Arm Guarded Control Stack "GCS" Patches Debut For The Linux Kernel

A set of 35 patches were posted on Sunday for introducing ARM64 Guarded Control Stack (GCS) support to the Linux kernel. This is akin to x86 Shadow Stack support for hardware-protected stacks of return addresses to help fend off ROP attacks.

Arm's Guarded Control Stack functionality is designed to help prevent return-oriented programming (ROP) attacks similar to the Intel Shadow Stack work, and in fact this Linux kernel enablement depends upon that x86 Shadow Stack code in some areas. GCS can additionally help in gathering call stacks of an application such as for profiling purposes.

Mark Brown explains in the patch cover letter:

"When GCS is active a secondary stack called the Guarded Control Stack is maintained, protected with a memory attribute which means that it can only be written with specific GCS operations. When a BL is executed the value stored in LR is also pushed onto the GCS, and when a RET is executed the top of the GCS is popped and compared to LR with a fault being raised if the values do not match. GCS operations may only be performed on GCS pages, a data abort is generated if they are not.

This series implements support for use of GCS by EL0, along with support for use of GCS within KVM guests. It does not enable use of GCS by either EL1 or EL2. Executables are started without GCS and must use a prctl() to enable it, it is expected that this will be done very early in application execution by the dynamic linker or other startup code."

As for that prctl-based opt-in support by applications, the patch series adds an architecture-agnostic prctl for toggling shadow stack support with PR_GET_SHADOW_STACK_STATUS and PR_SET_SHADOW_STACK_STATUS. Besides Arm GCS and x86 Shadow Stack support, RISC-V is also working on similar functionality too.

More details on Arm Guarded Control Stack support via this documentation patch. Those interested in ARM64 GCS support can see this patch series now under review.