{"record":{"id":"40e5e24643799181","repo":"oracle/graal","slug":"spectrephtbarriers-can-be-set-to-alltargets-if-a","errorCode":null,"errorMessage":"SpectrePHTBarriers can be set to 'AllTargets' if and only if SpeculativeExecutionBarriers is enabled or unspecified.","messagePattern":"SpectrePHTBarriers can be set to 'AllTargets' if and only if SpeculativeExecutionBarriers is enabled or unspecified\\.","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"compiler/src/jdk.graal.compiler/src/jdk/graal/compiler/core/common/SpectrePHTMitigations.java","lineNumber":61,"sourceCode":"        // @formatter:off\n\n        @Option(help = \"Stop speculative execution on all branch targets with execution barrier instructions.\", stability = OptionStability.STABLE)\n        public static final OptionKey<Boolean> SpeculativeExecutionBarriers = new OptionKey<>(false) {\n\n            @Override\n            public Boolean getValue(OptionValues values) {\n                // Do not use getValue to avoid an infinite recursion\n                if (values.getMap().get(SpectrePHTBarriers) == AllTargets) {\n                    return true;\n                }\n                return super.getValue(values);\n            }\n\n            protected void onValueUpdate(EconomicMap<OptionKey<?>, Object> values, Boolean oldValue, Boolean newValue) {\n                if (values.containsKey(SpectrePHTBarriers)) {\n                    Object otherValue = values.get(SpectrePHTBarriers);\n                    if (newValue && otherValue != AllTargets || (!newValue && otherValue == AllTargets)) {\n                        throw new IllegalArgumentException(\"SpectrePHTBarriers can be set to 'AllTargets' if and only if SpeculativeExecutionBarriers is enabled or unspecified.\");\n                    }\n                }\n            }\n        };\n\n        @Option(help = \"\"\"\n                       Selects a strategy to mitigate speculative bounds check bypass (also known as Spectre-PHT or Spectre V1).\n                       The accepted values are:\n                                         None - No mitigations are used in JIT compiled code.\n                                   AllTargets - Speculative execution on all branch targets is\n                                                stopped using speculative execution barrier instructions.\n                                                This option is equivalent to setting SpeculativeExecutionBarriers to true.\n                                 GuardTargets - Branch targets relevant to Java memory safety are instrumented with barrier instructions.\n                                                This option has a lower performance impact than AllTargets.\n                         NonDeoptGuardTargets - Same as GuardTargets, except that branches which deoptimize are not protected because they cannot be\n                                                executed repeatedly and are thus less likely to be successfully exploited in an attack.\n\n","sourceCodeStart":43,"sourceCodeEnd":79,"githubUrl":"https://github.com/oracle/graal/blob/a66e9ccd1d7bf2552883939aa0788dfd0e294aab/compiler/src/jdk.graal.compiler/src/jdk/graal/compiler/core/common/SpectrePHTMitigations.java#L43-L79","documentation":"The Graal option SpectrePHTBarriers accepts 'AllTargets', which is defined to be exactly equivalent to enabling SpeculativeExecutionBarriers. SpeculativeExecutionBarriers is a derived Boolean option; when its effective value is updated, onValueUpdate enforces the coupling: 'AllTargets' is legal only when SpeculativeExecutionBarriers is enabled or left unspecified, and conversely.","triggerScenarios":"Setting -Dgraal.SpeculativeExecutionBarriers=false together with -Dgraal.SpectrePHTBarriers=AllTargets (the newValue=true && otherValue==AllTargets branch), or otherwise updating SpeculativeExecutionBarriers to a value inconsistent with an explicitly set AllTargets. The check fires while option values propagate into the OptionValues map.","commonSituations":"Hardening-tuning mistakes: an operator copies Spectre mitigation flags from one system to another, disables speculative-execution barriers for performance but leaves the AllTargets barrier mode on, or sets both options in different layers (JVM CI options vs. system properties) that conflict. Common after security-baseline changes or benchmark tuning passes.","solutions":["Remove the conflict: either drop -Dgraal.SpeculativeExecutionBarriers=false, or change SpectrePHTBarriers to None/NormalTargets.","If you only want barriers on protected targets, use -Dgraal.SpectrePHTBarriers=None (or omit it) and keep SpeculativeExecutionBarriers unset.","Audit startup scripts, docker images, and .hotspotrc files for stale copies of one flag without its pair."],"exampleFix":"# before (conflicting)\n-Dgraal.SpeculativeExecutionBarriers=false -Dgraal.SpectrePHTBarriers=AllTargets\n\n# after (equivalent mitigation, no conflict)\n-Dgraal.SpeculativeExecutionBarriers=true","handlingStrategy":"validation","validationCode":"// before applying options, check the coupling\nObject barriers = options.getMap().get(GraalOptions.SpeculativeExecutionBarriers);\nObject pht = options.getMap().get(SpectrePHTMitigations.Options.SpectrePHTBarriers);\nboolean allTargets = pht != null && pht.toString().equals(\"AllTargets\");\nboolean barriersDisabled = Boolean.FALSE.equals(barriers);\nif (allTargets && barriersDisabled) {\n    throw new IllegalArgumentException(\"AllTargets requires SpeculativeExecutionBarriers enabled or unspecified\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Manage Spectre flags from a single configuration source so the pair cannot drift apart.","Remember AllTargets and SpeculativeExecutionBarriers=true are the same setting — set only one of them."],"tags":["options","spectre-mitigation","security","configuration","illegal-argument"],"backgroundTag":null,"analyzedSha":"a66e9ccd1d7bf2552883939aa0788dfd0e294aab","analyzedAt":"2026-08-14T13:58:47.161Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}