[PATCH v4 1/2] aarch64: Lock GCS status at startup

[Adhemerval Zanella Netto]

On 17/02/26 12:32, Yury Khrustalev wrote:
> On Tue, Feb 17, 2026 at 09:49:29AM -0300, Adhemerval Zanella Netto wrote:
>>
>> On 16/02/26 14:25, Yury Khrustalev wrote:
>>> If GCS is enabled (see tunable glibc.cpu.aarch64_gcs), we lock all GCS
>>> operations (including status, write on shadow stack, and push to shadow
>>> stack) unless OPTIONAL policy is used.
>>
>> Patch look ok, some minor nits below. I think we can just fix them, install
>> and send a committed version.
>>
>> Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
> 
> Thanks!
> 
>> ...
>>
>>> +  uint64_t gcs = GL (dl_aarch64_gcs);
>>> +  if (gcs != GCS_POLICY_DISABLED)
>>>      {
>>> -      int ret = INLINE_SYSCALL_CALL (prctl, PR_SET_SHADOW_STACK_STATUS,
>>> -				     PR_SHADOW_STACK_ENABLE, 0, 0, 0);
>>> -      if (ret)
>>> -        _dl_fatal_printf ("failed to enable GCS: %d\n", -ret);
>>> +      int r0 = INLINE_SYSCALL_CALL (prctl, PR_SET_SHADOW_STACK_STATUS,
>>> +				    PR_SHADOW_STACK_ENABLE, 0, 0, 0);
>>> +      if (r0)
>>
>> No implicit checks (r0 != 0)
> 
> OK
> 
>> and I think you can just remove r0 and
>> check the INLINE_SYSCALL_CALL return directly in the if.
> 
> We use returned value for error reporting, so we need a variable.
> 

Ah right!