Arm64: [PAC-RET] Add Pointer Authentication support for Arm64

src/coreclr/debug/ee/controller.cpp

@@ -19,6 +19,10 @@
 #include "../../vm/methoditer.h"
 #include "../../vm/tailcallhelp.h"
 
+#if defined(TARGET_ARM64)
+extern "C" void* PacStripPtr(void* ptr);
+#endif // TARGET_ARM64
+
 const char *GetTType( TraceType tt);
 
 #define IsSingleStep(exception) ((exception) == EXCEPTION_SINGLE_STEP)
@@ -6222,6 +6226,12 @@ static bool IsTailCall(const BYTE * ip, ControllerStackInfo* info, TailCallFunct
     TailCallTls* tls = GetThread()->GetTailCallTls();
     LPVOID tailCallAwareRetAddr = tls->GetFrame()->TailCallAwareReturnAddress;
 
+#if defined(TARGET_ARM64)
+    //TODO-PAC: Authenticate instead of stripping the return addresses.
+    retAddr = PacStripPtr(retAddr);
+    tailCallAwareRetAddr = PacStripPtr(tailCallAwareRetAddr);
+#endif // TARGET_ARM64
+
     LOG((LF_CORDB,LL_INFO1000, "ITCTR: ret addr is %p, tailcall aware ret addr is %p\n",
         retAddr, tailCallAwareRetAddr));
 

src/coreclr/inc/cfi.h

@@ -9,7 +9,9 @@ enum CFI_OPCODE
 {
    CFI_ADJUST_CFA_OFFSET,    // Offset is adjusted relative to the current one.
    CFI_DEF_CFA_REGISTER,     // New register is used to compute CFA
-   CFI_REL_OFFSET            // Register is saved at offset from the current CFA
+   CFI_REL_OFFSET,           // Register is saved at offset from the current CFA
+   CFI_DEF_CFA,              // Take address from register and add offset to it
+   CFI_NEGATE_RA_STATE,      // Sign the return address in lr with paciaz
 };
 
 struct CFI_CODE

src/coreclr/inc/clrconfigvalues.h

@@ -709,6 +709,7 @@ RETAIL_CONFIG_DWORD_INFO(EXTERNAL_EnableArm64Rcpc,              W("EnableArm64Rc
 RETAIL_CONFIG_DWORD_INFO(EXTERNAL_EnableArm64Rcpc2,             W("EnableArm64Rcpc2"),          1, "Allows Arm64 Rcpc2+ hardware intrinsics to be disabled")
 RETAIL_CONFIG_DWORD_INFO(EXTERNAL_EnableArm64Sve,               W("EnableArm64Sve"),            1, "Allows Arm64 SVE hardware intrinsics to be disabled")
 RETAIL_CONFIG_DWORD_INFO(EXTERNAL_EnableArm64Sve2,              W("EnableArm64Sve2"),           1, "Allows Arm64 SVE2 hardware intrinsics to be disabled")
+RETAIL_CONFIG_DWORD_INFO(EXTERNAL_JitPacEnabled,                W("JitPacEnabled"),             1, "Allows Arm64 Pointer Authentication (PAC) to be disabled")
 #elif defined(TARGET_RISCV64)
 RETAIL_CONFIG_DWORD_INFO(EXTERNAL_EnableRiscV64Zba,             W("EnableRiscV64Zba"),          1, "Allows RiscV64 Zba hardware intrinsics to be disabled")
 RETAIL_CONFIG_DWORD_INFO(EXTERNAL_EnableRiscV64Zbb,             W("EnableRiscV64Zbb"),          1, "Allows RiscV64 Zbb hardware intrinsics to be disabled")

src/coreclr/inc/gcinfodecoder.h

@@ -76,6 +76,10 @@ typedef void * OBJECTREF;
 
 #ifndef __cgencpu_h__
 
+#if defined(TARGET_ARM64)
+extern "C" void* PacStripPtr(void* ptr);
+#endif // TARGET_ARM64
+
 inline void SetIP(T_CONTEXT* context, PCODE rip)
 {
     _ASSERTE(!"don't call this");
@@ -105,7 +109,8 @@ inline PCODE GetIP(T_CONTEXT* context)
 #elif defined(TARGET_ARM)
     return (PCODE)context->Pc;
 #elif defined(TARGET_ARM64)
-    return (PCODE)context->Pc;
+    //TODO-PAC: Authenticate instead of stripping the return address.
+    return (PCODE) PacStripPtr((void *)context->Pc);
 #elif defined(TARGET_LOONGARCH64)
     return (PCODE)context->Pc;
 #elif defined(TARGET_RISCV64)

