<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Please ignore the "Confidential - Oracle Restricted \Including External Recipients” text on the previous email - email client accidentally adding incorrect labels.</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
—Dan</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="mail-editor-reference-message-container">
<div class="ms-outlook-mobile-reference-message skipProofing" style="direction: ltr;">
</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="text-align: left; padding: 3pt 0in 0in; border-width: 1pt medium medium; border-style: solid none none; border-color: rgb(181, 196, 223) currentcolor currentcolor; font-family: Aptos; font-size: 12pt; color: black;">
<b>From: </b>leyden-dev <leyden-dev-retn@openjdk.org> on behalf of Dan Heidinga <dan.heidinga@oracle.com><br>
<b>Date: </b>Friday, February 20, 2026 at 10:14 AM<br>
<b>To: </b>Aman Sharma <amansha@kth.se>, leyden-dev@openjdk.org <leyden-dev@openjdk.org><br>
<b>Cc: </b>Martin Monperrus <monperrus@kth.se>, Benoit Baudry <benoit.baudry@umontreal.ca>, Roberto Castaneda Lozano <roberto.castaneda.lozano@oracle.com><br>
<b>Subject: </b>Re: Applying Software Supply Chain concepts to AOTCache/CDS<br>
<br>
</div>
<p class="ms-outlook-mobile-reference-message skipProofing" style="margin: 5pt; font-family: Calibri; font-size: 10pt; color: rgb(0, 0, 0);">
Confidential - Oracle Restricted \Including External Recipients</p>
<div class="ms-outlook-mobile-reference-message skipProofing" style="direction: ltr;">
<br>
</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi Aman,</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I’d suggest giving this a read as a starting point: <a href="https://openjdk.org/projects/leyden/notes/05-training-runs" data-outlook-id="6d3b1dce-5b37-4045-8266-2593279e5636">
https://openjdk.org/projects/leyden/notes/05-training-runs</a></div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Leyden’s model is that the AOTCache is application-specific. The more accurate - that is, the more representative of the production run - the training run is, the greater the benefit in production runs. To achieve this, Leyden ensures that classes used in
the production run are the same as the classes used in the training run as this allows us to side-step all kinds of versioning and compatibility issues. Library-specific caches don’t make sense in this model as the other classes - like JDK class - which are
used by a given library aren’t present (“owned”) by the jar and yet still need to be identical across uses.</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
The idea of combining caches does make sense when done carefully. The primary use case for this is frameworks - like Helidon, Micronaut, Spring, Quarkus, etc - that want to train their framework and have their uses train on top of the framework trained cache.
The document linked above calls that “linear training”, though I think we often use the term “iterative training” in our discussions.</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
The design builds on the previous levels being “the same” - the classes are the same for AOT Class loading and linking. AOT method profiling requires the classes to be “the same” so they profiles correctly apply. AOT code generation needs the classes and
profiles to be the same to generate the right code. Merging from different sources violates that “sameness” requirement.</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
—Dan</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="mail-editor-reference-message-container">
<div style="padding: 3pt 0in 0in; border-width: 1pt medium medium; border-style: solid none none; border-color: rgb(181, 196, 223) currentcolor currentcolor;">
<div class="ms-outlook-mobile-reference-message skipProofing" style="direction: ltr; text-align: left; font-family: Aptos; font-size: 12pt; color: black;">
