Generate calls to interface methods through resolve helper #122639

MichalStrehovsky · 2025-12-18T13:45:22Z

Successor of #112406. That branch has way too many merge conflicts, so leaving the PR as-is for posterity and starting a new one with a clean slate (I basically manually ported everything).

This changes interface calls when CFG is enabled to use a resolve helper instead of the stub dispatcher. I've also extended the CFG testing a bit to cover more of interface calls in the smoke test.

static int Call(IFoo f, int x, int y) => f.Call(x, y);

Before this change:

00007FF605971D50  push        rbx
00007FF605971D51  sub         rsp,20h
00007FF605971D55  mov         qword ptr [rsp+30h],rcx
00007FF605971D5A  mov         r10d,edx
00007FF605971D5D  mov         ebx,r8d
00007FF605971D60  mov         rcx,qword ptr [__InterfaceDispatchCell_repro_Program_IFoo__Call_repro_Program__Call (07FF6059BEBD0h)]
00007FF605971D67  call        qword ptr [__guard_check_icall_fptr (07FF6059CD558h)]
00007FF605971D6D  mov         rax,rcx
00007FF605971D70  mov         rcx,qword ptr [rsp+30h]
00007FF605971D75  mov         r8d,ebx
00007FF605971D78  mov         edx,r10d
00007FF605971D7B  lea         r10,[__InterfaceDispatchCell_repro_Program_IFoo__Call_repro_Program__Call (07FF6059BEBD0h)]
00007FF605971D82  call        rax
00007FF605971D84  nop
00007FF605971D85  add         rsp,20h
00007FF605971D89  pop         rbx
00007FF605971D8A  ret

After this change:

00007FF704181CF0  sub         rsp,28h
00007FF704181CF4  lea         r10,[__InterfaceDispatchCell_repro_Program_IFoo__Call_repro_Program__Call (07FF7041CEBD0h)]
00007FF704181CFB  call        RhpResolveInterfaceMethodFast (07FF703FFF5A0h)
00007FF704181D00  call        qword ptr [__guard_dispatch_icall_fptr (07FF7041DD560h)]
00007FF704181D06  nop
00007FF704181D07  add         rsp,28h
00007FF704181D0B  ret

Cc @dotnet/ilc-contrib @jakobbotsch

Successor of dotnet#112406. That branch has way too many merge conflicts, so leaving the PR as-is for posterity and starting a new one with a clean slate (I basically manually ported everything). This changes interface calls when CFG is enabled to use a resolve helper instead of the stub dispatcher. I've also extended the CFG testing a bit to cover more of interface calls in the smoke test. ```csharp static int Call(IFoo f, int x, int y) => f.Call(x, y); ``` Before this change: ``` 00007FF605971D50 push rbx 00007FF605971D51 sub rsp,20h 00007FF605971D55 mov qword ptr [rsp+30h],rcx 00007FF605971D5A mov r10d,edx 00007FF605971D5D mov ebx,r8d 00007FF605971D60 mov rcx,qword ptr [__InterfaceDispatchCell_repro_Program_IFoo__Call_repro_Program__Call (07FF6059BEBD0h)] 00007FF605971D67 call qword ptr [__guard_check_icall_fptr (07FF6059CD558h)] 00007FF605971D6D mov rax,rcx 00007FF605971D70 mov rcx,qword ptr [rsp+30h] 00007FF605971D75 mov r8d,ebx 00007FF605971D78 mov edx,r10d 00007FF605971D7B lea r10,[__InterfaceDispatchCell_repro_Program_IFoo__Call_repro_Program__Call (07FF6059BEBD0h)] 00007FF605971D82 call rax 00007FF605971D84 nop 00007FF605971D85 add rsp,20h 00007FF605971D89 pop rbx 00007FF605971D8A ret ``` After this change: ``` 00007FF704181CF0 sub rsp,28h 00007FF704181CF4 lea r10,[__InterfaceDispatchCell_repro_Program_IFoo__Call_repro_Program__Call (07FF7041CEBD0h)] 00007FF704181CFB call RhpResolveInterfaceMethodFast (07FF703FFF5A0h) 00007FF704181D00 call qword ptr [__guard_dispatch_icall_fptr (07FF7041DD560h)] 00007FF704181D06 nop 00007FF704181D07 add rsp,28h 00007FF704181D0B ret ```

MichalStrehovsky · 2025-12-18T13:46:15Z

src/coreclr/vm/virtualcallstub.cpp

+
+    pSDFrame->SetCallSite(NULL, (TADDR)callSite.GetIndirectCell());
+
+    DispatchToken representativeToken = DispatchToken(VirtualCallStubManager::GetTokenFromStub(callSite.GetSiteTarget(), NULL));


I added the , NULL part because we now need to provide some context, but it doesn't seem necessary here.

