From 1a9bbcce9a1e2df1639ceeb85d05692b5448b67d Mon Sep 17 00:00:00 2001
From: Jeremy Linton <jeremy.linton@arm.com>
Date: Sat, 5 Sep 2026 12:17:56 +0200
Subject: [PATCH] llvm: enable bti and pac-ret for aarch64-openbsd
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

OpenBSD requires the former and strongly encourages the latter.

ref https://codeberg.org/ziglang/zig/issues/35570

Co-authored-by: Alex Rønne Petersen <alex@alexrp.com>
---
 src/codegen/llvm.zig | 32 +++++++++++++++++++++++++++++++-
 1 file changed, 31 insertions(+), 1 deletion(-)

diff --git a/src/codegen/llvm.zig b/src/codegen/llvm.zig
index 186dab61293ae7ccd8d00fa17d328959c8b62cc6..a146fed57f4d9a3ee582639d4f036ae30466ed88 100644
--- a/src/codegen/llvm.zig
+++ b/src/codegen/llvm.zig
@@ -395,7 +395,7 @@ pub const Object = struct {
         }
 
         {
-            var module_flags = try std.array_list.Managed(Builder.Metadata).initCapacity(o.gpa, 8);
+            var module_flags = try std.array_list.Managed(Builder.Metadata).initCapacity(o.gpa, 11);
             defer module_flags.deinit();
 
             const behavior_error = try o.builder.metadataConstant(try o.builder.intConst(.i32, 1));
@@ -492,6 +492,20 @@ pub const Object = struct {
                 }));
             }
 
+            // The frontend should eventually offer options to control these.
+            if (target.cpu.arch.isAarch64() and target.os.tag == .openbsd) {
+                module_flags.appendAssumeCapacity(try o.builder.metadataTuple(&.{
+                    behavior_min,
+                    (try o.builder.metadataString("branch-target-enforcement")).toMetadata(),
+                    try o.builder.metadataConstant(try o.builder.intConst(.i32, 2)),
+                }));
+                module_flags.appendAssumeCapacity(try o.builder.metadataTuple(&.{
+                    behavior_min,
+                    (try o.builder.metadataString("sign-return-address")).toMetadata(),
+                    try o.builder.metadataConstant(try o.builder.intConst(.i32, 2)),
+                }));
+            }
+
             try o.builder.addNamedMetadata(try o.builder.string("llvm.module.flags"), module_flags.items);
         }
 
@@ -2228,6 +2242,22 @@ pub const Object = struct {
             // above, this should be revisited if `softfp` support is added.
             try attributes.addFnAttr(.noimplicitfloat, &o.builder);
         }
+
+        // The frontend should eventually offer options to control these.
+        if (target.cpu.arch.isAarch64() and target.os.tag == .openbsd) {
+            try attributes.addFnAttr(.{ .string = .{
+                .kind = try o.builder.string("branch-target-enforcement"),
+                .value = try o.builder.string(""),
+            } }, &o.builder);
+            try attributes.addFnAttr(.{ .string = .{
+                .kind = try o.builder.string("sign-return-address"),
+                .value = try o.builder.string("non-leaf"),
+            } }, &o.builder);
+            try attributes.addFnAttr(.{ .string = .{
+                .kind = try o.builder.string("sign-return-address-key"),
+                .value = try o.builder.string("a_key"),
+            } }, &o.builder);
+        }
     }
 
     pub fn addCallingConventionFnAttributes(
-- 
2.54.0