We already assemble our assembly files using the $(CC) compiler driver, rather than the actual $(AS) assembler. This means that * The C preprocessor gets run on the assembly file * It's valid to pass gcc-style flags to it, like e.g. -mbranch-protection or -fcf-protection * If you do so, the relevant preprocessor macros like __CET__ get set * If you really wanted to pass assembler flags, you would need to do that using -Wa,... anyway So I think it makes sense to pass "$(XCFLAGS) $(CFLAGS) $(CPPFLAGS)" to gcc/clang/etc when assembling, rather than passing $(ASFLAGS) (since the flags are not actually passed to `as`, but `cc`!). The side effect of this is that if there are mitigation flags like -fcf-protection in $CFLAGS, then the relevant macros like __CET__ will be defined when assembling the files. [Bug #20601]