21.4.2 x86

set struct-convention mode

Set the convention used by the inferior to return structs and unions from functions to mode. Possible values of mode are "pcc", "reg", and "default" (the default). "default" or "pcc" means that structs are returned on the stack, while "reg" means that a struct or a union whose size is 1, 2, 4, or 8 bytes will be returned in a register.

show struct-convention

Show the current setting of the convention to return structs from functions.

21.4.2.1 x87 registers

GDB provides access to the x87 state through the following registers:

• $st0 to st7: ST(0) to ST(7) floating-point registers
• $fctrl: control word register (FCW)
• $fstat: status word register (FSW)
• $ftag: tag word (FTW)
• $fiseg: last instruction pointer segment
• $fioff: last instruction pointer
• $foseg: last data pointer segment
• $fooff: last data pointer
• $fop: last opcode

21.4.2.2 Intel Control-Flow Enforcement Technology.

The Intel Control-Flow Enforcement Technology (Intel CET) provides two capabilities to defend against “Return-oriented Programming” and “call/jmp-oriented programming” style control-flow attacks:

• Shadow Stack: A shadow stack is a second stack for a program. It holds the return addresses pushed by the call instruction. The RET instruction pops the return addresses from both call and shadow stack. If the return addresses from the two stacks do not match, the processor signals a control protection exception.
• Indirect Branch Tracking (IBT): When IBT is enabled, the CPU implements a state machine that tracks indirect JMP and CALL instructions. The state machine can be either IDLE or WAIT_FOR_ENDBRANCH. When a JMP or CALL is executed the state machine chages to the WAIT_FOR_ENDBRANCH state. In WAIT_FOR_ENDBRANCH state the next instruction in the program stream must be an ENDBR instruction, otherwise the processor signals a control protection exception. After executing a ENDBR instruction the state machine returns to the IDLE state.

Impact on GDB commands:

• Call/Print: Inferior calls in GDB reset the current PC to the beginning of the function that is called. No call instruction is executed, but the RET instruction actually is. To avoid a control protection exception due to the missing return address on the shadow stack, GDB pushes the new return address to the shadow stack and updates the shadow stack pointer.
• Step: With displaced stepping, GDB may run an out of line copy of a call instruction. In this case, the wrong return address is pushed to the shadow stack. GDB corrects this value to avoid a control protection exception. For more details on displaced stepping, see displaced-stepping.