Extends AArch64 branch protection support to include GCS

[CrooseGit]

Extends existing support for AArch64 branch protection to include support for Guarded Control Stacks.

[rustbot]

r? @davidtwco

rustbot has assigned @davidtwco.
They will have a look at your PR within the next two weeks and either review your PR or reassign to another reviewer.

Use r? to explicitly pick a reviewer

[rustbot]

Some changes occurred in src/doc/unstable-book/src/compiler-flags/branch-protection.md

cc @rust-lang/project-exploit-mitigations, @rcvalle

[davidtwco]

I've reviewed this internally so will reroll. GCS is exposed in Clang through their -mbranch-protection flag, so this just mirrors that like the rest of this flag.

r? compiler

[Urgau]

Seems pretty straightforward, and looks consistent with clang.

View changes since this review

[Urgau]

r=me with the updated test output and CI green

r? Urgau
@bors delegate+

[bors]

✌️ @CrooseGit, you can now approve this pull request!

If @Urgau told you to "r=me" after making some further change, please make that change, then do @bors r=@Urgau

[nnethercote]

Thanks, @Urgau!

View changes since this review

[Urgau]

Does your local rustc uses LLVM 19 (like the job)? Or are you building LLVM locally/with download-ci-llvm?

[davidtwco]

Checked locally and it's the LLVM version that is causing this, just add a //@ min-llvm-version: 21 directive only for the GCS revision (or //@ min-llvm-version: 20 if it works with that version).

[CrooseGit]

@bors r=@Urgau

Thank you

[bors]

📌 Commit 661289b has been approved by Urgau

It is now in the queue for this repository.

[rust-bors]

💔 Test for 6f90524 failed: CI. Failed jobs:

• try - aarch64-gnu-debug (web logs, extended logs)

[rustbot]

This PR was rebased onto a different master commit. Here's a range-diff highlighting what actually changed.

Rebasing is a normal part of keeping PRs up to date, so no action is needed—this note is just to help reviewers.

[rust-bors]

@CrooseGit: 🔑 Insufficient privileges: not in try users

[Urgau]

Seems like installing a specific version of g++ doesn't provide the cc binary by default.

I tested adding the update-alternatives to provide gcc, cc, g++ and cxx and that fixes the issue about cc not being provided.

# Link standard gcc binary to the g++-15 ones
RUN update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-15 10 \
  && update-alternatives --install /usr/bin/g++ g++ /usr/bin/g++-15 10 \
  && update-alternatives --install /usr/bin/cc cc /usr/bin/gcc-15 30 \
  && update-alternatives --install /usr/bin/cxx cxx /usr/bin/g++-15 30

(to be added after the install in this Dockerfile)

[CrooseGit]

Just seen this, thank you very much for looking into this issue.
I believe I found an alternative fix for the problem, changing the Ubuntu version to 25.10 for the builds where the above is a problem gives you gcc15 as the default. It is passing when I run the CI locally. Of course if it fails now I shall try your solution.

[davidtwco]

cc @rust-lang/infra for the CI image changes

[Urgau]

@bors try jobs=aarch64

[rust-bors]

💔 Test for d260a23 failed: CI. Failed jobs:

• try - aarch64-apple (web logs, extended logs)

[Urgau]

@bors try jobs=aarch64

[rust-bors]

💔 Test for c3587c9 failed: CI. Failed jobs:

• try - aarch64-apple (web logs, extended logs)

[jieyouxu]

Question: doesn't this mean that we no longer test if we can build against Ubuntu 22?

[jieyouxu]

Question: ... and for that matter, is this a higher g++ baseline? (I'm not super sure.)