4.2.1.21 The not-branch-protection test ¶

  Problem:  Protecting AArch64 binaries needs newer versions of AArch64 cores
  Fix By:   Compile with -mbranch-protection=none
  Waive If: Not running on AArch64
  Waive If: The application will run on Fedora 35 or later.
  Waive If: The application will not run on newer AArch64 cores.
  Waive If: The application does not expect to have branch protection.

  Example:  MAYB: not branch protection test because branch protection is enabled - but not supported by the OS
  Example:  MAYB: not branch protection test because branch protection is partially enabled, but not supported by the OS

Note - this test is the inverse of the The branch-protection test test and directly related to the The not-dynamic-tags test test.

This test checks to see if the compile time option to enable the AArch64 branch protection security feature was used. This feature is only supported on newer versions of AArch64 core, and will not be effective on older cores. (Enabling branch protection will not stop the application from working, but it will be run without the expected protection). Hence this test checks to make sure that the option was not used, or was used but was set to disable the feature.

The branch protection feature can be disabled by compiling with the -mbranch-protection=none gcc command line option.

Note - this test is automatically disabled if one of the following profile options is used:

--profile=rawhide

--profile=f44

--profile=f43

--profile=f42

--profile=f41

--profile=f40

--profile=f39

--profile=f38

--profile=f37

--profile=f36

--profile=el10

The test is automatically enabled if one of the other profile options is used, ie:

--profile=el7

--profile=el8

--profile=el9

--profile=f35

If necessary the test can be disabled via the --skip-not-branch-protection option and re-enabled via the --test-not-branch-protection option.