#include "expop.h"
#include "arch/amd64-linux-tdesc.h"
#include "inferior.h"
+#include "x86-tdep.h"
/* The syscall's XML filename for i386. */
#define XML_SYSCALL_FILENAME_AMD64 "syscalls/amd64-linux.xml"
return 0;
}
+/* Return true if the core file ABFD contains shadow stack pointer state.
+ Otherwise, return false. */
+
+static bool
+amd64_linux_core_read_ssp_state_p (bfd *abfd)
+{
+ return bfd_get_section_by_name (abfd, ".reg-ssp") != nullptr;
+}
+
/* Get Linux/x86 target description from core dump. */
static const struct target_desc *
{
/* Linux/x86-64. */
x86_xsave_layout layout;
- uint64_t xcr0 = i386_linux_core_read_xsave_info (abfd, layout);
- if (xcr0 == 0)
- xcr0 = X86_XSTATE_SSE_MASK;
+ uint64_t xstate_bv = i386_linux_core_read_xsave_info (abfd, layout);
+ if (xstate_bv == 0)
+ xstate_bv = X86_XSTATE_SSE_MASK;
+
+ if (amd64_linux_core_read_ssp_state_p (abfd))
+ xstate_bv |= X86_XSTATE_CET_U;
- return amd64_linux_read_description (xcr0 & X86_XSTATE_ALL_MASK,
+ return amd64_linux_read_description (xstate_bv & X86_XSTATE_ALL_MASK,
gdbarch_ptr_bit (gdbarch) == 32);
}
amd64_linux_collect_xstateregset
};
+/* Supply shadow stack pointer register from SSP to the register cache
+ REGCACHE. */
+
+static void
+amd64_linux_supply_ssp (const regset *regset,
+ regcache *regcache, int regnum,
+ const void *ssp, size_t len)
+{
+ gdb_assert (len == sizeof (uint64_t));
+ x86_supply_ssp (regcache, *static_cast<const uint64_t *> (ssp));
+}
+
+/* Collect the shadow stack pointer register from the register cache
+ REGCACHE and store it in SSP. */
+
+static void
+amd64_linux_collect_ssp (const regset *regset,
+ const regcache *regcache, int regnum,
+ void *ssp, size_t len)
+{
+ gdb_assert (len == sizeof (uint64_t));
+ x86_collect_ssp (regcache, *static_cast<uint64_t *> (ssp));
+}
+
+/* Shadow stack pointer register. */
+
+static const struct regset amd64_linux_ssp_register
+ {
+ NULL, amd64_linux_supply_ssp, amd64_linux_collect_ssp
+ };
+
/* Iterate over core file register note sections. */
static void
cb (".reg-xstate", tdep->xsave_layout.sizeof_xsave,
tdep->xsave_layout.sizeof_xsave, &amd64_linux_xstateregset,
"XSAVE extended state", cb_data);
+
+ /* SSP can be unavailable. Thus, we need to check the register status
+ in case we write a core file (regcache != nullptr). */
+ if (tdep->ssp_regnum != -1
+ && (regcache == nullptr
+ || REG_VALID == regcache->get_register_status (tdep->ssp_regnum)))
+ cb (".reg-ssp", 8, 8, &amd64_linux_ssp_register,
+ "shadow stack pointer", cb_data);
}
/* The instruction sequences used in x86_64 machines for a
--- /dev/null
+/* This test program is part of GDB, the GNU debugger.
+
+ Copyright 2025 Free Software Foundation, Inc.
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <http://www.gnu.org/licenses/>. */
+
+#include <stdio.h>
+
+/* Call the return instruction before function epilogue to trigger a
+ control-flow exception. */
+void
+function ()
+{
+ unsigned long ssp;
+ #ifndef __ILP32__
+ asm volatile ("xor %0, %0; rdsspq %0" : "=r" (ssp));
+ #else
+ asm volatile ("xor %0, %0; rdsspd %0" : "=r" (ssp));
+ #endif
+
+ /* Print ssp to stdout so that the testcase can capture it. */
+ printf ("%p\n", (void *) ssp);
+ fflush (stdout);
+
+ /* Manually cause a control-flow exception by executing a return
+ instruction before function epilogue, so the address atop the stack
+ is not the return instruction. */
+ __asm__ volatile ("ret\n");
+}
+
+int
+main (void)
+{
+ function (); /* Break here. */
+}
--- /dev/null
+# Copyright 2024-2025 Free Software Foundation, Inc.
