Aarch64/gcs #2725

svilenkov · 2025-08-31T16:30:14Z

This PR adds initial support for the Arm64 Guarded Control Stack (GCS). This work is part of the Google Summer of Code 2025 projects.

compel/arch/aarch64/src/lib/infect.c

rppt

Acked-by: Mike Rapoport rppt@kernel.org

compel/arch/aarch64/src/lib/include/uapi/asm/gcs-types.h

compel/arch/aarch64/src/lib/infect.c

rppt · 2025-09-04T05:43:16Z

compel/include/uapi/infect.h

 #endif

+#ifndef compel_gcs_enabled
+static inline bool compel_gcs_enabled(struct user_gcs *gcs)


It looks like we don't need neither compel_gcs_enabled() nor compel_shstk_enabled().
The both only appear in arch/ code and it seems better to just define no underscore version in compel/arch//src/lib/include/uapi/asm/infect-types.h and drop the global stubs.

rppt · 2025-09-04T05:45:51Z

compel/arch/aarch64/src/lib/infect.c

 		goto err;
 	}

+	memset(&fpsimd->gcs, 0, sizeof(fpsimd->gcs));


we don't memset(0) other register structs, why there is a need to clear fpsimd->gcs?

I've explicitly zeroed out to be sure GCS fields won't contain garbage values that would falsely indicate it's enabled

rppt

Implement parasite_setup_gcs() to:

read NT_ARM_GCS via

ptrace I presume? ;)

compel/arch/aarch64/src/lib/infect.c

rppt · 2025-09-04T06:48:16Z

This PR adds initial support for the Arm64 Guarded Control Stack (GCS). This work is part of the Google Summer of Code 2025 projects.

Great work @svilenkov !

github-actions · 2025-10-05T00:09:36Z

A friendly reminder that this PR had no activity for 30 days.

Refactor user_fpregs_struct_t to wrap user_fpsimd_state in a dedicated struct, preparing for future extending by just adding new members Signed-off-by: Igor Svilenkov Bozic <svilenkov@gmail.com> Reviewed-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>

Introduce ARM64 Guarded Control Stack (GCS) constants and macros in a new uapi header for use in both CRIU and compel. Includes: - NT_ARM_GCS type - prctl(2) constants for GCS enable/write/push modes - Capability token helpers (GCS_CAP, GCS_SIGNAL_CAP) - HWCAP_GCS definition These are based on upstream Linux definitions Signed-off-by: Igor Svilenkov Bozic <svilenkov@gmail.com>

Add basic prerequisites for Guarded Control Stack (GCS) state on AArch64. This adds a gcs_context to the signal frame and extends user_fpregs_struct_t to carry GCS metadata, preparing the groundwork for GCS in the parasite. For now, the GCS fields are zeroed during compel_get_task_regs(), technically ignoring GCS since it does not reach the control logic yet; that will be introduced in the next commit. The code path is gated and does not affect normal tests. Can be explicitly enabled and tested via: make -C infect GCS_ENABLE=1 && make -C infect run Signed-off-by: Igor Svilenkov Bozic <svilenkov@gmail.com>

When GCS is enabled, the kernel expects a capability token at GCSPR_EL0-8 and sa_restorer at GCSPR_EL0-16 on rt_sigreturn. The sigframe must be consistent with the kernel’s expectations, with GCSPR_EL0 advanced by -8 having it point to the token on signal entry. On rt_sigreturn, the kernel verifies the cap at GCSPR_EL0, invalidates it and increments GCSPR_EL0 by 8 at the end of gcs_restore_signal() . Implement parasite_setup_gcs() to: - read NT_ARM_GCS via ptrace(PTRACE_GETREGSET) - write (via ptrace) the computed capability token and restorer address - update GCSPR_EL0 to point to the token's location Call parasite_setup_gcs() into parasite_start_daemon() so the sigreturn frame satisfies kernel's expectation Tests with GCS remain opt‑in: make -C compel/test/infect GCS_ENABLE=1 && make -C compel/test/infect run Signed-off-by: Igor Svilenkov Bozic <svilenkov@gmail.com>

Introduce an opt-in mode for building and running compel tests with Guarded Control Stack (GCS) enabled on AArch64. Changes: - Extend compel/test/infect to support `GCS_ENABLE=1` builds, adding `-mbranch-protection=standard` and `-z experimental-gcs=check` to CFLAGS/LDFLAGS. - Export required GLIBC_TUNABLES at runtime via `TEST_ENV`. Usage: make -C compel/test/infect GCS_ENABLE=1 make -C compel/test/infect GCS_ENABLE=1 run By default (`GCS_ENABLE` unset or 0), builds and runs are unchanged. Signed-off-by: Igor Svilenkov Bozic <svilenkov@gmail.com>

- Define user_aarch64_gcs_entry in core-aarch64.proto to store Guarded Control Stack state (gcspr_el0, features_enabled). - Extend thread_info_aarch64 with an optional gcs field Also extend thread_info_aarch64 with an optional gcs field Signed-off-by: Igor Svilenkov Bozic <svilenkov@gmail.com>

Add debug and info messages to log Guarded Control Stack state when dumping AArch64 threads. This includes the following values: - gcspr_el0 - features_enabled Signed-off-by: Igor Svilenkov Bozic <svilenkov@gmail.com>

