[PATCH 1/2] aarch64: Lock GCS with glibc.cpu.aarch64_gcs_lock tunable

[Yury Khrustalev]

On Fri, Dec 19, 2025 at 08:39:05AM -0500, enh wrote:
> On Fri, Dec 19, 2025 at 8:36 AM Yury Khrustalev <yury.khrustalev@arm.com> wrote:
> >
> > On Fri, Dec 19, 2025 at 10:17:02AM -0300, Adhemerval Zanella Netto wrote:
> > >
> > > >> ...
> > > >>
> > > >> My main issue is the tunable requirement, not the GCS locking by default.
> > > >
> > > > We can just lock it unconditionally.
> > >
> > > Yes, that is my position.
> >
> > Since there is also some opposition to allow userspace to control shadow
> > stack size [1], some applications might want to choose to execute some
> > of their threads without GCS in which case they will want to disable GCS
> > for such threads and will need to disable GCS locking.
> 
> that sounds like an even more contentious option to me? a per-thread
> opt-out is a dangerous thing to leave lying around for your _security_
> feature!

Of course it's not something one would do on purpose. I was merely
trying to suggest a situation when one has to reduce security hardening
due to performance (e.g. memory) constraints. If your application
creates a large number of threads and you run out of memory because you
cannot control size of shadow stacks, you may have to disable GCS for
some threads while still keeping it for most important threads. It's not
ideal but I think it's better than disabling GCS for the whole
application?

> >
> > [1]: https://inbox.sourceware.org/libc-alpha/146d9fe7-ef32-4f0d-a2b2-8a36eae1bab7@linaro.org/
> >