Closes#376820
The issue with providing `moduleMakeFlags` via `passthru` of the kernel
package is that when this package gets overriden[1], the `moduleMakeFlags`
list still references the kernel without the overrides.
This broke e.g. kernel modules of linux-rpi4 which can be reproduced
with
nix-build --argstr system aarch64-linux -A linuxKernel.packages.linux_rpi4.zfs_2_3
This used to break with
Error: modDirVersion 6.6.51 specified in the Nix expression is wrong, it should be: 6.6.51-v8
since KBUILD_OUTPUT referenced the kernel without the changes from
`overrideDerivation` that also changes the `modDirVersion`.
The new approach is to add the build flags right into
`linuxKernel.packages.linux_X_Y`: that way we don't need any hacks to
update `moduleMakeFlags` when the derivation with the passthru gets
overridden.
By using the fixpoint of the package-set, the `kernelModuleMakeFlags`
list is correctly updated. E.g. given
with import ./. {};
linuxKernel.packages.linux_6_6.extend (self: super: {
kernel = super.kernel.overrideAttrs (_: {
name = "linux-snens";
});
})
the `makeFlags` is correctly updated:
$ nix-instantiate snenskek.nix -A zfs_2_3.makeFlags --eval --strict
[ "ARCH=x86_64" "CROSS_COMPILE=" "KBUILD_OUTPUT=/nix/store/gsp68549k1aqbwxwczpgw67w5jjn4shw-linux-snens-dev/lib/modules/6.6.74/build" ]
[1] E.g. `linux-rpi4`.
I don't think this really makes sense, because upstream doesn't list any constraints on supported kernel versions, and worst case it'll just fail to build.
The following parameters are now available:
* hardeningDisable
To disable specific hardening flags
* hardeningEnable
To enable specific hardening flags
Only the cc-wrapper supports this right now, but these may be reused by
other wrappers, builders or setup hooks.
cc-wrapper supports the following flags:
* fortify
* stackprotector
* pie (disabled by default)
* pic
* strictoverflow
* format
* relro
* bindnow