src/coreclr/jit/codegenarm64.cpp

@@ -213,25 +213,42 @@ void CodeGen::genPopCalleeSavedRegistersAndFreeLclFrame(bool jmpEpilog)
     {
         case 1:
         {
-            // Generate:
-            //      ldp fp,lr,[sp],#framesz
-
-            GetEmitter()->emitIns_R_R_R_I(INS_ldp, EA_PTRSIZE, REG_FP, REG_LR, REG_SPBASE, totalFrameSize,
-                                          INS_OPTS_POST_INDEX);
-            m_compiler->unwindSaveRegPairPreindexed(REG_FP, REG_LR, -totalFrameSize);
+            if (JitConfig.JitPacEnabled() != 0 && !m_compiler->IsAot())
+            {
+                // Generate:
+                //      ldp fp,lr,[sp]
+                //      autiasp
+                //      add sp, sp, #framesz
+                GetEmitter()->emitIns_R_R_R_I(INS_ldp, EA_PTRSIZE, REG_FP, REG_LR, REG_SPBASE, 0);
+                m_compiler->unwindSaveRegPair(REG_FP, REG_LR, 0);
+                GetEmitter()->emitPacInEpilog();
+                genStackPointerAdjustment(totalFrameSize, REG_SCRATCH, nullptr, /* reportUnwindData */ true);
+            }
+            else
+            {
+                // Generate:
+                //      ldp fp,lr,[sp],#framesz
+                GetEmitter()->emitIns_R_R_R_I(INS_ldp, EA_PTRSIZE, REG_FP, REG_LR, REG_SPBASE, totalFrameSize,
+                                              INS_OPTS_POST_INDEX);
+                m_compiler->unwindSaveRegPairPreindexed(REG_FP, REG_LR, -totalFrameSize);
+            }
             break;
         }
 
         case 2:
         {
             // Generate:
             //      ldp fp,lr,[sp,#outsz]
+            //      autiasp             ; if PAC is enabled
             //      add sp,sp,#framesz
 
             GetEmitter()->emitIns_R_R_R_I(INS_ldp, EA_PTRSIZE, REG_FP, REG_LR, REG_SPBASE,
                                           m_compiler->lvaOutgoingArgSpaceSize);
             m_compiler->unwindSaveRegPair(REG_FP, REG_LR, m_compiler->lvaOutgoingArgSpaceSize);
-
+            if (!m_compiler->IsAot())
+            {
+                GetEmitter()->emitPacInEpilog();
+            }
             GetEmitter()->emitIns_R_R_I(INS_add, EA_PTRSIZE, REG_SPBASE, REG_SPBASE, totalFrameSize);
             m_compiler->unwindAllocStack(totalFrameSize);
             break;
@@ -275,6 +292,11 @@ void CodeGen::genPopCalleeSavedRegistersAndFreeLclFrame(bool jmpEpilog)
         GetEmitter()->emitIns_R_R_I(INS_add, EA_PTRSIZE, REG_SPBASE, REG_SPBASE, spAdjust);
         m_compiler->unwindAllocStack(spAdjust);
     }
+
+    if (m_compiler->IsAot())
+    {
+        GetEmitter()->emitPacInEpilog();
+    }
 }
 
