[PATCH v8 00/20] aarch64: Add support for Guarded Control Stack extension
Adhemerval Zanella Netto
adhemerval.zanella@linaro.org
Thu Jan 16 13:49:45 GMT 2025
On 14/01/25 13:03, Yury Khrustalev wrote:
> This patch series adds support for the Guarded Control Stack extension [1] that
> allows to use shadow stacks on AArch64 systems with enabled GCS.
>
> This patch series includes:
> - Definition of jmp_buf offset for GCS
> - GCS support in longjmp, vfork, setcontext, makecontext
> - GCS support in static startup code and dynamic linker
> - Handling of GCS marking in dynamic binaries and DSOs
> - Handling of GCS marking in static binaries
> - Mark swapcontext with indirect_return
> - New tunables glibc.cpu.aarch64_gcs and glibc.cpu.aarch64_gcs_policy
> - Processing GNU property notes executables
>
> GCS marking for binaries is specified in [2].
> Regression tested on AArch64 and x86 and no regressions have been found.
> Also build-tested using build-many-glibcs.py and no regressions found.
>
> Applies to 2ac7701888 in master. Any feedback is welcome and appreciated.
>
> Sources and branches:
> - binutils-gdb: sourceware.org/git/binutils-gdb.git master
> - gcc: gcc.gnu.org/git/gcc.git master
> - glibc: this patch series
> - kernel: git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
>
> Cross-building the toolchain for target aarch64-none-linux-gnu:
> - build and install binutils-gdb
> - build and install GCC stage 1
> - install kernel headers
> - install glibc headers
> - build and install GCC stage 2 configuring with --enable-standard-branch-protection
> - build and install glibc
> - build and install GCC stage 3 along with target libraries configuring with --enable-standard-branch-protection
>
> FVP model provided by the Shrinkwrap tool [3] can be used for testing.
>
> To enable GCS, run tests with environment variable:
>
> GLIBC_TUNABLES=glibc.cpu.aarch64_gcs=1:glibc.cpu.aarch64_gcs_policy=2
Hi Yuri,
I think I reviewed all the remaning patches, and the only contention I have is
the inclusion of aarch64_gcs_policy=1 that allows dlopen to disable GCS support
if a shared library does not contain the GCS marking.
As I said, we recently removed a similar support for executable stacks
(commit 0ca8785a28) because this is silent change of process semantic and
it also used as way to enable a RCE on a CVE [1].
So I don't think we should explict support options to allow process to move
from a hardened to a lower hardened security perpective, specially in a
silent manner, and even though a explicit option (the tunable, where use
does need to opt-in).
It would be good to have some more input for other maintainers. How x86 does
in this regard (I haven't check it).
[1] https://www.qualys.com/2023/07/19/cve-2023-38408/rce-openssh-forwarded-ssh-agent.txt
>
> [1] https://developer.arm.com/documentation/ddi0487/ka/ (chapter D11)
> [2] https://github.com/ARM-software/abi-aa/blob/main/sysvabi64/sysvabi64.rst
> [3] https://git.gitlab.arm.com/tooling/shrinkwrap.git
>
> ---
>
> Changes in v8:
> - Removed attempt to free GCS shadow stack allocated in makecontext()
> - Show error if prctl() syscall to enable GCS does not succeed when
> GCS is requested and supported.
> - Added descriptions of GCS tunables to the manual.
> - Reverted processing of GNU properties to the original version [4].
> - Addressed other comments in v7 [5].
>
> [4] https://inbox.sourceware.org/libc-alpha/20241129163721.2385847-20-yury.khrustalev@arm.com/
> [5] https://inbox.sourceware.org/libc-alpha/20250103154141.47731-1-yury.khrustalev@arm.com/
>
> Changes in v7:
> - Rebased on recent master (required fix-up for one of the commits: is_rtld_link_map).
> - Added check for incorrect tunable value for glibc.cpu.aarch64_gcs_policy.
> - Updated copyright years.
>
> Link to v6:
> https://inbox.sourceware.org/libc-alpha/20241212143749.767747-1-yury.khrustalev@arm.com/
>
> Changes in v6:
> - Changed how notes and properties are processed for static executables.
> - Fixed vfork() comment.
> - Fixed error message formatting for GCS errors for static executables.
> - Fixed ARCH_THREAD_FREERES macro to avoid #ifdef-s.
> - Rebased on recent master.
>
> Link to v5:
> https://inbox.sourceware.org/libc-alpha/20241206132952.2410680-1-yury.khrustalev@arm.com/
>
> Changes in v5:
> - Reworked patch series to exclude exporting new public header constants.
> - Fixed minor style issues.
> - Added reserved names for new Glibc tunables to the manual.
> - GCS tunables are now using internally defined HWCAP_GCS unless it is
> already defined.