<b><br>
</b></div>
<p class="ms-outlook-mobile-reference-message skipProofing" style="margin: 5pt; font-family: Calibri; font-size: 10pt; color: rgb(0, 0, 0);">
Confidential - Oracle Restricted \Including External Recipients</p>
<div class="ms-outlook-mobile-reference-message skipProofing" style="text-align: left; font-family: Aptos; font-size: 12pt; color: black;">
<b>From: </b>leyden-dev <leyden-dev-retn@openjdk.org> on behalf of Aman Sharma <amansha@kth.se><br>
<b>Date: </b>Tuesday, February 17, 2026 at 3:50 PM<br>
<b>To: </b>leyden-dev@openjdk.org <leyden-dev@openjdk.org><br>
<b>Cc: </b>Martin Monperrus <monperrus@kth.se>, Benoit Baudry <benoit.baudry@umontreal.ca>, Roberto Castaneda Lozano <roberto.castaneda.lozano@oracle.com><br>
<b>Subject: </b>Applying Software Supply Chain concepts to AOTCache/CDS<br>
<br>
</div>
</div>
<div id="divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:#000000; font-family:Garamond,Georgia,serif">
<p style="margin-top: 0px; margin-bottom: 0px;">Hi all,</p>
<p style="margin-top: 0px; margin-bottom: 0px;"><br>
</p>
<p style="margin-top: 0px; margin-bottom: 0px;">I want to attach the thread below since there is some context for what I will say next, and I believe it should be okay since the issue has been addressed in
<a href="https://github.com/openjdk/jdk/pull/29728" id="LPlnk457021" class="OWAAutoLink" data-outlook-id="66153b95-6a0c-4d8f-a584-906291b824e3" style="margin-top: 0px; margin-bottom: 0px;">
https://github.com/openjdk/jdk/pull/29728</a>.</p>
<p style="margin-top: 0px; margin-bottom: 0px;"><br>
</p>
<p style="margin-top: 0px; margin-bottom: 0px;">I want to explore the idea of sharing AOTCache as software supply chain artifact. Currently, Java packages are published on Maven Central and consumers can run them as applications or reuse them as libraries.
I am proposing that AOTCache is shared along with the Java package by the developer/publisher so that downstream consumers can use it to achieve optimal performance. They could either 1) use the AOTCache as-is for the corresponding application or the downstream
developer could 2) <i>merge the AOTCache from Maven Central with the AOTCache from their application.</i> In this way the distribution of AOTCache as a supply chain artifact can take place.</p>
<p style="margin-top: 0px; margin-bottom: 0px;"><br>
</p>
<p style="margin-top: 0px; margin-bottom: 0px;"><img src="cid:5f9ec946-9815-45e5-affa-da2032f00e67" id="img890783" style="max-width: 100%; margin-top: 0px; margin-bottom: 0px;"><br>
<br>
</p>
<p style="margin-top: 0px; margin-bottom: 0px;"><br>
</p>
<p style="margin-top: 0px; margin-bottom: 0px;">In this figure, each rectangle is a Java package, and each cylinder is an AOTCache. As you can see, the AOTCache of App (AOTApp) is generated by merging all its dependencies' caches.</p>
<p style="margin-top: 0px; margin-bottom: 0px;"><br>
</p>
<p style="margin-top: 0px; margin-bottom: 0px;">The thread below can also be summarised in a figure.</p>
<p style="margin-top: 0px; margin-bottom: 0px;"><img src="cid:1b52b633-5ec5-49b5-b5aa-ed4767298ee2" id="img630097" style="max-width: 100%; margin-top: 0px; margin-bottom: 0px;"></p>
<p style="margin-top: 0px; margin-bottom: 0px;">Basically, the red AOT11 contains a poisoned class that shares the fully qualified name with a class name in say D2. In this case, the App was loading the class from the AOTCache (AOTApp) instead the benign class
in D2.</p>
<p style="margin-top: 0px; margin-bottom: 0px;"><br>
</p>
<p style="margin-top: 0px; margin-bottom: 0px;">I think sharing AOTCache by developers is a good idea because:</p>
<ol start="1" style="margin-top: 0px; margin-bottom: 0px;">
