Support for Clang's Shadow Call Stack in the kernel (Sami Tolvanen and Will Deacon) * for-next/scs: arm64: entry-ftrace.S: Update comment to indicate that x18 is live scs: Move DEFINE_SCS macro into core code scs: Remove references to asm/scs.h from core code scs: Move scs_overflow_check() out of architecture code arm64: scs: Use 'scs_sp' register alias for x18 scs: Move accounting into alloc/free functions arm64: scs: Store absolute SCS stack pointer value in thread_info efi/libstub: Disable Shadow Call Stack arm64: scs: Add shadow stacks for SDEI arm64: Implement Shadow Call Stack arm64: Disable SCS for hypervisor code arm64: vdso: Disable Shadow Call Stack arm64: efi: Restore register x18 if it was corrupted arm64: Preserve register x18 when CPU is suspended arm64: Reserve register x18 from general allocation with SCS scs: Disable when function graph tracing is enabled scs: Add support for stack usage debugging scs: Add page accounting for shadow call stack allocations scs: Add support for Clang's Shadow Call Stack (SCS)
Showing the changes to include/linux (4 of 31 files). Show all
Unified · Split
| @@ -42,3 +42,7 @@ · 41 unmodified lines | ||
| 42 | 42 | * compilers, like ICC. |
| 43 | 43 | */ |
| 44 | 44 | #define barrier() __asm__ __volatile__("" : : : "memory") |
| 45 | + | |
| 46 | +#if __has_feature(shadow_call_stack) | |
| 47 | +# define __noscs __attribute__((__no_sanitize__("shadow-call-stack"))) | |
| 48 | +#endif | |
| @@ -193,6 +193,10 @@ struct ftrace_likely_data { · 192 unmodified lines | ||
| 193 | 193 | # define randomized_struct_fields_end |
| 194 | 194 | #endif |
| 195 | 195 | |
| 196 | +#ifndef __noscs | |
| 197 | +# define __noscs | |
| 198 | +#endif | |
| 199 | + | |
| 196 | 200 | #ifndef asm_volatile_goto |
| 197 | 201 | #define asm_volatile_goto(x...) asm goto(x) |
| 198 | 202 | #endif |
| @@ -156,6 +156,9 @@ enum zone_stat_item { · 155 unmodified lines | ||
| 156 | 156 | NR_MLOCK, /* mlock()ed pages found and moved off LRU */ |
| 157 | 157 | NR_PAGETABLE, /* used for pagetables */ |
| 158 | 158 | NR_KERNEL_STACK_KB, /* measured in KiB */ |
| 159 | +#if IS_ENABLED(CONFIG_SHADOW_CALL_STACK) | |
| 160 | + NR_KERNEL_SCS_KB, /* measured in KiB */ | |
| 161 | +#endif | |
| 159 | 162 | /* Second 128 byte cacheline */ |
| 160 | 163 | NR_BOUNCE, |
| 161 | 164 | #if IS_ENABLED(CONFIG_ZSMALLOC) |
| @@ -0,0 +1,72 @@ | ||
| 1 | +/* SPDX-License-Identifier: GPL-2.0 */ | |
| 2 | +/* | |
| 3 | + * Shadow Call Stack support. | |
| 4 | + * | |
| 5 | + * Copyright (C) 2019 Google LLC | |
| 6 | + */ | |
| 7 | + | |
| 8 | +#ifndef _LINUX_SCS_H | |
| 9 | +#define _LINUX_SCS_H | |
| 10 | + | |
| 11 | +#include <linux/gfp.h> | |
| 12 | +#include <linux/poison.h> | |
| 13 | +#include <linux/sched.h> | |
| 14 | +#include <linux/sizes.h> | |
| 15 | + | |
| 16 | +#ifdef CONFIG_SHADOW_CALL_STACK | |
| 17 | + | |
| 18 | +/* | |
| 19 | + * In testing, 1 KiB shadow stack size (i.e. 128 stack frames on a 64-bit | |
| 20 | + * architecture) provided ~40% safety margin on stack usage while keeping | |
| 21 | + * memory allocation overhead reasonable. | |
| 22 | + */ | |
| 23 | +#define SCS_SIZE SZ_1K | |
| 24 | +#define GFP_SCS (GFP_KERNEL | __GFP_ZERO) | |
| 25 | + | |
| 26 | +/* An illegal pointer value to mark the end of the shadow stack. */ | |
| 27 | +#define SCS_END_MAGIC (0x5f6UL + POISON_POINTER_DELTA) | |
| 28 | + | |
| 29 | +/* Allocate a static per-CPU shadow stack */ | |
| 30 | +#define DEFINE_SCS(name) \ | |
| 31 | + DEFINE_PER_CPU(unsigned long [SCS_SIZE/sizeof(long)], name) \ | |
| 32 | + | |
| 33 | +#define task_scs(tsk) (task_thread_info(tsk)->scs_base) | |
| 34 | +#define task_scs_sp(tsk) (task_thread_info(tsk)->scs_sp) | |
| 35 | + | |
| 36 | +void scs_init(void); | |
| 37 | +int scs_prepare(struct task_struct *tsk, int node); | |
| 38 | +void scs_release(struct task_struct *tsk); | |
| 39 | + | |
| 40 | +static inline void scs_task_reset(struct task_struct *tsk) | |
| 41 | +{ | |
| 42 | + /* | |
| 43 | + * Reset the shadow stack to the base address in case the task | |
| 44 | + * is reused. | |
| 45 | + */ | |
| 46 | + task_scs_sp(tsk) = task_scs(tsk); | |
| 47 | +} | |
| 48 | + | |
| 49 | +static inline unsigned long *__scs_magic(void *s) | |
| 50 | +{ | |
| 51 | + return (unsigned long *)(s + SCS_SIZE) - 1; | |
| 52 | +} | |
| 53 | + | |
| 54 | +static inline bool task_scs_end_corrupted(struct task_struct *tsk) | |
| 55 | +{ | |
| 56 | + unsigned long *magic = __scs_magic(task_scs(tsk)); | |
| 57 | + unsigned long sz = task_scs_sp(tsk) - task_scs(tsk); | |
| 58 | + | |
| 59 | + return sz >= SCS_SIZE - 1 || READ_ONCE_NOCHECK(*magic) != SCS_END_MAGIC; | |
| 60 | +} | |
| 61 | + | |
| 62 | +#else /* CONFIG_SHADOW_CALL_STACK */ | |
| 63 | + | |
| 64 | +static inline void scs_init(void) {} | |
| 65 | +static inline void scs_task_reset(struct task_struct *tsk) {} | |
| 66 | +static inline int scs_prepare(struct task_struct *tsk, int node) { return 0; } | |
| 67 | +static inline void scs_release(struct task_struct *tsk) {} | |
| 68 | +static inline bool task_scs_end_corrupted(struct task_struct *tsk) { return false; } | |
| 69 | + | |
| 70 | +#endif /* CONFIG_SHADOW_CALL_STACK */ | |
| 71 | + | |
| 72 | +#endif /* _LINUX_SCS_H */ | |