[PATCH 2.41] aarch64: Do not link conform tests with -Wl,-z,force-bti (bug 33601)

[Yury Khrustalev]

On Thu, Nov 13, 2025 at 10:40:38AM +0100, Florian Weimer wrote:
> If the toolchain does not default to generate BTI markers in GCC,
> the main program for conform runtime tests will not have the
> BTI marker that -Wl,-z,force-bti requires.  Without -Wl,-z,force-bti,
> the link editor will not tell the dynamic linker to enable BTI,
> and the missing BTI marker is harmless.
> 
> ---
>  NEWS                     | 1 +
>  sysdeps/aarch64/Makefile | 6 +++++-
>  2 files changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/NEWS b/NEWS
> index a3b8956b63..b55b70a65b 100644
> --- a/NEWS
> +++ b/NEWS
> @@ -42,6 +42,7 @@ The following bugs were resolved with this release:
>    [33234] Use TLS initial-exec model for __libc_tsd_CTYPE_* thread variables
>    [33245] nptl: nptl: error in internal cancellation syscall handling
>    [33361] nss: Group merge does not react to ERANGE during merge
> +  [33601] aarch64: Do not link conform tests with -Wl,-z,force-bti
>  
>  Version 2.41
>  
> diff --git a/sysdeps/aarch64/Makefile b/sysdeps/aarch64/Makefile
> index e069796fc8..53f5bd4ce0 100644
> --- a/sysdeps/aarch64/Makefile
> +++ b/sysdeps/aarch64/Makefile
> @@ -2,11 +2,15 @@ long-double-fcts = yes
>  
>  ifeq (yes,$(aarch64-bti))
>  # Mark linker output BTI compatible, it warns on non-BTI inputs.
> +# Do not do this for conform tests because they may not be compiled
> +# with the appropriate compiler flags.
> +ifneq ($(subdir),conform)
>  sysdep-LDFLAGS += -Wl,-z,force-bti
>  # Make warnings fatal outside the test system.
>  LDFLAGS-lib.so += -Wl,--fatal-warnings
>  LDFLAGS-rtld += -Wl,-z,force-bti,--fatal-warnings
> -endif
> +endif # $(subdir) != conform
> +endif # $(aarch64-bit)
>  
>  ifeq ($(subdir),elf)
>  sysdep-dl-routines += \
> 
> base-commit: 5bf8ee7ad559fd60bedd3f5ec831d0b12b5000b8

LGTM.

Reviewed-by: Yury Khrustalev <yury.khrustalev@arm.com>

I've tested this on a system that supports BTI with a GCC toolchain that
does not enable standard branch protection by default. It works.

Thanks,
Yury