RE: [PATCH v4 08/13] gdb: Add command option 'bt -shadow' to print the shadow stack backtrace.

["Joos, Christina" <christina.joos@intel.com>]

> -----Original Message-----
> From: Thiago Jung Bauermann <thiago.bauermann@linaro.org>
> Sent: Donnerstag, 3. September 2026 09:38
> To: Joos, Christina <christina.joos@intel.com>
> Cc: gdb-patches@sourceware.org; tom@tromey.com
> Subject: Re: [PATCH v4 08/13] gdb: Add command option 'bt -shadow' to print
> the shadow stack backtrace.
> 
> Christina Schimpe <christina.schimpe@intel.com> writes:
> 
> > Add command option '-shadow" to the backtrace command to print the
> > shadow stack backtrace instead of the normal backtrace.
> >
> > This option may be combined with '-frame-info' and implies '-no-filters'
> > and '-frame-arguments none'.  Also the options @samp{-past-entry} or
> > @samp{-hide} are not supported.
> >
> > This is an example for the output of 'bt -shadow' on amd64 linux:
> > ~~
> > (gdb) bt -shadow
> > /#0  0x000055555555514a in call1 at amd64-shadow-stack.c:27
> > /#1  0x000055555555515f in main at amd64-shadow-stack.c:38 ~~
> >
> > Note that the normal backtrace includes one additional frame, since
> > the shadow stack backtrace relies on return addresses of the shadow
> > stack only.  But except the missing frame arguments and frame #0 of
> > the normal backtrace, the backtrace is the same.
> > ~~
> > (gdb) bt
> > /#0  call2 () at amd64-shadow-stack.c:21
> > /#1  0x000055555555514a in call1 () at amd64-shadow-stack.c:27
> > /#2  0x000055555555515f in main () at amd64-shadow-stack.c:38 ~~
> >
> > This commit also adds a test for 'bt -shadow' on amd64.
> > Although the test is OS independent we can only test this on linux, as
> > GDB does not support shadow stack on other OS for now.
> > Also we do not add a test for 32 bit, as support for shadow stack is
> > limited to 64 bit by the linux kernel.
> > ---
> >  gdb/NEWS                                      |   3 +
> >  gdb/doc/gdb.texinfo                           |  25 +
> >  gdb/gdbarch-gen.h                             |   2 +
> >  gdb/gdbarch.h                                 |   1 +
> >  gdb/gdbarch_components.py                     |   2 +
> >  gdb/shadow-stack.c                            | 475 ++++++++++++++++++
> >  gdb/shadow-stack.h                            |  65 +++
> >  gdb/stack.c                                   |  49 +-
> >  gdb/stack.h                                   |  43 ++
> >  .../gdb.arch/amd64-shadow-stack-cmds.exp      |  47 ++
> >  gdb/testsuite/gdb.base/options.exp            |   2 +-
> >  11 files changed, 689 insertions(+), 25 deletions(-)
> 
> Just one comment. In any case:
> 
> Reviewed-by: Thiago Jung Bauermann <thiago.bauermann@linaro.org>
> 
> > +/* If possible, get shadow stack frame info for the shadow stack pointer
> > +   SSP and its current frame LEVEL.  Pass FALLBACK_ARCH which can be used
> > +   as fallback gdbarch in case the gdbarch cannot be extracted from the
> > +   SAL.  Usually this is the gdbarch of the previous frame.  */
> > +
> > +static std::optional<shadow_stack_frame_info>
> > +get_shadow_stack_frame_info
> > +  (gdbarch *fallback_arch, const CORE_ADDR ssp, unsigned long level)
> > +{
> > +  CORE_ADDR value;
> > +  if (!read_shadow_stack_memory (fallback_arch, ssp, value))
> > +    return {};
> > +
> > +  /* At this point, we know that SSP points to VALUE which is a return
> > +     address.  In contrast to find_frame_sal which is used for the normal
> > +     backtrace command, VALUE always points at the return instruction
> > +     (which is *after* the call instruction).  Since we want to get the
> > +     line containing the call (because the call is where the user thinks
> > +     the program is), we pass 1 here as second argument.  */
> > + symtab_and_line sal = find_sal_for_pc (value, 1);  struct gdbarch
> > + *sal_arch = get_sal_arch (sal);
> 
> Nit: remove unnecessary struct keyword.
> 
> Also just FYI I'm encountering a snag here in the case of aarch64, which I'm still
> looking into:
> 
> The gdbarch returned by get_sal_arch here doesn't have the shadow stack
> hooks set. This causes "bt -shadow" from a signal handler not to show
> "<sigframe token>", because this "simpler" gdbarch will get passed as
> fallback_arch in the next call to get_shadow_stack_frame_info by
> shadow_stack_frame_info::unwind_prev_shadow_stack_frame_info, and then
> gdbarch_is_no_return_shadow_stack_address_p (fallback_arch) will be false
> and the corresponding aarch64 hook won't get a change to identify the
> sigframe token.
> 
> I think get_sal_arch is returning a gdbarch that was created before the inferior
> was started, and at that time GDB couldn't know that GCS would be enabled.
> 
> In any case, if this is working fine for x86 then don't worry about it. I can fix it
> when posting the aarch64 support for "bt -shadow".

Hi Thiago, 

I don't remember seeing something like this, but I also posted this some time ago.... Maybe something changed in between in upstream.
Did this happen with a specific linux kernel/OS version or a specific testprogram?
Then I can double check to verify this.

Thanks,
Christina

 
________________________________________
Intel Deutschland GmbH 

Registered Address: Dornacher Strasse 1, 85622 Feldkirchen, Germany 

Tel: +49 (89) 99143-0 

www.intel.de 

Managing Directors: Candice Moore, Jeffrey Schneiderman, Ramachandran Sitaraman

Chairperson of the Supervisory Board: Sonja Pierer

Registered Seat: Munich Commercial Register B: Amtsgericht Munich HRB 186928

This e-mail and any attachments may contain confidential material for
the sole use of the intended recipient(s). Any review or distribution
by others is strictly prohibited. If you are not the intended
recipient, please contact the sender and delete all copies.