Skip to content

Arm64: [PAC-RET] Add Pointer Authentication support for Arm64#125436

Open
SwapnilGaikwad wants to merge 78 commits into
dotnet:mainfrom
SwapnilGaikwad:github-add-pac
Open

Arm64: [PAC-RET] Add Pointer Authentication support for Arm64#125436
SwapnilGaikwad wants to merge 78 commits into
dotnet:mainfrom
SwapnilGaikwad:github-add-pac

Conversation

@SwapnilGaikwad
Copy link
Copy Markdown
Contributor

@SwapnilGaikwad SwapnilGaikwad commented Mar 11, 2026

This PR adds support for Pointer Authentication (PAC) on Arm64. Pointer Authentication (PAC) is an Armv8.3+ security feature designed to mitigate Return-Oriented Programming (ROP) attacks by cryptographically signing return addresses. While using PAC, we store a signed return address, instead of the plain address, on the stack and later authenticate it before returning from a function. It ensures control flow returns to the intended caller.

More details on PAC and its role in software security can be found (here).

  • The current implementation of PAC is turned off by default, but can be turned on by setting DOTNET_JitPacEnabled=1.
  • PAC protects link register (LR) by signing it in the prolog (using paciasp) before it is split, using the current SP as the modifier. It then authenticates the LR in the epilog (using autiasp) before the function returns. If the signature is invalid, the execution fails with SIGILL.
  • When the runtime needs to read or overwrite a return address during hijacking for GC, it now strips the PAC (using xpaclri) and re-signs the new target address before storing it back.

ToDos

  • Disable PAC by default before merge.
  • Restore the original frame layout that used pre-indexed variant of stp to store FP/LR.
  • Authenticate the return address instead of stripping in return address hijacking and unwinding.
  • Identify increased binary size for System.*.dll
  • Determine performance regressions using benchmarks such as OrchirdCMS.

Contributes to #109457

This PR adds support for Pointer Authentication (PAC) on Arm64. Pointer Authentication (PAC) is an Armv8.3+ security feature designed to mitigate Return-Oriented Programming (ROP) attacks by cryptographically signing return addresses. While using PAC, we store a signed return address, instead of the plain address, on the stack and later authenticate it before returning from a function. It ensures control flow returns to the intended caller.

More details on PAC and its role in software security can be found ([here](https://llsoftsec.github.io/llsoftsecbook/#sec:pointer-authentication)).

- The current implementation of PAC is turned off by default, but can be turned on by setting DOTNET_JitPacEnabled=1.
- PAC protects link register (LR) by signing it in the prolog (using `paciasp`) before it is split, using the current SP as the modifier. It then authenticates the LR in the epilog (using `autiasp`) before the function returns. If the signature is invalid, the execution fails with `SIGILL`.
- - When the runtime needs to read or overwrite a return address during hijacking for GC, it now strips the PAC (using `xpaclri`) and re-signs the new target address before storing it back.
- To simply tracking the SP in return address hijacking, we avoid using the pre-indexed variant of storing FP/LR on stack (e.g., `stp fp,lr,[sp,-#framesz]! `) to simply tracking the SP in return address hijacking. We obtain the value of SP at the time of signing the LR from the location of the current FP.  We can't use this approach when the pre-indexed `stp` is used because we don't know the`#framesz`.
- The updated prolog/epilog sequences generated by the JIT now look like:

 // Prolog
 sub     sp, sp, #framesz
 paciasp                 ; sign LR with A-key + SP
 stp     fp, lr, [sp]

 // Epilog
 ldp     fp, lr, [sp]
 autiasp                 ; authenticate LR
 add     sp, sp, #framesz
 ret

ToDos:
[] Restore the original frame layout that used pre-indexed variant of `stp` to store FP/LR.
[] Authenticate the return address instead of stripping in return address hijacking and unwinding.
[] Identify increased binary size for System.*.dll
[] Determine performance regressions using benchmarks such as OrchirdCMS.
@dotnet-policy-service dotnet-policy-service Bot added the community-contribution Indicates that the PR has been added by a community member label Mar 11, 2026
@jkotas jkotas added area-CodeGen-coreclr CLR JIT compiler in src/coreclr/src/jit and related components such as SuperPMI arch-arm64 and removed area-NativeAOT-coreclr labels Mar 11, 2026
@dotnet-policy-service
Copy link
Copy Markdown
Contributor

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

Comment thread src/coreclr/jit/codegenarm64.cpp Outdated
Comment on lines +5703 to +5705
#ifdef TARGET_WINDOWS
GetEmitter()->emitIns(INS_autib1716);
#else
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should use TargetOS::IsWindows.

(I assume you meant to push this to #127838)

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should use TargetOS::IsWindows.

Cool, I'll update it.

(I assume you meant to push this to #127838)

This is a full PR but we are going to peel parts of it into separate PRs to simply reviews from area owners and faster merging. However, the partial versions won't be able to pass tests, e.g., PAC with return address hijacking. Thus, I'm maintaining this PR with all the changes and when they pass CI here, I'm moving them to their respective part.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I put a note on #127838 that the full changes are here and can be looked at for test output. However, I understand that it may cause extra work for the reviewers. To avoid this, I will try to update both the PRs simultaneously. Not sure if that would help. Feel free to suggest anything that could be improved 🙂

dhartglassMSFT pushed a commit that referenced this pull request May 13, 2026
This PR adds instruction encodings for Pointer Authentication
instructions, especially the B key variants.
Part of this is useful for #125436 and #127838.

Add encoding for:

1.  AUTIB
2.  AUTIB1716
3.  AUTIBSP
4.  AUTIBZ
5.  AUTIZB
6.  PACIB
7.  PACIB1716
8.  PACIBSP
9.  PACIBZ
10. PACIZB
11. RETAA
12. RETAB
@SwapnilGaikwad SwapnilGaikwad added the NO-MERGE The PR is not ready for merge yet (see discussion for detailed reasons) label May 13, 2026
@SwapnilGaikwad
Copy link
Copy Markdown
Contributor Author

Added a NO-MERGE label to indicate that we will be peeling subsets of the PR and merging them separately. I'll maintain this PR to reflect the CI status of the subsets where the PAC is disabled using DOTNET_JitPacEnabled=0.

SwapnilGaikwad added a commit to SwapnilGaikwad/runtime that referenced this pull request May 13, 2026
As suggested in [comment](dotnet#125436 (comment)), this PR covers subset of changes from dotnet#125436 related to the coreclr and VM.

More details on PAC and its role in software security can be found ([here](https://llsoftsec.github.io/llsoftsecbook/#sec:pointer-authentication)).
@dhartglassMSFT
Copy link
Copy Markdown
Contributor

The linux-arm nativeAOT hardware-intrinsics failure looks real - it seems to consistently fail in that spot, and I didn't see any other PRs with that failure

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

arch-arm64 area-CodeGen-coreclr CLR JIT compiler in src/coreclr/src/jit and related components such as SuperPMI community-contribution Indicates that the PR has been added by a community member NO-MERGE The PR is not ready for merge yet (see discussion for detailed reasons)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants