[PATCH v5 10/23] aarch64: Add glibc.cpu.aarch64_gcs tunable

[Yury Khrustalev]

On Wed, Dec 11, 2024 at 06:13:48PM -0500, Carlos O'Donell wrote:
> On 12/6/24 8:29 AM, Yury Khrustalev wrote:
> > From: Szabolcs Nagy <szabolcs.nagy@arm.com>
> > 
> > This tunable is for controlling the GCS status. It is the argument to
> > the PR_SET_SHADOW_STACK_STATUS prctl, by default 0, so GCS is disabled.
> > 
> > The status is stored into GL(dl_aarch64_gcs) early and only applied
> > later, since enabling GCS is tricky: it must happen on a top level
> > stack frame. (Using GL instead of GLRO because it may need updates
> > depending on loaded libraries that happen after readonly protection
> > is applied, however library marking based GCS setting is not yet
> > implemented.)
> 
> This defines the tunable.
>
> ...
> 
> > +  if (GLRO (dl_hwcap) & HWCAP_GCS)
> > +    /* GCS status may be updated later by binary compatibility checks.  */
> > +    GL (dl_aarch64_gcs) = TUNABLE_GET (glibc, cpu, aarch64_gcs, uint64_t, 0);
> 
> Is it OK not to filter the value passed by the user?

This is a good question. I suppose it would make sense to validate the values,
but quick look through adjacent code suggests that such checks are usually not
implemented and it's up to the code that uses the value of a tunable to do the
right thing.

If some validation of the tunable value was implemented, what would be correct
to do in case of incorrect or unexpected value? Abort execution?

Thanks,
Yury