<li>Developers would probably have a better idea of how well to exercise their application and hence their downstream consumer does not have to worry about creating an "ideal" workload.</li><li>Merging AOTCache in this way does not require creating complex workloads because your library code is already available in the AOTCache. You only need to add your own classes from the application.</li></ol>
<div style="direction: ltr;"><br>
</div>
<p style="margin-top: 0px; margin-bottom: 0px;"><br>
</p>
<p style="margin-top: 0px; margin-bottom: 0px;">Now, 1) "use the AOTCache as-is for the corresponding application" could be realized by developers pushing their AOTCache on Maven Central along with their jars. However, achieving 2 is non-trivial because merge
option is not available in the JVM.</p>
<p style="margin-top: 0px; margin-bottom: 0px;"><br>
</p>
<p style="margin-top: 0px; margin-bottom: 0px;">How have I tried to achieve merging:</p>
<ol start="1" style="margin-top: 0px; margin-bottom: 0px;">
<li>I first tried to create a parser for *.aot files. The idea was to <a href="https://github.com/chains-project/aotp/blob/main/src/main/java/io/github/chains_project/aotp/oops/klass/SPECIFICATION.md" class="OWAAutoLink" data-outlook-id="8c696166-cc97-423c-ac0c-2969841bae00">
deserialize this memory mapped file into objects declared by src/hotspot/share/oops</a>. And then do the merging using Java APIs I created. However, there were too many pointers that needed to be adjusted and I did not understand how I would parse or generate
the bitmap region.</li><li>I took a step back and tried to modify *.classlist files generated using CDS training run. Here I tried creating separate classlists for different submodules of
<a href="https://github.com/apache/pdfbox" class="OWAAutoLink" data-outlook-id="a6b65abe-b35e-4e6e-9549-219d44c088bd">
PDFBox</a> and then combining them manually. Then I created the CDS archive (.jsa file) using this "combined" classlist. During the production run, I could observe that some classes from different classlist were loaded from shared object files. (I had to disable
some checks for time and size of jar in JDK for this work). However, I am more inclined to have the AOTCache or CDS archive as an artifact which is distributed.</li><li> Now I am trying to patch JDK code with an option "-XX:+AOTMerge" which would work with "-XX:AOTCache"and this would return "merged.aot". To me, AOTCache is a dump of the memory so I think this is feasible. Given the size of JDK code and how sophisticated
HotSpot is, I can be completely wrong about this. I spun up a <a href="https://github.com/openjdk/jdk/commit/9d303022edfa6b67a895b7e826382bdbf246c230" class="OWAAutoLink" data-outlook-id="e48f77dd-7420-4a4b-9438-6edf38efe9e9">
blueprint for this feature</a> and now I am trying to use APIs like "AOTMetaspace::dump_static_archive(thread);" which, of course, end in SEGFaults. Can anyone please give me advice on how to go about implementing this feature? I can use some advice on how
exactly AOTCache is dumped.</li></ol>
<div style="direction: ltr;"><br>
</div>
<div>Caveats I have considered.</div>
<ol start="1" style="margin-top: 0px; margin-bottom: 0px;">
<li>I know AOTCaches and CDS archive are specific to a single JVM version, classpath, etc</li><li>The merged AOTCache may be too bloated.</li></ol>
<p style="margin-top: 0px; margin-bottom: 0px;">Yet I am motivated to explore more here.</p>
<p style="margin-top: 0px; margin-bottom: 0px;"><br>
</p>
<p style="margin-top: 0px; margin-bottom: 0px;">Please share your thoughts on this, and I would also love some technical advice. Thank you in advance!</p>
<p style="margin-top: 0px; margin-bottom: 0px;"><br>
</p>
<div id="Signature">
<div id="divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:rgb(0,0,0); font-family:Calibri,Helvetica,sans-serif,"EmojiFont","Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols">
<div id="m_4935352394101912768Signature">
