build: discover -O0 side-channel components from a source marker

The list of timing-sensitive components built at -O0 was hand-maintained in the
Makefile, so adding one required a Makefile edit (breaking the drop-in component
model) and the -O0 files emitted a spurious "_FORTIFY_SOURCE requires -O"
warning from glibc.

Discover the set by grepping the source for a KASLD_BUILD_NO_OPTIMIZE marker
(added to each of the 7 side-channel headers) instead, and append
-U_FORTIFY_SOURCE to the -O0 recipe to drop the fortify define (a no-op at -O0).
Whole-file -O0 is kept deliberately — a per-function no-opt attribute is not a
reliable substitute for the timing guarantee.

Author: bcoles

Makefile

@@ -227,10 +227,15 @@ COMP_SRC_DIR := $(SRC_DIR)/components
 SRC_FILES := $(wildcard $(COMP_SRC_DIR)/*.c)
 BIN_FILES := $(patsubst $(COMP_SRC_DIR)/%.c,$(COMP_DIR)/%,$(SRC_FILES))
 
-# Side-channel components compiled with -O0 (see the recipe below for why).
-# Named once here so the build rule and `make print-deps` share one list.
-SIDECHANNEL_COMPONENTS := databounce echoload entrybleed mincore prefetch \
-                          prefetch_directmap zombieload
+# Side-channel components opt out of optimization by carrying the marker
+# KASLD_BUILD_NO_OPTIMIZE in their source header; they are discovered by grep so
+# adding one needs no Makefile edit (matching the drop-in component model). The
+# same list feeds the build rule below and `make print-deps`. Whole-file -O0 is
+# deliberate: it reliably stops the optimizer reordering or eliding the
+# rdtsc/mfence timing loops, which a per-function attribute does not guarantee
+# (gcc's optimize attribute is documented debugging-only).
+SIDECHANNEL_COMPONENTS := $(patsubst $(COMP_SRC_DIR)/%.c,%,\
+    $(shell grep -l KASLD_BUILD_NO_OPTIMIZE $(COMP_SRC_DIR)/*.c 2>/dev/null))
 SIDECHANNEL_BINS := $(addprefix $(COMP_DIR)/,$(SIDECHANNEL_COMPONENTS))
 
 # cc-component <cmd...>: compile one leak component. One line per component.
@@ -305,9 +310,11 @@ endif
 # (rdtsc/rdtscp + mfence/lfence), speculative execution gadgets (asm goto),
 # or Flush+Reload cache probing via volatile pointer accesses. The static
 # pattern rule takes precedence over the generic $(COMP_DIR)/% rule above for
-# the listed targets; the list lives in SIDECHANNEL_COMPONENTS.
+# the SIDECHANNEL_BINS (discovered by the KASLD_BUILD_NO_OPTIMIZE marker above).
+# -U_FORTIFY_SOURCE drops the fortify define inherited from ALL_CFLAGS: it is a
+# no-op at -O0 and glibc otherwise warns "_FORTIFY_SOURCE requires -O".
 $(SIDECHANNEL_BINS): $(COMP_DIR)/%: $(COMP_SRC_DIR)/%.c $(HDRS) | $(COMP_DIR)
-	$(call cc-component, $(CC) $(ALL_CFLAGS) -O0 $(ALL_LDFLAGS) -I$(SRC_DIR) $< -o $@)
+	$(call cc-component, $(CC) $(ALL_CFLAGS) -O0 -U_FORTIFY_SOURCE $(ALL_LDFLAGS) -I$(SRC_DIR) $< -o $@)
 
