From: Andrew Cooper Date: Tue, 12 May 2020 18:18:43 +0000 (+0100) Subject: x86/build: Unilaterally disable -fcf-protection X-Git-Tag: archive/raspbian/4.14.0+80-gd101b417b7-1+rpi1^2~63^2~275 X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=3a218961b16f1f4feb1147f56338faf1ac8f5703;p=xen.git x86/build: Unilaterally disable -fcf-protection Xen doesn't support CET-IBT yet. At a minimum, logic is required to enable it for supervisor use, but the livepatch functionality needs to learn not to overwrite ENDBR64 instructions. Furthermore, Ubuntu enables -fcf-protection by default, along with a buggy version of GCC-9 which objects to it in combination with -mindirect-branch=thunk-extern (Fixed in GCC 10, 9.4). Various objects (Xen boot path, Rombios 32 stubs) require .text to be at the beginning of the object. These paths explode when .note.gnu.properties gets put ahead of .text and we end up executing the notes data. Disable -fcf-protection for all embedded objects. Reported-by: Jason Andryuk Signed-off-by: Andrew Cooper Reviewed-by: Jason Andryuk Reviewed-by: Jan Beulich --- diff --git a/Config.mk b/Config.mk index b0f16680f3..7d556aed30 100644 --- a/Config.mk +++ b/Config.mk @@ -205,6 +205,7 @@ APPEND_CFLAGS += $(foreach i, $(APPEND_INCLUDES), -I$(i)) EMBEDDED_EXTRA_CFLAGS := -nopie -fno-stack-protector -fno-stack-protector-all EMBEDDED_EXTRA_CFLAGS += -fno-exceptions -fno-asynchronous-unwind-tables +EMBEDDED_EXTRA_CFLAGS += -fcf-protection=none XEN_EXTFILES_URL ?= http://xenbits.xen.org/xen-extfiles # All the files at that location were downloaded from elsewhere on