+
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+# Test the shadow stack pointer note in core dumps.
+# Based on the corefile tests in gdb.arch/aarch64-gcs-core.exp.
+
+require allow_ssp_tests
+
+standard_testfile
+
+# Make sure GDB can read the given core file correctly.
+
+proc check_core_file {core_filename saved_pl3_ssp} {
+ global decimal
+
+ # Load the core file.
+ if [gdb_test "core $core_filename" \
+ [multi_line \
+ "Core was generated by .*\\." \
+ "Program terminated with signal SIGSEGV, Segmentation fault.*" \
+ "#0 function \\(\\) at .*amd64-shadow-stack-corefile.c:$decimal" \
+ "$decimal.*__asm__ volatile \\(\"ret\\\\n\"\\);"] \
+ "load core file"] {
+ return
+ }
+
+ # Check the value of ssp in the core file.
+ gdb_test "print/x \$pl3_ssp" "\\$\[0-9\]+ = $saved_pl3_ssp" \
+ "pl3_ssp contents from core file $saved_pl3_ssp"
+}
+
+save_vars { ::env(GLIBC_TUNABLES) } {
+
+ append_environment GLIBC_TUNABLES "glibc.cpu.hwcaps" "SHSTK"
+
+ if { [prepare_for_testing "failed to prepare" $testfile $srcfile \
+ {debug additional_flags="-fcf-protection=return"}] } {
+ return
+ }
+
+ set linespec ${srcfile}:[gdb_get_line_number "Break here"]
+
+ if ![runto $linespec] {
+ return
+ }
+
+ # Obtain an OS-generated core file. Save test program output to
+ # ${binfile}.out.
+ set core_filename [core_find $binfile {} {} "${binfile}.out"]
+ set core_generated [expr {$core_filename != ""}]
+
+ if {!$core_generated} {
+ untested "unable to create or find corefile"
+ }
+
+ # Load the core file and check the value of the shadow stack pointer.
+ if {$core_generated} {
+ clean_restart $binfile
+
+ with_test_prefix "OS corefile" {
+ # Read ssp value from saved output of the test program.
+ set out_id [open ${binfile}.out "r"]
+ set ssp_in_gcore [gets $out_id]
+ close $out_id
+ check_core_file $core_filename $ssp_in_gcore
+ }
+ }
+
+ if ![gcore_cmd_available] {
+ unsupported "target does not support gcore command."
+ return
+ }
+
+ clean_restart $binfile
+
+ if ![runto $linespec] {
+ return
+ }
+
+ # Continue until a crash. The line with the hex number is optional because
+ # it's printed by the test program, and doesn't appear in the Expect buffer
+ # when testing a remote target.
+
+ gdb_test "continue" \
+ [multi_line \
+ "Continuing\\." \
+ "($hex\r\n)?" \
+ "Program received signal SIGSEGV, Segmentation fault.*" \
+ "function \\(\\) at .*amd64-shadow-stack-corefile.c:$decimal" \
+ {.*__asm__ volatile \("ret\\n"\);}] \
+ "continue to SIGSEGV"
+
+ set ssp_in_gcore [get_valueof "/x" "\$pl3_ssp" "*unknown*"]
+
+ # Generate the gcore core file.
+ set gcore_filename [standard_output_file "${testfile}.gcore"]
+ set gcore_generated [gdb_gcore_cmd "$gcore_filename" "generate gcore file"]
+
+ gdb_assert { $gcore_generated } "gcore corefile created"
+ if { $gcore_generated } {
+ clean_restart $binfile
+
+ with_test_prefix "gcore corefile" {
+ check_core_file $gcore_filename $ssp_in_gcore
+ }
+ }
+}
projects / thirdparty / binutils-gdb.git / commitdiff
