8277204: Implement PAC-RET branch protection on Linux/AArch64

src/hotspot/cpu/aarch64/aarch64.ad

@@ -1369,8 +1369,8 @@ source %{
       _NO_SPECIAL_PTR_REG_mask.SUBTRACT(_HEAPBASE_REG_mask);
     }
 
-    // r29 is not allocatable when PreserveFramePointer or ROP protection is on
-    if (PreserveFramePointer || VM_Version::use_rop_protection()) {
+    // r29 is not allocatable when PreserveFramePointer is on
+    if (PreserveFramePointer) {
       _NO_SPECIAL_REG32_mask.Remove(OptoReg::as_OptoReg(r29->as_VMReg()));
       _NO_SPECIAL_REG_mask.SUBTRACT(_FP_REG_mask);
       _NO_SPECIAL_PTR_REG_mask.SUBTRACT(_FP_REG_mask);
@@ -1856,6 +1856,10 @@ void MachPrologNode::format(PhaseRegAlloc *ra_, outputStream *st) const {
   if (C->output()->need_stack_bang(framesize))
     st->print("# stack bang size=%d\n\t", framesize);
 
+  if (VM_Version::use_rop_protection()) {
+    st->print("ldr zr, [lr]\n\t");
+    st->print("pacia  lr, rfp\n\t");
+  }
   if (framesize < ((1 << 9) + 2 * wordSize)) {
     st->print("sub  sp, sp, #%d\n\t", framesize);
     st->print("stp  rfp, lr, [sp, #%d]", framesize - 2 * wordSize);
@@ -1964,6 +1968,10 @@ void MachEpilogNode::format(PhaseRegAlloc *ra_, outputStream *st) const {
     st->print("add  sp, sp, rscratch1\n\t");
     st->print("ldp  lr, rfp, [sp],#%d\n\t", (2 * wordSize));
   }
+  if (VM_Version::use_rop_protection()) {
+    st->print("autia lr, rfp\n\t");
+    st->print("ldr zr, [lr]\n\t");
+  }
 
   if (do_polling() && C->is_method_compilation()) {
     st->print("# test polling word\n\t");

src/hotspot/cpu/aarch64/gc/g1/g1BarrierSetAssembler_aarch64.cpp

@@ -271,7 +271,7 @@ void G1BarrierSetAssembler::load_at(MacroAssembler* masm, DecoratorSet decorator
   ModRefBarrierSetAssembler::load_at(masm, decorators, type, dst, src, tmp1, tmp_thread);
   if (on_oop && on_reference) {
     // LR is live.  It must be saved around calls.
-    __ enter(true); // barrier may call runtime
+    __ enter(/*strip_ret_addr*/true); // barrier may call runtime
     // Generate the G1 pre-barrier code to log the value of
     // the referent field in an SATB buffer.
     g1_write_barrier_pre(masm /* masm */,

src/hotspot/cpu/aarch64/gc/shenandoah/shenandoahBarrierSetAssembler_aarch64.cpp

@@ -237,7 +237,7 @@ void ShenandoahBarrierSetAssembler::load_reference_barrier(MacroAssembler* masm,
   bool is_narrow  = UseCompressedOops && !is_native;
 
   Label heap_stable, not_cset;
-  __ enter(true);
+  __ enter(/*strip_ret_addr*/true);
   Address gc_state(rthread, in_bytes(ShenandoahThreadLocalData::gc_state_offset()));
   __ ldrb(rscratch2, gc_state);
 
@@ -359,7 +359,7 @@ void ShenandoahBarrierSetAssembler::load_at(MacroAssembler* masm, DecoratorSet d
 
   // 3: apply keep-alive barrier if needed
   if (ShenandoahBarrierSet::need_keep_alive_barrier(decorators, type)) {
-    __ enter(true);
+    __ enter(/*strip_ret_addr*/true);
     __ push_call_clobbered_registers();
     satb_write_barrier_pre(masm /* masm */,
                            noreg /* obj */,

src/hotspot/cpu/aarch64/gc/z/zBarrierSetAssembler_aarch64.cpp

@@ -78,7 +78,7 @@ void ZBarrierSetAssembler::load_at(MacroAssembler* masm,
   __ tst(dst, rscratch1);
   __ br(Assembler::EQ, done);
 
-  __ enter(true);
+  __ enter(/*strip_ret_addr*/true);
 
   __ push_call_clobbered_registers_except(RegSet::of(dst));
 

src/hotspot/cpu/aarch64/macroAssembler_aarch64.cpp

@@ -5325,6 +5325,7 @@ void MacroAssembler::protect_return_address() {
 //
 void MacroAssembler::protect_return_address(Register return_reg, Register temp_reg) {
   if (VM_Version::use_rop_protection()) {
+    assert(PreserveFramePointer, "PreserveFramePointer must be set for ROP protection");
     check_return_address(return_reg);
     ldr(temp_reg, Address(rfp));
     pacia(return_reg, temp_reg);
@@ -5333,10 +5334,10 @@ void MacroAssembler::protect_return_address(Register return_reg, Register temp_r
 
 // Authenticate the LR. Use before function return, after restoring FP and loading LR from memory.
 //
-void MacroAssembler::authenticate_return_address() {
+void MacroAssembler::authenticate_return_address(Register return_reg) {
   if (VM_Version::use_rop_protection()) {
-    autia(lr, rfp);
-    check_return_address();
+    autia(return_reg, rfp);
+    check_return_address(return_reg);
   }
 }
 
@@ -5347,6 +5348,7 @@ void MacroAssembler::authenticate_return_address() {
 //
 void MacroAssembler::authenticate_return_address(Register return_reg, Register temp_reg) {
   if (VM_Version::use_rop_protection()) {
+    assert(PreserveFramePointer, "PreserveFramePointer must be set for ROP protection");
     ldr(temp_reg, Address(rfp));
     autia(return_reg, temp_reg);
     check_return_address(return_reg);

src/hotspot/cpu/aarch64/macroAssembler_aarch64.hpp

@@ -694,7 +694,7 @@ class MacroAssembler: public Assembler {
   // ROP Protection
   void protect_return_address();
   void protect_return_address(Register return_reg, Register temp_reg);
-  void authenticate_return_address();
+  void authenticate_return_address(Register return_reg = lr);
   void authenticate_return_address(Register return_reg, Register temp_reg);
   void strip_return_address();
   void check_return_address(Register return_reg=lr) PRODUCT_RETURN;

src/hotspot/cpu/aarch64/sharedRuntime_aarch64.cpp

@@ -2923,6 +2923,7 @@ void OptoRuntime::generate_exception_blob() {
   // there are no callee save registers now that adapter frames are gone.
   // and we dont' expect an arg reg save area
   __ ldp(rfp, r3, Address(__ post(sp, 2 * wordSize)));
+  __ authenticate_return_address(r3);
 
   // r0: exception handler
 

src/hotspot/cpu/aarch64/vm_version_aarch64.cpp

@@ -433,6 +433,11 @@ void VM_Version::initialize() {
     vm_exit_during_initialization(err_msg("Unsupported UseBranchProtection: %s", UseBranchProtection));
   }
 
+  // The frame pointer must be preserved for ROP protection.
+  if (_rop_protection == true) {
+    PreserveFramePointer = true;
+  }
+
 #ifdef COMPILER2
   if (FLAG_IS_DEFAULT(UseMultiplyToLenIntrinsic)) {
     UseMultiplyToLenIntrinsic = true;