[PATCH] armv8a: Set -mbranch-protection more specifically

[PATCH] armv8a: Set -mbranch-protection more specifically

[Frank Zhang]

GCC-15 enable gcs in standard branch protection, which is support by armv9.
Openssl don't support this feature in assemble code, caused ld warning.
Moeover, other recipes will fail when link with openssl.
This patch set armv8a branch protection based on extension version.

Signed-off-by: Frank Zhang <rmxpzlb@gmail.com>
---
 meta/conf/machine/include/arm/arch-arm64.inc | 21 +++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/meta/conf/machine/include/arm/arch-arm64.inc b/meta/conf/machine/include/arm/arch-arm64.inc
index 832d0000ac..938dee4798 100644
--- a/meta/conf/machine/include/arm/arch-arm64.inc
+++ b/meta/conf/machine/include/arm/arch-arm64.inc
@@ -41,4 +41,23 @@ TARGET_FPU = "${@bb.utils.contains('TUNE_FEATURES', 'aarch64', '${TARGET_FPU_64}
 # Emit branch protection (PAC/BTI) instructions.  On hardware that doesn't
 # support these they're meaningless NOP instructions, so there's very little
 # reason not to.
-TUNE_CCARGS .= "${@bb.utils.contains('TUNE_FEATURES', 'aarch64', ' -mbranch-protection=standard', '', d)}"
+def arm64_get_branch_protection(d):
+    import re
+    bp = "standard"
+    tunes = d.getVar('AVAILTUNES')
+    if "armv8a" in tunes.split():
+        bp = "none"
+        subver = 0
+        for tune in tunes.split():
+            arch = re.match('armv8-[1-9]a', tune)
+            if arch:
+                subver = int(tune[6:7])
+                break
+
+        if subver >= 5:
+            bp = "bti+pac-ret"
+        elif subver >= 3:
+            bp = "pac-ret"
+    return bp
+
+TUNE_CCARGS .= "${@bb.utils.contains('TUNE_FEATURES', 'aarch64', ' -mbranch-protection=%s' % (arm64_get_branch_protection(d)), '', d)}"

Re: [OE-core] [PATCH] armv8a: Set -mbranch-protection more specifically

[Ross Burton]

On 13 Nov 2025, at 07:47, Frank Zhang via lists.openembedded.org <rmxpzlb=gmail.com@lists.openembedded.org> wrote:
> 
> GCC-15 enable gcs in standard branch protection, which is support by armv9.
> Openssl don't support this feature in assemble code, caused ld warning.
> Moeover, other recipes will fail when link with openssl.
> This patch set armv8a branch protection based on extension version.

What other recipes? We’ve already fixed this in systemd (oe-core 295e30) so I’m curious what else breaks, as it’s nothing on the AB.

I don’t think we should be quite so particular about breaking down the ISA version, if we do this then I think simply gating it on v8 vs v9 is going to be just as effective with a lot less logic.

Ross

Re: [PATCH] armv8a: Set -mbranch-protection more specifically

[Frank Zhang]

[-- Attachment #1: Type: text/plain, Size: 165 bytes --]

As I know karchive kfilemetadata and kpipewire will fail. They are in meta-kf6 and meta-kde.

Do I need update patch, just set v8 branch-protection to BTI & PAC?

[-- Attachment #2: Type: text/html, Size: 208 bytes --]

Re: [OE-core] [PATCH] armv8a: Set -mbranch-protection more specifically

[Khem Raj]

[-- Attachment #1: Type: text/plain, Size: 822 bytes --]

On Thu, Nov 13, 2025 at 7:19 PM Frank Zhang via lists.openembedded.org
<rmxpzlb=gmail.com@lists.openembedded.org> wrote:

> As I know karchive kfilemetadata and kpipewire will fail. They are in
> meta-kf6 and meta-kde.
>
> Do I need update patch, just set v8 branch-protection to BTI & PAC?
>

Please use the systemd patch-like approach for these recipes.

>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#226285):
> https://lists.openembedded.org/g/openembedded-core/message/226285
> Mute This Topic: https://lists.openembedded.org/mt/116271008/1997914
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [
> raj.khem@gmail.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>
>

[-- Attachment #2: Type: text/html, Size: 1856 bytes --]

Re: [OE-core] [PATCH] armv8a: Set -mbranch-protection more specifically

[Ross Burton]

On 14 Nov 2025, at 04:15, Khem Raj via lists.openembedded.org <raj.khem=gmail.com@lists.openembedded.org> wrote:
> On Thu, Nov 13, 2025 at 7:19 PM Frank Zhang via lists.openembedded.org <rmxpzlb=gmail.com@lists.openembedded.org> wrote:
> As I know karchive kfilemetadata and kpipewire will fail. They are in meta-kf6 and meta-kde.
>   Do I need update patch, just set v8 branch-protection to BTI & PAC?
> 
> Please use the systemd patch-like approach for these recipes. 

Agreed.

Ross