MF12 r340697: Introduce src.conf knob to build userland with retpoline

MFC r339511: Introduce src.conf knob to build userland with retpoline

WITH_RETPOLINE enables -mretpoline vulnerability mitigation in userland
for CVE-2017-5715.

MFC r340099: libcompat: disable retpoline when building build tools

These are built with the host toolchain which may not support retpoline.
While here, move the MK_ overrides to a separate line and sort them
alphabetically to support future changes.

MFC r340650: Avoid retpolineplt with static linking

Statically linked binaries linked with -zretpolineplt crash at startup
as lld produces a broken PLT.

MFC r340652: rescue: set NO_SHARED in Makefile

The rescue binary is built statically via the Makefile generated by
crunchgen, but that does not trigger other shared/static logic in
bsd.prog.mk - in particular

PR:		233336
Reported by:	Peter Malcom (r339511), Charlie Li (r340652)
Approved by:	re (kib)
Sponsored by:	The FreeBSD Foundation

1 files changed, 3 insertions, 0 deletions

diff --git a/tools/build/options/WITH_RETPOLINE b/tools/build/options/WITH_RETPOLINE
new file mode 100644
index 000000000000..97093da078d5
--- /dev/null
+++ b/tools/build/options/WITH_RETPOLINE
@@ -0,0 +1,3 @@
+.\" $FreeBSD$
+Set to build the base system with the retpoline speculative execution
+vulnerability mitigation for CVE-2017-5715.