[PATCH v2] Enable -mrop-protect through configure command

[Peter Bergner]

On 4/29/25 3:14 PM, Adhemerval Zanella Netto wrote:
> On 29/04/25 16:17, Sachin Monga wrote:
>> powerpc64le: Add --enable-rop-protection=yes for configure command.
>> Suffix -mrop-protect to only ppc64le configured builds with ROP.
>> Flag error when ROP is configured but the compiler is unsupportive.
>> Add -mno-rop-protect for Power7 specific source files.
>>
>> Signed-off-by: Sachin Monga <smonga@linux.ibm.com>
> 
> Why do we need a configure switch to enable it, instead of getting it
> through either default compilers options and/or through cflags (like
> aarch64 BTI, libc_cv_aarch64_bti, or PAC-RET, libc_cv_aarch64_pac_ret)?

I guess we thought it was a good idea to offer a configure option like
we do for other "protection" like features like --enable-stack-protector,
etc.  If it's not wanted, I guess we can go the route of modifying CFLAGS
during our builds.  We'll do what the community thinks is best.

Sachin, can you confirm that setting CFLAGS with -mrop-protect gives
us the same result as using the configure option?


Peter