Skip to content

Use hint-safe pointer authentication stripping in NativeAOT - #130474

Merged
kotlarmilos merged 2 commits into
mainfrom
copilot/fix-pacstrip-ptr-issue
Jul 10, 2026
Merged

Use hint-safe pointer authentication stripping in NativeAOT#130474
kotlarmilos merged 2 commits into
mainfrom
copilot/fix-pacstrip-ptr-issue

Conversation

CopilotAI commented Jul 10, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

NativeAOT executed xpaci during arm64 GC stack walking, causing SIGILL on tvOS devices without pointer authentication. This ports CoreCLR’s hint-safe PacStripPtr implementation.

Changes

  • Preserve the caller’s lr.
  • Move the pointer through lr and execute xpaclri.
  • Return the stripped pointer through x0.
  • Apply the change to Unix and Windows arm64 assembly stubs.
mov lr, x0xpaclrimov x0, lr

Note

This description was generated by GitHub Copilot.

CopilotAI requested review from Copilot and removed request for CopilotJuly 10, 2026 10:38
CopilotAI linked an issue Jul 10, 2026 that may be closed by this pull request
[NativeAOT][tvOS] PacStripPtr executes xpaci on devices without pointer authentication #130470
Closed
@kotlarmilos
Use hint-safe PAC stripping in NativeAOT
7208134
Co-authored-by: kotlarmilos <11523312+kotlarmilos@users.noreply.github.com>
CopilotAI requested review from Copilot and removed request for CopilotJuly 10, 2026 11:06
@dotnet-policy-service

dotnet-policy-serviceBot commented Jul 10, 2026

Copy link
Copy Markdown
Contributor

Tagging subscribers to this area: @agocke, @dotnet/ilc-contrib
See info in area-owners.md if you want to be subscribed.

CopilotAI changed the title [WIP] Fix PacStripPtr execution on tvOS without pointer authenticationUse hint-safe pointer authentication stripping in NativeAOTJul 10, 2026
CopilotAI requested a review from kotlarmilosJuly 10, 2026 11:12
@kotlarmilos

kotlarmilos commented Jul 10, 2026

Copy link
Copy Markdown
Member

/azp run runtime-extra-platforms

@azure-pipelines

azure-pipelinesBot commented Jul 10, 2026

Copy link
Copy Markdown
Azure Pipelines successfully started running 1 pipeline(s).

@jkotas

jkotas commented Jul 10, 2026

Copy link
Copy Markdown
Member

cc @SwapnilGaikwad

@SwapnilGaikwad

SwapnilGaikwad commented Jul 10, 2026

Copy link
Copy Markdown
Contributor

The fix LGTM!
It matches with the fix in asmhelpers.S/asm. Missed to update MiscStubsS/.asm‎

@SwapnilGaikwad

SwapnilGaikwad commented Jul 10, 2026

Copy link
Copy Markdown
Contributor

Failure seem unrelated, no SIGILL or Illegal Instruction failures.

@kotlarmilos
kotlarmilos marked this pull request as ready for review July 10, 2026 15:54
CopilotAI review requested due to automatic review settings July 10, 2026 15:54
CopilotAI reviewed Jul 10, 2026
View reviewed changes

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates NativeAOT’s ARM64 PacStripPtr helper to use the same hint-safe pointer-authentication stripping sequence used by CoreCLR, avoiding execution of xpaci x0 and instead using xpaclri while preserving the caller’s lr.

Changes:

  • Replace the Unix ARM64 PacStripPtr leaf stub (xpaci x0; ret) with a nested prolog/epilog that saves fp/lr, routes the input pointer through lr, executes xpaclri, and returns the stripped pointer in x0.
  • Apply the same change to the Windows ARM64 stub, encoding xpaclri as a raw instruction word (consistent with existing PAC instruction encoding patterns in that file).
Show a summary per file
FileDescription
src/coreclr/nativeaot/Runtime/arm64/MiscStubs.SSwitches PacStripPtr to a CoreCLR-matching, hint-safe xpaclri sequence with proper lr preservation/unwind-friendly prolog/epilog.
src/coreclr/nativeaot/Runtime/arm64/MiscStubs.asmMirrors the same PacStripPtr update for Windows ARM64, using DCD 0xD50320FF for xpaclri.

Copilot's findings

  • Files reviewed: 2/2 changed files
  • Comments generated: 0

@build-analysisbuild-analysisBot mentioned this pull request Jul 10, 2026
Open
3 tasks
This was referenced Jul 10, 2026
Open
Closed
@kotlarmilos

kotlarmilos commented Jul 10, 2026

Copy link
Copy Markdown
Member

Failure seem unrelated, no SIGILL or Illegal Instruction failures.

Correct, no jobs reported SIGILL, EXC_BAD_INSTRUCTION, or signal 4.

@kotlarmilos
kotlarmilos enabled auto-merge (squash) July 10, 2026 16:22
@jkotas

jkotas commented Jul 10, 2026

Copy link
Copy Markdown
Member

/ba-g infrastructure timeouts

@kotlarmilos
kotlarmilos merged commit 66cc35c into mainJul 10, 2026
133 of 152 checks passed
@kotlarmilos
kotlarmilos deleted the copilot/fix-pacstrip-ptr-issue branch July 10, 2026 23:26
@dotnet-maestrodotnet-maestroBot mentioned this pull request Jul 11, 2026
Merged
@dotnet-milestone-botdotnet-milestone-botBot added this to the 11.0-preview7 milestone Jul 11, 2026
eiriktsarpalis pushed a commit that referenced this pull request Jul 15, 2026
@kotlarmilos@eiriktsarpalis
Use hint-safe pointer authentication stripping in NativeAOT (#130474)
d1dac9f
<!-- -->
NativeAOT executed `xpaci` during arm64 GC stack walking, causing
`SIGILL` on tvOS devices without pointer authentication. This ports
CoreCLR’s hint-safe `PacStripPtr` implementation.
## Changes
- Preserve the caller’s `lr`.
- Move the pointer through `lr` and execute `xpaclri`.
- Return the stripped pointer through `x0`.
- Apply the change to Unix and Windows arm64 assembly stubs.
```asm
mov lr, x0
xpaclri
mov x0, lr
```
> [!NOTE]
> This description was generated by GitHub Copilot.
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: kotlarmilos <11523312+kotlarmilos@users.noreply.github.com>
@github-actionsgithub-actionsBot locked and limited conversation to collaborators Aug 11, 2026
Sign up for freeto subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

Copilot code reviewCopilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@jkotasjkotasjkotas approved these changes
@kotlarmiloskotlarmilosAwaiting requested review from kotlarmilos
@MichalStrehovskyMichalStrehovskyAwaiting requested review from MichalStrehovskyMichalStrehovsky is a code owner

Assignees

@kotlarmiloskotlarmilos

Copilot code reviewCopilot

Labels

arch-arm64area-NativeAOT-coreclr

Projects

None yet

Milestone

11.0-preview7

Development

Successfully merging this pull request may close these issues.

