[xen stable-4.13] x86/build: Unilaterally disable -fcf-protection

[patchbot@xxxxxxx]

commit eccc242b590c04758c176120a0ff5a53c044aee0
Author:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Wed Jun 24 16:24:56 2020 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Wed Jun 24 16:24:56 2020 +0200

    x86/build: Unilaterally disable -fcf-protection
    
    Xen doesn't support CET-IBT yet.  At a minimum, logic is required to enable 
it
    for supervisor use, but the livepatch functionality needs to learn not to
    overwrite ENDBR64 instructions.
    
    Furthermore, Ubuntu enables -fcf-protection by default, along with a buggy
    version of GCC-9 which objects to it in combination with
    -mindirect-branch=thunk-extern (Fixed in GCC 10, 9.4).
    
    Various objects (Xen boot path, Rombios 32 stubs) require .text to be at the
    beginning of the object.  These paths explode when .note.gnu.properties gets
    put ahead of .text and we end up executing the notes data.
    
    Disable -fcf-protection for all embedded objects.
    
    Reported-by: Jason Andryuk <jandryuk@xxxxxxxxx>
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Jason Andryuk <jandryuk@xxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
---
 Config.mk | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Config.mk b/Config.mk
index 85bde01f77..fb7c0511b1 100644
--- a/Config.mk
+++ b/Config.mk
@@ -236,6 +236,7 @@ APPEND_CFLAGS += $(foreach i, $(APPEND_INCLUDES), -I$(i))
 
 EMBEDDED_EXTRA_CFLAGS := -nopie -fno-stack-protector -fno-stack-protector-all
 EMBEDDED_EXTRA_CFLAGS += -fno-exceptions -fno-asynchronous-unwind-tables
+EMBEDDED_EXTRA_CFLAGS += -fcf-protection=none
 
 XEN_EXTFILES_URL ?= http://xenbits.xen.org/xen-extfiles
 # All the files at that location were downloaded from elsewhere on
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.13