If cachedInterfaceDispatch is enabled for coreclr, then you definitely need to pass something here, as GetTokenFromStub will unconditionally read from the CONTEXT passed in to find the indirection cell. Possibly you could add a new method in parallel to GetTokenFromStub which called something like GetTokenFromStubAndIndirectionCell, which took the indirection cell pointer instead of pulling it out of a CONTEXT?

Thank you! I tried adding the new API and it does find a token that seems valid but under dotnet_jitforcecontrolflowguard=1/dotnet_usecachedinterfacedispatch=1 we then assert here because we can't find a VirtualCallStubManager:

runtime/src/coreclr/vm/virtualcallstub.cpp

Lines 1767 to 1768 in 6646b0e

VirtualCallStubManager *pMgr = VirtualCallStubManager::FindStubManager(callSiteTarget, &stubKind);

_ASSERTE(pMgr != NULL);

Copilot

Pull request overview

This PR changes interface calls when Control Flow Guard (CFG) is enabled to use a resolve helper (CORINFO_HELP_INTERFACELOOKUP_FOR_SLOT) instead of the stub dispatcher. The implementation adds a fast path for interface dispatch resolution on Windows for AMD64 and ARM64 architectures, improving performance while maintaining CFG security guarantees.

Introduces new helper RhpResolveInterfaceMethodFast for NativeAOT and VSD_ResolveWorkerForInterfaceLookupSlot for CoreCLR to resolve interface methods with inline cache lookup
Modifies JIT lowering to route virtual stub calls through the resolver when CFG is enabled, eliminating double indirection
Adds comprehensive test coverage for interface dispatch scenarios including exception handling and null reference checks