[NativeAOT][tvOS] PacStripPtr executes xpaci on devices without pointer authentication

5 participants

@kotlarmilos@jkotas@SwapnilGaikwad
, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
Use hint-safe pointer authentication stripping in NativeAOT by Copilot · Pull Request #130474 · dotnet/runtime · GitHub
Skip to content
Use hint-safe pointer authentication stripping in NativeAOT - #130474
Merged
kotlarmilos merged 2 commits into
mainfrom 
copilot/fix-pacstrip-ptr-issue
Jul 10, 2026
Merged
Use hint-safe pointer authentication stripping in NativeAOT#130474
kotlarmilos merged 2 commits into
mainfrom 
copilot/fix-pacstrip-ptr-issue
Conversation
CopilotAI
commented
Jul 10, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
NativeAOT executed xpaci during arm64 GC stack walking, causing SIGILL on tvOS devices without pointer authentication. This ports CoreCLR’s hint-safe PacStripPtr implementation.
Changes
  • Preserve the caller’s lr.
  • Move the pointer through lr and execute xpaclri.
  • Return the stripped pointer through x0.
  • Apply the change to Unix and Windows arm64 assembly stubs.
mov lr, x0xpaclrimov x0, lr
Note
This description was generated by GitHub Copilot.
CopilotAI
requested review from
Copilot
and removed request for
CopilotJuly 10, 2026 10:38
CopilotAI
linked an issue
Jul 10, 2026
that may be
closed
by this pull request


[NativeAOT][tvOS] PacStripPtr executes xpaci on devices without pointer authentication
#130470

Closed

@kotlarmilos
Use hint-safe PAC stripping in NativeAOT
7208134
Co-authored-by: kotlarmilos <11523312+kotlarmilos@users.noreply.github.com>
CopilotAI
requested review from
Copilot
and removed request for
CopilotJuly 10, 2026 11:06
@dotnet-policy-service
dotnet-policy-serviceBot
commented
Jul 10, 2026

Copy link


Copy Markdown

Contributor
Tagging subscribers to this area: @agocke, @dotnet/ilc-contrib

See info in area-owners.md if you want to be subscribed.
CopilotAI
changed the title
[WIP] Fix PacStripPtr execution on tvOS without pointer authenticationUse hint-safe pointer authentication stripping in NativeAOTJul 10, 2026
CopilotAI
requested a review
from kotlarmilosJuly 10, 2026 11:12
@kotlarmilos
kotlarmilos
commented
Jul 10, 2026

Copy link


Copy Markdown

Member
/azp run runtime-extra-platforms
@azure-pipelines
azure-pipelinesBot
commented
Jul 10, 2026

Copy link


Copy Markdown


Azure Pipelines successfully started running 1 pipeline(s).
@jkotas
jkotas
commented
Jul 10, 2026

Copy link


Copy Markdown

Member
cc @SwapnilGaikwad
@SwapnilGaikwad
SwapnilGaikwad
commented
Jul 10, 2026

Copy link


Copy Markdown

Contributor
The fix LGTM!

It matches with the fix in asmhelpers.S/asm. Missed to update MiscStubsS/.asm‎
@SwapnilGaikwad
SwapnilGaikwad
commented
Jul 10, 2026

Copy link


Copy Markdown

Contributor
Failure seem unrelated, no SIGILL or Illegal Instruction failures.
@kotlarmilos
kotlarmilos
marked this pull request as ready for review
July 10, 2026 15:54
CopilotAI
review requested due to automatic review settings
July 10, 2026 15:54
CopilotAI
reviewed
Jul 10, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Updates NativeAOT’s ARM64 PacStripPtr helper to use the same hint-safe pointer-authentication stripping sequence used by CoreCLR, avoiding execution of xpaci x0 and instead using xpaclri while preserving the caller’s lr.
Changes:
  • Replace the Unix ARM64 PacStripPtr leaf stub (xpaci x0; ret) with a nested prolog/epilog that saves fp/lr, routes the input pointer through lr, executes xpaclri, and returns the stripped pointer in x0.
  • Apply the same change to the Windows ARM64 stub, encoding xpaclri as a raw instruction word (consistent with existing PAC instruction encoding patterns in that file).
Show a summary per file
FileDescription
src/coreclr/nativeaot/Runtime/arm64/MiscStubs.SSwitches PacStripPtr to a CoreCLR-matching, hint-safe xpaclri sequence with proper lr preservation/unwind-friendly prolog/epilog.
src/coreclr/nativeaot/Runtime/arm64/MiscStubs.asmMirrors the same PacStripPtr update for Windows ARM64, using DCD 0xD50320FF for xpaclri.
Copilot's findings
  • Files reviewed: 2/2 changed files
  • Comments generated: 0
@build-analysisbuild-analysisBot
mentioned this pull request
Jul 10, 2026

Open

3 tasks

This was referenced Jul 10, 2026

Open


Closed

@kotlarmilos
kotlarmilos
commented
Jul 10, 2026

Copy link


Copy Markdown

Member
Failure seem unrelated, no SIGILL or Illegal Instruction failures.
Correct, no jobs reported SIGILL, EXC_BAD_INSTRUCTION, or signal 4.
@kotlarmilos
kotlarmilos
enabled auto-merge (squash)
July 10, 2026 16:22
@jkotas
jkotas
commented
Jul 10, 2026

Copy link


Copy Markdown

Member
/ba-g infrastructure timeouts
@kotlarmilos
kotlarmilos
merged commit 66cc35c
into
mainJul 10, 2026

133 of 152 checks passed

@kotlarmilos
kotlarmilos
deleted the

copilot/fix-pacstrip-ptr-issue

branch
July 10, 2026 23:26
@dotnet-maestrodotnet-maestroBot
mentioned this pull request
Jul 11, 2026
 Merged

@dotnet-milestone-botdotnet-milestone-botBot
added this to the 11.0-preview7 milestone
Jul 11, 2026
eiriktsarpalis pushed a commit
that referenced
this pull request
Jul 15, 2026
@kotlarmilos@eiriktsarpalis
Use hint-safe pointer authentication stripping in NativeAOT (#130474)
d1dac9f
<!-- -->
NativeAOT executed `xpaci` during arm64 GC stack walking, causing
`SIGILL` on tvOS devices without pointer authentication. This ports
CoreCLR’s hint-safe `PacStripPtr` implementation.
## Changes
- Preserve the caller’s `lr`.
- Move the pointer through `lr` and execute `xpaclri`.
- Return the stripped pointer through `x0`.
- Apply the change to Unix and Windows arm64 assembly stubs.
```asm
mov lr, x0
xpaclri
mov x0, lr
```
> [!NOTE]
> This description was generated by GitHub Copilot.
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: kotlarmilos <11523312+kotlarmilos@users.noreply.github.com>
@github-actionsgithub-actionsBot
locked and limited conversation to collaborators
Aug 11, 2026
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

Copilot code reviewCopilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@jkotasjkotasjkotas approved these changes
@kotlarmiloskotlarmilosAwaiting requested review from kotlarmilos
@MichalStrehovskyMichalStrehovskyAwaiting requested review from MichalStrehovskyMichalStrehovsky is a code owner

Assignees

@kotlarmiloskotlarmilos
Copilot code reviewCopilot

Labels

arch-arm64area-NativeAOT-coreclr

Projects


None yet


Milestone

11.0-preview7

Development

Successfully merging this pull request may close these issues.

