From f3b54d5fc236d01c0e34650b797820e4b09e2a41 Mon Sep 17 00:00:00 2001
From: Jeremiah Gowdy <jeremiah@gowdy.me>
Date: Wed, 15 Jun 2022 10:31:15 -0700
Subject: [PATCH] Add branch protection to aarch64 targets

---
 configure.ac | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/configure.ac b/configure.ac
index 50ccc76504..ef3f521a6d 100644
--- a/configure.ac
+++ b/configure.ac
@@ -780,6 +780,20 @@ AS_IF([test "$GCC" = yes], [
 	RUBY_APPEND_OPTION(LDFLAGS, $stack_protector)
     ])
 
+    # aarch64 branch protection
+    AS_CASE(["$target_cpu"], [aarch64], [
+        branch_protection=no
+        RUBY_TRY_CFLAGS(-mbranch-protection=pac-ret,[branch_protection=yes])
+        AS_IF([test "x$branch_protection" = xyes], [
+            RUBY_APPEND_OPTION(XCFLAGS, -mbranch-protection=pac-ret)
+        ],
+        [
+            RUBY_TRY_CFLAGS(-msign-return-address=all, [
+                RUBY_APPEND_OPTION(XCFLAGS, -msign-return-address=all)
+            ])
+        ])
+    ])
+
     AS_CASE("${compress_debug_sections:-zlib}",
     [none|no], [], [
     RUBY_TRY_LDFLAGS(${linker_flag}--compress-debug-sections=${compress_debug_sections:-zlib},