#### 21.4.2 x86 ¶

`set struct-convention mode` ¶

  Set the convention used by the inferior to return `struct`s and `union`s from functions to mode. Possible values of mode are `"pcc"`, `"reg"`, and `"default"` (the default). `"default"` or `"pcc"` means that `struct`s are returned on the stack, while `"reg"` means that a `struct` or a `union` whose size is 1, 2, 4, or 8 bytes will be returned in a register.

`show struct-convention` ¶

  Show the current setting of the convention to return `struct`s from functions.

#### 21.4.2.1 x87 registers ¶

GDB provides access to the x87 state through the following registers:

- `$st0` to `st7`: `ST(0)` to `ST(7)` floating-point registers
- `$fctrl`: control word register (`FCW`)
- `$fstat`: status word register (`FSW`)
- `$ftag`: tag word (`FTW`)
- `$fiseg`: last instruction pointer segment
- `$fioff`: last instruction pointer
- `$foseg`: last data pointer segment
- `$fooff`: last data pointer
- `$fop`: last opcode

#### 21.4.2.2 Intel Control-Flow Enforcement Technology. ¶

The Intel Control-Flow Enforcement Technology (Intel CET) provides two capabilities to defend against “Return-oriented Programming” and “call/jmp-oriented programming” style control-flow attacks:

- Shadow Stack: A shadow stack is a second stack for a program. It holds the return addresses pushed by the call instruction. The `RET` instruction pops the return addresses from both call and shadow stack. If the return addresses from the two stacks do not match, the processor signals a control protection exception.
- Indirect Branch Tracking (IBT): When IBT is enabled, the CPU implements a state machine that tracks indirect `JMP` and `CALL` instructions. The state machine can be either IDLE or WAIT_FOR_ENDBRANCH. When a `JMP` or `CALL` is executed the state machine chages to the WAIT_FOR_ENDBRANCH state. In WAIT_FOR_ENDBRANCH state the next instruction in the program stream must be an `ENDBR` instruction, otherwise the processor signals a control protection exception. After executing a `ENDBR` instruction the state machine returns to the IDLE state.

Impact on GDB commands:

- Call/Print: Inferior calls in GDB reset the current PC to the beginning of the function that is called. No call instruction is executed, but the `RET` instruction actually is. To avoid a control protection exception due to the missing return address on the shadow stack, GDB pushes the new return address to the shadow stack and updates the shadow stack pointer.
- Step: With displaced stepping, GDB may run an out of line copy of a call instruction. In this case, the wrong return address is pushed to the shadow stack. GDB corrects this value to avoid a control protection exception. For more details on displaced stepping, see displaced-stepping.