Add checks for Spectre v2 mitigation (retpoline)

This adds checks for gcc and clang flags for mitigations for Spectre
variant 2, ie "retpoline".  It'll automatically enabled if the compiler
supports it as part of toolchain hardening flag.  ok djm@

diff --git a/configure.ac b/configure.ac
index 0476398acf6ea65ca2770d2006dc0be5e80bfcdf..71174571b30594187e2512bc6f77067591a15d85 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -163,6 +163,10 @@ if test "$GCC" = "yes" || test "$GCC" = "egcs"; then
        OSSH_CHECK_CFLAG_COMPILE([-Wunused-result], [-Wno-unused-result])
        OSSH_CHECK_CFLAG_COMPILE([-fno-strict-aliasing])
     if test "x$use_toolchain_hardening" = "x1"; then
+       OSSH_CHECK_CFLAG_COMPILE([-mfunction-return=thunk]) # gcc
+       OSSH_CHECK_CFLAG_COMPILE([-mindirect-branch=thunk]) # gcc
+       OSSH_CHECK_CFLAG_COMPILE([-mretpoline]) # clang
+       OSSH_CHECK_CFLAG_LINK([-z retpolineplt])
        OSSH_CHECK_CFLAG_COMPILE([-D_FORTIFY_SOURCE=2])
        OSSH_CHECK_LDFLAG_LINK([-Wl,-z,relro])
        OSSH_CHECK_LDFLAG_LINK([-Wl,-z,now])