checkpoint-restore / criu

Checkpoint/Restore tool
criu.org
Other
2.77k stars 561 forks source link

x86: shadow stack support #2306

Closed rppt closed 4 months ago

rppt commented 7 months ago

Shadow stack support for userspace finally made it to the kernel and varying level of success to glibc.

This PR enables shadow stack support in CRIU.

Aside from saving/restoring the actual shadow stack contents and control, there are some changes to the way CRIU calls rt_sigreturn and a bit of black magic around restoring of the shadow stack contents.

As it's still unclear what will be glibc policy about making shadow stack on or off by default, this patchset takes care of both cases and lets CRIU fully control shadow stack for the restored tasks.

Testing:

cd /path/to/criu
USERCFLAGS="-fcf-protection" make -C test/zdtm  -j$(nproc)
export GLIBC_TUNABLES=glibc.cpu.hwcaps=SHSTK
codecov-commenter commented 7 months ago

Codecov Report

Attention: 74 lines in your changes are missing coverage. Please review.

Comparison is base (b17a73b) 70.62% compared to head (4b86398) 70.17%.

:exclamation: Current head 4b86398 differs from pull request most recent head 394dab0. Consider uploading reports for the commit 394dab0 to get more accurate results

Files Patch % Lines
criu/arch/x86/shstk.c 21.25% 63 Missing :warning:
criu/kerndat.c 46.66% 8 Missing :warning:
criu/mem.c 50.00% 2 Missing :warning:
criu/proc_parse.c 80.00% 1 Missing :warning:
Additional details and impacted files ```diff @@ Coverage Diff @@ ## criu-dev #2306 +/- ## ============================================ - Coverage 70.62% 70.17% -0.45% ============================================ Files 134 135 +1 Lines 33316 34153 +837 ============================================ + Hits 23528 23968 +440 - Misses 9788 10185 +397 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

github-actions[bot] commented 6 months ago

A friendly reminder that this PR had no activity for 30 days.

avagin commented 6 months ago

Sorry for the delay. It is still in my todo list. @0x7f454c46 @mihalicyn, you help will be welcome too;)

avagin commented 4 months ago

Merged. Thanks a lot.