>
> + /* Try Shadow Stack. */
> + feature_pl3_ssp = tdesc_find_feature (tdesc, "org.gnu.gdb.i386.pl3_ssp");
> +
> valid_p = 1;
>
> /* The XCR0 bits. */
> @@ -8544,6 +8548,15 @@ i386_validate_tdesc_p (i386_gdbarch_tdep *tdep,
> tdep->pkeys_register_names[i]);
> }
>
> + if (feature_pl3_ssp != nullptr)
> + {
> + if (tdep->ssp_regnum < 0)
> + tdep->ssp_regnum = I386_PL3_SSP_REGNUM;
> +
> + valid_p &= tdesc_numbered_register (feature_pl3_ssp, tdesc_data,
> + tdep->ssp_regnum, "pl3_ssp");
> + }
> +
> return valid_p;
> }
>
> @@ -8835,6 +8848,9 @@ i386_gdbarch_init (struct gdbarch_info info, struct gdbarch_list *arches)
> /* No segment base registers. */
> tdep->fsbase_regnum = -1;
>
> + /* No shadow stack pointer register. */
> + tdep->ssp_regnum = -1;
> +
> tdesc_arch_data_up tdesc_data = tdesc_data_alloc ();
>
> set_gdbarch_relocate_instruction (gdbarch, i386_relocate_instruction);
> @@ -8955,13 +8971,15 @@ const struct target_desc *
> i386_target_description (uint64_t xstate_bv_mask, bool segments)
> {
> static target_desc *i386_tdescs \
> - [2/*SSE*/][2/*AVX*/][2/*AVX512*/][2/*PKRU*/][2/*segments*/] = {};
> + [2/*SSE*/][2/*AVX*/][2/*AVX512*/][2/*PKRU*/][2/*CET_U*/] \
> + [2/*segments*/] = {};
> target_desc **tdesc;
>
> tdesc = &i386_tdescs[(xstate_bv_mask & X86_XSTATE_SSE) ? 1 : 0]
> [(xstate_bv_mask & X86_XSTATE_AVX) ? 1 : 0]
> [(xstate_bv_mask & X86_XSTATE_AVX512) ? 1 : 0]
> [(xstate_bv_mask & X86_XSTATE_PKRU) ? 1 : 0]
> + [(xstate_bv_mask & X86_XSTATE_CET_U) ? 1 : 0]
> [segments ? 1 : 0];
>
> if (*tdesc == NULL)
> diff --git a/gdb/i386-tdep.h b/gdb/i386-tdep.h
> index 239bc8674e8..60d6f3eb732 100644
> --- a/gdb/i386-tdep.h
> +++ b/gdb/i386-tdep.h
> @@ -191,6 +191,9 @@ struct i386_gdbarch_tdep : gdbarch_tdep_base
> /* PKEYS register names. */
> const char * const *pkeys_register_names = nullptr;
>
> + /* Shadow stack pointer register. */
> + int ssp_regnum = 0;
> +
> /* Register number for %fsbase. Set this to -1 to indicate the
> absence of segment base registers. */
> int fsbase_regnum = 0;
> @@ -293,6 +296,7 @@ enum i386_regnum
> I386_ZMM0H_REGNUM, /* %zmm0h */
> I386_ZMM7H_REGNUM = I386_ZMM0H_REGNUM + 7,
> I386_PKRU_REGNUM,
> + I386_PL3_SSP_REGNUM,
> I386_FSBASE_REGNUM,
> I386_GSBASE_REGNUM
> };
> diff --git a/gdb/nat/x86-linux-tdesc.c b/gdb/nat/x86-linux-tdesc.c
> index e9cf2527c5f..5bc36b6bef2 100644
> --- a/gdb/nat/x86-linux-tdesc.c
> +++ b/gdb/nat/x86-linux-tdesc.c
> @@ -110,6 +110,8 @@ x86_linux_tdesc_for_tid (int tid, uint64_t *xstate_bv_storage,
> = x86_fetch_xsave_layout (xcr0, x86_xsave_length ());
>
> *xstate_bv_storage = xcr0;
> + if (x86_check_ssp_support (tid))
> + *xstate_bv_storage |= X86_XSTATE_CET_U;
> }
> }
>
> diff --git a/gdb/nat/x86-linux.c b/gdb/nat/x86-linux.c
> index 0bdff736f8a..1756d5441fc 100644
> --- a/gdb/nat/x86-linux.c
> +++ b/gdb/nat/x86-linux.c
> @@ -17,6 +17,12 @@
> You should have received a copy of the GNU General Public License
> along with this program. If not, see <http://www.gnu.org/licenses/>. */
>
> +#include "elf/common.h"
> +#include "gdbsupport/common-defs.h"
> +#include "nat/gdb_ptrace.h"
> +#include "nat/linux-ptrace.h"
> +#include "nat/x86-cpuid.h"
> +#include <sys/uio.h>
> #include "x86-linux.h"
> #include "x86-linux-dregs.h"
> #include "nat/gdb_ptrace.h"
> @@ -126,3 +132,54 @@ x86_linux_ptrace_get_arch_size (int tid)
> return x86_linux_arch_size (false, false);
> #endif
> }
> +
> +/* See nat/x86-linux.h. */
> +
> +bool
> +x86_check_ssp_support (const int tid)
> +{
> + /* It's not enough to check shadow stack support with the ptrace call
> + below only, as we cannot distinguish between shadow stack not enabled
> + for the current thread and shadow stack is not supported by HW. In
> + both scenarios the ptrace call fails with ENODEV. In case shadow
> + stack is not enabled for the current thread, we still want to return
> + true. */
> + unsigned int eax, ebx, ecx, edx;
> +
> + __get_cpuid_count (7, 0, &eax, &ebx, &ecx, &edx);

It should be

if (! __get_cpuid_count (7, 0, &eax, &ebx, &ecx, &edx))
return false;

> +
> + if ((ecx & bit_SHSTK) == 0)
> + return false;
> +

H.J.