Repository navigation
Arm64: [PAC-RET] cDAC changes - #135959
Open
SwapnilGaikwad wants to merge 17 commits into
Open
SwapnilGaikwad wants to merge 17 commits into
SwapnilGaikwad wants to merge 17 commits into
Conversation
Strip PAC from saved return addresses before unwinding and resolving code.
dotnet-policy-service
Bot
added
the
community-contribution
|
Azure Pipelines: Successfully started running 4 pipeline(s). 12 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
|
Tagging subscribers to this area: @steveisok, @tommcdon, @dotnet/dotnet-diag |
Contributor
Author
|
The CI status of changes when PAC is enabled is found on PR #125436. |
SwapnilGaikwad
commented
Oct 16, 2026
| #if defined(TARGET_UNIX) | ||
| *Pointer &= 0x0000FFFFFFFFFFFF; | ||
| #else | ||
| // Windows uses 47-bit user addresses, so bit 47 can also contain PAC. |
Contributor
Author
There was a problem hiding this comment.
We may need to change wording with certainty if we can confirm TCR_EL1.T0SZ always = 17 on Windows. It would make PAC algorithm use TCR_EL1.T0SZ = PACEffectiveTxSZ = 17 in InsertPAC(). Thus, bit indexed 47 will always be used for storing PAC.
This was referenced Oct 16, 2026
Closed
jkotas
reviewed
Oct 19, 2026
max-charlamb
pushed a commit
that referenced
this pull request
Oct 20, 2026
Some runtime paths report stack-interior references without using PromoteCarefully. Filter these references from both cDAC and runtime results before comparison so asymmetric filtering does not produce false stress-test failures. NOTE: This PR is created with the help of codex to address failing CI pipeline for #135959 cc: @dotnet/arm64-contrib @dhartglassMSFT @max-charlamb
27 tasks
This was referenced Oct 26, 2026
Open
3 tasks
This was referenced Oct 27, 2026
Contributor
Author
|
The CI failures look unrelated to PAC changes. |
Member
|
Changes look pretty good. |
max-charlamb
approved these changes
Oct 29, 2026
3 tasks
Contributor
Author
|
Hi @jkotas, kindly look at the patch and let me know if there is anything we need to push this further. |
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Existing x86 transition-frame tests lack the required metadata mock, and PAC handling remains untested for explicit frames and real ARM64 dumps.
4 open issues
What changed in this PR
Adds ARM64 pointer-authentication support to cDAC stack walking, complementing the earlier JIT, VM, and NativeAOT work by recovering usable addresses from signed return addresses.
Changes:
- Publishes a runtime-derived pointer-authentication mask through platform metadata.
- Applies the mask during ARM64 unwinding and explicit-frame handling, and adjusts native Windows PAC stripping.
- Adds mask and unwind unit tests and updates the platform-metadata specification.
| File | Description |
|---|---|
src/native/managed/cdac/tests/UnitTests/StackWalkTests.cs |
Adds PAC unwind cases and platform-metadata mocks. |
src/native/managed/cdac/tests/UnitTests/PlatformMetadataTests.cs |
Tests missing masks and selective bit clearing. |
src/native/managed/cdac/Microsoft.Diagnostics.DataContractReader.Legacy/ConversionExtensions.cs |
Removes the obsolete PAC rejection from address conversion. |
src/native/managed/cdac/Microsoft.Diagnostics.DataContractReader.Contracts/Data/PlatformMetadata.cs |
Reads the optional authentication mask. |
src/native/managed/cdac/Microsoft.Diagnostics.DataContractReader.Contracts/Contracts/StackWalk/StackWalk_1.cs |
Uses normalized frame return addresses for method lookup. |
src/native/managed/cdac/Microsoft.Diagnostics.DataContractReader.Contracts/Contracts/StackWalk/FrameHandling/FrameHelpers.cs |
Strips authentication bits from explicit-frame return addresses. |
src/native/managed/cdac/Microsoft.Diagnostics.DataContractReader.Contracts/Contracts/StackWalk/FrameHandling/BaseFrameHandler.cs |
Normalizes inlined-call and transition-frame instruction pointers. |
src/native/managed/cdac/Microsoft.Diagnostics.DataContractReader.Contracts/Contracts/StackWalk/FrameHandling/ARM64FrameHandler.cs |
Normalizes hijack-frame return addresses. |
src/native/managed/cdac/Microsoft.Diagnostics.DataContractReader.Contracts/Contracts/StackWalk/Context/ARM64/ARM64Unwinder.cs |
Handles the PAC unwind opcode using the target mask. |
src/native/managed/cdac/Microsoft.Diagnostics.DataContractReader.Contracts/Contracts/PrecodeStubs_Common.cs |
Removes obsolete PAC-specific rejection. |
src/native/managed/cdac/Microsoft.Diagnostics.DataContractReader.Contracts/Contracts/PlatformMetadata_1.cs |
Exposes the mask, defaulting to zero when absent. |
src/native/managed/cdac/Microsoft.Diagnostics.DataContractReader.Contracts/CodePointerUtils.cs |
Adds shared return-address masking. |
src/native/managed/cdac/Microsoft.Diagnostics.DataContractReader.Abstractions/Contracts/IPlatformMetadata.cs |
Replaces the PAC flag with a mask accessor. |
src/coreclr/vm/datadescriptor/datadescriptor.inc |
Exports the mask field in runtime descriptors. |
src/coreclr/vm/cdacplatformmetadata.hpp |
Stores the authentication mask in native metadata. |
src/coreclr/vm/cdacplatformmetadata.cpp |
Derives and initializes the ARM64 mask. |
src/coreclr/unwinder/arm64/unwinder.cpp |
Clears bit 47 when stripping PAC on Windows. |
docs/design/datacontracts/PlatformMetadata.md |
Documents the mask accessor and optional-field behavior. |
docs/design/datacontracts/data-descriptor-meanings.json |
Describes the new mask descriptor. |
Review effort: Balanced
| return TargetCodePointer.Null; | ||
| } | ||
|
|
||
| return CodePointerUtils.StripPtrAuthFromReturnAddress(returnAddress, _target); |
jkotas
reviewed
Nov 2, 2026
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR covers the cDAC subset of changes from 1#25436 related to cDAC.
It follows the previous work from- #127949, #127838, #128147 and #128950
More details on PAC and its role in software security can be found (here).
cc: @dotnet/arm64-contrib @a74nh @jkotas @dhartglassMSFT