You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/doc/unstable-book/src/compiler-flags/sanitizer.md
+28-6
Original file line number
Diff line number
Diff line change
@@ -776,21 +776,42 @@ See the [Clang SafeStack documentation][clang-safestack] for more details.
776
776
# ShadowCallStack
777
777
778
778
ShadowCallStack provides backward edge control flow protection by storing a function's return address in a separately allocated 'shadow call stack' and loading the return address from that shadow call stack.
779
-
780
-
ShadowCallStack requires a platform ABI which reserves `x18` as the instrumentation makes use of this register.
779
+
To that end, implementation of this sanitizer requires reservation of one of the registers on the target platform.
780
+
Software support from the operating system and runtime may be required depending on the target platform which is detailed in the remaining section.
781
+
See the [Clang ShadowCallStack documentation][clang-scs] for more details.
781
782
782
783
ShadowCallStack can be enabled with `-Zsanitizer=shadow-call-stack` option and is supported on the following targets:
783
784
784
-
*`aarch64-linux-android`
785
+
## AArch64 family
785
786
786
-
A runtime must be provided by the application or operating system.
787
+
ShadowCallStack requires on this platform ABI reservation of the register `x18` as the instrumentation makes use of this register.
788
+
When `x18` is not reserved on the target AArch64 platform and is availabe as a scratch register, enabling ShadowCallStack leds to undefined behaviour.
789
+
In other words, code that is calling into or called by functions instrumented with ShadowCallStack must reserve the `x18` register or preserve its value.
787
790
788
-
See the [Clang ShadowCallStack documentation][clang-scs] for more details.
791
+
### `aarch64-linux-android`
789
792
790
-
*`aarch64-unknown-none`
793
+
This target already reserves the `x18` register.
794
+
A runtime must be provided by the application or operating system.
795
+
If `bionic` is used on this target, the software support is provided.
796
+
Otherwise, a runtime needs to prepare a memory region and points `x18` to the region which serves as the shadow call stack.
797
+
798
+
### `aarch64-unknown-none`
791
799
792
800
In addition to support from a runtime by the application or operating system, the `-Zfixed-x18` flag is also mandatory.
793
801
802
+
## RISC-V 64 family
803
+
804
+
ShadowCallStack uses either the `gp` register for software shadow stack, also known as `x3`, or the `ssp` register if [`Zicfiss`][riscv-zicfiss] extension is available.
805
+
`gp`/`x3` is currently always reserved and available forShadowCallStack instrumentation, and `ssp`incase of `Zicfiss` is only accessible through its dedicated shadow stack instructions.
806
+
807
+
Support from the runtime and operating system is required when `gp`/`x3` is used for software shadow stack.
808
+
A runtime must prepare a memory region and point `gp`/`x3` to the region before executing the code.
809
+
810
+
The following targets support ShadowCallStack.
811
+
812
+
*`riscv64imac-unknown-none-elf`
813
+
*`riscv64gc-unknown-none-elf`
814
+
794
815
# ThreadSanitizer
795
816
796
817
ThreadSanitizer is a data race detection tool. It is supported on the following
@@ -912,3 +933,4 @@ Sanitizers produce symbolized stacktraces when llvm-symbolizer binary is in `PAT
0 commit comments