22.4.2.1 x87 registers ¶

ROCgdb provides access to the x87 state through the following registers:

• $st0 to st7: ST(0) to ST(7) floating-point registers
• $fctrl: control word register (FCW)
• $fstat: status word register (FSW)
• $ftag: tag word (FTW)
• $fiseg: last instruction pointer segment
• $fioff: last instruction pointer
• $foseg: last data pointer segment
• $fooff: last data pointer
• $fop: last opcode

22.4.2.2 Intel Control-Flow Enforcement Technology. ¶

The Intel Control-Flow Enforcement Technology (Intel CET) provides two capabilities to defend against “Return-oriented Programming” and “call/jmp-oriented programming” style control-flow attacks:

• Shadow Stack: A shadow stack is a second stack for a program. It holds the return addresses pushed by the call instruction. The RET instruction pops the return addresses from both call and shadow stack. If the return addresses from the two stacks do not match, the processor signals a control protection exception.
• Indirect Branch Tracking (IBT): When IBT is enabled, the CPU implements a state machine that tracks indirect JMP and CALL instructions. The state machine can be either IDLE or WAIT_FOR_ENDBRANCH. When a JMP or CALL is executed the state machine changes to the WAIT_FOR_ENDBRANCH state. In WAIT_FOR_ENDBRANCH state the next instruction in the program stream must be an ENDBR instruction, otherwise the processor signals a control protection exception. After executing a ENDBR instruction the state machine returns to the IDLE state.

Impact on ROCgdb commands:

• Call/Print: Inferior calls in ROCgdb reset the current PC to the beginning of the function that is called. No call instruction is executed, but the RET instruction actually is. To avoid a control protection exception due to the missing return address on the shadow stack, ROCgdb pushes the new return address to the shadow stack and updates the shadow stack pointer.
• Step: With displaced stepping, ROCgdb may run an out of line copy of a call instruction. In this case, the wrong return address is pushed to the shadow stack. ROCgdb corrects this value to avoid a control protection exception. For more details on displaced stepping, see displaced-stepping.