Delete x86_64 ShadowCallStack support

[vlad.tsyrklevich]

Summary

ShadowCallStack on x86_64 suffered from the same racy security issues as
Return Flow Guard and had performance overhead as high as 13% depending
on the benchmark. x86_64 ShadowCallStack was always an experimental
feature and never shipped a runtime required to support it, as such
there are no expected downstream users.

[pcc]

Thanks for cleaning this up.

clang/docs/ShadowCallStack.rst

23 ↗

(On Diff #189541)

Should we keep a link to the Clang 7.0.1 docs?

[vlad.tsyrklevich]

• Keep x86_64 doc link

cmake/config-ix.cmake

 set(ALL_ESAN_SUPPORTED_ARCH ${X86_64} ${MIPS64})
 set(ALL_SCUDO_SUPPORTED_ARCH ${X86} ${X86_64} ${ARM32} ${ARM64} ${MIPS32} ${MIPS64} ${PPC64})
 set(ALL_SCUDO_STANDALONE_SUPPORTED_ARCH ${X86} ${X86_64})
 if(APPLE)
 set(ALL_XRAY_SUPPORTED_ARCH ${X86_64})
 else()
 set(ALL_XRAY_SUPPORTED_ARCH ${X86_64} ${ARM32} ${ARM64} ${MIPS32} ${MIPS64} powerpc64le)
 endif()
-set(ALL_SHADOWCALLSTACK_SUPPORTED_ARCH ${X86_64} ${ARM64})
+set(ALL_SHADOWCALLSTACK_SUPPORTED_ARCH ${ARM64})
 
 if(APPLE)
   include(CompilerRTDarwinUtils)
 
   find_darwin_sdk_dir(DARWIN_osx_SYSROOT macosx)
   find_darwin_sdk_dir(DARWIN_iossim_SYSROOT iphonesimulator)
   find_darwin_sdk_dir(DARWIN_ios_SYSROOT iphoneos)
   find_darwin_sdk_dir(DARWIN_watchossim_SYSROOT watchsimulator)

test/shadowcallstack/libc_support.h

__asm__ __volatile__(
       "mov x2, %1\n"
       "mov x8, #64\n"  // write
       "svc #0\n" ::"r"(p),
       "r"(scs_strlen(p))
       : "x0", "x1", "x2", "x8");
 }
 
 #else
-
-__attribute__((noinline)) void scs_fputs_stdout(const char *p) {
-  fputs(p, stdout);
-}
-
+#error Unsupported platform
 #endif

test/shadowcallstack/lit.cfg

 # Add clang substitutions.
 config.substitutions.append( ("%clang_noscs ", config.clang + ' -O0 -fno-sanitize=shadow-call-stack ' + config.target_cflags + ' ') )
 
 scs_arch_cflags = config.target_cflags
 if config.target_arch == 'aarch64':
   scs_arch_cflags += ' -ffixed-x18 '
 config.substitutions.append( ("%clang_scs ", config.clang + ' -O0 -fsanitize=shadow-call-stack ' + scs_arch_cflags + ' ') )
 
-if config.host_os not in ['Linux'] or config.target_arch not in ['x86_64', 'aarch64']:
+if config.host_os not in ['Linux'] or config.target_arch not in ['aarch64']:
    config.unsupported = True

test/shadowcallstack/minimal_runtime.h

 // A shadow call stack runtime is not yet included with compiler-rt, provide a
 // minimal runtime to allocate a shadow call stack and assign an
 // architecture-specific register to point at it.
 
 #pragma once
 
-#ifdef __x86_64__
-#include <asm/prctl.h>
-int arch_prctl(int code, void *addr);
-#endif
 #include <stdlib.h>
 #include <sys/mman.h>
 #include <sys/prctl.h>
 
 #include "libc_support.h"
 
 __attribute__((no_sanitize("shadow-call-stack")))
 static void __shadowcallstack_init() {
   void *stack = mmap(NULL, 8192, PROT_READ | PROT_WRITE,
                      MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
   if (stack == MAP_FAILED)
     abort();
 
-#if defined(__x86_64__)
-  if (arch_prctl(ARCH_SET_GS, stack))
-    abort();
-#elif defined(__aarch64__)
+#if defined(__aarch64__)
   __asm__ __volatile__("mov x18, %0" ::"r"(stack));
 #else
 #error Unsupported platform
 #endif
 }
 
 int scs_main(void);
 
 __attribute__((no_sanitize("shadow-call-stack"))) int main(void) {
   __shadowcallstack_init();
 
   // We can't simply return scs_main() because scs_main might have corrupted our
   // return address for testing purposes (see overflow.c), so we need to exit
   // ourselves.
   exit(scs_main());
 }

test/shadowcallstack/overflow-aarch64.c

-// See overflow.c for a description.
-
-// REQUIRES: aarch64-target-arch
-// RUN: %clang_scs %S/overflow.c -o %t -DITERATIONS=12
-// RUN: %run %t | FileCheck %S/overflow.c

test/shadowcallstack/overflow-x86_64.c

-// See overflow.c for a description.
-
-// REQUIRES: x86_64-target-arch
-// RUN: %clang_scs %S/overflow.c -o %t -DITERATIONS=12
-// RUN: not --crash %run %t

test/shadowcallstack/overflow.c

 // Test that a stack overflow fails as expected
 
 // RUN: %clang_noscs %s -o %t -DITERATIONS=3
 // RUN: %run %t | FileCheck %s
 // RUN: %clang_noscs %s -o %t -DITERATIONS=12
 // RUN: %run %t | FileCheck -check-prefix=OVERFLOW_SUCCESS %s
 
 // RUN: %clang_scs %s -o %t -DITERATIONS=3
 // RUN: %run %t | FileCheck %s
 
-// The behavioral check for SCS + overflow lives in the tests overflow-x86_64.c
-// and overflow-aarch64.c. This is because the expected behavior is different
-// between the two platforms. On x86_64 we crash because the comparison between
-// the shadow call stack and the regular stack fails. On aarch64 there is no
-// comparison, we just load the return address from the shadow call stack. So we
-// just expect not to see the output from print_and_exit.
+// On aarch64 we just load the return address from the shadow call stack so we
+// do not expect to see the output from print_and_exit.
+// RUN: %clang_scs %s -o %t -DITERATIONS=12
+// RUN: %run %t | FileCheck %S/overflow.c
 
 #include <stdio.h>
 #include <stdlib.h>
 
 #include "minimal_runtime.h"
 
 void print_and_exit(void) {
 // CHECK-NOT: Stack overflow successful.