On Sun, Aug 16, 2026 at 04:28:20PM +0200, Christoph Erhardt wrote: > Hi Norbert, > > this sounds a sensible initiative to me. > > Do you have more information to share? Areas of interest: > * concrete numbers from the performance measurements, > * number and names of packages that required fixing, > * their upstream status. > > In principle I see two possible ways for introducing the new flags: > a) Append them to `_hardening_cflags` if we consider them generic hardening > options that should be set for every hardened build. > b) Allow more fine-grained control by introducing an extra macro, similar to > e.g. `_include_frame_pointers`. > > I'm not sure which is preferable here. > > Regarding `-ftrivial-auto-var-init=zero`: this is best done as a separate > effort because its implications are somewhat more invasive from what I know.
snip > > Would there be another process for other flags, like > > -ftrivial-auto-var-init=zero where there can be minor performance > > consequences? "minor performance consequences" really depends on your POV of what "minor" means. Upstream we enabled -ftrivial-auto-var-init=zero unconditionally in QEMU and found that virtio-blk degraded by 9%. In something where we fight for every single 1% of performance, a 9% loss is major. We can expect to see many examples of this across the Fedora package set which will require maintainer attention if -ftrivial-auto-var-init=zero is always enabled by default in Fedora CFLAGS. Either maintainers will need to turn off the new flag or will need to patch the code to add __attribute__((uninitialized)) against variables that are performance sensitive. The latter is the best option and what QEMU did upstream but much more work. None the less I encourage wide adoption of -ftrivial-auto-var-init=zero because it eliminates a whole class of vulnerabilities that the AI powered security scanners otherwise complain about. This is more a thing for upstream though. With regards, Daniel -- |: https://berrange.com ~~ https://hachyderm.io/@berrange :| |: https://libvirt.org ~~ https://entangle-photo.org :| |: https://pixelfed.art/berrange ~~ https://fstop138.berrange.com :| -- _______________________________________________ devel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