<div style="margin-top: 0px; margin-bottom: 0px; font-family: Garamond, Georgia, serif; font-size: 12pt; color: rgb(0, 0, 0);">
Regards,</div>
<div style="margin-top: 0px; margin-bottom: 0px; font-family: Garamond, Georgia, serif; font-size: 12pt; color: rgb(0, 0, 0);">
Aman Sharma</div>
<span style="font-family: Arial, "Helvetica Neue", helvetica, sans-serif; font-size: 13px; color: rgb(128, 128, 128); background-color: rgb(255, 255, 255);"><br>
</span>
<div style="font-size: 13px; color: rgb(128, 128, 128);">PhD Student<br>
<span style="font-family: Arial, "Helvetica Neue", helvetica, sans-serif; background-color: rgb(255, 255, 255);">KTH Royal Institute of Technology</span><br>
<span style="font-family: Arial, "Helvetica Neue", helvetica, sans-serif; background-color: rgb(255, 255, 255);">School of Electrical Engineering and Computer Science (EECS)</span><br>
<span style="font-family: Arial, "Helvetica Neue", helvetica, sans-serif; background-color: rgb(255, 255, 255);">Department of Theoretical Computer Science (TCS)</span></div>
</div>
<a href="https://algomaster99.github.io/" id="LPNoLP" class="OWAAutoLink" data-outlook-id="45fac9c4-fe37-4927-9cb4-4c2bf03d6e04">https://algomaster99.github.io/</a><br>
</div>
</div>
<br>
<br>
<hr style="display: inline-block; width: 98%;">
<div id="divRplyFwdMsg" dir="ltr"><span style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);"><b>From:</b> Aman Sharma<br>
<b>Sent:</b> Friday, January 30, 2026 11:53 AM<br>
<b>To:</b> leyden-dev@openjdk.org<br>
<b>Cc:</b> Martin Monperrus; roberto.castaneda.lozano@oracle.com<br>
<b>Subject:</b> Integrity violation in AOTCache</span>
<div> </div>
</div>
<div id="divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:rgb(0,0,0); font-family:Garamond,Georgia,serif,"EmojiFont","Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols">
<div style="margin-top: 0px; margin-bottom: 0px; font-family: Garamond, Georgia, serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 16px; color: black;">
Hi all,</div>
<div style="direction: ltr; margin-top: 0px; margin-bottom: 0px; font-family: Garamond, Georgia, serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 16px; color: black;">
<br>
</div>
<div style="margin-top: 0px; margin-bottom: 0px; font-family: Garamond, Georgia, serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 16px; color: black;">
I have been playing around with AOTCache and I tried a small with it experiment whose idea was to shadow a class using AOTCache. By class shadowing, I mean loading a different class than intended but they both share the same fully qualified name. We also explored
this concept in the paper: <a href="https://arxiv.org/abs/2407.18760v4" class="OWAAutoLink" data-outlook-id="10d29d2e-0ee5-4467-b576-989b504b8a47">
Maven-Hijack: Software Supply Chain Attack Exploiting Packaging Order</a>, and now I am trying to extend it to AOTCache.</div>
<div style="direction: ltr; margin-top: 0px; margin-bottom: 0px; font-family: Garamond, Georgia, serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 16px; color: black;">
<br>
</div>
<div style="margin-top: 0px; margin-bottom: 0px; font-family: Garamond, Georgia, serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 16px; color: black;">
The steps in the experiment are based on <a href="https://github.com/chains-project/maven-hijack-poc" target="_blank" rel="noopener noreferrer" data-outlook-id="84cdff21-bb99-4e43-bc1a-2002df1db94d">
POC</a> from the same paper and are written briefly below. The exact commands are documented
<a href="https://github.com/chains-project/maven-hijack-poc/blob/main/java/maven/abstract-project/AOTCache.md" class="OWAAutoLink" data-outlook-id="dd6b03c6-99f9-44d5-9009-6c4e495a3170">
here</a>.</div>
<ol start="1" style="margin-top: 0px; margin-bottom: 0px;">
<li style="font-family: Garamond, Georgia, serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 16px; color: black;">
