[xen staging] x86/build: Unilaterally disable -fcf-protection

[patchbot@xxxxxxx]

commit 3a218961b16f1f4feb1147f56338faf1ac8f5703
Author:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Tue May 12 19:18:43 2020 +0100
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Wed May 13 20:33:42 2020 +0100

    x86/build: Unilaterally disable -fcf-protection
    
    Xen doesn't support CET-IBT yet.  At a minimum, logic is required to enable 
it
    for supervisor use, but the livepatch functionality needs to learn not to
    overwrite ENDBR64 instructions.
    
    Furthermore, Ubuntu enables -fcf-protection by default, along with a buggy
    version of GCC-9 which objects to it in combination with
    -mindirect-branch=thunk-extern (Fixed in GCC 10, 9.4).
    
    Various objects (Xen boot path, Rombios 32 stubs) require .text to be at the
    beginning of the object.  These paths explode when .note.gnu.properties gets
    put ahead of .text and we end up executing the notes data.
    
    Disable -fcf-protection for all embedded objects.
    
    Reported-by: Jason Andryuk <jandryuk@xxxxxxxxx>
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Jason Andryuk <jandryuk@xxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
---
 Config.mk | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Config.mk b/Config.mk
index b0f16680f3..7d556aed30 100644
--- a/Config.mk
+++ b/Config.mk
@@ -205,6 +205,7 @@ APPEND_CFLAGS += $(foreach i, $(APPEND_INCLUDES), -I$(i))
 
 EMBEDDED_EXTRA_CFLAGS := -nopie -fno-stack-protector -fno-stack-protector-all
 EMBEDDED_EXTRA_CFLAGS += -fno-exceptions -fno-asynchronous-unwind-tables
+EMBEDDED_EXTRA_CFLAGS += -fcf-protection=none
 
 XEN_EXTFILES_URL ?= http://xenbits.xen.org/xen-extfiles
 # All the files at that location were downloaded from elsewhere on
--
generated by git-patchbot for /home/xen/git/xen.git#staging