[PATCH v9 00/19] aarch64: Add support for Guarded Control Stack extension

Fri Jan 17 17:41:00 GMT 2025

This patch series adds support for the Guarded Control Stack extension [1] that
allows to use shadow stacks on AArch64 systems with enabled GCS.

This patch series includes:
 - Definition of jmp_buf offset for GCS
 - GCS support in longjmp, vfork, setcontext, makecontext
 - GCS support in static startup code and dynamic linker
 - Handling of GCS marking in dynamic binaries and DSOs
 - Handling of GCS marking in static binaries
 - Mark swapcontext with indirect_return
 - New tunable glibc.cpu.aarch64_gcs
 - Processing GNU property notes executables

GCS marking for binaries is specified in [2].
Regression tested on AArch64 and x86 and no regressions have been found.
Also build-tested using build-many-glibcs.py and no regressions found.

Applies to 252fc3628b in master. Any feedback is welcome and appreciated.

Sources and branches:
 - binutils-gdb: sourceware.org/git/binutils-gdb.git master
 - gcc: gcc.gnu.org/git/gcc.git master
 - glibc: this patch series
 - kernel: git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

Cross-building the toolchain for target aarch64-none-linux-gnu:
 - build and install binutils-gdb
 - build and install GCC stage 1
 - install kernel headers
 - install glibc headers
 - build and install GCC stage 2 configuring with --enable-standard-branch-protection
 - build and install glibc
 - build and install GCC stage 3 along with target libraries configuring with --enable-standard-branch-protection

FVP model provided by the Shrinkwrap tool [3] can be used for testing.

To enable GCS, run tests with environment variable (see patch 09/19 for details):

  GLIBC_TUNABLES=glibc.cpu.aarch64_gcs=1

[1] https://developer.arm.com/documentation/ddi0487/ka/ (chapter D11)
[2] https://github.com/ARM-software/abi-aa/blob/main/sysvabi64/sysvabi64.rst
[3] https://git.gitlab.arm.com/tooling/shrinkwrap.git

---

Changes in v9:
 - There is only one GCS tunable with 4 possible values (see discussion in [4]).
 - Addressed other minor comments in v8 [4].
[4] https://inbox.sourceware.org/libc-alpha/20250114160328.2031684-1-yury.khrustalev@arm.com/

Changes in v8:
 - Removed attempt to free GCS shadow stack allocated in makecontext()
 - Show error if prctl() syscall to enable GCS does not succeed when
   GCS is requested and supported.
 - Added descriptions of GCS tunables to the manual.
 - Reverted processing of GNU properties to the original version [4].
 - Addressed other comments in v7 [6].

[5] https://inbox.sourceware.org/libc-alpha/20241129163721.2385847-20-yury.khrustalev@arm.com/
[6] https://inbox.sourceware.org/libc-alpha/20250103154141.47731-1-yury.khrustalev@arm.com/

Changes in v7:
 - Rebased on recent master (required fix-up for one of the commits: is_rtld_link_map).
 - Added check for incorrect tunable value for glibc.cpu.aarch64_gcs_policy.
 - Updated copyright years.

Link to v6:
https://inbox.sourceware.org/libc-alpha/20241212143749.767747-1-yury.khrustalev@arm.com/

Changes in v6:
 - Changed how notes and properties are processed for static executables.
 - Fixed vfork() comment.
 - Fixed error message formatting for GCS errors for static executables.
 - Fixed ARCH_THREAD_FREERES macro to avoid #ifdef-s.
 - Rebased on recent master.

Link to v5:
https://inbox.sourceware.org/libc-alpha/20241206132952.2410680-1-yury.khrustalev@arm.com/

Changes in v5:
 - Reworked patch series to exclude exporting new public header constants.
 - Fixed minor style issues.
 - Added reserved names for new Glibc tunables to the manual.
 - GCS tunables are now using internally defined HWCAP_GCS unless it is
   already defined.
 - vfork() does not clear x30 before "returning" to child any more as this
   would be unnecessary in most cases but might create some undocumented
   "de facto" ABI.

Link to v4:
https://inbox.sourceware.org/libc-alpha/20241129163721.2385847-1-yury.khrustalev@arm.com/

Changes in v4:
 - Merged patches 17 and 18 from v3 series.
 - Amended tests that would fail if executed on a system with GCS.

