[xen stable-4.12] x86/build: Unilaterally disable -fcf-protection

[patchbot@xxxxxxx]

commit bcdaffc58987c943e553739b6bcbfa4323cc5bd8
Author:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Wed Jun 24 16:59:49 2020 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Wed Jun 24 16:59:49 2020 +0200

    x86/build: Unilaterally disable -fcf-protection
    
    Xen doesn't support CET-IBT yet.  At a minimum, logic is required to enable 
it
    for supervisor use, but the livepatch functionality needs to learn not to
    overwrite ENDBR64 instructions.
    
    Furthermore, Ubuntu enables -fcf-protection by default, along with a buggy
    version of GCC-9 which objects to it in combination with
    -mindirect-branch=thunk-extern (Fixed in GCC 10, 9.4).
    
    Various objects (Xen boot path, Rombios 32 stubs) require .text to be at the
    beginning of the object.  These paths explode when .note.gnu.properties gets
    put ahead of .text and we end up executing the notes data.
    
    Disable -fcf-protection for all embedded objects.
    
    Reported-by: Jason Andryuk <jandryuk@xxxxxxxxx>
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Jason Andryuk <jandryuk@xxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
---
 Config.mk | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Config.mk b/Config.mk
index 952b398174..be5634f26e 100644
--- a/Config.mk
+++ b/Config.mk
@@ -236,6 +236,7 @@ APPEND_CFLAGS += $(foreach i, $(APPEND_INCLUDES), -I$(i))
 
 EMBEDDED_EXTRA_CFLAGS := -nopie -fno-stack-protector -fno-stack-protector-all
 EMBEDDED_EXTRA_CFLAGS += -fno-exceptions -fno-asynchronous-unwind-tables
+EMBEDDED_EXTRA_CFLAGS += -fcf-protection=none
 
 XEN_EXTFILES_URL ?= http://xenbits.xen.org/xen-extfiles
 # All the files at that location were downloaded from elsewhere on
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.12