build: use `-mbranch-protection=standard` for aarch64-linux (non-guix) #25919

pull fanquake wants to merge 1 commits into bitcoin:master from fanquake:mbranch_protection_aarch64_linux_non_guix changing 1 files +6 −0

fanquake commented at 3:43 PM on August 24, 2022: member

For this to be enabled, all libs must be compiled with / instrumented with this option. This can be the case for some distros, like Fedora.

-mbranch-protection=x was added to GCC in GCC 9.x (replacing -msign-return-address=x, and added to LLVM clang in 14.0.0.

-z,pac-plt was added to binutils ld in 2.33

Add -z pac-plt for AArch64 to pick PAC enabled PLTs.

LLVMs ld.lld --pac-plt option became -z,pac-plt starting with LLVM 10.

Split from #24123, as these changes shouldn't have to wait for us to fully support using this in our Guix env, before we can make a best-effort to turn these flags on for users who are self-compiling.

build: use -mbranch-protection=standard for aarch64-linux

For this to be enabled, all libs must be compiled with / instrumented
with this option. This is the case for some distros, like Fedora.

`-mbranch-protection=x` was added to GCC in GCC 9.x (replacing
`-msign-return-address=x`, and added to LLVM clang in 14.0.0.

`-z,pac-plt` was added to binutils ld in 2.33
> Add -z pac-plt for AArch64 to pick PAC enabled PLTs.

LLVMs lld --pac-plt option became -z,pac-plt starting with LLVM 10.

9c3261efe6

fanquake added the label Build system on Aug 24, 2022
DrahtBot commented at 5:32 AM on August 26, 2022: contributor


The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.



Conflicts

Reviewers, this pull request conflicts with the following ones:
- #24123 (build: Pointer Authentication and Branch Target Identification for aarch64 Linux (Guix) by fanquake)
If you consider this pull request important, please also help to review the conflicting pull requests. Ideally, start with the one that should be merged first.
luke-jr commented at 11:10 PM on August 26, 2022: member

For this to be enabled, all libs must be compiled with / instrumented

But the configure check doesn't verify that...?
fanquake commented at 10:03 AM on August 31, 2022: member

Guess we can't do this while we are building for Android (clang-12) in the CI... Closing for now.
fanquake closed this on Aug 31, 2022
fanquake deleted the branch on Aug 31, 2022
bitcoin locked this on Aug 31, 2023

Contributors

Labels

Linked (view graph)

#24123 guix: Pointer Authentication and Branch Target Identification for aarch64 Linux

build: use `-mbranch-protection=standard` for aarch64-linux (non-guix) #25919

Conflicts