Arm64: [PAC-RET] Add Pointer Authentication support for Arm64 by SwapnilGaikwad · Pull Request #125436 · dotnet/runtime

SwapnilGaikwad · 2026-03-11T12:31:22Z

This PR adds support for Pointer Authentication (PAC) on Arm64. Pointer Authentication (PAC) is an Armv8.3+ security feature designed to mitigate Return-Oriented Programming (ROP) attacks by cryptographically signing return addresses. While using PAC, we store a signed return address, instead of the plain address, on the stack and later authenticate it before returning from a function. It ensures control flow returns to the intended caller.

More details on PAC and its role in software security can be found (here).

The current implementation of PAC is turned off by default, but can be turned on by setting DOTNET_JitPacEnabled=1.
PAC protects link register (LR) by signing it in the prolog (using paciasp) before it is split, using the current SP as the modifier. It then authenticates the LR in the epilog (using autiasp) before the function returns. If the signature is invalid, the execution fails with SIGILL.
When the runtime needs to read or overwrite a return address during hijacking for GC, it now strips the PAC (using xpaclri) and re-signs the new target address before storing it back.

ToDos

Disable PAC by default before merge.
Restore the original frame layout that used pre-indexed variant of stp to store FP/LR.
Authenticate the return address instead of stripping in return address hijacking and unwinding.
Identify increased binary size for System.*.dll
Determine performance regressions using benchmarks such as OrchirdCMS.

Contributes to #109457

This PR adds support for Pointer Authentication (PAC) on Arm64. Pointer Authentication (PAC) is an Armv8.3+ security feature designed to mitigate Return-Oriented Programming (ROP) attacks by cryptographically signing return addresses. While using PAC, we store a signed return address, instead of the plain address, on the stack and later authenticate it before returning from a function. It ensures control flow returns to the intended caller. More details on PAC and its role in software security can be found ([here](https://llsoftsec.github.io/llsoftsecbook/#sec:pointer-authentication)). - The current implementation of PAC is turned off by default, but can be turned on by setting DOTNET_JitPacEnabled=1. - PAC protects link register (LR) by signing it in the prolog (using `paciasp`) before it is split, using the current SP as the modifier. It then authenticates the LR in the epilog (using `autiasp`) before the function returns. If the signature is invalid, the execution fails with `SIGILL`. - - When the runtime needs to read or overwrite a return address during hijacking for GC, it now strips the PAC (using `xpaclri`) and re-signs the new target address before storing it back. - To simply tracking the SP in return address hijacking, we avoid using the pre-indexed variant of storing FP/LR on stack (e.g., `stp fp,lr,[sp,-#framesz]! `) to simply tracking the SP in return address hijacking. We obtain the value of SP at the time of signing the LR from the location of the current FP. We can't use this approach when the pre-indexed `stp` is used because we don't know the`#framesz`. - The updated prolog/epilog sequences generated by the JIT now look like: // Prolog sub sp, sp, #framesz paciasp ; sign LR with A-key + SP stp fp, lr, [sp] // Epilog ldp fp, lr, [sp] autiasp ; authenticate LR add sp, sp, #framesz ret ToDos: [] Restore the original frame layout that used pre-indexed variant of `stp` to store FP/LR. [] Authenticate the return address instead of stripping in return address hijacking and unwinding. [] Identify increased binary size for System.*.dll [] Determine performance regressions using benchmarks such as OrchirdCMS.

dotnet-policy-service · 2026-03-11T14:51:42Z

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

SwapnilGaikwad · 2026-05-05T21:38:21Z

If you would like to start getting the changes in fast, it may be best to peel it into separate PRs per area. The JIT changes would be the first one. We can certainly keep iterating on one large PR if you prefer. It will likely take longer to get it in since different parts need to reviewed and signed off by different people.

JIT changes (src\coreclr\jit...)

Regular CoreCLR changes (src\coreclr...)

