From 22ee4c0760d3af2892cc9b57926fe1afd6bad4c7 Mon Sep 17 00:00:00 2001 From: Stenzek Date: Tue, 2 Jun 2026 21:34:23 +1000 Subject: [PATCH] CMake: Build with immediate binding/full relro Doing a full xsave/xrstor the first time a library function is called is completely bonkers. Plus the obvious security issues with the PLT being writable. And people think this OS is faster than Windows. Even with immediate binding it's still slower, since it's a single indirect call on Windows, versus a direct call+indirect jump here. --- CMakeLists.txt | 3 +++ CMakeModules/DuckStationBuildSummary.cmake | 1 + 2 files changed, 4 insertions(+) diff --git a/CMakeLists.txt b/CMakeLists.txt index 40ec4aa8f..357ee6954 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -42,10 +42,13 @@ include(DuckStationDependencies) include(DuckStationCompilerRequirement) # Enable PIC on Linux, otherwise the builds do not support ASLR. +# Also force immediate binding of all symbols, glibc and its +# xsave/xrstor on first shared library call is bonkers. if(LINUX OR BSD) include(CheckPIESupported) check_pie_supported() set(CMAKE_POSITION_INDEPENDENT_CODE TRUE) + set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -Wl,-z,now,-z,relro") endif() # Force debug symbols for Linux builds. diff --git a/CMakeModules/DuckStationBuildSummary.cmake b/CMakeModules/DuckStationBuildSummary.cmake index f3ad0bc51..60de622f8 100644 --- a/CMakeModules/DuckStationBuildSummary.cmake +++ b/CMakeModules/DuckStationBuildSummary.cmake @@ -8,6 +8,7 @@ message(STATUS "Build Type: ${CMAKE_BUILD_TYPE}") string(TOUPPER "${CMAKE_BUILD_TYPE}" CMAKE_BUILD_TYPE_UPPER) message(STATUS "C Flags: ${CMAKE_C_FLAGS} ${CMAKE_C_FLAGS_${CMAKE_BUILD_TYPE_UPPER}}") message(STATUS "CXX Flags: ${CMAKE_CXX_FLAGS} ${CMAKE_CXX_FLAGS_${CMAKE_BUILD_TYPE_UPPER}}") +message(STATUS "Linker Flags: ${CMAKE_EXE_LINKER_FLAGS} ${CMAKE_EXE_LINKER_FLAGS_${CMAKE_BUILD_TYPE_UPPER}}") if(ENABLE_OPENGL) message(STATUS "Building with OpenGL support.")