[NativeAOT][tvOS] PacStripPtr executes xpaci on devices without pointer authentication


5 participants

@kotlarmilos@jkotas@SwapnilGaikwad

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Use hint-safe pointer authentication stripping in NativeAOT by Copilot · Pull Request #130474 · dotnet/runtime · GitHub
Skip to content
Use hint-safe pointer authentication stripping in NativeAOT - #130474
Merged
kotlarmilos merged 2 commits into
mainfrom 
copilot/fix-pacstrip-ptr-issue
Jul 10, 2026
Merged
Use hint-safe pointer authentication stripping in NativeAOT#130474
kotlarmilos merged 2 commits into
mainfrom 
copilot/fix-pacstrip-ptr-issue
Conversation
CopilotAI
commented
Jul 10, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
NativeAOT executed xpaci during arm64 GC stack walking, causing SIGILL on tvOS devices without pointer authentication. This ports CoreCLR’s hint-safe PacStripPtr implementation.
Changes
  • Preserve the caller’s lr.
  • Move the pointer through lr and execute xpaclri.
  • Return the stripped pointer through x0.
  • Apply the change to Unix and Windows arm64 assembly stubs.
mov lr, x0xpaclrimov x0, lr
Note
This description was generated by GitHub Copilot.
CopilotAI
requested review from
Copilot
and removed request for
CopilotJuly 10, 2026 10:38
CopilotAI
linked an issue
Jul 10, 2026
that may be
closed
by this pull request


[NativeAOT][tvOS] PacStripPtr executes xpaci on devices without pointer authentication
#130470

Closed

@kotlarmilos
Use hint-safe PAC stripping in NativeAOT
7208134
Co-authored-by: kotlarmilos <11523312+kotlarmilos@users.noreply.github.com>
CopilotAI
requested review from
Copilot
and removed request for
CopilotJuly 10, 2026 11:06
@dotnet-policy-service
dotnet-policy-serviceBot
commented
Jul 10, 2026

Copy link


Copy Markdown

Contributor
Tagging subscribers to this area: @agocke, @dotnet/ilc-contrib

See info in area-owners.md if you want to be subscribed.
CopilotAI
changed the title
[WIP] Fix PacStripPtr execution on tvOS without pointer authenticationUse hint-safe pointer authentication stripping in NativeAOTJul 10, 2026
CopilotAI
requested a review
from kotlarmilosJuly 10, 2026 11:12
@kotlarmilos
kotlarmilos
commented
Jul 10, 2026

Copy link


Copy Markdown

Member
/azp run runtime-extra-platforms
@azure-pipelines
azure-pipelinesBot
commented
Jul 10, 2026

Copy link


Copy Markdown


Azure Pipelines successfully started running 1 pipeline(s).
@jkotas
jkotas
commented
Jul 10, 2026

Copy link


Copy Markdown

Member
cc @SwapnilGaikwad
@SwapnilGaikwad
SwapnilGaikwad
commented
Jul 10, 2026

Copy link


Copy Markdown

Contributor
The fix LGTM!

It matches with the fix in asmhelpers.S/asm. Missed to update MiscStubsS/.asm‎
@SwapnilGaikwad
SwapnilGaikwad
commented
Jul 10, 2026

Copy link


Copy Markdown

Contributor
Failure seem unrelated, no SIGILL or Illegal Instruction failures.
@kotlarmilos
kotlarmilos
marked this pull request as ready for review
July 10, 2026 15:54
CopilotAI
review requested due to automatic review settings
July 10, 2026 15:54
CopilotAI
reviewed
Jul 10, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Updates NativeAOT’s ARM64 PacStripPtr helper to use the same hint-safe pointer-authentication stripping sequence used by CoreCLR, avoiding execution of xpaci x0 and instead using xpaclri while preserving the caller’s lr.
Changes:
  • Replace the Unix ARM64 PacStripPtr leaf stub (xpaci x0; ret) with a nested prolog/epilog that saves fp/lr, routes the input pointer through lr, executes xpaclri, and returns the stripped pointer in x0.
  • Apply the same change to the Windows ARM64 stub, encoding xpaclri as a raw instruction word (consistent with existing PAC instruction encoding patterns in that file).
Show a summary per file
FileDescription
src/coreclr/nativeaot/Runtime/arm64/MiscStubs.SSwitches PacStripPtr to a CoreCLR-matching, hint-safe xpaclri sequence with proper lr preservation/unwind-friendly prolog/epilog.
src/coreclr/nativeaot/Runtime/arm64/MiscStubs.asmMirrors the same PacStripPtr update for Windows ARM64, using DCD 0xD50320FF for xpaclri.
Copilot's findings
  • Files reviewed: 2/2 changed files
  • Comments generated: 0
@build-analysisbuild-analysisBot
mentioned this pull request
Jul 10, 2026

Open

3 tasks

This was referenced Jul 10, 2026

Open


Closed

@kotlarmilos
kotlarmilos
commented
Jul 10, 2026

Copy link


Copy Markdown

Member
Failure seem unrelated, no SIGILL or Illegal Instruction failures.
Correct, no jobs reported SIGILL, EXC_BAD_INSTRUCTION, or signal 4.
@kotlarmilos
kotlarmilos
enabled auto-merge (squash)
July 10, 2026 16:22
@jkotas
jkotas
commented
Jul 10, 2026

Copy link


Copy Markdown

Member
/ba-g infrastructure timeouts
@kotlarmilos
kotlarmilos
merged commit 66cc35c
into
mainJul 10, 2026

133 of 152 checks passed

@kotlarmilos
kotlarmilos
deleted the

copilot/fix-pacstrip-ptr-issue

branch
July 10, 2026 23:26
@dotnet-maestrodotnet-maestroBot
mentioned this pull request
Jul 11, 2026
 Merged

@dotnet-milestone-botdotnet-milestone-botBot
added this to the 11.0-preview7 milestone
Jul 11, 2026
eiriktsarpalis pushed a commit
that referenced
this pull request
Jul 15, 2026
@kotlarmilos@eiriktsarpalis
Use hint-safe pointer authentication stripping in NativeAOT (#130474)
d1dac9f
<!-- -->
NativeAOT executed `xpaci` during arm64 GC stack walking, causing
`SIGILL` on tvOS devices without pointer authentication. This ports
CoreCLR’s hint-safe `PacStripPtr` implementation.
## Changes
- Preserve the caller’s `lr`.
- Move the pointer through `lr` and execute `xpaclri`.
- Return the stripped pointer through `x0`.
- Apply the change to Unix and Windows arm64 assembly stubs.
```asm
mov lr, x0
xpaclri
mov x0, lr
```
> [!NOTE]
> This description was generated by GitHub Copilot.
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: kotlarmilos <11523312+kotlarmilos@users.noreply.github.com>
@github-actionsgithub-actionsBot
locked and limited conversation to collaborators
Aug 11, 2026
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

Copilot code reviewCopilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@jkotasjkotasjkotas approved these changes
@kotlarmiloskotlarmilosAwaiting requested review from kotlarmilos
@MichalStrehovskyMichalStrehovskyAwaiting requested review from MichalStrehovskyMichalStrehovsky is a code owner

Assignees

@kotlarmiloskotlarmilos
Copilot code reviewCopilot

Labels

arch-arm64area-NativeAOT-coreclr

Projects


None yet


Milestone

11.0-preview7

Development

Successfully merging this pull request may close these issues.