Reviewed changes

Copilot reviewed 30 out of 30 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/tests/nativeaot/SmokeTests/ControlFlowGuard/ControlFlowGuard.cs	Adds test cases for interface dispatch with CFG, including generic and non-generic interfaces, multiple implementations, and exception scenarios
src/coreclr/vm/virtualcallstub.h	Declares new `VSD_ResolveWorkerForInterfaceLookupSlot` function for interface method resolution
src/coreclr/vm/virtualcallstub.cpp	Implements the new resolver worker that handles interface dispatch with null checking and cache resolution
src/coreclr/vm/jithelpers.cpp	Adds external declaration for `JIT_InterfaceLookupForSlot` helper
src/coreclr/vm/contractimpl.h	Removes INVALID_TOKEN consistency check from DispatchToken constructor
src/coreclr/vm/amd64/cgenamd64.cpp	Adds `UpdateRegDisplayFromArgumentRegisters` to preserve argument registers for stack walking
src/coreclr/vm/amd64/VirtualCallStubAMD64.asm	Implements `JIT_InterfaceLookupForSlot` assembly stub for AMD64
src/coreclr/vm/amd64/AsmHelpers.asm	Removes stray TAILJMP_RAX instruction after epilog
src/coreclr/tools/aot/ILCompiler.RyuJit/JitInterface/CorInfoImpl.RyuJit.cs	Maps helper to `RhpResolveInterfaceMethodFast` runtime function for NativeAOT
src/coreclr/tools/Common/JitInterface/CorInfoHelpFunc.cs	Adds `CORINFO_HELP_INTERFACELOOKUP_FOR_SLOT` helper enum value
src/coreclr/nativeaot/Runtime/inc/rhbinder.h	Defines `IDC_CACHE_POINTER_MASK` constant for cache pointer masking
src/coreclr/nativeaot/Runtime/arm64/UniversalTransition.asm	Adds parameterized return behavior to support both tail-call and return-result modes
src/coreclr/nativeaot/Runtime/arm64/DispatchResolve.asm	Implements fast interface method resolution for ARM64 with cache lookup
src/coreclr/nativeaot/Runtime/amd64/UniversalTransition.asm	Adds parameterized exit sequence to universal transition macro
src/coreclr/nativeaot/Runtime/amd64/DispatchResolve.asm	Implements fast interface method resolution for AMD64 with polymorphic cache support
src/coreclr/nativeaot/Runtime/StackFrameIterator.cpp	Recognizes new universal transition return variants for stack unwinding
src/coreclr/nativeaot/Runtime/EHHelpers.cpp	Adds `RhpResolveInterfaceMethodFast` to AV-translation locations
src/coreclr/nativeaot/Runtime/CMakeLists.txt	Conditionally includes DispatchResolve.asm for Windows AMD64/ARM64 builds
src/coreclr/nativeaot/Runtime/AsmOffsets.h	Adds assembly offsets for interface dispatch cache structures
src/coreclr/jit/targetarm64.h	Defines register trash mask for the interface lookup helper on ARM64
src/coreclr/jit/targetamd64.h	Defines register trash mask for the interface lookup helper on AMD64
src/coreclr/jit/morph.cpp	Updates CFG handling to apply to all virtual calls, not just vtable calls
src/coreclr/jit/lower.cpp	Implements lowering logic to transform VSD calls into resolver calls when CFG is enabled, removes VSD cell argument, and updates call structure
src/coreclr/jit/gentree.h	Adds `RemoveLate` method declaration to CallArgs
src/coreclr/jit/gentree.cpp	Implements `RemoveLate` to remove arguments from both early and late argument lists
src/coreclr/jit/emit.cpp	Treats interface lookup helper specially to preserve argument registers during GC
src/coreclr/jit/codegencommon.cpp	Defines helper kill set for interface lookup and marks it as needing label definition
src/coreclr/inc/jithelpers.h	Maps `CORINFO_HELP_INTERFACELOOKUP_FOR_SLOT` to `JIT_InterfaceLookupForSlot` for AMD64
src/coreclr/inc/jiteeversionguid.h	Updates JIT/EE version GUID to reflect interface changes
src/coreclr/inc/corinfo.h	Adds `CORINFO_HELP_INTERFACELOOKUP_FOR_SLOT` helper function enum

Comments suppressed due to low confidence (1)

src/coreclr/jit/lower.cpp:3759

This code block duplicates the logic already implemented in the cloneUse lambda function defined at lines 3630-3646. The call to cloneUse at line 3749 already handles the exact same logic as lines 3751-3759, making this code redundant. The result from cloneUse should be used directly without the additional if-else block.

        GenTree* indirCellClone = cloneUse(indirCellArgUse, cloneConsts);

        if (indirCellArgUse.Def()->OperIs(GT_LCL_VAR) || (cloneConsts && indirCellArgUse.Def()->IsCnsIntOrI()))
        {
            indirCellClone = comp->gtClone(indirCellArgUse.Def());
        }
        else
        {
            unsigned newLcl = indirCellArgUse.ReplaceWithLclVar(comp);
            indirCellClone  = comp->gtNewLclvNode(newLcl, TYP_I_IMPL);
        }

src/coreclr/vm/amd64/cgenamd64.cpp

Copilot · 2025-12-18T13:56:11Z

src/coreclr/vm/contractimpl.h

    }

    explicit DispatchToken(UINT_PTR token)
    {


The CONSISTENCY_CHECK assertion for the INVALID_TOKEN was removed from the DispatchToken constructor. This could allow invalid tokens to be created without detection. If this removal is intentional (e.g., to support a new use case where tokens can legitimately be INVALID_TOKEN), it should be documented with a comment explaining when and why an invalid token is acceptable.

