On Mon, 6 Jul 2026 17:52:58 GMT, Ashay Rane <[email protected]> wrote:
> This patch adds MSVC's "/guard:signret" flag to the C/C++ compilation
> flags so that the VM code includes signing and authentication
> instructions to ensure that the return address is not tampered by any
> callee. Specifically, MSVC chooses signing using the B key, so every
> non-leaf function starts with the `pacibsp` instruction (for signining
> the return address) and ends with the `autibsp` instruction (for
> authenticating the return address). Both `pacibsp` and `autibsp`
> instructions are in the NOP space, so older AArch64 processors that do
> not support these instructions shouldn't be impacted by these
> instructions.
>
> As a matter of slight detail, this patch adds the "/guard:signret" flag
> only when the OpenJDK build is passed the "--enable-branch-protection"
> flag, which is off by default. Consequently, this change will not
> impact ordinary builds of OpenJDK.
>
> I've validated this patch by running the test/jdk:tier{1,2,3},
> test/hotspot/jtreg:tier{1,2,3}, test/langtools:tier{1,2,3}, and
> test/lib-test:tier1 tests with branch protection enabled. This patch
> does not introduce any new failures.
>
> ---------
> - [x] I confirm that I make this contribution in accordance with the [OpenJDK
> Interim AI Policy](https://openjdk.org/legal/ai).
Seems reasonable. I have a couple of queries, but the approval needs to come
from @erikj79 .
make/autoconf/flags-cflags.m4 line 955:
> 953: FLAGS_COMPILER_CHECK_ARGUMENTS(ARGUMENT: [$BRANCH_PROTECTION_FLAG],
> 954: IF_TRUE: [BRANCH_PROTECTION_AVAILABLE=true])
> 955: elif test "x$TOOLCHAIN_TYPE" = xmicrosoft && test
> "x$OPENJDK_TARGET_OS" = xwindows; then
Is it possible for the toolchain type to be "microsoft" when the target OS is
not "windows"??
Related: the docs say this is/was Linux only, but the preceding logic does not
check the OS for gcc/clang. ??
make/autoconf/flags-other.m4 line 216:
> 214: # MSVC's assembler does not support branch protection flags.
> 215: test "x$TOOLCHAIN_TYPE" != xmicrosoft; then
> 216: $2JVM_ASFLAGS="${$2JVM_ASFLAGS} $BRANCH_PROTECTION_FLAG"
I wonder if it would be cleaner to separate the BP compiler flag from the BP
assembler flag? (E.g. we would define `BRANCH_PROTECTION_CFLAG` and
`BRANCH_PROTECTION_ASFLAG` separately and so avoid repeating platform/toolchain
checks.)
-------------
PR Review: https://git.openjdk.org/jdk/pull/31795#pullrequestreview-4640881026
PR Review Comment: https://git.openjdk.org/jdk/pull/31795#discussion_r3532970363
PR Review Comment: https://git.openjdk.org/jdk/pull/31795#discussion_r3532984882