[NativeAOT][tvOS] PacStripPtr executes xpaci on devices without pointer authentication


5 participants

@kotlarmilos@jkotas@SwapnilGaikwad

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Use hint-safe pointer authentication stripping in NativeAOT by Copilot · Pull Request #130474 · dotnet/runtime · GitHub
Skip to content
Use hint-safe pointer authentication stripping in NativeAOT - #130474
Merged
kotlarmilos merged 2 commits into
mainfrom 
copilot/fix-pacstrip-ptr-issue
Jul 10, 2026
Merged
Use hint-safe pointer authentication stripping in NativeAOT#130474
kotlarmilos merged 2 commits into
mainfrom 
copilot/fix-pacstrip-ptr-issue
Conversation
CopilotAI
commented
Jul 10, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
NativeAOT executed xpaci during arm64 GC stack walking, causing SIGILL on tvOS devices without pointer authentication. This ports CoreCLR’s hint-safe PacStripPtr implementation.
Changes
  • Preserve the caller’s lr.
  • Move the pointer through lr and execute xpaclri.
  • Return the stripped pointer through x0.
  • Apply the change to Unix and Windows arm64 assembly stubs.
mov lr, x0xpaclrimov x0, lr
Note
This description was generated by GitHub Copilot.
CopilotAI
requested review from
Copilot
and removed request for
CopilotJuly 10, 2026 10:38
CopilotAI
linked an issue
Jul 10, 2026
that may be
closed
by this pull request


[NativeAOT][tvOS] PacStripPtr executes xpaci on devices without pointer authentication
#130470

Closed

@kotlarmilos
Use hint-safe PAC stripping in NativeAOT
7208134
Co-authored-by: kotlarmilos <11523312+kotlarmilos@users.noreply.github.com>
CopilotAI
requested review from
Copilot
and removed request for
CopilotJuly 10, 2026 11:06
@dotnet-policy-service
dotnet-policy-serviceBot
commented
Jul 10, 2026

Copy link


Copy Markdown

Contributor
Tagging subscribers to this area: @agocke, @dotnet/ilc-contrib

See info in area-owners.md if you want to be subscribed.
CopilotAI
changed the title
[WIP] Fix PacStripPtr execution on tvOS without pointer authenticationUse hint-safe pointer authentication stripping in NativeAOTJul 10, 2026
CopilotAI
requested a review
from kotlarmilosJuly 10, 2026 11:12
@kotlarmilos
kotlarmilos
commented
Jul 10, 2026

Copy link


Copy Markdown

Member
/azp run runtime-extra-platforms
@azure-pipelines
azure-pipelinesBot
commented
Jul 10, 2026

Copy link


Copy Markdown


Azure Pipelines successfully started running 1 pipeline(s).
@jkotas
jkotas
commented
Jul 10, 2026

Copy link


Copy Markdown

Member
cc @SwapnilGaikwad
@SwapnilGaikwad
SwapnilGaikwad
commented
Jul 10, 2026

Copy link


Copy Markdown

Contributor
The fix LGTM!

It matches with the fix in asmhelpers.S/asm. Missed to update MiscStubsS/.asm‎
@SwapnilGaikwad
SwapnilGaikwad
commented
Jul 10, 2026

Copy link


Copy Markdown

Contributor
Failure seem unrelated, no SIGILL or Illegal Instruction failures.
@kotlarmilos
kotlarmilos
marked this pull request as ready for review
July 10, 2026 15:54
CopilotAI
review requested due to automatic review settings
July 10, 2026 15:54
CopilotAI
reviewed
Jul 10, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Updates NativeAOT’s ARM64 PacStripPtr helper to use the same hint-safe pointer-authentication stripping sequence used by CoreCLR, avoiding execution of xpaci x0 and instead using xpaclri while preserving the caller’s lr.
Changes:
  • Replace the Unix ARM64 PacStripPtr leaf stub (xpaci x0; ret) with a nested prolog/epilog that saves fp/lr, routes the input pointer through lr, executes xpaclri, and returns the stripped pointer in x0.
  • Apply the same change to the Windows ARM64 stub, encoding xpaclri as a raw instruction word (consistent with existing PAC instruction encoding patterns in that file).
Show a summary per file
FileDescription
src/coreclr/nativeaot/Runtime/arm64/MiscStubs.SSwitches PacStripPtr to a CoreCLR-matching, hint-safe xpaclri sequence with proper lr preservation/unwind-friendly prolog/epilog.
src/coreclr/nativeaot/Runtime/arm64/MiscStubs.asmMirrors the same PacStripPtr update for Windows ARM64, using DCD 0xD50320FF for xpaclri.
Copilot's findings
  • Files reviewed: 2/2 changed files
  • Comments generated: 0
@build-analysisbuild-analysisBot
mentioned this pull request
Jul 10, 2026

Open

3 tasks

This was referenced Jul 10, 2026

Open


Closed

@kotlarmilos
kotlarmilos
commented
Jul 10, 2026

Copy link


Copy Markdown

Member
Failure seem unrelated, no SIGILL or Illegal Instruction failures.
Correct, no jobs reported SIGILL, EXC_BAD_INSTRUCTION, or signal 4.
@kotlarmilos
kotlarmilos
enabled auto-merge (squash)
July 10, 2026 16:22
@jkotas
jkotas
commented
Jul 10, 2026

Copy link


Copy Markdown

Member
/ba-g infrastructure timeouts
@kotlarmilos
kotlarmilos
merged commit 66cc35c
into
mainJul 10, 2026

133 of 152 checks passed

@kotlarmilos
kotlarmilos
deleted the

copilot/fix-pacstrip-ptr-issue

branch
July 10, 2026 23:26
@dotnet-maestrodotnet-maestroBot
mentioned this pull request
Jul 11, 2026
 Merged

@dotnet-milestone-botdotnet-milestone-botBot
added this to the 11.0-preview7 milestone
Jul 11, 2026
eiriktsarpalis pushed a commit
that referenced
this pull request
Jul 15, 2026
@kotlarmilos@eiriktsarpalis
Use hint-safe pointer authentication stripping in NativeAOT (#130474)
d1dac9f
<!-- -->
NativeAOT executed `xpaci` during arm64 GC stack walking, causing
`SIGILL` on tvOS devices without pointer authentication. This ports
CoreCLR’s hint-safe `PacStripPtr` implementation.
## Changes
- Preserve the caller’s `lr`.
- Move the pointer through `lr` and execute `xpaclri`.
- Return the stripped pointer through `x0`.
- Apply the change to Unix and Windows arm64 assembly stubs.
```asm
mov lr, x0
xpaclri
mov x0, lr
```
> [!NOTE]
> This description was generated by GitHub Copilot.
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: kotlarmilos <11523312+kotlarmilos@users.noreply.github.com>
@github-actionsgithub-actionsBot
locked and limited conversation to collaborators
Aug 11, 2026
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

Copilot code reviewCopilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@jkotasjkotasjkotas approved these changes
@kotlarmiloskotlarmilosAwaiting requested review from kotlarmilos
@MichalStrehovskyMichalStrehovskyAwaiting requested review from MichalStrehovskyMichalStrehovsky is a code owner

Assignees

@kotlarmiloskotlarmilos
Copilot code reviewCopilot

Labels

arch-arm64area-NativeAOT-coreclr

Projects


None yet


Milestone

11.0-preview7

Development

Successfully merging this pull request may close these issues.