Suggested change

{

{

LIMITED_METHOD_CONTRACT;

CONSISTENCY_CHECK(token != INVALID_TOKEN);

MichalStrehovsky · 2025-12-18T14:32:51Z

/azp run jit-cfg, runtime-nativeaot-outerloop

azure-pipelines · 2025-12-18T14:33:06Z

Azure Pipelines successfully started running 2 pipeline(s).

src/tests/nativeaot/SmokeTests/ControlFlowGuard/ControlFlowGuard.cs

jkotas · 2025-12-21T20:01:51Z

/azp run jit-cfg

azure-pipelines · 2025-12-21T20:02:01Z

Azure Pipelines successfully started running 1 pipeline(s).

jkotas · 2025-12-22T05:35:38Z

/azp run jit-cfg, runtime-nativeaot-outerloop

azure-pipelines · 2025-12-22T05:35:50Z

Azure Pipelines successfully started running 2 pipeline(s).

MichalStrehovsky · 2025-12-22T05:59:35Z

/azp run jit-cfg

azure-pipelines · 2025-12-22T05:59:45Z

Azure Pipelines successfully started running 1 pipeline(s).

MichalStrehovsky · 2025-12-22T06:00:53Z

/azp run jit-cfg

Had to retrigger this because if this is triggered "too fast" after pushing to a branch (up to 1 minute), devops will start running against old commit (I guess?) and then immediately cancel.

jkotas · 2025-12-22T14:49:42Z

src/coreclr/vm/arm64/asmhelpers.asm

+
+        EPILOG_WITH_TRANSITION_BLOCK_TAILCALL
+
+        EPILOG_NOP mov x0, x12


@jakobbotsch Would it make sense for the resolve helper to return the target address in x9 so that the JIT does not need to move the registers around before dispatching the call?

bl JIT_InterfaceLookupForSlot mov x9,x0 <- Avoid these moves mov x0,x4 <- bl JIT_DispatchIndirectCall

If we wanted to go further, we can even make JIT_InterfaceLookupForSlot tailcall the CFG validation or dispatch helpers.

jkotas · 2025-12-22T14:53:59Z

/azp run jit-cfg

azure-pipelines · 2025-12-22T14:54:08Z

Azure Pipelines successfully started running 1 pipeline(s).

jkotas · 2025-12-22T18:14:42Z

/azp run jit-cfg

azure-pipelines · 2025-12-22T18:14:53Z

Azure Pipelines successfully started running 1 pipeline(s).

MichalStrehovsky · 2025-12-22T22:12:29Z

/azp run jit-cfg

azure-pipelines · 2025-12-22T22:12:44Z

Azure Pipelines successfully started running 1 pipeline(s).

jkotas · 2025-12-23T08:59:52Z

This is passing all tests except the async one that looks like a JIT bug
A few comments above need resolving

am11 · 2025-12-24T23:48:43Z

The implementation adds a fast path for interface dispatch resolution on Windows for AMD64 and ARM64 architectures, improving performance while maintaining CFG security guarantees.

Will a similar fast path be implemented for Unix platforms as a follow-up task? Should we create a tracking issue for it?

jkotas · 2025-12-25T00:02:31Z

Will a similar fast path be implemented for Unix platforms as a follow-up task?

Control Flow Guard is Windows specific feature. It does not make sense to build it on non-Windows in .NET runtime. It would not have the OS support to plug into. PA and IBT makes more sense for non-Windows/Linux.

https://github.com/dotnet/designs/blob/main/accepted/2021/runtime-security-mitigations.md has details.

Copilot AI review requested due to automatic review settings December 18, 2025 13:45

MichalStrehovsky added the area-NativeAOT-coreclr label Dec 18, 2025

dotnet-policy-service bot assigned MichalStrehovsky Dec 18, 2025

MichalStrehovsky commented Dec 18, 2025

View reviewed changes

Copilot started reviewing on behalf of MichalStrehovsky December 18, 2025 13:46 View session

MichalStrehovsky mentioned this pull request Dec 18, 2025

Generate calls to interface methods through resolve helper #112406

Closed

Copilot AI reviewed Dec 18, 2025

View reviewed changes

Fix non-Windows

9531ff9

This was referenced Dec 18, 2025

Checkout failure: "Git fetch failed with exit code 128" dotnet/arcade#9009

Open

Unable to checkout dotnet/dnceng#4115

Open

davidwrighton reviewed Dec 18, 2025

View reviewed changes

src/tests/nativeaot/SmokeTests/ControlFlowGuard/ControlFlowGuard.cs Show resolved Hide resolved

jkotas added 2 commits December 18, 2025 19:43

Formatting

4c77f75

Fix double reporting

09b0ae8

Copilot AI mentioned this pull request Dec 21, 2025

Add CodePointerLookupFrame class for interface dispatch #122683

Closed

build-analysis bot mentioned this pull request Dec 21, 2025

[android] Android.Device_Emulator.JIT.Test failing on emulators with CoreCLR #112633

