[PATCH v2] Enable -mrop-protect through configure command

[Peter Bergner]

On 5/8/25 4:06 AM, Sachin Monga wrote:
 >
 > 1. -mrop-protect works well with CC but not with CFLAGS as they don’t 
reach .S files.

I think that is due to this hunk in Makeconfig:

     # The assembler can generate debug information too.
     ifndef ASFLAGS
     ASFLAGS := $(filter -g% -fdebug-prefix-map=%,$(CFLAGS))
     endif
     override ASFLAGS += -Werror=undef $(ASFLAGS-config) $(asflags-cpu)

The $(filter ....) ends up setting ASLFAGS to CFLAGS with every option
removed except for options starting with -g* and -fdebug-prefix-map=*,
so the machine specific options starting with -m* are not passed to ASFLAGS.
The next line ends up adding back the -mcpu=* option, but not the 
-mrop-protect.

Maybe it would make sense to pass those machine specific options to ASLFAGS
too, ala:

-ASFLAGS := $(filter -g% -fdebug-prefix-map=%,$(CFLAGS))
+ASFLAGS := $(filter -g% -fdebug-prefix-map=% -m%,$(CFLAGS))

That might make the need to add back $(asflags-cpu) not needed anymore...
not sure about that.

At least on powerpc, the -m* options can set predefined macros that
could be used in asm files, like -mrop-protect setting __ROP_PROTECT__.



 > However, as Florian said CC="gcc -mrop-protect” is enough and I ‘ve 
checked that.

Nod.  It would be nice if setting either CC or CFLAGS would work, ala a
change like above.  However, if people are against the change above, then
we can stick to just setting CC or setting CFLAGS and ASFLAGS.

Peter