[NativeAOT][tvOS] PacStripPtr executes xpaci on devices without pointer authentication


5 participants

@kotlarmilos@jkotas@SwapnilGaikwad

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '
Use hint-safe pointer authentication stripping in NativeAOT by Copilot · Pull Request #130474 · dotnet/runtime · GitHub
Skip to content
Use hint-safe pointer authentication stripping in NativeAOT - #130474
Merged
kotlarmilos merged 2 commits into
mainfrom 
copilot/fix-pacstrip-ptr-issue
Jul 10, 2026
Merged
Use hint-safe pointer authentication stripping in NativeAOT#130474
kotlarmilos merged 2 commits into
mainfrom 
copilot/fix-pacstrip-ptr-issue
Conversation
CopilotAI
commented
Jul 10, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
NativeAOT executed xpaci during arm64 GC stack walking, causing SIGILL on tvOS devices without pointer authentication. This ports CoreCLR’s hint-safe PacStripPtr implementation.
Changes
  • Preserve the caller’s lr.
  • Move the pointer through lr and execute xpaclri.
  • Return the stripped pointer through x0.
  • Apply the change to Unix and Windows arm64 assembly stubs.
mov lr, x0xpaclrimov x0, lr
Note
This description was generated by GitHub Copilot.
CopilotAI
requested review from
Copilot
and removed request for
CopilotJuly 10, 2026 10:38
CopilotAI
linked an issue
Jul 10, 2026
that may be
closed
by this pull request


[NativeAOT][tvOS] PacStripPtr executes xpaci on devices without pointer authentication
#130470

Closed

@kotlarmilos
Use hint-safe PAC stripping in NativeAOT
7208134
Co-authored-by: kotlarmilos <11523312+kotlarmilos@users.noreply.github.com>
CopilotAI
requested review from
Copilot
and removed request for
CopilotJuly 10, 2026 11:06
@dotnet-policy-service
dotnet-policy-serviceBot
commented
Jul 10, 2026

Copy link


Copy Markdown

Contributor
Tagging subscribers to this area: @agocke, @dotnet/ilc-contrib

See info in area-owners.md if you want to be subscribed.
CopilotAI
changed the title
[WIP] Fix PacStripPtr execution on tvOS without pointer authenticationUse hint-safe pointer authentication stripping in NativeAOTJul 10, 2026
CopilotAI
requested a review
from kotlarmilosJuly 10, 2026 11:12
@kotlarmilos
kotlarmilos
commented
Jul 10, 2026

Copy link


Copy Markdown

Member
/azp run runtime-extra-platforms
@azure-pipelines
azure-pipelinesBot
commented
Jul 10, 2026

Copy link


Copy Markdown


Azure Pipelines successfully started running 1 pipeline(s).
@jkotas
jkotas
commented
Jul 10, 2026

Copy link


Copy Markdown

Member
cc @SwapnilGaikwad
@SwapnilGaikwad
SwapnilGaikwad
commented
Jul 10, 2026

Copy link


Copy Markdown

Contributor
The fix LGTM!

It matches with the fix in asmhelpers.S/asm. Missed to update MiscStubsS/.asm‎
@SwapnilGaikwad
SwapnilGaikwad
commented
Jul 10, 2026

Copy link


Copy Markdown

Contributor
Failure seem unrelated, no SIGILL or Illegal Instruction failures.
@kotlarmilos
kotlarmilos
marked this pull request as ready for review
July 10, 2026 15:54
CopilotAI
review requested due to automatic review settings
July 10, 2026 15:54
CopilotAI
reviewed
Jul 10, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Updates NativeAOT’s ARM64 PacStripPtr helper to use the same hint-safe pointer-authentication stripping sequence used by CoreCLR, avoiding execution of xpaci x0 and instead using xpaclri while preserving the caller’s lr.
Changes:
  • Replace the Unix ARM64 PacStripPtr leaf stub (xpaci x0; ret) with a nested prolog/epilog that saves fp/lr, routes the input pointer through lr, executes xpaclri, and returns the stripped pointer in x0.
  • Apply the same change to the Windows ARM64 stub, encoding xpaclri as a raw instruction word (consistent with existing PAC instruction encoding patterns in that file).
Show a summary per file
FileDescription
src/coreclr/nativeaot/Runtime/arm64/MiscStubs.SSwitches PacStripPtr to a CoreCLR-matching, hint-safe xpaclri sequence with proper lr preservation/unwind-friendly prolog/epilog.
src/coreclr/nativeaot/Runtime/arm64/MiscStubs.asmMirrors the same PacStripPtr update for Windows ARM64, using DCD 0xD50320FF for xpaclri.
Copilot's findings
  • Files reviewed: 2/2 changed files
  • Comments generated: 0
@build-analysisbuild-analysisBot
mentioned this pull request
Jul 10, 2026

Open

3 tasks

This was referenced Jul 10, 2026

Open


Closed

@kotlarmilos
kotlarmilos
commented
Jul 10, 2026

Copy link


Copy Markdown

Member
Failure seem unrelated, no SIGILL or Illegal Instruction failures.
Correct, no jobs reported SIGILL, EXC_BAD_INSTRUCTION, or signal 4.
@kotlarmilos
kotlarmilos
enabled auto-merge (squash)
July 10, 2026 16:22
@jkotas
jkotas
commented
Jul 10, 2026

Copy link


Copy Markdown

Member
/ba-g infrastructure timeouts
@kotlarmilos
kotlarmilos
merged commit 66cc35c
into
mainJul 10, 2026

133 of 152 checks passed

@kotlarmilos
kotlarmilos
deleted the

copilot/fix-pacstrip-ptr-issue

branch
July 10, 2026 23:26
@dotnet-maestrodotnet-maestroBot
mentioned this pull request
Jul 11, 2026
 Merged

@dotnet-milestone-botdotnet-milestone-botBot
added this to the 11.0-preview7 milestone
Jul 11, 2026
eiriktsarpalis pushed a commit
that referenced
this pull request
Jul 15, 2026
@kotlarmilos@eiriktsarpalis
Use hint-safe pointer authentication stripping in NativeAOT (#130474)
d1dac9f
<!-- -->
NativeAOT executed `xpaci` during arm64 GC stack walking, causing
`SIGILL` on tvOS devices without pointer authentication. This ports
CoreCLR’s hint-safe `PacStripPtr` implementation.
## Changes
- Preserve the caller’s `lr`.
- Move the pointer through `lr` and execute `xpaclri`.
- Return the stripped pointer through `x0`.
- Apply the change to Unix and Windows arm64 assembly stubs.
```asm
mov lr, x0
xpaclri
mov x0, lr
```
> [!NOTE]
> This description was generated by GitHub Copilot.
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: kotlarmilos <11523312+kotlarmilos@users.noreply.github.com>
@github-actionsgithub-actionsBot
locked and limited conversation to collaborators
Aug 11, 2026
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

Copilot code reviewCopilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@jkotasjkotasjkotas approved these changes
@kotlarmiloskotlarmilosAwaiting requested review from kotlarmilos
@MichalStrehovskyMichalStrehovskyAwaiting requested review from MichalStrehovskyMichalStrehovsky is a code owner

Assignees

@kotlarmiloskotlarmilos
Copilot code reviewCopilot

Labels

arch-arm64area-NativeAOT-coreclr

Projects


None yet


Milestone

11.0-preview7

Development

Successfully merging this pull request may close these issues.