Build the application with one of the dependencies having malicious class. The malicious class has the same name as one of the other classes, say `org.postrgresql.Driver` but
<a href="https://github.com/chains-project/maven-hijack-poc/blob/0310de24103a55d1f51f70ef625933a40a7a55b3/java/maven/abstract-project/install-me-first/D11/src/main/java/org/postgresql/Driver.java#L8-L23" class="OWAAutoLink" data-outlook-id="bad815e5-de43-4612-b68a-b8f1fa4bd241">
has malicious contents</a>.</li><li style="font-family: Garamond, Georgia, serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 16px; color: black;">
Create an AOTCache using these dependencies in jar. <i>This creates a "polluted AOTCache".</i></li><li style="font-family: Garamond, Georgia, serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 16px; color: black;">
Now using the polluted cache, run the application that is packaged with genuine dependencies. Apparently, the JVM initializes the malicious class from AOTCache instead of loading it from classpath. In other words, `<span style="font-family: "Courier New", monospace;" role="presentation">java
-XX:AOTCache=maven.aot -jar target/victim-1.0.jar</span>` and `<span style="font-family: "Courier New", monospace;" role="presentation">java -jar target/victim-1.0.jar</span>` give different outputs.</li></ol>
<div style="direction: ltr; font-family: Garamond, Georgia, serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 16px; color: black;">
<br>
</div>
<div style="font-family: Garamond, Georgia, serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 16px; color: black;">
I see this as a weakness if the poisoned AOTCache is distributed as an artifact for consumers to be used because maybe it is not expected from consumers to perform a training run themselves. I believe there should be some sort of integrity checks before a class
is initialized from AOTCache. I noticed there are <a href="https://github.com/openjdk/jdk/blob/e3b5b261af6acbe7ab074f301c70283b06c17d39/src/hotspot/share/code/aotCodeCache.cpp#L435" class="OWAAutoLink" data-outlook-id="9f55ff04-1174-4557-9bfa-a016a4dd11d5">
already some</a> (please share if there are more, and I have missed them), but none of them relate to what I am mentioning. I am happy to listen to some thoughts on this.</div>
<p style="margin-top: 0px; margin-bottom: 0px;"><br>
</p>
<div id="Signature">
<div id="divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:rgb(0,0,0); font-family:Calibri,Helvetica,sans-serif,"EmojiFont","Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols">
<div id="m_4935352394101912768Signature">
<div style="margin-top: 0px; margin-bottom: 0px; font-family: Garamond, Georgia, serif; font-size: 12pt; color: rgb(0, 0, 0);">
Regards,</div>
<div style="margin-top: 0px; margin-bottom: 0px; font-family: Garamond, Georgia, serif; font-size: 12pt; color: rgb(0, 0, 0);">
Aman Sharma</div>
<span style="font-family: Arial, "Helvetica Neue", helvetica, sans-serif; font-size: 13px; color: rgb(128, 128, 128); background-color: rgb(255, 255, 255);"><br>
</span>
<div style="font-size: 13px; color: rgb(128, 128, 128);">PhD Student<br>
<span style="font-family: Arial, "Helvetica Neue", helvetica, sans-serif; background-color: rgb(255, 255, 255);">KTH Royal Institute of Technology</span><br>
<span style="font-family: Arial, "Helvetica Neue", helvetica, sans-serif; background-color: rgb(255, 255, 255);">School of Electrical Engineering and Computer Science (EECS)</span><br>
<span style="font-family: Arial, "Helvetica Neue", helvetica, sans-serif; background-color: rgb(255, 255, 255);">Department of Theoretical Computer Science (TCS)</span></div>
</div>
<a href="https://algomaster99.github.io/" id="LPNoLP" class="OWAAutoLink" data-outlook-id="d682035f-6fc9-4ae4-b8be-b6520f5a51ae">https://algomaster99.github.io/</a><br>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>