From: Darren Tucker Date: Sat, 10 Feb 2018 22:32:37 +0000 (+1100) Subject: Add checks for Spectre v2 mitigation (retpoline) X-Git-Tag: V_7_7_P1~116 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3377df00ea3fece5293db85fe63baef33bf5152e;p=thirdparty%2Fopenssh-portable.git Add checks for Spectre v2 mitigation (retpoline) This adds checks for gcc and clang flags for mitigations for Spectre variant 2, ie "retpoline". It'll automatically enabled if the compiler supports it as part of toolchain hardening flag. ok djm@ --- diff --git a/configure.ac b/configure.ac index 0476398ac..71174571b 100644 --- a/configure.ac +++ b/configure.ac @@ -163,6 +163,10 @@ if test "$GCC" = "yes" || test "$GCC" = "egcs"; then OSSH_CHECK_CFLAG_COMPILE([-Wunused-result], [-Wno-unused-result]) OSSH_CHECK_CFLAG_COMPILE([-fno-strict-aliasing]) if test "x$use_toolchain_hardening" = "x1"; then + OSSH_CHECK_CFLAG_COMPILE([-mfunction-return=thunk]) # gcc + OSSH_CHECK_CFLAG_COMPILE([-mindirect-branch=thunk]) # gcc + OSSH_CHECK_CFLAG_COMPILE([-mretpoline]) # clang + OSSH_CHECK_CFLAG_LINK([-z retpolineplt]) OSSH_CHECK_CFLAG_COMPILE([-D_FORTIFY_SOURCE=2]) OSSH_CHECK_LDFLAG_LINK([-Wl,-z,relro]) OSSH_CHECK_LDFLAG_LINK([-Wl,-z,now])