================
@@ -0,0 +1,178 @@
+##################################
+ Return Address Signing Hardening
+##################################
+
+.. contents::
+ :local:
+
+**************
+ Introduction
+**************
+
+Return Address Signing Hardening is a mitigation against the PACMAN
+attack, which aims to bypass Pointer Authentication on AArch64 targets.
+The hardening mechanism described here is specific to pointer
+authentication of return addresses.
+
+Return Address Signing, also known as Pointer Authentication Code
+(PAC-RET), is a feature devised to protect programs against Return
+Oriented Programming (ROP), in which attackers may hijack the return
+address of functions in order to direct execution to malicious code.
+
+PAC-RET can be enabled via different command-line options:
+
+ - ``-mbranch-protection=`` with ``pac-ret``, ``pac-ret+leaf`` or
+ ``standard`` as value.
+ - ``-msign-return-address=`` with ``non-leaf`` or ``all`` as value.
+ - ``-fptrauth-returns``.
+
+More information can be found in :doc:`Pointer Authentication
+<PointerAuthentication>`.
+
+Return Address Signing Hardening is a mechanism to strenghthen Return
+Address Signing against the PACMAN attack in AArch64 targets. It can be
+enabled with ``-mharden-pac-ret=load-return-address``.
+
+***************
+ PACMAN attack
+***************
+
+PACMAN is an attack that aims to extract valuable information about
+pointer authentication codes using side-channels in speculative
+execution.
+
+It is performed with the use of gadgets to try and guess PAC codes.
+These guesses raise no faults because they are done in speculation. By
+observing the effects of the guessed PAC code on the processor's cache,
+it might be possible to determine the valid PAC code for the address to
+which the attacker wants the program to return.
+
+A usual PACMAN gadget looks like this:
+
+.. code:: C
+
+ void function() {
+ ...
+ if (condition)
+ return;
+ ...
+ }
+
+Such code would be compiled to:
+
+.. code:: asm
+
+ paciasp
+ ...
+ cbz w0, .LBB0_2
+ autiasp
+ ret
+ ...
+
+This code segment may be used as a gadget. A speculative execution of
+this segment can happen as follows:
+
+ - If the Link Register (LR) has the right PAC code, ``autiasp`` will
+ succeed and strip the PAC code out of the it. The processor's
----------------
statham-arm wrote:
```suggestion
succeed and strip the PAC code out of it. The processor's
```
https://github.com/llvm/llvm-project/pull/176171
_______________________________________________
cfe-commits mailing list
[email protected]
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