 //------------------------------------------------------------------------
@@ -485,12 +507,28 @@ void CodeGen::genPrologSaveRegPair(regNumber reg1,
         assert(!useSaveNextPair);
         if ((spOffset == 0) && (spDelta >= -512))
         {
-            // We can use pre-indexed addressing.
-            // stp REG, REG + 1, [SP, #spDelta]!
-            // 64-bit STP offset range: -512 to 504, multiple of 8.
-            GetEmitter()->emitIns_R_R_R_I(INS_stp, EA_PTRSIZE, reg1, reg2, REG_SPBASE, spDelta, INS_OPTS_PRE_INDEX);
-            m_compiler->unwindSaveRegPairPreindexed(reg1, reg2, spDelta);
-
+            // We can use pre-indexed addressing when pointer authentication PAC is disabled.
+            assert(reg1 != REG_LR);
+            if ((JitConfig.JitPacEnabled() != 0) && (reg2 == REG_LR) && !m_compiler->IsAot())
+            {
+                // Generate:
+                // sub SP, SP, #spDelta
+                // paciasp
+                // stp REG, REG + 1, [SP]
+                assert(reg1 == REG_FP);
+                genStackPointerAdjustment(spDelta, REG_NA, nullptr, /* reportUnwindData */ true);
+                GetEmitter()->emitPacInProlog();
+                GetEmitter()->emitIns_R_R_R_I(INS_stp, EA_PTRSIZE, REG_FP, REG_LR, REG_SPBASE, 0);
+                m_compiler->unwindSaveRegPair(REG_FP, REG_LR, 0);
+            }
+            else
+            {
+                // Generate:
+                // stp REG, REG + 1, [SP, #spDelta]!
+                // 64-bit STP offset range: -512 to 504, multiple of 8.
+                GetEmitter()->emitIns_R_R_R_I(INS_stp, EA_PTRSIZE, reg1, reg2, REG_SPBASE, spDelta, INS_OPTS_PRE_INDEX);
+                m_compiler->unwindSaveRegPairPreindexed(reg1, reg2, spDelta);
+            }
             needToSaveRegs = false;
         }
         else // (spOffset != 0) || (spDelta < -512)
@@ -509,6 +547,13 @@ void CodeGen::genPrologSaveRegPair(regNumber reg1,
         // 64-bit STP offset range: -512 to 504, multiple of 8.
         assert(spOffset <= 504);
         assert((spOffset % 8) == 0);
+        assert(reg1 != REG_LR);
+
+        if ((JitConfig.JitPacEnabled() != 0) && (reg2 == REG_LR) && !m_compiler->IsAot())
+        {
+            assert(reg1 == REG_FP);
+            GetEmitter()->emitPacInProlog();
+        }
         GetEmitter()->emitIns_R_R_R_I(INS_stp, EA_PTRSIZE, reg1, reg2, REG_SPBASE, spOffset);
 
         if (TargetOS::IsUnix && m_compiler->generateCFIUnwindCodes())
@@ -617,16 +662,30 @@ void CodeGen::genEpilogRestoreRegPair(regNumber reg1,
     assert((spDelta % 16) == 0);                                  // SP changes must be 16-byte aligned
     assert(genIsValidFloatReg(reg1) == genIsValidFloatReg(reg2)); // registers must be both general-purpose, or both
                                                                   // FP/SIMD
+    assert(reg1 != REG_LR);
 
     if (spDelta != 0)
     {
         assert(!useSaveNextPair);
         if ((spOffset == 0) && (spDelta <= 504))
         {
-            // Fold the SP change into this instruction.
-            // ldp reg1, reg2, [SP], #spDelta
-            GetEmitter()->emitIns_R_R_R_I(INS_ldp, EA_PTRSIZE, reg1, reg2, REG_SPBASE, spDelta, INS_OPTS_POST_INDEX);
-            m_compiler->unwindSaveRegPairPreindexed(reg1, reg2, -spDelta);
+            if ((JitConfig.JitPacEnabled() != 0) && (reg2 == REG_LR) && !m_compiler->IsAot())
+            {
+                // We separate SP increment and loading FP/LR when PAC is enabled.
+                assert(reg1 == REG_FP);
+                GetEmitter()->emitIns_R_R_R_I(INS_ldp, EA_PTRSIZE, reg1, reg2, REG_SPBASE, 0);
+                m_compiler->unwindSaveRegPair(reg1, reg2, 0);
+                GetEmitter()->emitPacInEpilog();
+                genStackPointerAdjustment(spDelta, REG_NA, nullptr, /* reportUnwindData */ true);
+            }
+            else
+            {
+                // Fold the SP change into this instruction.
+                // ldp reg1, reg2, [SP], #spDelta
+                GetEmitter()->emitIns_R_R_R_I(INS_ldp, EA_PTRSIZE, reg1, reg2, REG_SPBASE, spDelta,
+                                              INS_OPTS_POST_INDEX);
+                m_compiler->unwindSaveRegPairPreindexed(reg1, reg2, -spDelta);
+            }
         }
         else // (spOffset != 0) || (spDelta > 504)
         {
@@ -636,6 +695,12 @@ void CodeGen::genEpilogRestoreRegPair(regNumber reg1,
             GetEmitter()->emitIns_R_R_R_I(INS_ldp, EA_PTRSIZE, reg1, reg2, REG_SPBASE, spOffset);
             m_compiler->unwindSaveRegPair(reg1, reg2, spOffset);
 
+            if ((JitConfig.JitPacEnabled() != 0) && (reg2 == REG_LR) && !m_compiler->IsAot())
+            {
+                assert(reg1 == REG_FP);
+                GetEmitter()->emitPacInEpilog();
+            }
+
             // generate add SP,SP,imm
             genStackPointerAdjustment(spDelta, tmpReg, pTmpRegIsZero, /* reportUnwindData */ true);
         }
@@ -644,6 +709,12 @@ void CodeGen::genEpilogRestoreRegPair(regNumber reg1,
     {
         GetEmitter()->emitIns_R_R_R_I(INS_ldp, EA_PTRSIZE, reg1, reg2, REG_SPBASE, spOffset);
 
