gcc: enable branch protection by standard

Pass --enable-standard-branch-protection.  This is an aarch64-specific
option (currently) which does nothing on other targets.  On aarch64 this
generates code uses BTI/PAC instructions to mitigate Return Orientated
Programming attacks.  This approach is backwards compatible and the code
size/performance impact is typically negliable.

More details can be found at
https://events.static.linuxfound.org/sites/events/files/slides/slides_23.pdf

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

diff --git a/meta/recipes-devtools/gcc/gcc-configure-common.inc b/meta/recipes-devtools/gcc/gcc-configure-common.inc
index a64c4caf0010349eb062fb52e8443b02fc670974..dc7f458b255f3c2d9d727e657cd6ba362ece2e4c 100644 (file)
--- a/meta/recipes-devtools/gcc/gcc-configure-common.inc
+++ b/meta/recipes-devtools/gcc/gcc-configure-common.inc
@@ -40,6 +40,7 @@ EXTRA_OECONF = "\
     ${@get_gcc_mips_plt_setting(bb, d)} \
     ${@get_gcc_ppc_plt_settings(bb, d)} \
     ${@get_gcc_multiarch_setting(bb, d)} \
+       --enable-standard-branch-protection \
 "
 
 # glibc version is a minimum controlling whether features are enabled.