https://github.com/Sharjeel-Khan updated https://github.com/llvm/llvm-project/pull/218066
>From b3cd42bb36eb73035b72638ba76b5853b4e8c551 Mon Sep 17 00:00:00 2001 From: Sharjeel Khan <[email protected]> Date: Fri, 21 Aug 2026 23:10:54 +0000 Subject: [PATCH 1/4] [Android][Driver] Enable PAC/BTI for Android by Default We enable it by default in the Android Ecosystem so it makes sense to set it as the default for Android in the Clang driver. This change will make sure anyone compiling for Android (like through NDK) automatically gets PAC/BTI. It should not cause issues with older Android devices since they become nops. Fixes: https://github.com/android/ndk/issues/1914 --- clang/lib/Driver/ToolChains/Clang.cpp | 4 ++-- clang/test/Driver/android-security-options.c | 16 ++++++++++++++++ 2 files changed, 18 insertions(+), 2 deletions(-) create mode 100644 clang/test/Driver/android-security-options.c diff --git a/clang/lib/Driver/ToolChains/Clang.cpp b/clang/lib/Driver/ToolChains/Clang.cpp index dabc8c8d964d6..44573460ce72c 100644 --- a/clang/lib/Driver/ToolChains/Clang.cpp +++ b/clang/lib/Driver/ToolChains/Clang.cpp @@ -1392,7 +1392,7 @@ static void CollectARMPACBTIOptions(const ToolChain &TC, const ArgList &Args, options::OPT_mbranch_protection_EQ) : Args.getLastArg(options::OPT_mbranch_protection_EQ); if (!A) { - if (Triple.isOSOpenBSD() && isAArch64) { + if ((Triple.isOSOpenBSD() || Triple.isAndroid()) && isAArch64) { CmdArgs.push_back("-msign-return-address=non-leaf"); CmdArgs.push_back("-msign-return-address-key=a_key"); CmdArgs.push_back("-mbranch-target-enforce"); @@ -1414,7 +1414,7 @@ static void CollectARMPACBTIOptions(const ToolChain &TC, const ArgList &Args, D.Diag(diag::err_drv_unsupported_option_argument) << A->getSpelling() << Scope; Key = "a_key"; - IndirectBranches = Triple.isOSOpenBSD() && isAArch64; + IndirectBranches = (Triple.isOSOpenBSD() || Triple.isAndroid()) && isAArch64; BranchProtectionPAuthLR = false; GuardedControlStack = false; } else { diff --git a/clang/test/Driver/android-security-options.c b/clang/test/Driver/android-security-options.c new file mode 100644 index 0000000000000..b74d9dce65e95 --- /dev/null +++ b/clang/test/Driver/android-security-options.c @@ -0,0 +1,16 @@ +// Check that Android enables PAC and BTI by default on AArch64. +// RUN: %clang --target=aarch64-linux-android -### -c %s 2>&1 \ +// RUN: | FileCheck %s --check-prefix=ANDROID-DEFAULT +// ANDROID-DEFAULT: "-msign-return-address=non-leaf" "-msign-return-address-key=a_key" "-mbranch-target-enforce" + +// Check that the Android default can be overridden. +// RUN: %clang --target=aarch64-linux-android -mbranch-protection=none -### -c %s 2>&1 \ +// RUN: | FileCheck %s --check-prefix=ANDROID-OVERRIDE +// ANDROID-OVERRIDE: "-msign-return-address=none" +// ANDROID-OVERRIDE-NOT: "-msign-return-address-key" +// ANDROID-OVERRIDE-NOT: "-mbranch-target-enforce" + +// Check that Android enables BTI by default when -msign-return-address is passed. +// RUN: %clang --target=aarch64-linux-android -msign-return-address=non-leaf -### -c %s 2>&1 \ +// RUN: | FileCheck %s --check-prefix=ANDROID-PAC-BTI +// ANDROID-PAC-BTI: "-msign-return-address=non-leaf" "-msign-return-address-key=a_key" "-mbranch-target-enforce" \ No newline at end of file >From 08c10c9cd7c364802f91ba4a14591d59ec246044 Mon Sep 17 00:00:00 2001 From: Sharjeel Khan <[email protected]> Date: Fri, 21 Aug 2026 23:44:52 +0000 Subject: [PATCH 2/4] Move tests into aarch64-security-options.c --- clang/test/Driver/aarch64-security-options.c | 12 ++++++++++++ clang/test/Driver/android-security-options.c | 16 ---------------- 2 files changed, 12 insertions(+), 16 deletions(-) delete mode 100644 clang/test/Driver/android-security-options.c diff --git a/clang/test/Driver/aarch64-security-options.c b/clang/test/Driver/aarch64-security-options.c index 967a6122a333d..125e90b2b51fb 100644 --- a/clang/test/Driver/aarch64-security-options.c +++ b/clang/test/Driver/aarch64-security-options.c @@ -33,6 +33,18 @@ // RUN: %clang --target=aarch64 -### -o /dev/null -mbranch-protection=standard /dev/null 2>&1 | \ // RUN: FileCheck --allow-empty %s --check-prefix=LINKER-DRIVER +// Check that Android enables PAC and BTI by default on AArch64. +// RUN: %clang --target=aarch64-linux-android -### -c %s 2>&1 | \ +// RUN: FileCheck %s --check-prefix=RA-NON-LEAF --check-prefix=KEY-A --check-prefix=BTE-ON --check-prefix=GCS-OFF --check-prefix=WARN + +// Check that the Android default can be overridden. +// RUN: %clang --target=aarch64-linux-android -mbranch-protection=none -### -c %s 2>&1 | \ +// RUN: FileCheck %s --check-prefix=RA-OFF --check-prefix=KEY --check-prefix=BTE-OFF --check-prefix=GCS-OFF --check-prefix=WARN + +// Check that Android enables BTI by default when -msign-return-address is passed. +// RUN: %clang --target=aarch64-linux-android -msign-return-address=non-leaf -### -c %s 2>&1 | \ +// RUN: FileCheck %s --check-prefix=RA-NON-LEAF --check-prefix=KEY-A --check-prefix=BTE-ON --check-prefix=GCS-OFF --check-prefix=WARN + // WARN-NOT: warning: ignoring '-mbranch-protection=' option because the 'aarch64' architecture does not support it [-Wbranch-protection] // RA-OFF: "-msign-return-address=none" diff --git a/clang/test/Driver/android-security-options.c b/clang/test/Driver/android-security-options.c deleted file mode 100644 index b74d9dce65e95..0000000000000 --- a/clang/test/Driver/android-security-options.c +++ /dev/null @@ -1,16 +0,0 @@ -// Check that Android enables PAC and BTI by default on AArch64. -// RUN: %clang --target=aarch64-linux-android -### -c %s 2>&1 \ -// RUN: | FileCheck %s --check-prefix=ANDROID-DEFAULT -// ANDROID-DEFAULT: "-msign-return-address=non-leaf" "-msign-return-address-key=a_key" "-mbranch-target-enforce" - -// Check that the Android default can be overridden. -// RUN: %clang --target=aarch64-linux-android -mbranch-protection=none -### -c %s 2>&1 \ -// RUN: | FileCheck %s --check-prefix=ANDROID-OVERRIDE -// ANDROID-OVERRIDE: "-msign-return-address=none" -// ANDROID-OVERRIDE-NOT: "-msign-return-address-key" -// ANDROID-OVERRIDE-NOT: "-mbranch-target-enforce" - -// Check that Android enables BTI by default when -msign-return-address is passed. -// RUN: %clang --target=aarch64-linux-android -msign-return-address=non-leaf -### -c %s 2>&1 \ -// RUN: | FileCheck %s --check-prefix=ANDROID-PAC-BTI -// ANDROID-PAC-BTI: "-msign-return-address=non-leaf" "-msign-return-address-key=a_key" "-mbranch-target-enforce" \ No newline at end of file >From 4ed8f9207c4acdc5ee66d76b30f1d841fea50894 Mon Sep 17 00:00:00 2001 From: Sharjeel Khan <[email protected]> Date: Fri, 21 Aug 2026 23:47:47 +0000 Subject: [PATCH 3/4] Update Release Notes for Android --- clang/docs/ReleaseNotes.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/clang/docs/ReleaseNotes.md b/clang/docs/ReleaseNotes.md index 3c6694f510952..dc20b38b0a7a7 100644 --- a/clang/docs/ReleaseNotes.md +++ b/clang/docs/ReleaseNotes.md @@ -580,6 +580,8 @@ features cannot lower the translation-unit ABI level; #### Android Support +- Enabled PAC and BTI by default for AArch64 Android targets. + #### Windows Support - Fixed a bug where Clang did not match the MSVC ABI on Arm64 when an >From 04bd72b5f2a80e85482b9f4b913c0038306e83a5 Mon Sep 17 00:00:00 2001 From: Sharjeel Khan <[email protected]> Date: Fri, 21 Aug 2026 23:49:42 +0000 Subject: [PATCH 4/4] Fix Clang Format issues --- clang/lib/Driver/ToolChains/Clang.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/clang/lib/Driver/ToolChains/Clang.cpp b/clang/lib/Driver/ToolChains/Clang.cpp index 44573460ce72c..f3aeed61a064b 100644 --- a/clang/lib/Driver/ToolChains/Clang.cpp +++ b/clang/lib/Driver/ToolChains/Clang.cpp @@ -1414,7 +1414,8 @@ static void CollectARMPACBTIOptions(const ToolChain &TC, const ArgList &Args, D.Diag(diag::err_drv_unsupported_option_argument) << A->getSpelling() << Scope; Key = "a_key"; - IndirectBranches = (Triple.isOSOpenBSD() || Triple.isAndroid()) && isAArch64; + IndirectBranches = + (Triple.isOSOpenBSD() || Triple.isAndroid()) && isAArch64; BranchProtectionPAuthLR = false; GuardedControlStack = false; } else { _______________________________________________ cfe-commits mailing list [email protected] https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