+        if ((JitConfig.JitPacEnabled() != 0) && (reg2 == REG_LR) && !m_compiler->IsAot())
+        {
+            assert(reg1 == REG_FP);
+            GetEmitter()->emitPacInEpilog();
+        }
+
         if (TargetOS::IsUnix && m_compiler->generateCFIUnwindCodes())
         {
             useSaveNextPair = false;
@@ -1347,6 +1418,11 @@ void CodeGen::genFuncletProlog(BasicBlock* block)
 
     m_compiler->unwindBegProlog();
 
+    if (m_compiler->IsAot())
+    {
+        GetEmitter()->emitPacInProlog();
+    }
+
     regMaskTP maskSaveRegsFloat = genFuncletInfo.fiSaveRegs & RBM_ALLFLOAT;
     regMaskTP maskSaveRegsInt   = genFuncletInfo.fiSaveRegs & ~maskSaveRegsFloat;
 
@@ -1379,14 +1455,29 @@ void CodeGen::genFuncletProlog(BasicBlock* block)
             bool scratchRegIsZero = false;
             genAllocLclFrame(-genFuncletInfo.fiSpDelta1, REG_SCRATCH, &scratchRegIsZero, maskArgRegsLiveIn);
             genStackPointerAdjustment(genFuncletInfo.fiSpDelta1, REG_SCRATCH, nullptr, /* reportUnwindData */ true);
+            if (!m_compiler->IsAot())
+            {
+                GetEmitter()->emitPacInProlog();
+            }
             GetEmitter()->emitIns_R_R_R_I(INS_stp, EA_PTRSIZE, REG_FP, REG_LR, REG_SPBASE, 0);
             m_compiler->unwindSaveRegPair(REG_FP, REG_LR, 0);
         }
         else
         {
-            GetEmitter()->emitIns_R_R_R_I(INS_stp, EA_PTRSIZE, REG_FP, REG_LR, REG_SPBASE, genFuncletInfo.fiSpDelta1,
-                                          INS_OPTS_PRE_INDEX);
-            m_compiler->unwindSaveRegPairPreindexed(REG_FP, REG_LR, genFuncletInfo.fiSpDelta1);
+            if (JitConfig.JitPacEnabled() != 0 && !m_compiler->IsAot())
+            {
+                // generate sub SP,SP,imm
+                genStackPointerAdjustment(genFuncletInfo.fiSpDelta1, REG_NA, nullptr, /* reportUnwindData */ true);
+                GetEmitter()->emitPacInProlog();
+                GetEmitter()->emitIns_R_R_R_I(INS_stp, EA_PTRSIZE, REG_FP, REG_LR, REG_SPBASE, 0);
+                m_compiler->unwindSaveRegPair(REG_FP, REG_LR, 0);
+            }
+            else
+            {
+                GetEmitter()->emitIns_R_R_R_I(INS_stp, EA_PTRSIZE, REG_FP, REG_LR, REG_SPBASE,
+                                              genFuncletInfo.fiSpDelta1, INS_OPTS_PRE_INDEX);
+                m_compiler->unwindSaveRegPairPreindexed(REG_FP, REG_LR, genFuncletInfo.fiSpDelta1);
+            }
         }
 
         maskSaveRegsInt &= ~(RBM_LR | RBM_FP); // We've saved these now
@@ -1405,6 +1496,10 @@ void CodeGen::genFuncletProlog(BasicBlock* block)
 
         assert(genFuncletInfo.fiSpDelta2 == 0);
 
