Epic: Support Intel CET

[janvorli]

Recent Intel x64 CPUs support a new security feature called CET (Control-flow Enforcement Technology). We plan to support it in the .NET 6.0.

Windows and Linux

• Add Shadow stack popping during stack unwinding.

Windows

• Add proper compiler and linker options to support CET for the C/C++ code.
• Implement our own version of RtlRestoreContext for exception handling (done on Windows only for now)
• Implement new way of thread suspension using a new user mode APC that would work the same way as on Unix.
• Implement new way of return address hijacking compatible with the CET.
• Make ThreadAbort work with CET enabled
• Make GC stress 4/8 work with CET enabled
• Enable CI for CET
• Enable non-strict mode by default
• Performance is comparable without CET enabled
• Debugging support is not restricted with CET enabled

Linux

• Add proper compiler options to enable IBT (indirect branch tracing) support and .note.gnu.property section to indicate our native runtime binaries are compatible with shadow stack and IBT.
• Add ENDBR instructions at the beginning of asm helper functions that can be called using indirect jumps or calls.
• Modify JIT to add ENDBR instructions at the beginning of all methods that can be called via indirect jumps or calls.
• The Linux work depends on the availability of the CET support in the mainstream Linux kernel. There is a patch that adds some arch_prctl operations for the Intel CET.

[tannergooding]

Is the AMD shadow stack support the same as Intel CET or is it a different feature/ISA?

[janvorli]

@tannergooding I am not aware of AMD releasing a spec of their shadow stack technology.

[tannergooding]

@janvorli, AMD published it back in August (at the very least) in preparation of the Zen3 release. Most of their developer manuals can be found here: https://developer.amd.com/resources/developer-guides-manuals/

The core information on their shadow stack support, as far as I'm aware, is in Volume 2, Chapter 18: https://www.amd.com/system/files/TechDocs/24593.pdf

---

At least comparing to Intel's own manuals (https://software.intel.com/content/www/us/en/develop/download/intel-64-and-ia-32-architectures-sdm-combined-volumes-1-2a-2b-2c-2d-3a-3b-3c-3d-and-4.html), it looks like they use the same CPUID register/name: CPUID Fn0000_0007 ECX:CET_SS=1 (bit 7) and CR4.CET=1 (bit 23). It also looks like at least a handful of the instructions match, so that seems hopeful 😄