[PATCH v2 1/1] aarch64: clear ZA state of SME before clone and clone3 syscalls

[enh]

On Tue, Jun 17, 2025 at 8:04 AM Yury Khrustalev <yury.khrustalev@arm.com> wrote:
>
> On Mon, Jun 16, 2025 at 05:39:57PM +0200, Florian Weimer wrote:
> >
> > > Any direct syscall is regarded as sufficiently low level, and we presume that
> > > those who do that already know what they are doing and they would have to do
> > > all the required ABI-related preparations.
> >
> > I don't think this assumption is correct.  Fork-style clone is
> > reasonably portable today, so it's used in quite a few places:
> >
> >   <https://codesearch.debian.net/search?q=syscall.*(NR%7CSYS)_clone&literal=0>
> >
>
> * Florian
>
> Thanks, this is a very good point. Given relatively wide-spread use of syscall()
> with __NR_clone, I can see how it might be confusing if clone() wrapper would do
> different things compared to syscall(__NR_clone, ...) although perhaps one should
> expect some extras from a wrapper?
>
> * Elliott
>
> Would it be possible to check of any of the software common on Android would use
> direct clone syscall?

i don't have any easy way to do that beyond "try it and see". clone()
is certainly allowed in the default seccomp filter for apps (without
any restriction on what flags), so it's possible.

(that would probably be the easiest way to catch this: install a
seccomp filter that only allows the flags that the kernel has a check
for, then run the apps you care about and see if you get any SIGSYS
deaths.)

> Thanks,
> Yury
>