+        if (!m_compiler->IsAot())
+        {
+            GetEmitter()->emitPacInProlog();
+        }
         GetEmitter()->emitIns_R_R_R_I(INS_stp, EA_PTRSIZE, REG_FP, REG_LR, REG_SPBASE,
                                       genFuncletInfo.fiSP_to_FPLR_save_delta);
         m_compiler->unwindSaveRegPair(REG_FP, REG_LR, genFuncletInfo.fiSP_to_FPLR_save_delta);
@@ -1413,13 +1508,15 @@ void CodeGen::genFuncletProlog(BasicBlock* block)
     }
     else if (genFuncletInfo.fiFrameType == 3)
     {
-        if (m_compiler->opts.IsOSR())
+        // Avoid using pre-indexed store when PAC is enabled.
+        if ((m_compiler->opts.IsOSR()) || ((JitConfig.JitPacEnabled() != 0) && !m_compiler->IsAot()))
         {
             // With OSR we may see large values for fiSpDelta1
             // We repurpose genAllocLclFram to do the necessary probing.
             bool scratchRegIsZero = false;
             genAllocLclFrame(-genFuncletInfo.fiSpDelta1, REG_SCRATCH, &scratchRegIsZero, maskArgRegsLiveIn);
             genStackPointerAdjustment(genFuncletInfo.fiSpDelta1, REG_SCRATCH, nullptr, /* reportUnwindData */ true);
+            GetEmitter()->emitPacInProlog();
             GetEmitter()->emitIns_R_R_R_I(INS_stp, EA_PTRSIZE, REG_FP, REG_LR, REG_SPBASE, 0);
             m_compiler->unwindSaveRegPair(REG_FP, REG_LR, 0);
         }
@@ -1549,12 +1646,24 @@ void CodeGen::genFuncletEpilog()
     {
         // With OSR we may see large values for fiSpDelta1
         //
-        if (m_compiler->opts.IsOSR())
+        if (m_compiler->opts.IsOSR() || ((JitConfig.JitPacEnabled() != 0) && !m_compiler->IsAot()))
         {
-            GetEmitter()->emitIns_R_R_R_I(INS_ldp, EA_PTRSIZE, REG_FP, REG_LR, REG_SPBASE, 0);
-            m_compiler->unwindSaveRegPair(REG_FP, REG_LR, 0);
+            ssize_t   imm     = 0;
+            regNumber tempReg = REG_SCRATCH;
 
-            genStackPointerAdjustment(-genFuncletInfo.fiSpDelta1, REG_SCRATCH, nullptr, /* reportUnwindData */ true);
+            if (JitConfig.JitPacEnabled() != 0)
+            {
+                imm     = genFuncletInfo.fiSP_to_FPLR_save_delta;
+                tempReg = REG_NA;
+            }
+
+            GetEmitter()->emitIns_R_R_R_I(INS_ldp, EA_PTRSIZE, REG_FP, REG_LR, REG_SPBASE, imm);
+            m_compiler->unwindSaveRegPair(REG_FP, REG_LR, static_cast<int>(imm));
+            if (!m_compiler->IsAot())
+            {
+                GetEmitter()->emitPacInEpilog();
+            }
+            genStackPointerAdjustment(-genFuncletInfo.fiSpDelta1, tempReg, nullptr, /* reportUnwindData */ true);
         }
         else
         {
@@ -1571,6 +1680,10 @@ void CodeGen::genFuncletEpilog()
         GetEmitter()->emitIns_R_R_R_I(INS_ldp, EA_PTRSIZE, REG_FP, REG_LR, REG_SPBASE,
                                       genFuncletInfo.fiSP_to_FPLR_save_delta);
         m_compiler->unwindSaveRegPair(REG_FP, REG_LR, genFuncletInfo.fiSP_to_FPLR_save_delta);
+        if (!m_compiler->IsAot())
+        {
+            GetEmitter()->emitPacInEpilog();
+        }
 
         // fiFrameType==2 constraints:
         assert(genFuncletInfo.fiSpDelta1 < 0);
@@ -1584,12 +1697,12 @@ void CodeGen::genFuncletEpilog()
     else if (genFuncletInfo.fiFrameType == 3)
     {
         // With OSR we may see large values for fiSpDelta1
-        //
-        if (m_compiler->opts.IsOSR())
+        // Avoid post-indexed load when PAC is enabled.
+        if (m_compiler->opts.IsOSR() || ((JitConfig.JitPacEnabled() != 0) && !m_compiler->IsAot()))
         {
             GetEmitter()->emitIns_R_R_R_I(INS_ldp, EA_PTRSIZE, REG_FP, REG_LR, REG_SPBASE, 0);
             m_compiler->unwindSaveRegPair(REG_FP, REG_LR, 0);
-
+            GetEmitter()->emitPacInEpilog();
             genStackPointerAdjustment(-genFuncletInfo.fiSpDelta1, REG_SCRATCH, nullptr, /* reportUnwindData */ true);
         }
         else
@@ -1632,6 +1745,11 @@ void CodeGen::genFuncletEpilog()
         }
     }
 
+    if (m_compiler->IsAot())
+    {
+        GetEmitter()->emitPacInEpilog();
+    }
+
     inst_RV(INS_ret, REG_LR, TYP_I_IMPL);
     m_compiler->unwindReturn(REG_LR);