[PATCH v3 0/3] aarch64: support shadow stack in clone3

[Yury Khrustalev]

Kernel extends clone3() interface to allow specifying a shadow stack
when creating a new thread or process [1].

In this patch series we make use of this extended interface on aarch64
when GCS is available.

Part of the difficulty is versioning of the clone3() syscall in terms of
the struct clone_args as discussed in [2] and that a system can support
HWCAP_GCS without supporting extended struct clone_args. We check this
by doing a dummy clone3 syscall with a specific size of the struct and
looking for the E2BIG errno.

Regression was tested on aarch64 and x86, and no regression has been found.

Corresponding Linux kernel patch is [1] and can be checked out from [3]
(based on v6.17-rc1) which is the same as [1].

This change can be tested on the FVP model as described in [4].

base commit: 13d67746cb

Changes in v3:
 - Added enum to be used for the state determined by the utility function
   __clone3_supports_shadow_stack().
 - Fixed tests: using support function to check if memory was unmapped
   and use seccomp filter instead of unreliable enforced memory limit.
   Also using x-function from support to make code in the tests simpler.
 - Keeping all three (base, token, size) params of the shadow stack in the
   struct pthread for better portability across targets that support shadow
   stack.
 - Tested along with the latest version v21 of the corresponding kernel patch.
 - v2: https://inbox.sourceware.org/libc-alpha/20250707124722.2251501-1-yury.khrustalev@arm.com/

Changes in v2:
 - Instead of relying on kernel version, we fire a dummy clone3 syscall
   with a specific size and check if we get the E2BIG error which would
   indicate that the shadow_stack_token field is not supported in struct
   clone_args.
 - Added tests for cancelled and non-started threads to check that
   shadow stack is de-allocated.
 - v1: https://inbox.sourceware.org/libc-alpha/20250610151320.885131-1-yury.khrustalev@arm.com/

[1]: https://lore.kernel.org/all/20250916-clone3-shadow-stack-v21-0-910493527013@kernel.org/
[2]: https://lore.kernel.org/lkml/aCs65ccRQtJBnZ_5@arm.com/
[3]: https://git.kernel.org/pub/scm/linux/kernel/git/broonie/ci.git/log/?h=clone3-shadow-stack
[4]: https://inbox.sourceware.org/libc-help/aIc3ElNTSQrelCK9@arm.com/

---

Yury Khrustalev (3):
  clone: Add clone_arg field for shadow stack
  nptl: Add libc allocated shadow stack for new threads
  aarch64: GCS: add clone3 tests for shadow stack

 nptl/descr.h                                  |   7 ++
 nptl/pthread_create.c                         |  29 +++++
 sysdeps/aarch64/libc-shadow-stack.h           |  99 ++++++++++++++++
 sysdeps/generic/libc-shadow-stack.h           |  25 ++++
 sysdeps/unix/sysv/linux/aarch64/Makefile      |  17 +++
 .../linux/aarch64/tst-gcs-clone3-cancel.c     |  84 +++++++++++++
 .../sysv/linux/aarch64/tst-gcs-clone3-nomem.c | 111 ++++++++++++++++++
 .../unix/sysv/linux/aarch64/tst-gcs-clone3.c  |  89 ++++++++++++++
 sysdeps/unix/sysv/linux/clone-internal.c      |   7 +-
 sysdeps/unix/sysv/linux/clone3.h              |   2 +
 sysdeps/unix/sysv/linux/spawni.c              |   1 +
 11 files changed, 469 insertions(+), 2 deletions(-)
 create mode 100644 sysdeps/aarch64/libc-shadow-stack.h
 create mode 100644 sysdeps/generic/libc-shadow-stack.h
 create mode 100644 sysdeps/unix/sysv/linux/aarch64/tst-gcs-clone3-cancel.c
 create mode 100644 sysdeps/unix/sysv/linux/aarch64/tst-gcs-clone3-nomem.c
 create mode 100644 sysdeps/unix/sysv/linux/aarch64/tst-gcs-clone3.c

-- 
2.47.3