This commit finalizes AArch64 Guarded Control Stack (GCS) support by wiring the full dump and restore flow. The restore path adds the following steps: - Define shared AArch64 GCS types and constants in a dedicated header for both compel and CRIU inclusion - compel: add get/set NT_ARM_GCS via ptrace, enabling user-space GCS state save and restore. - During restore switch to the new GCS (via GCSSTR) to place capability token sa_restorer address - arch_shstk_trampoline() — We enable GCS in a trampoline that using prctl(PR_SET_SHADOW_STACK_STATUS, ...) via inline SVC. The trampoline ineeded because we can’t RET without a valid GCS. - restorer: map the recorded GCS VMA, populate contents top-down with GCSSTR, write the signal capability at GCSPR_EL0 and the valid token at GCSPR_EL0-8, then switch to the rebuilt GCS (GCSSS1) - Save and restore registers via ptrace - Extend restorer argument structures to carry GCS state into post-restore execution - Add shstk_set_restorer_stack(): sets tmp_gcs to temporary restorer shadow stack start - Add gcs_vma_restore implementation (required for mremap of the GCS VMA) Tested with: GCS_ENABLE=1 ./zdtm.py run -t zdtm/static/env00 Signed-off-by: Igor Svilenkov Bozic <svilenkov@gmail.com>

Introduce an opt-in mode for building and running ZDTM static tests with Guarded Control Stack (GCS) enabled on AArch64. Changes: - Support `GCS_ENABLE=1` builds, adding `-mbranch-protection=standard` and `-z experimental-gcs=check` to CFLAGS/LDFLAGS. - Export required GLIBC_TUNABLES at runtime via `TEST_ENV`. - %.pid rules to prefix test binaries with `$(TEST_ENV)` so the tunables are set when running tests. - Makefile rules for selectively enabling GCS in tests Usage: # Build and run with GCS enabled make -C zdtm/static GCS_ENABLE=1 posix_timers GCS_ENABLE=1 ./zdtm.py run --keep-img=always \ -t zdtm/static/posix_timers By default (`GCS_ENABLE` unset or 0), test builds and runs are unchanged. NOTE: This assumes that the test victim was compiled also using GCS_ENABLE=1 so that the proper GCS AArch64 ELF headers are present Signed-off-by: Igor Svilenkov Bozic <svilenkov@gmail.com> Reviewed-by: Alexander Mikhalitsyn aleksandr.mikhalitsyn@canonical.com

rst0git reviewed Sep 1, 2025

View reviewed changes

compel/arch/aarch64/src/lib/infect.c Show resolved Hide resolved

rppt reviewed Sep 4, 2025

View reviewed changes

compel/arch/aarch64/src/lib/include/uapi/asm/gcs-types.h Show resolved Hide resolved

rppt reviewed Sep 4, 2025

View reviewed changes

compel/arch/aarch64/src/lib/infect.c Outdated Show resolved Hide resolved

rppt reviewed Sep 4, 2025

View reviewed changes

compel/arch/aarch64/src/lib/infect.c Outdated Show resolved Hide resolved

rppt reviewed Sep 4, 2025

View reviewed changes

compel/arch/aarch64/src/lib/infect.c Show resolved Hide resolved

This comment was marked as off-topic.

Sign in to view

github-actions bot added the stale-pr label Oct 5, 2025

github-actions bot removed the stale-pr label Oct 15, 2025

svilenkov added 2 commits October 30, 2025 17:50

svilenkov force-pushed the aarch64/gcs branch from dd8018f to 12328e1 Compare November 3, 2025 14:34

svilenkov added 4 commits November 3, 2025 15:58

svilenkov force-pushed the aarch64/gcs branch 3 times, most recently from 4fe3599 to 002bf34 Compare November 3, 2025 15:10

svilenkov added 3 commits November 3, 2025 16:53

criu/dump: gcs: save GCS state during dump

94a04e1

Add debug and info messages to log Guarded Control Stack state when dumping AArch64 threads. This includes the following values: - gcspr_el0 - features_enabled Signed-off-by: Igor Svilenkov Bozic <svilenkov@gmail.com>

svilenkov force-pushed the aarch64/gcs branch from 002bf34 to d2fd607 Compare November 3, 2025 15:53

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Aarch64/gcs #2725

Aarch64/gcs #2725

Uh oh!

svilenkov commented Aug 31, 2025 •

edited

Loading

Uh oh!

Uh oh!

rppt left a comment

Uh oh!

Uh oh!

Uh oh!

rppt Sep 4, 2025

Uh oh!

rppt Sep 4, 2025

Uh oh!

svilenkov Sep 4, 2025

Uh oh!

rppt left a comment •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

This comment was marked as off-topic.

Uh oh!

rppt commented Sep 4, 2025

Uh oh!

github-actions bot commented Oct 5, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Aarch64/gcs #2725

Are you sure you want to change the base?

Aarch64/gcs #2725

Uh oh!

Conversation

svilenkov commented Aug 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

rppt left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

rppt Sep 4, 2025

Choose a reason for hiding this comment

Uh oh!

rppt Sep 4, 2025

Choose a reason for hiding this comment

Uh oh!

svilenkov Sep 4, 2025

Choose a reason for hiding this comment

Uh oh!

rppt left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

This comment was marked as off-topic.

Uh oh!

rppt commented Sep 4, 2025

Uh oh!

github-actions bot commented Oct 5, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

svilenkov commented Aug 31, 2025 •

edited

Loading

rppt left a comment •

edited

Loading