NativeAOT changes (src\coreclr\nativeaot...)

Sure, happy to peel this PR into smaller ones. I'll start creating them sequentially and tag them here.

Created #127838 with JIT changes. Marked PAC to default disabled value (JitPacEnabled=0) as tests would need other changes to pass correctly.

jkotas · 2026-05-06T05:07:24Z


+#if defined(TARGET_ARM64)
+    // We strip the PC here as it's not being used to branch execution to.
+    m_ControlPC = PacStripPtr(m_ControlPC);


I would expect the stripping to be always done when we are converting return address to a PC.

It is hard to see that stripping in the middle like here is done correctly. We should avoid fields that are mix of stripped and signed values depending on the code location.

To avoid a location dependent value, I updated the patch to always save plain return address in m_RegDisplay instead of stripping it on-demand at use sites. Not sure if this is an ideal approach but it avoids confusion.
Happy to incorporate if you suggest any other approach.

jkotas · 2026-05-06T05:23:36Z

+    *pSpForPacSign = 0;
+
+    // In prolog or epilog while the current frame is still being established or torn down
+    // retrieving correct SP is complex. We conservatively bail-out in this case.


This is a potential perf regression (longer GC pauses). It will need either fixing or targeted testing to prove that it is ok.

jkotas · 2026-05-07T03:57:23Z


+    if (HasPacInUnwindInfo(pUnwindDataBlob, unwindDataBlobSize))
+    {
+        *pSpForArm64PacSign = pRegisterSet->GetSP();


The regular CoreCLR JIT version parses the unwind info to compute the signing SP. Do we need to do the same here? Or is there something why it is not needed here?

You're right. I missed this, it relied on older version of the patch where I had updated prolog to do paciasp right before saving FP/LR. The HasPacInUnwindInfo() should look similar to GetPacSignInfo(). I'll update this. I'm surprised how it wasn't flagged up on Windows CI workflows.

…ckinfo This covers a usecase where SP adjustments are done before PAC instruction. e.g., ``` sub sp, sp, #0x30 paciasp stp fp, lr, [sp, #0x50]! ```

jakobbotsch · 2026-05-07T18:25:54Z

+#ifdef TARGET_WINDOWS
+        GetEmitter()->emitIns(INS_autib1716);
+#else


This should use TargetOS::IsWindows.

(I assume you meant to push this to #127838)

This should use TargetOS::IsWindows.

Cool, I'll update it.

(I assume you meant to push this to #127838)

This is a full PR but we are going to peel parts of it into separate PRs to simply reviews from area owners and faster merging. However, the partial versions won't be able to pass tests, e.g., PAC with return address hijacking. Thus, I'm maintaining this PR with all the changes and when they pass CI here, I'm moving them to their respective part.

I put a note on #127838 that the full changes are here and can be looked at for test output. However, I understand that it may cause extra work for the reviewers. To avoid this, I will try to update both the PRs simultaneously. Not sure if that would help. Feel free to suggest anything that could be improved 🙂

github-actions Bot added the area-NativeAOT-coreclr label Mar 11, 2026

dotnet-policy-service Bot added the community-contribution Indicates that the PR has been added by a community member label Mar 11, 2026

jkotas added area-CodeGen-coreclr CLR JIT compiler in src/coreclr/src/jit and related components such as SuperPMI arch-arm64 and removed area-NativeAOT-coreclr labels Mar 11, 2026

SwapnilGaikwad added 2 commits March 11, 2026 17:05

Merge main

8551ad0

Fix build failures

584a268

SwapnilGaikwad added 7 commits March 12, 2026 10:11

Merge main

8216472

Fix build errors

74a5293

Limit thread context changes to Arm64

c9c43c9

Merge main

5d6058c

Fix build issues on x86

ce5d79b

Merge main

8db6f6d

Merge branch 'main' into github-add-pac

872443e

build-analysis Bot mentioned this pull request Mar 12, 2026

System.IO.Tests.Directory_Create_Tests.FileSystemWatcher_Directory_Create_InNestedDirectory fails with "Created event did not occur as expected" #103630