[NativeAOT][tvOS] PacStripPtr executes xpaci on devices without pointer authentication


5 participants

@kotlarmilos@jkotas@SwapnilGaikwad

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Use hint-safe pointer authentication stripping in NativeAOT by Copilot · Pull Request #130474 · dotnet/runtime · GitHub
Skip to content
Use hint-safe pointer authentication stripping in NativeAOT - #130474
Merged
kotlarmilos merged 2 commits into
mainfrom 
copilot/fix-pacstrip-ptr-issue
Jul 10, 2026
Merged
Use hint-safe pointer authentication stripping in NativeAOT#130474
kotlarmilos merged 2 commits into
mainfrom 
copilot/fix-pacstrip-ptr-issue
Conversation
CopilotAI
commented
Jul 10, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
NativeAOT executed xpaci during arm64 GC stack walking, causing SIGILL on tvOS devices without pointer authentication. This ports CoreCLR’s hint-safe PacStripPtr implementation.
Changes
  • Preserve the caller’s lr.
  • Move the pointer through lr and execute xpaclri.
  • Return the stripped pointer through x0.
  • Apply the change to Unix and Windows arm64 assembly stubs.
mov lr, x0xpaclrimov x0, lr
Note
This description was generated by GitHub Copilot.
CopilotAI
requested review from
Copilot
and removed request for
CopilotJuly 10, 2026 10:38
CopilotAI
linked an issue
Jul 10, 2026
that may be
closed
by this pull request


[NativeAOT][tvOS] PacStripPtr executes xpaci on devices without pointer authentication
#130470

Closed

@kotlarmilos
Use hint-safe PAC stripping in NativeAOT
7208134
Co-authored-by: kotlarmilos <11523312+kotlarmilos@users.noreply.github.com>
CopilotAI
requested review from
Copilot
and removed request for
CopilotJuly 10, 2026 11:06
@dotnet-policy-service
dotnet-policy-serviceBot
commented
Jul 10, 2026

Copy link


Copy Markdown

Contributor
Tagging subscribers to this area: @agocke, @dotnet/ilc-contrib

See info in area-owners.md if you want to be subscribed.
CopilotAI
changed the title
[WIP] Fix PacStripPtr execution on tvOS without pointer authenticationUse hint-safe pointer authentication stripping in NativeAOTJul 10, 2026
CopilotAI
requested a review
from kotlarmilosJuly 10, 2026 11:12
@kotlarmilos
kotlarmilos
commented
Jul 10, 2026

Copy link


Copy Markdown

Member
/azp run runtime-extra-platforms
@azure-pipelines
azure-pipelinesBot
commented
Jul 10, 2026

Copy link


Copy Markdown


Azure Pipelines successfully started running 1 pipeline(s).
@jkotas
jkotas
commented
Jul 10, 2026

Copy link


Copy Markdown

Member
cc @SwapnilGaikwad
@SwapnilGaikwad
SwapnilGaikwad
commented
Jul 10, 2026

Copy link


Copy Markdown

Contributor
The fix LGTM!

It matches with the fix in asmhelpers.S/asm. Missed to update MiscStubsS/.asm‎
@SwapnilGaikwad
SwapnilGaikwad
commented
Jul 10, 2026

Copy link


Copy Markdown

Contributor
Failure seem unrelated, no SIGILL or Illegal Instruction failures.
@kotlarmilos
kotlarmilos
marked this pull request as ready for review
July 10, 2026 15:54
CopilotAI
review requested due to automatic review settings
July 10, 2026 15:54
CopilotAI
reviewed
Jul 10, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Updates NativeAOT’s ARM64 PacStripPtr helper to use the same hint-safe pointer-authentication stripping sequence used by CoreCLR, avoiding execution of xpaci x0 and instead using xpaclri while preserving the caller’s lr.
Changes:
  • Replace the Unix ARM64 PacStripPtr leaf stub (xpaci x0; ret) with a nested prolog/epilog that saves fp/lr, routes the input pointer through lr, executes xpaclri, and returns the stripped pointer in x0.
  • Apply the same change to the Windows ARM64 stub, encoding xpaclri as a raw instruction word (consistent with existing PAC instruction encoding patterns in that file).
Show a summary per file
FileDescription
src/coreclr/nativeaot/Runtime/arm64/MiscStubs.SSwitches PacStripPtr to a CoreCLR-matching, hint-safe xpaclri sequence with proper lr preservation/unwind-friendly prolog/epilog.
src/coreclr/nativeaot/Runtime/arm64/MiscStubs.asmMirrors the same PacStripPtr update for Windows ARM64, using DCD 0xD50320FF for xpaclri.
Copilot's findings
  • Files reviewed: 2/2 changed files
  • Comments generated: 0
@build-analysisbuild-analysisBot
mentioned this pull request
Jul 10, 2026

Open

3 tasks

This was referenced Jul 10, 2026

Open


Closed

@kotlarmilos
kotlarmilos
commented
Jul 10, 2026

Copy link


Copy Markdown

Member
Failure seem unrelated, no SIGILL or Illegal Instruction failures.
Correct, no jobs reported SIGILL, EXC_BAD_INSTRUCTION, or signal 4.
@kotlarmilos
kotlarmilos
enabled auto-merge (squash)
July 10, 2026 16:22
@jkotas
jkotas
commented
Jul 10, 2026

Copy link


Copy Markdown

Member
/ba-g infrastructure timeouts
@kotlarmilos
kotlarmilos
merged commit 66cc35c
into
mainJul 10, 2026

133 of 152 checks passed

@kotlarmilos
kotlarmilos
deleted the

copilot/fix-pacstrip-ptr-issue

branch
July 10, 2026 23:26
@dotnet-maestrodotnet-maestroBot
mentioned this pull request
Jul 11, 2026
 Merged

@dotnet-milestone-botdotnet-milestone-botBot
added this to the 11.0-preview7 milestone
Jul 11, 2026
eiriktsarpalis pushed a commit
that referenced
this pull request
Jul 15, 2026
@kotlarmilos@eiriktsarpalis
Use hint-safe pointer authentication stripping in NativeAOT (#130474)
d1dac9f
<!-- -->
NativeAOT executed `xpaci` during arm64 GC stack walking, causing
`SIGILL` on tvOS devices without pointer authentication. This ports
CoreCLR’s hint-safe `PacStripPtr` implementation.
## Changes
- Preserve the caller’s `lr`.
- Move the pointer through `lr` and execute `xpaclri`.
- Return the stripped pointer through `x0`.
- Apply the change to Unix and Windows arm64 assembly stubs.
```asm
mov lr, x0
xpaclri
mov x0, lr
```
> [!NOTE]
> This description was generated by GitHub Copilot.
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: kotlarmilos <11523312+kotlarmilos@users.noreply.github.com>
@github-actionsgithub-actionsBot
locked and limited conversation to collaborators
Aug 11, 2026
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

Copilot code reviewCopilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@jkotasjkotasjkotas approved these changes
@kotlarmiloskotlarmilosAwaiting requested review from kotlarmilos
@MichalStrehovskyMichalStrehovskyAwaiting requested review from MichalStrehovskyMichalStrehovsky is a code owner

Assignees

@kotlarmiloskotlarmilos
Copilot code reviewCopilot

Labels

arch-arm64area-NativeAOT-coreclr

Projects


None yet


Milestone

11.0-preview7

Development

Successfully merging this pull request may close these issues.