Open

jkotas added 3 commits December 21, 2025 11:11

Use a special frame to protect arguments

9268892

Add comment

6915a0d

Cleanup

43e2101

jkotas force-pushed the intfresolve branch from 17f86c6 to 43e2101 Compare December 21, 2025 19:30

dotnet deleted a comment from azure-pipelines bot Dec 21, 2025

This was referenced Dec 21, 2025

Unable to pull image from mcr.microsoft.com #117164

Open

System.Transactions.Tests.OleTxTests.Recovery timeout #122621

Open

jkotas mentioned this pull request Dec 21, 2025

Delete redundant RhpUniversalTransition #122689

Merged

Run cfg tests on Windows only

c726f08

Add Win Arm64 impl

6646b0e

jkotas added 2 commits December 22, 2025 06:07

Merge branch 'main' into intfresolve

5015e08

Fix build breaks

41d22be

jkotas reviewed Dec 22, 2025

View reviewed changes

build-analysis bot mentioned this pull request Dec 22, 2025

"We stopped hearing from agent Azure Pipelines 32. Verify the agent machine is running and has a healthy network connection" dotnet/dnceng#1886

Open

3 tasks

x8 too

124785a

jkotas force-pushed the intfresolve branch from a3e424f to 124785a Compare December 22, 2025 20:26


		pSDFrame->SetCallSite(NULL, (TADDR)callSite.GetIndirectCell());

		DispatchToken representativeToken = DispatchToken(VirtualCallStubManager::GetTokenFromStub(callSite.GetSiteTarget(), NULL));

	VirtualCallStubManager *pMgr = VirtualCallStubManager::FindStubManager(callSiteTarget, &stubKind);
	_ASSERTE(pMgr != NULL);

-    {
+    {
+        LIMITED_METHOD_CONTRACT;
+        CONSISTENCY_CHECK(token != INVALID_TOKEN);

Generate calls to interface methods through resolve helper #122639

Are you sure you want to change the base?

Generate calls to interface methods through resolve helper #122639

Uh oh!

Conversation

MichalStrehovsky commented Dec 18, 2025

Uh oh!

MichalStrehovsky Dec 18, 2025

Choose a reason for hiding this comment

Uh oh!

davidwrighton Dec 18, 2025

Choose a reason for hiding this comment

Uh oh!

MichalStrehovsky Dec 22, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Copilot AI Dec 18, 2025

Choose a reason for hiding this comment

Uh oh!

MichalStrehovsky commented Dec 18, 2025

Uh oh!

azure-pipelines bot commented Dec 18, 2025

Uh oh!

Uh oh!

jkotas commented Dec 21, 2025

Uh oh!

azure-pipelines bot commented Dec 21, 2025

Uh oh!

jkotas commented Dec 22, 2025

Uh oh!

azure-pipelines bot commented Dec 22, 2025

Uh oh!

MichalStrehovsky commented Dec 22, 2025

Uh oh!

azure-pipelines bot commented Dec 22, 2025

Uh oh!

MichalStrehovsky commented Dec 22, 2025

Uh oh!

jkotas Dec 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jkotas Dec 22, 2025

Choose a reason for hiding this comment

Uh oh!

jkotas commented Dec 22, 2025

Uh oh!

azure-pipelines bot commented Dec 22, 2025

Uh oh!

jkotas commented Dec 22, 2025

Uh oh!

azure-pipelines bot commented Dec 22, 2025

Uh oh!

MichalStrehovsky commented Dec 22, 2025

Uh oh!

azure-pipelines bot commented Dec 22, 2025

Uh oh!

jkotas commented Dec 23, 2025

Uh oh!

am11 commented Dec 24, 2025

Uh oh!

jkotas commented Dec 25, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

jkotas Dec 22, 2025 •

edited

Loading