> This patch enables PAC and AUT instructions for pointer signing and > authentication in JIT code on Windows/ARM64 when "UseBranchProtection" > flag is set and when the processor supports the feature. > > Specifically, JVM detects hardware support by reading ID_AA64ISAR1_EL1 > and ID_AA64ISAR2_EL1 registers via CP4031 and CP4032 keys in the Windows > registry. Then, if the "UseBranchProtection" flag is set, then HotSpot > emits the signing and authenticating instructions. Windows uses > AArch64's "B" key, so this patch selects between "paciaz" and "pacibz" > instructions (and similarly, between "autiaz" and "autibz" instructions) > depending on whether HotSpot is being compiled for Linux versus Windows. > Both the MacroAssembler and the Windows' PAC helpers need to stay in > sync, so this patch needs changes to both macroAssembler_aarch64.cpp as > well as pauth_windows_aarch64.inline.hpp. > > Since Linux supports both "A" as well as "B" keys, it's possible to use > "B" keys for both Linux and Windows, although I fear doing so may > introduce more churn in the code. > > This patch also introduces a cross-platform (Linux and Windows) test > that compiles and runs a method under both C1 and C2 before checking > whether the generated instructions include the "paci[ab]z" and the > "auti[ab]z" instructions. > > Since CI doesn't test with branch protection enabled, I manually changed > the default value of "UseBranchProtection" in globals_aarch64.cpp to be > "pac-ret" before running tier 1 through tier 3 tests in the HotSpot, > JDK, and LangTools test groups to ensure that this patch does not > introduce any new failures. I also validated this patch by running the > same tests with the default value for "UseBranchProtection". > > --------- > - [x] I confirm that I make this contribution in accordance with the [OpenJDK > Interim AI Policy](https://openjdk.org/legal/ai).
Ashay Rane has updated the pull request with a new target base due to a merge or a rebase. The incremental webrev excludes the unrelated changes brought in by the merge/rebase. The pull request contains six additional commits since the last revision: - Merge branch 'master' into JDK-8395991-windows-arm64-jit-pac-ret - Merge branch 'master' into JDK-8395991-windows-arm64-jit-pac-ret - Enable branch protection checks in CI build The intent behind this change is to make CI catch subtle bugs that corrupt return addresses. Whether the protection is actually enforced depends on whether the GitHub runner uses an AArch64 processor that supports pointer authentication. - Merge branch 'master' into JDK-8395991-windows-arm64-jit-pac-ret - Documentation updates - Include section numbers from ARM ISA document - Mark branch protection on Windows/ARM64 as supported - Enable pointer authentication for JIT code on Windows/ARM64 This patch enables PAC and AUT instructions for pointer signing and authentication in JIT code on Windows/ARM64 when "UseBranchProtection" flag is set and when the processor supports the feature. Specifically, JVM detects hardware support by reading ID_AA64ISAR1_EL1 and ID_AA64ISAR2_EL1 registers via CP4031 and CP4032 keys in the Windows registry. Then, if the "UseBranchProtection" flag is set, then HotSpot emits the signing and authenticating instructions. Windows uses AArch64's "B" key, so this patch selects between "paciaz" and "pacibz" instructions (and similarly, between "autiaz" and "autibz" instructions) depending on whether HotSpot is being compiled for Linux versus Windows. Both the MacroAssembler and the Windows' PAC helpers need to stay in sync, so this patch needs changes to both macroAssembler_aarch64.cpp as well as pauth_windows_aarch64.inline.hpp. Since Linux supports both "A" as well as "B" keys, it's possible to use "B" keys for both Linux and Windows, although I fear doing so may introduce more churn in the code. This patch also introduces a cross-platform (Linux and Windows) test that compiles and runs a method under both C1 and C2 before checking whether the generated instructions include the "paci[ab]z" and the "auti[ab]z" instructions. Since CI doesn't test with branch protection enabled, I manually changed the default value of "UseBranchProtection" in globals_aarch64.cpp to be "pac-ret" before running tier 1 through tier 3 tests in the HotSpot, JDK, and LangTools test groups to ensure that this patch does not introduce any new failures. I also validated this patch by running the same tests with the default value for "UseBranchProtection". ------------- Changes: - all: https://git.openjdk.org/jdk/pull/33595/files - new: https://git.openjdk.org/jdk/pull/33595/files/9e6b4c3b..e8111605 Webrevs: - full: https://webrevs.openjdk.org/?repo=jdk&pr=33595&range=04 - incr: https://webrevs.openjdk.org/?repo=jdk&pr=33595&range=03-04 Stats: 14125 lines in 453 files changed: 7620 ins; 566 del; 5939 mod Patch: https://git.openjdk.org/jdk/pull/33595.diff Fetch: git fetch https://git.openjdk.org/jdk.git pull/33595/head:pull/33595 PR: https://git.openjdk.org/jdk/pull/33595