 # kernelsnitch: needs -lpthread (uses default -O2 for hash timing performance)
 $(COMP_DIR)/kernelsnitch: $(COMP_SRC_DIR)/kernelsnitch.c $(HDRS) | $(COMP_DIR)

src/components/databounce.c

@@ -46,6 +46,10 @@
 // https://cc0x1f.net/publications/kaslr.pdf
 // https://github.com/cc0x1f/store-to-leak-forwarding-there-and-back-again
 // https://i.blackhat.com/asia-20/Friday/asia-20-Canella-Store-To-Leak-Forwarding-There-And-Back-Again-wp.pdf
+//
+// KASLD_BUILD_NO_OPTIMIZE: built -O0 (Makefile) so the optimizer cannot reorder
+// or elide the timing / cache-probe / speculation measurements this technique
+// relies on; a per-function no-opt attribute is not a reliable substitute.
 // ---
 // <bcoles@gmail.com>
 

src/components/echoload.c

@@ -49,6 +49,10 @@
 // https://cc0x1f.net/publications/kaslr.pdf
 // https://github.com/cc0x1f/store-to-leak-forwarding-there-and-back-again
 // https://i.blackhat.com/asia-20/Friday/asia-20-Canella-Store-To-Leak-Forwarding-There-And-Back-Again-wp.pdf
+//
+// KASLD_BUILD_NO_OPTIMIZE: built -O0 (Makefile) so the optimizer cannot reorder
+// or elide the timing / cache-probe / speculation measurements this technique
+// relies on; a per-function no-opt attribute is not a reliable substitute.
 // ---
 // <bcoles@gmail.com>
 

src/components/entrybleed.c

@@ -44,6 +44,10 @@
 // https://dl.acm.org/doi/pdf/10.1145/3623652.3623669
 // https://googleprojectzero.blogspot.com/2022/12/exploiting-CVE-2022-42703-bringing-back-the-stack-attack.html
 // https://bugs.chromium.org/p/project-zero/issues/detail?id=2351
+//
+// KASLD_BUILD_NO_OPTIMIZE: built -O0 (Makefile) so the optimizer cannot reorder
+// or elide the timing / cache-probe / speculation measurements this technique
+// relies on; a per-function no-opt attribute is not a reliable substitute.
 // ---
 // <bcoles@gmail.com>
 

src/components/mincore.c

@@ -25,6 +25,10 @@
 // Mitigations:
 //   Patched in v4.15. No runtime sysctl could restrict access — the
 //   bug was an uninitialized byte in the mincore output vector. x86_64 only.
+//
+// KASLD_BUILD_NO_OPTIMIZE: built -O0 (Makefile) so the optimizer cannot reorder
+// or elide the timing / cache-probe / speculation measurements this technique
+// relies on; a per-function no-opt attribute is not a reliable substitute.
 // ---
 // <bcoles@gmail.com>
 

src/components/prefetch.c

@@ -126,6 +126,10 @@
 //   https://github.com/IAIK/prefetch
 //   https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/gruss
 //   https://www.amd.com/en/resources/product-security/bulletin/amd-sb-1017.html
+//
+// KASLD_BUILD_NO_OPTIMIZE: built -O0 (Makefile) so the optimizer cannot reorder
+// or elide the timing / cache-probe / speculation measurements this technique
+// relies on; a per-function no-opt attribute is not a reliable substitute.
 // ---
 // <bcoles@gmail.com>
 

src/components/prefetch_directmap.c

@@ -41,6 +41,10 @@
 //
 // References:
 //   https://gruss.cc/files/prefetch.pdf
+//
+// KASLD_BUILD_NO_OPTIMIZE: built -O0 (Makefile) so the optimizer cannot reorder
+// or elide the timing / cache-probe / speculation measurements this technique
+// relies on; a per-function no-opt attribute is not a reliable substitute.
 // ---
 // <bcoles@gmail.com>
 

src/components/zombieload.c

@@ -78,6 +78,10 @@
 // Van Schaik, Milburn, Österlund, Frigo, Maisuradze, Razavi, Bos,
 // Giuffrida.
 // "RIDL: Rogue In-Flight Data Load" (S&P 2019)
+//
+// KASLD_BUILD_NO_OPTIMIZE: built -O0 (Makefile) so the optimizer cannot reorder
+// or elide the timing / cache-probe / speculation measurements this technique
+// relies on; a per-function no-opt attribute is not a reliable substitute.
 // ---
 // <bcoles@gmail.com>