> - vfork() does not clear x30 before "returning" to child any more as this
> would be unnecessary in most cases but might create some undocumented
> "de facto" ABI.
>
> Link to v4:
> https://inbox.sourceware.org/libc-alpha/20241129163721.2385847-1-yury.khrustalev@arm.com/
>
> Changes in v4:
> - Merged patches 17 and 18 from v3 series.
> - Amended tests that would fail if executed on a system with GCS.
>
> Link to v3:
> https://inbox.sourceware.org/libc-alpha/20241023083920.466015-1-yury.khrustalev@arm.com/
>
> ---
>
> Szabolcs Nagy (19):
> aarch64: Add asm helpers for GCS
> elf.h: Define GNU_PROPERTY_AARCH64_FEATURE_1_GCS
> aarch64: Define jmp_buf offset for GCS
> aarch64: Add GCS support to longjmp
> aarch64: Add GCS support to vfork
> aarch64: Add GCS support for setcontext
> aarch64: Mark swapcontext with indirect_return
> aarch64: Add GCS support for makecontext
> aarch64: Add glibc.cpu.aarch64_gcs tunable
> aarch64: Enable GCS in static linked exe
> aarch64: Enable GCS in dynamic linked exe
> aarch64: Mark objects with GCS property note
> aarch64: Add glibc.cpu.aarch64_gcs_policy tunable
> aarch64: Use l_searchlist.r_list for bti
> aarch64: Handle GCS marking
> aarch64: Ignore GCS property of ld.so
> aarch64: Process gnu properties in static exe
> aarch64: Add GCS user-space allocation logic
> aarch64: Use __alloc_gcs in makecontext
>
> Yury Khrustalev (1):
> aarch64: Fix tests not compatible with targets supporting GCS
>
> elf/elf.h | 1 +
> elf/tst-asm-helper.h | 49 +++++++++++
> elf/tst-big-note-lib.S | 2 +
> elf/tst-ro-dynamic-mod.map | 7 +-
> manual/tunables.texi | 41 +++++++++
> sysdeps/aarch64/Makefile | 11 ++-
> sysdeps/aarch64/__alloc_gcs.c | 63 ++++++++++++++
> sysdeps/aarch64/__longjmp.S | 30 +++++++
> sysdeps/aarch64/aarch64-gcs.h | 28 +++++++
> sysdeps/aarch64/bits/indirect-return.h | 36 ++++++++
> sysdeps/aarch64/dl-bti.c | 5 +-
> sysdeps/aarch64/dl-gcs.c | 83 +++++++++++++++++++
> sysdeps/aarch64/dl-prop.h | 15 ++--
> sysdeps/aarch64/dl-start.S | 34 +++++++-
> sysdeps/aarch64/dl-tunables.list | 10 +++
> sysdeps/aarch64/jmpbuf-offsets.h | 62 ++++++++++++++
> sysdeps/aarch64/linkmap.h | 1 +
> sysdeps/aarch64/rtld-global-offsets.sym | 5 ++
> sysdeps/aarch64/setjmp.S | 10 +++
> sysdeps/aarch64/sysdep.h | 12 ++-
> sysdeps/aarch64/tst-vpcs-mod.S | 4 +-
> .../unix/sysv/linux/aarch64/cpu-features.c | 13 +++
> sysdeps/unix/sysv/linux/aarch64/dl-procinfo.c | 13 +++
> .../unix/sysv/linux/aarch64/dl-procruntime.c | 37 +++++++++
> sysdeps/unix/sysv/linux/aarch64/getcontext.S | 17 +++-
> sysdeps/unix/sysv/linux/aarch64/libc-start.h | 62 ++++++++++++++
> sysdeps/unix/sysv/linux/aarch64/makecontext.c | 41 ++++++++-
> sysdeps/unix/sysv/linux/aarch64/setcontext.S | 42 ++++++++++
> sysdeps/unix/sysv/linux/aarch64/swapcontext.S | 32 +++++--
> .../sysv/linux/aarch64/ucontext-internal.h | 5 ++
> sysdeps/unix/sysv/linux/aarch64/vfork.S | 7 +-
> 31 files changed, 744 insertions(+), 34 deletions(-)
> create mode 100644 elf/tst-asm-helper.h
> create mode 100644 sysdeps/aarch64/__alloc_gcs.c
> create mode 100644 sysdeps/aarch64/aarch64-gcs.h
> create mode 100644 sysdeps/aarch64/bits/indirect-return.h
> create mode 100644 sysdeps/aarch64/dl-gcs.c
> create mode 100644 sysdeps/unix/sysv/linux/aarch64/dl-procruntime.c
> create mode 100644 sysdeps/unix/sysv/linux/aarch64/libc-start.h
>
More information about the Libc-alpha
mailing list