Closed

SwapnilGaikwad added 3 commits March 18, 2026 11:42

Merge main

3591b2a

Limit framelayout changes to JIT

867e149

Fix formatting

f00f789

This was referenced Mar 18, 2026

Cannot find 'arm64-v8a' device dotnet/dnceng#2284

Closed

System.Text.Json.Tests fails with GC hole assert #117186

Open

Test failure: Assertion failed. state is RuntimeAsyncTask<T> #125015

Closed

Merge main

9616e73

SwapnilGaikwad mentioned this pull request May 5, 2026

Arm64: [PAC-RET] Add Pointer Authentication support for Arm64 (Part 1/3: JIT) #127838

Open

dhartglassMSFT reviewed May 5, 2026

View reviewed changes

Comment thread src/coreclr/jit/unwindarm64.cpp

jkotas reviewed May 6, 2026

View reviewed changes

Comment thread src/coreclr/nativeaot/Runtime/StackFrameIterator.cpp Outdated

jkotas reviewed May 6, 2026

View reviewed changes

Comment thread src/coreclr/nativeaot/Runtime/windows/CoffNativeCodeManager.cpp Outdated

jkotas reviewed May 6, 2026

View reviewed changes

Comment thread src/coreclr/vm/threadsuspend.cpp Outdated

jkotas reviewed May 6, 2026

View reviewed changes

SwapnilGaikwad added 2 commits May 6, 2026 15:30

Merge main

80ed0b4

Refactor GetPacSignInfo

e17d8e9

This was referenced May 6, 2026

CI failure on iOS: test process was killed because of OS_REASON_CODESIGNING #127867

Closed

[ios-arm64 Release AllSubsets_CoreCLR_Smoke] The app 'net.dot.System.Runtime.Tests' terminated with signal 9 #127872

Open

jkotas reviewed May 7, 2026

View reviewed changes

SwapnilGaikwad added 3 commits May 7, 2026 11:20

Don't assume sp offset to be zero for PAC signing

22dccb7

Canonicalize return addresses in StackFrameIterator for NativeAOT

21bc75a

Merge main

cd162df

jakobbotsch reviewed May 7, 2026

View reviewed changes

Comment thread src/coreclr/vm/excep.cpp

SwapnilGaikwad added 5 commits May 7, 2026 15:22

Track SP offset for PAC instruction separately while calculating hija…

493eff7

…ckinfo This covers a usecase where SP adjustments are done before PAC instruction. e.g., ``` sub sp, sp, #0x30 paciasp stp fp, lr, [sp, #0x50]! ```

Merge main

84741a8

Use B key on Windows and A key otherwise for PAC

bcbc1c1

Merge main

dfac51c

Fix formatting

24d44ea

jakobbotsch reviewed May 7, 2026

View reviewed changes

build-analysis Bot mentioned this pull request May 8, 2026

[8.0] GC Large array test failure #114222

Open

SwapnilGaikwad mentioned this pull request May 8, 2026

[Arm64][PAC-RET] Add encoding for Pointer Authentication instructions #127949

Open

SwapnilGaikwad added 5 commits May 8, 2026 10:57

Merge main

12ca90d

Address review comments

7df0c1f

Merge main

0b6b5a2

Track PAC CFA offset while unwinding for NativeAOT

e9be308

Match finding SP for PAC signing on Windows NativeAOT with the JIT

ddccab0

Conversation

SwapnilGaikwad commented Mar 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ToDos

Uh oh!

dotnet-policy-service Bot commented Mar 11, 2026

Uh oh!

SwapnilGaikwad commented May 5, 2026

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

SwapnilGaikwad commented Mar 11, 2026 •

edited

Loading