Merge ~smb/ubuntu/+source/xen:wip/focal-devel into ubuntu/+source/xen:ubuntu/focal-devel

[Stefan Bader]

Beside of updating the patch for handling the hypervisor build with cf-protection turned on by default in the compiler, I also added a small change to xen-init-list and xen-init-name. Both get installed on the host and currently have python as the requested interpreter. This gets changed to python2.

[Stefan Bader (smb)]

A test build was done in ppa:smb/focal

[Christian Ehrhardt  (paelzer)]

ack on Select python2 for xen-init-* scripts
ack on changelog
ack on the extension of 1000-flags-fcs-protect-none.patch

As I said before I'd have done it with DEB_*_APPEND in d/rules but I can follow your argument that you want to disable it in as few places as possible to keep as much protection as you can get.
Therefore +1 to this MP - thanks for working this out.

Note: we are past FF, but IMHO this isn't a feature it is a bug fix, so feel free to go on uploading.

review: Approve

diff --git a/debian/changelog b/debian/changelog
index 16ae97d..e335912 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+xen (4.11.3+24-g14b62ab3e5-1ubuntu2) focal; urgency=medium
+
+  * Update: Building hypervisor with cf-protection enabled
+  * Set python2 for xen-init-name and xen-init-list scripts
+
+ -- Stefan Bader <[e-mail]>  Mon, 09 Mar 2020 16:17:56 +0100
+
 xen (4.11.3+24-g14b62ab3e5-1ubuntu1) focal; urgency=medium
 
   * Merge from Debian/Sid. Remaining changes:
diff --git a/debian/patches/1000-flags-fcs-protect-none.patch b/debian/patches/1000-flags-fcs-protect-none.patch
index 9f3a9a9..987cf3b 100644
--- a/debian/patches/1000-flags-fcs-protect-none.patch
+++ b/debian/patches/1000-flags-fcs-protect-none.patch
@@ -21,3 +21,23 @@ Index: xen/xen/arch/x86/Rules.mk
  CFLAGS += -mindirect-branch=thunk-extern -mindirect-branch-register
  CFLAGS += -DCONFIG_INDIRECT_THUNK
  export CONFIG_INDIRECT_THUNK=y
+Index: xen/xen/arch/x86/boot/build32.mk
+===================================================================
+--- xen.orig/xen/arch/x86/boot/build32.mk
++++ xen/xen/arch/x86/boot/build32.mk
+@@ -6,6 +6,15 @@ $(call cc-options-add,CFLAGS,CC,$(EMBEDD
+ 
+ CFLAGS += -Werror -fno-asynchronous-unwind-tables -fno-builtin -g0 -msoft-float
+ CFLAGS += -I$(XEN_ROOT)/xen/include
++# The other hypervisor code is compiled with -mindirect-branch=thunk-extern
++# and for that reason has to disable cf-protection. Not quite sure whether
++# it has to be disabled here for that reason or because the boot code can
++# not use it for other reasons. Either way since enabling full cf-protection
++# by default it *MUST* be turned off here otherwise the hypervisor crashes
++# on boot!
++ifneq ($(call cc-option,$(CC),-fcf-protection,n),n)
++CFLAGS += -fcf-protection=none
++endif
+ CFLAGS := $(filter-out -flto,$(CFLAGS)) 
+ 
+ # NB. awk invocation is a portable alternative to 'head -n -1'
diff --git a/debian/scripts/xen-init-list b/debian/scripts/xen-init-list
index 99646ce..9220df7 100755
--- a/debian/scripts/xen-init-list
+++ b/debian/scripts/xen-init-list
@@ -1,4 +1,4 @@
-#!/usr/bin/python
+#!/usr/bin/python2
 
 import json
 import re
diff --git a/debian/scripts/xen-init-name b/debian/scripts/xen-init-name
index 21aad6f..cf28ba7 100755
--- a/debian/scripts/xen-init-name
+++ b/debian/scripts/xen-init-name
@@ -1,4 +1,4 @@
-#!/usr/bin/python
+#!/usr/bin/python2
 
 import json
 import re