RFR: 8277204: Implement PAC-RET branch protection on Linux/AArch64 [v25]

[Doug Simon]

On Mon, 6 Feb 2023 07:05:39 GMT, Hao Sun <haosun at openjdk.org> wrote:

>> src/hotspot/cpu/aarch64/vm_version_aarch64.cpp line 413:
>> 
>>> 411:   }
>>> 412: 
>>> 413:   if (UseBranchProtection == nullptr || strcmp(UseBranchProtection, "none") == 0) {
>> 
>> My understanding is that `UseBranchProtection` requires JIT compiler integration. This is currently missing in Graal. The logic that decides if it should be enabled by default needs to take JVMCI into consideration, much like the call to `JVMCIGlobals::check_jvmci_supported_gc` determines if JVMCI supports the configured GC.
>> 
>> Thanks to @gilles-duboscq for alerting me to this change.
>
> Thanks for reporting this. @dougxc 
> 
> Yes. I encountered several jtreg failures with Graal, which is built with PAC-RET enabled JDK.
> 
> As I see it, the straightforward fix is to disable JVMCI if `_rop_protection` is parsed as "true" finally, since Graal doesn't supports PAC-RET currently. 
> That is similar to the way `JVMCIGlobals::check_jvmci_supported_gc` does, i.e. if one GC except `G1/Serial/Parallel` is configured, we disable JVMCI.
> WDYT

The problem with `JVMCIGlobals::check_jvmci_supported_gc` is that it does not give the compiler a chance to specify whether it supports a given GC.
Instead, we want a JVMCI upcall like `jdk.vm.ci.hotspot.HotSpotJVMCIRuntime.isGCSupported(int)`.

-------------

PR: https://git.openjdk.org/jdk/pull/6334