[NativeAOT][tvOS] PacStripPtr executes xpaci on devices without pointer authentication


5 participants

@kotlarmilos@jkotas@SwapnilGaikwad

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Use hint-safe pointer authentication stripping in NativeAOT by Copilot · Pull Request #130474 · dotnet/runtime · GitHub
Skip to content
Use hint-safe pointer authentication stripping in NativeAOT - #130474
Merged
kotlarmilos merged 2 commits into
mainfrom 
copilot/fix-pacstrip-ptr-issue
Jul 10, 2026
Merged
Use hint-safe pointer authentication stripping in NativeAOT#130474
kotlarmilos merged 2 commits into
mainfrom 
copilot/fix-pacstrip-ptr-issue
Conversation
CopilotAI
commented
Jul 10, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
NativeAOT executed xpaci during arm64 GC stack walking, causing SIGILL on tvOS devices without pointer authentication. This ports CoreCLR’s hint-safe PacStripPtr implementation.
Changes
  • Preserve the caller’s lr.
  • Move the pointer through lr and execute xpaclri.
  • Return the stripped pointer through x0.
  • Apply the change to Unix and Windows arm64 assembly stubs.
mov lr, x0xpaclrimov x0, lr
Note
This description was generated by GitHub Copilot.
CopilotAI
requested review from
Copilot
and removed request for
CopilotJuly 10, 2026 10:38
CopilotAI
linked an issue
Jul 10, 2026
that may be
closed
by this pull request


[NativeAOT][tvOS] PacStripPtr executes xpaci on devices without pointer authentication
#130470

Closed

@kotlarmilos
Use hint-safe PAC stripping in NativeAOT
7208134
Co-authored-by: kotlarmilos <11523312+kotlarmilos@users.noreply.github.com>
CopilotAI
requested review from
Copilot
and removed request for
CopilotJuly 10, 2026 11:06
@dotnet-policy-service
dotnet-policy-serviceBot
commented
Jul 10, 2026

Copy link


Copy Markdown

Contributor
Tagging subscribers to this area: @agocke, @dotnet/ilc-contrib

See info in area-owners.md if you want to be subscribed.
CopilotAI
changed the title
[WIP] Fix PacStripPtr execution on tvOS without pointer authenticationUse hint-safe pointer authentication stripping in NativeAOTJul 10, 2026
CopilotAI
requested a review
from kotlarmilosJuly 10, 2026 11:12
@kotlarmilos
kotlarmilos
commented
Jul 10, 2026

Copy link


Copy Markdown

Member
/azp run runtime-extra-platforms
@azure-pipelines
azure-pipelinesBot
commented
Jul 10, 2026

Copy link


Copy Markdown


Azure Pipelines successfully started running 1 pipeline(s).
@jkotas
jkotas
commented
Jul 10, 2026

Copy link


Copy Markdown

Member
cc @SwapnilGaikwad
@SwapnilGaikwad
SwapnilGaikwad
commented
Jul 10, 2026

Copy link


Copy Markdown

Contributor
The fix LGTM!

It matches with the fix in asmhelpers.S/asm. Missed to update MiscStubsS/.asm‎
@SwapnilGaikwad
SwapnilGaikwad
commented
Jul 10, 2026

Copy link


Copy Markdown

Contributor
Failure seem unrelated, no SIGILL or Illegal Instruction failures.
@kotlarmilos
kotlarmilos
marked this pull request as ready for review
July 10, 2026 15:54
CopilotAI
review requested due to automatic review settings
July 10, 2026 15:54
CopilotAI
reviewed
Jul 10, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Updates NativeAOT’s ARM64 PacStripPtr helper to use the same hint-safe pointer-authentication stripping sequence used by CoreCLR, avoiding execution of xpaci x0 and instead using xpaclri while preserving the caller’s lr.
Changes:
  • Replace the Unix ARM64 PacStripPtr leaf stub (xpaci x0; ret) with a nested prolog/epilog that saves fp/lr, routes the input pointer through lr, executes xpaclri, and returns the stripped pointer in x0.
  • Apply the same change to the Windows ARM64 stub, encoding xpaclri as a raw instruction word (consistent with existing PAC instruction encoding patterns in that file).
Show a summary per file
FileDescription
src/coreclr/nativeaot/Runtime/arm64/MiscStubs.SSwitches PacStripPtr to a CoreCLR-matching, hint-safe xpaclri sequence with proper lr preservation/unwind-friendly prolog/epilog.
src/coreclr/nativeaot/Runtime/arm64/MiscStubs.asmMirrors the same PacStripPtr update for Windows ARM64, using DCD 0xD50320FF for xpaclri.
Copilot's findings
  • Files reviewed: 2/2 changed files
  • Comments generated: 0
@build-analysisbuild-analysisBot
mentioned this pull request
Jul 10, 2026

Open

3 tasks

This was referenced Jul 10, 2026

Open


Closed

@kotlarmilos
kotlarmilos
commented
Jul 10, 2026

Copy link


Copy Markdown

Member
Failure seem unrelated, no SIGILL or Illegal Instruction failures.
Correct, no jobs reported SIGILL, EXC_BAD_INSTRUCTION, or signal 4.
@kotlarmilos
kotlarmilos
enabled auto-merge (squash)
July 10, 2026 16:22
@jkotas
jkotas
commented
Jul 10, 2026

Copy link


Copy Markdown

Member
/ba-g infrastructure timeouts
@kotlarmilos
kotlarmilos
merged commit 66cc35c
into
mainJul 10, 2026

133 of 152 checks passed

@kotlarmilos
kotlarmilos
deleted the

copilot/fix-pacstrip-ptr-issue

branch
July 10, 2026 23:26
@dotnet-maestrodotnet-maestroBot
mentioned this pull request
Jul 11, 2026
 Merged

@dotnet-milestone-botdotnet-milestone-botBot
added this to the 11.0-preview7 milestone
Jul 11, 2026
eiriktsarpalis pushed a commit
that referenced
this pull request
Jul 15, 2026
@kotlarmilos@eiriktsarpalis
Use hint-safe pointer authentication stripping in NativeAOT (#130474)
d1dac9f
<!-- -->
NativeAOT executed `xpaci` during arm64 GC stack walking, causing
`SIGILL` on tvOS devices without pointer authentication. This ports
CoreCLR’s hint-safe `PacStripPtr` implementation.
## Changes
- Preserve the caller’s `lr`.
- Move the pointer through `lr` and execute `xpaclri`.
- Return the stripped pointer through `x0`.
- Apply the change to Unix and Windows arm64 assembly stubs.
```asm
mov lr, x0
xpaclri
mov x0, lr
```
> [!NOTE]
> This description was generated by GitHub Copilot.
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: kotlarmilos <11523312+kotlarmilos@users.noreply.github.com>
@github-actionsgithub-actionsBot
locked and limited conversation to collaborators
Aug 11, 2026
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

Copilot code reviewCopilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@jkotasjkotasjkotas approved these changes
@kotlarmiloskotlarmilosAwaiting requested review from kotlarmilos
@MichalStrehovskyMichalStrehovskyAwaiting requested review from MichalStrehovskyMichalStrehovsky is a code owner

Assignees

@kotlarmiloskotlarmilos
Copilot code reviewCopilot

Labels

arch-arm64area-NativeAOT-coreclr

Projects


None yet


Milestone

11.0-preview7

Development

Successfully merging this pull request may close these issues.

