add a --without-retpoline configure option

discussed with deraadt and dtucker a while ago

diff --git a/configure.ac b/configure.ac
index fda0928303a23f7dfd7db1c05e5f63255cf962bc..c1af4b42329b35b423c844e459671beeff6957c8 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -149,6 +149,7 @@ fi
 
 use_stack_protector=1
 use_toolchain_hardening=1
+use_retpoline=1
 AC_ARG_WITH([stackprotect],
     [  --without-stackprotect  Don't use compiler's stack protection], [
     if test "x$withval" = "xno"; then
@@ -159,6 +160,11 @@ AC_ARG_WITH([hardening],
     if test "x$withval" = "xno"; then
        use_toolchain_hardening=0
     fi ])
+AC_ARG_WITH([retpoline],
+    [  --without-retpoline     Enable retpoline spectre mitigation], [
+    if test "x$withval" = "xno"; then
+       use_retpoline=0
+    fi ])
 
 # We use -Werror for the tests only so that we catch warnings like "this is
 # on by default" for things like -fPIE.
@@ -216,8 +222,6 @@ if test "$GCC" = "yes" || test "$GCC" = "egcs"; then
        OSSH_CHECK_CFLAG_COMPILE([-Wbitwise-instead-of-logical])
        OSSH_CHECK_CFLAG_COMPILE([-fno-strict-aliasing])
     if test "x$use_toolchain_hardening" = "x1"; then
-       OSSH_CHECK_CFLAG_COMPILE([-mretpoline]) # clang
-       OSSH_CHECK_LDFLAG_LINK([-Wl,-z,retpolineplt])
        OSSH_CHECK_CFLAG_COMPILE([-D_FORTIFY_SOURCE=2])
        OSSH_CHECK_LDFLAG_LINK([-Wl,-z,relro])
        OSSH_CHECK_LDFLAG_LINK([-Wl,-z,now])
@@ -240,6 +244,10 @@ if test "$GCC" = "yes" || test "$GCC" = "egcs"; then
        esac
        OSSH_CHECK_CFLAG_COMPILE([-ftrivial-auto-var-init=zero])
     fi
+    if test "x$use_retpoline" = "x1"; then
+       OSSH_CHECK_CFLAG_COMPILE([-mretpoline]) # clang
+       OSSH_CHECK_LDFLAG_LINK([-Wl,-z,retpolineplt])
+    fi
 
        AC_MSG_CHECKING([if $CC accepts -fno-builtin-memset])
        saved_CFLAGS="$CFLAGS"