Arm64: [PAC-RET] Add Pointer Authentication support for Arm64#125436
Arm64: [PAC-RET] Add Pointer Authentication support for Arm64#125436SwapnilGaikwad wants to merge 116 commits into
Conversation
This PR adds support for Pointer Authentication (PAC) on Arm64. Pointer Authentication (PAC) is an Armv8.3+ security feature designed to mitigate Return-Oriented Programming (ROP) attacks by cryptographically signing return addresses. While using PAC, we store a signed return address, instead of the plain address, on the stack and later authenticate it before returning from a function. It ensures control flow returns to the intended caller. More details on PAC and its role in software security can be found ([here](https://llsoftsec.github.io/llsoftsecbook/#sec:pointer-authentication)). - The current implementation of PAC is turned off by default, but can be turned on by setting DOTNET_JitPacEnabled=1. - PAC protects link register (LR) by signing it in the prolog (using `paciasp`) before it is split, using the current SP as the modifier. It then authenticates the LR in the epilog (using `autiasp`) before the function returns. If the signature is invalid, the execution fails with `SIGILL`. - - When the runtime needs to read or overwrite a return address during hijacking for GC, it now strips the PAC (using `xpaclri`) and re-signs the new target address before storing it back. - To simply tracking the SP in return address hijacking, we avoid using the pre-indexed variant of storing FP/LR on stack (e.g., `stp fp,lr,[sp,-#framesz]! `) to simply tracking the SP in return address hijacking. We obtain the value of SP at the time of signing the LR from the location of the current FP. We can't use this approach when the pre-indexed `stp` is used because we don't know the`#framesz`. - The updated prolog/epilog sequences generated by the JIT now look like: // Prolog sub sp, sp, #framesz paciasp ; sign LR with A-key + SP stp fp, lr, [sp] // Epilog ldp fp, lr, [sp] autiasp ; authenticate LR add sp, sp, #framesz ret ToDos: [] Restore the original frame layout that used pre-indexed variant of `stp` to store FP/LR. [] Authenticate the return address instead of stripping in return address hijacking and unwinding. [] Identify increased binary size for System.*.dll [] Determine performance regressions using benchmarks such as OrchirdCMS.
dotnet-policy-service
Bot
added
the
community-contribution
jkotas
added
area-CodeGen-coreclr
|
Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch |
This reverts commit 88b9eb2.
This PR covers subset of PAL-RET changes from #125436 related to the coreclr and VM. More details on PAC and its role in software security can be found ([here](https://llsoftsec.github.io/llsoftsecbook/#sec:pointer-authentication)). The feature is disabled by default so CI status of this PR won't reflect the impact of changes.
| typedef DPTR(TADDR) PTR_TADDR; | ||
|
|
||
| #ifndef NATIVEAOT | ||
| #if defined(NATIVEAOT) && defined(TARGET_ARM64) |
There was a problem hiding this comment.
How many places are these types used at? What would it take to fix the sources to use PTR_uint32_t insrtead PTR_DWORD, etc. defined above to avoid dealing with the Windows types mess?
There was a problem hiding this comment.
These typedefs were used from unwinder.cpp and clrnt.h. I’ve updated those paths to use the fixed-width PTR_uint32_t / PTR_uint64_t style aliases NativeAOT.
Apologies for spamming the CI 🙈 . I underestimated how many platform-specific type differences this would expose. Without access to the failing configurations, had to test it in the CI.
There was a problem hiding this comment.
Seems the failures for CDAC on x64 are because it builds dotnet/diagnostics repo that contains older crosscomp.h where the defs for CONTEXT_UNWOUND_TO_CALL are not guarded for ifndefs.
There was a problem hiding this comment.
I'll create a PR to sync changes from #127161 to the diagnostics repo. Unfortunately it will be next week as we need to sort out setting up the diagnostics repo for an internal review before creating the PR.
I'll move the new changes to the NativeAOT PR so the review can begin. The Pri0 failures for ElidedBoundsChecks test seems unrelated to the PR.
Probably, only failure to investigate are on runtime-diagnostics (CdacDumpTests windows-arm64 release) pipeline.
… for macros like CONTEXT_UNWOUND_TO_CALL
This PR adds support for Pointer Authentication (PAC) on Arm64. Pointer Authentication (PAC) is an Armv8.3+ security feature designed to mitigate Return-Oriented Programming (ROP) attacks by cryptographically signing return addresses. While using PAC, we store a signed return address, instead of the plain address, on the stack and later authenticate it before returning from a function. It ensures control flow returns to the intended caller.
More details on PAC and its role in software security can be found (here).
paciasp) before it is split, using the current SP as the modifier. It then authenticates the LR in the epilog (usingautiasp) before the function returns. If the signature is invalid, the execution fails withSIGILL.xpaclri) and re-signs the new target address before storing it back.ToDos
stpto store FP/LR.Contributes to #109457