Link to v3:
https://inbox.sourceware.org/libc-alpha/20241023083920.466015-1-yury.khrustalev@arm.com/

---

Szabolcs Nagy (18):
  aarch64: Add asm helpers for GCS
  elf.h: Define GNU_PROPERTY_AARCH64_FEATURE_1_GCS
  aarch64: Define jmp_buf offset for GCS
  aarch64: Add GCS support to longjmp
  aarch64: Add GCS support to vfork
  aarch64: Add GCS support for setcontext
  aarch64: Mark swapcontext with indirect_return
  aarch64: Add GCS support for makecontext
  aarch64: Add glibc.cpu.aarch64_gcs tunable
  aarch64: Enable GCS in static linked exe
  aarch64: Enable GCS in dynamic linked exe
  aarch64: Mark objects with GCS property note
  aarch64: Use l_searchlist.r_list for bti
  aarch64: Handle GCS marking
  aarch64: Ignore GCS property of ld.so
  aarch64: Process gnu properties in static exe
  aarch64: Add GCS user-space allocation logic
  aarch64: Use __alloc_gcs in makecontext

Yury Khrustalev (1):
  aarch64: Fix tests not compatible with targets supporting GCS

 elf/elf.h                                     |   1 +
 elf/tst-asm-helper.h                          |  49 +++++++
 elf/tst-big-note-lib.S                        |   2 +
 elf/tst-ro-dynamic-mod.map                    |   7 +-
 manual/tunables.texi                          |  43 ++++++
 sysdeps/aarch64/Makefile                      |  11 +-
 sysdeps/aarch64/__alloc_gcs.c                 |  63 +++++++++
 sysdeps/aarch64/__longjmp.S                   |  30 +++++
 sysdeps/aarch64/aarch64-gcs.h                 |  28 ++++
 sysdeps/aarch64/bits/indirect-return.h        |  36 +++++
 sysdeps/aarch64/dl-bti.c                      |   5 +-
 sysdeps/aarch64/dl-gcs.c                      | 123 ++++++++++++++++++
 sysdeps/aarch64/dl-prop.h                     |  15 ++-
 sysdeps/aarch64/dl-start.S                    |  34 ++++-
 sysdeps/aarch64/dl-tunables.list              |   6 +
 sysdeps/aarch64/jmpbuf-offsets.h              |  62 +++++++++
 sysdeps/aarch64/linkmap.h                     |   1 +
 sysdeps/aarch64/rtld-global-offsets.sym       |   5 +
 sysdeps/aarch64/setjmp.S                      |  10 ++
 sysdeps/aarch64/sysdep.h                      |  12 +-
 sysdeps/aarch64/tst-vpcs-mod.S                |   4 +-
 .../unix/sysv/linux/aarch64/cpu-features.c    |   8 ++
 .../unix/sysv/linux/aarch64/dl-procruntime.c  |  37 ++++++
 sysdeps/unix/sysv/linux/aarch64/getcontext.S  |  17 ++-
 sysdeps/unix/sysv/linux/aarch64/libc-start.h  |  62 +++++++++
 sysdeps/unix/sysv/linux/aarch64/makecontext.c |  39 +++++-
 sysdeps/unix/sysv/linux/aarch64/setcontext.S  |  42 ++++++
 sysdeps/unix/sysv/linux/aarch64/swapcontext.S |  32 +++--
 .../sysv/linux/aarch64/ucontext-internal.h    |   5 +
 sysdeps/unix/sysv/linux/aarch64/vfork.S       |   7 +-
 30 files changed, 762 insertions(+), 34 deletions(-)
 create mode 100644 elf/tst-asm-helper.h
 create mode 100644 sysdeps/aarch64/__alloc_gcs.c
 create mode 100644 sysdeps/aarch64/aarch64-gcs.h
 create mode 100644 sysdeps/aarch64/bits/indirect-return.h
 create mode 100644 sysdeps/aarch64/dl-gcs.c
 create mode 100644 sysdeps/unix/sysv/linux/aarch64/dl-procruntime.c
 create mode 100644 sysdeps/unix/sysv/linux/aarch64/libc-start.h

-- 
2.39.5