[NativeAOT][tvOS] PacStripPtr executes xpaci on devices without pointer authentication


5 participants

@kotlarmilos@jkotas@SwapnilGaikwad

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();
Use hint-safe pointer authentication stripping in NativeAOT by Copilot · Pull Request #130474 · dotnet/runtime · GitHub
Skip to content
Use hint-safe pointer authentication stripping in NativeAOT - #130474
Merged
kotlarmilos merged 2 commits into
mainfrom 
copilot/fix-pacstrip-ptr-issue
Jul 10, 2026
Merged
Use hint-safe pointer authentication stripping in NativeAOT#130474
kotlarmilos merged 2 commits into
mainfrom 
copilot/fix-pacstrip-ptr-issue
Conversation
CopilotAI
commented
Jul 10, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
NativeAOT executed xpaci during arm64 GC stack walking, causing SIGILL on tvOS devices without pointer authentication. This ports CoreCLR’s hint-safe PacStripPtr implementation.
Changes
  • Preserve the caller’s lr.
  • Move the pointer through lr and execute xpaclri.
  • Return the stripped pointer through x0.
  • Apply the change to Unix and Windows arm64 assembly stubs.
mov lr, x0xpaclrimov x0, lr
Note
This description was generated by GitHub Copilot.
CopilotAI
requested review from
Copilot
and removed request for
CopilotJuly 10, 2026 10:38
CopilotAI
linked an issue
Jul 10, 2026
that may be
closed
by this pull request


[NativeAOT][tvOS] PacStripPtr executes xpaci on devices without pointer authentication
#130470

Closed

@kotlarmilos
Use hint-safe PAC stripping in NativeAOT
7208134
Co-authored-by: kotlarmilos <11523312+kotlarmilos@users.noreply.github.com>
CopilotAI
requested review from
Copilot
and removed request for
CopilotJuly 10, 2026 11:06
@dotnet-policy-service
dotnet-policy-serviceBot
commented
Jul 10, 2026

Copy link


Copy Markdown

Contributor
Tagging subscribers to this area: @agocke, @dotnet/ilc-contrib

See info in area-owners.md if you want to be subscribed.
CopilotAI
changed the title
[WIP] Fix PacStripPtr execution on tvOS without pointer authenticationUse hint-safe pointer authentication stripping in NativeAOTJul 10, 2026
CopilotAI
requested a review
from kotlarmilosJuly 10, 2026 11:12
@kotlarmilos
kotlarmilos
commented
Jul 10, 2026

Copy link


Copy Markdown

Member
/azp run runtime-extra-platforms
@azure-pipelines
azure-pipelinesBot
commented
Jul 10, 2026

Copy link


Copy Markdown


Azure Pipelines successfully started running 1 pipeline(s).
@jkotas
jkotas
commented
Jul 10, 2026

Copy link


Copy Markdown

Member
cc @SwapnilGaikwad
@SwapnilGaikwad
SwapnilGaikwad
commented
Jul 10, 2026

Copy link


Copy Markdown

Contributor
The fix LGTM!

It matches with the fix in asmhelpers.S/asm. Missed to update MiscStubsS/.asm‎
@SwapnilGaikwad
SwapnilGaikwad
commented
Jul 10, 2026

Copy link


Copy Markdown

Contributor
Failure seem unrelated, no SIGILL or Illegal Instruction failures.
@kotlarmilos
kotlarmilos
marked this pull request as ready for review
July 10, 2026 15:54
CopilotAI
review requested due to automatic review settings
July 10, 2026 15:54
CopilotAI
reviewed
Jul 10, 2026
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview
Updates NativeAOT’s ARM64 PacStripPtr helper to use the same hint-safe pointer-authentication stripping sequence used by CoreCLR, avoiding execution of xpaci x0 and instead using xpaclri while preserving the caller’s lr.
Changes:
  • Replace the Unix ARM64 PacStripPtr leaf stub (xpaci x0; ret) with a nested prolog/epilog that saves fp/lr, routes the input pointer through lr, executes xpaclri, and returns the stripped pointer in x0.
  • Apply the same change to the Windows ARM64 stub, encoding xpaclri as a raw instruction word (consistent with existing PAC instruction encoding patterns in that file).
Show a summary per file
FileDescription
src/coreclr/nativeaot/Runtime/arm64/MiscStubs.SSwitches PacStripPtr to a CoreCLR-matching, hint-safe xpaclri sequence with proper lr preservation/unwind-friendly prolog/epilog.
src/coreclr/nativeaot/Runtime/arm64/MiscStubs.asmMirrors the same PacStripPtr update for Windows ARM64, using DCD 0xD50320FF for xpaclri.
Copilot's findings
  • Files reviewed: 2/2 changed files
  • Comments generated: 0
@build-analysisbuild-analysisBot
mentioned this pull request
Jul 10, 2026

Open

3 tasks

This was referenced Jul 10, 2026

Open


Closed

@kotlarmilos
kotlarmilos
commented
Jul 10, 2026

Copy link


Copy Markdown

Member
Failure seem unrelated, no SIGILL or Illegal Instruction failures.
Correct, no jobs reported SIGILL, EXC_BAD_INSTRUCTION, or signal 4.
@kotlarmilos
kotlarmilos
enabled auto-merge (squash)
July 10, 2026 16:22
@jkotas
jkotas
commented
Jul 10, 2026

Copy link


Copy Markdown

Member
/ba-g infrastructure timeouts
@kotlarmilos
kotlarmilos
merged commit 66cc35c
into
mainJul 10, 2026

133 of 152 checks passed

@kotlarmilos
kotlarmilos
deleted the

copilot/fix-pacstrip-ptr-issue

branch
July 10, 2026 23:26
@dotnet-maestrodotnet-maestroBot
mentioned this pull request
Jul 11, 2026
 Merged

@dotnet-milestone-botdotnet-milestone-botBot
added this to the 11.0-preview7 milestone
Jul 11, 2026
eiriktsarpalis pushed a commit
that referenced
this pull request
Jul 15, 2026
@kotlarmilos@eiriktsarpalis
Use hint-safe pointer authentication stripping in NativeAOT (#130474)
d1dac9f
<!-- -->
NativeAOT executed `xpaci` during arm64 GC stack walking, causing
`SIGILL` on tvOS devices without pointer authentication. This ports
CoreCLR’s hint-safe `PacStripPtr` implementation.
## Changes
- Preserve the caller’s `lr`.
- Move the pointer through `lr` and execute `xpaclri`.
- Return the stripped pointer through `x0`.
- Apply the change to Unix and Windows arm64 assembly stubs.
```asm
mov lr, x0
xpaclri
mov x0, lr
```
> [!NOTE]
> This description was generated by GitHub Copilot.
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: kotlarmilos <11523312+kotlarmilos@users.noreply.github.com>
@github-actionsgithub-actionsBot
locked and limited conversation to collaborators
Aug 11, 2026
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

Copilot code reviewCopilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@jkotasjkotasjkotas approved these changes
@kotlarmiloskotlarmilosAwaiting requested review from kotlarmilos
@MichalStrehovskyMichalStrehovskyAwaiting requested review from MichalStrehovskyMichalStrehovsky is a code owner

Assignees

@kotlarmiloskotlarmilos
Copilot code reviewCopilot

Labels

arch-arm64area-NativeAOT-coreclr

Projects


None yet


Milestone

11.0-preview7

Development

Successfully merging this pull request may close these issues.

[NativeAOT][tvOS] PacStripPtr executes xpaci on devices without pointer authentication


5 participants

@kotlarmilos@jkotas@SwapnilGaikwad