Arm64: [PAC-RET] Add Pointer Authentication support for Arm64#125436
Arm64: [PAC-RET] Add Pointer Authentication support for Arm64#125436SwapnilGaikwad wants to merge 78 commits into
Conversation
This PR adds support for Pointer Authentication (PAC) on Arm64. Pointer Authentication (PAC) is an Armv8.3+ security feature designed to mitigate Return-Oriented Programming (ROP) attacks by cryptographically signing return addresses. While using PAC, we store a signed return address, instead of the plain address, on the stack and later authenticate it before returning from a function. It ensures control flow returns to the intended caller. More details on PAC and its role in software security can be found ([here](https://llsoftsec.github.io/llsoftsecbook/#sec:pointer-authentication)). - The current implementation of PAC is turned off by default, but can be turned on by setting DOTNET_JitPacEnabled=1. - PAC protects link register (LR) by signing it in the prolog (using `paciasp`) before it is split, using the current SP as the modifier. It then authenticates the LR in the epilog (using `autiasp`) before the function returns. If the signature is invalid, the execution fails with `SIGILL`. - - When the runtime needs to read or overwrite a return address during hijacking for GC, it now strips the PAC (using `xpaclri`) and re-signs the new target address before storing it back. - To simply tracking the SP in return address hijacking, we avoid using the pre-indexed variant of storing FP/LR on stack (e.g., `stp fp,lr,[sp,-#framesz]! `) to simply tracking the SP in return address hijacking. We obtain the value of SP at the time of signing the LR from the location of the current FP. We can't use this approach when the pre-indexed `stp` is used because we don't know the`#framesz`. - The updated prolog/epilog sequences generated by the JIT now look like: // Prolog sub sp, sp, #framesz paciasp ; sign LR with A-key + SP stp fp, lr, [sp] // Epilog ldp fp, lr, [sp] autiasp ; authenticate LR add sp, sp, #framesz ret ToDos: [] Restore the original frame layout that used pre-indexed variant of `stp` to store FP/LR. [] Authenticate the return address instead of stripping in return address hijacking and unwinding. [] Identify increased binary size for System.*.dll [] Determine performance regressions using benchmarks such as OrchirdCMS.
|
Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch |
| #ifdef TARGET_WINDOWS | ||
| GetEmitter()->emitIns(INS_autib1716); | ||
| #else |
There was a problem hiding this comment.
This should use TargetOS::IsWindows.
(I assume you meant to push this to #127838)
There was a problem hiding this comment.
This should use
TargetOS::IsWindows.
Cool, I'll update it.
(I assume you meant to push this to #127838)
This is a full PR but we are going to peel parts of it into separate PRs to simply reviews from area owners and faster merging. However, the partial versions won't be able to pass tests, e.g., PAC with return address hijacking. Thus, I'm maintaining this PR with all the changes and when they pass CI here, I'm moving them to their respective part.
There was a problem hiding this comment.
I put a note on #127838 that the full changes are here and can be looked at for test output. However, I understand that it may cause extra work for the reviewers. To avoid this, I will try to update both the PRs simultaneously. Not sure if that would help. Feel free to suggest anything that could be improved 🙂
|
Added a NO-MERGE label to indicate that we will be peeling subsets of the PR and merging them separately. I'll maintain this PR to reflect the CI status of the subsets where the PAC is disabled using |
As suggested in [comment](dotnet#125436 (comment)), this PR covers subset of changes from dotnet#125436 related to the coreclr and VM. More details on PAC and its role in software security can be found ([here](https://llsoftsec.github.io/llsoftsecbook/#sec:pointer-authentication)).
|
The linux-arm nativeAOT hardware-intrinsics failure looks real - it seems to consistently fail in that spot, and I didn't see any other PRs with that failure |
This PR adds support for Pointer Authentication (PAC) on Arm64. Pointer Authentication (PAC) is an Armv8.3+ security feature designed to mitigate Return-Oriented Programming (ROP) attacks by cryptographically signing return addresses. While using PAC, we store a signed return address, instead of the plain address, on the stack and later authenticate it before returning from a function. It ensures control flow returns to the intended caller.
More details on PAC and its role in software security can be found (here).
paciasp) before it is split, using the current SP as the modifier. It then authenticates the LR in the epilog (usingautiasp) before the function returns. If the signature is invalid, the execution fails withSIGILL.xpaclri) and re-signs the new target address before storing it back.ToDos
stpto store FP/LR.Contributes to #109457