Add .note.GNU-stack at the source level.

GNU-based toolchains on ELF platforms default the stack to executable
and rely on a .note.GNU-stack section in *each* object file to flip it
off. The compiler knows to do this for its object files, but assembly
does everything by hand. See this link for details:
https://www.airs.com/blog/archives/518

We do this in the cmake build by passing -Wa,--noexecstack to the
assembler. However, since we have to deal with many buildsystems, it
would be more robust to put it in the source.

It's unclear whether this should be gated on ELF or Linux. The Gentoo
and Ubuntu documents recommend checking for Linux with gas, but only ELF
with NASM.
https://wiki.gentoo.org/wiki/Hardened/GNU_stack_quickstart
https://wiki.ubuntu.com/SecurityTeam/Roadmap/ExecutableStacks

At the same time, these links suggest it is an ELF-wide issue and not
just Linux:
https://github.com/golang/go/issues/5392
https://reviews.freebsd.org/D11033

https://github.com/openssl/openssl/issues/4575 also discusses this but
the rationale lists both ELF and non-ELF platforms, so it's unclear.

Treat it as ELF-wide for now. We can revisit this if necessary.

Update-Note: If there is a build failure due to .note.GNU-stack, holler.
Change-Id: Ic59096aa1fc2bf5380a412c9991de22cb46c0faf
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/37984
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: David Benjamin <davidben@google.com>

crypto/curve25519/asm/x25519-asm-arm.S

@@ -2129,4 +2129,8 @@ mov sp,r12
 vpop {q4,q5,q6,q7}
 bx lr
 
+#if defined(__ELF__)
+.section	.note.GNU-stack,"",%progbits
+#endif
+
 #endif  /* !OPENSSL_NO_ASM && __arm__ && !__APPLE__ */

crypto/hrss/asm/poly_rq_mul.S

@@ -8460,4 +8460,8 @@ ret
 .cfi_endproc
 .size poly_Rq_mul,.-poly_Rq_mul
 
+#if defined(__ELF__)
+.section	.note.GNU-stack,"",@progbits
+#endif
+
 #endif

crypto/perlasm/arm-xlate.pl

@@ -228,6 +228,9 @@ while(my $line=<>) {
     print "\n";
 }
 
+# See https://www.airs.com/blog/archives/518.
+print ".section\t.note.GNU-stack,\"\",\%progbits\n" if ($flavour =~ /linux/);
+
 print "#endif\n" if ($flavour eq "linux32" || $flavour eq "linux64");
 print "#endif  // !OPENSSL_NO_ASM\n";
 

crypto/perlasm/ppc-xlate.pl

@@ -309,6 +309,9 @@ while($line=<>) {
     print "\n";
 }
 
+# See https://www.airs.com/blog/archives/518.
+print ".section\t.note.GNU-stack,\"\",\@progbits\n" if ($flavour =~ /linux/);
+
 print "#endif  // !OPENSSL_NO_ASM && __powerpc64__\n";
 
 close STDOUT;

crypto/perlasm/x86_64-xlate.pl

@@ -1260,6 +1260,8 @@ while(defined(my $line=<>)) {
 
 print "\n$current_segment\tENDS\n"	if ($current_segment && $masm);
 print "END\n"				if ($masm);
+# See https://www.airs.com/blog/archives/518.
+print ".section\t.note.GNU-stack,\"\",\@progbits\n" if ($elf);
 print "#endif\n"			if ($gas);
 
 

crypto/perlasm/x86asm.pl

@@ -297,6 +297,8 @@ ___
 ___
     }
     print @out;
+    # See https://www.airs.com/blog/archives/518.
+    print ".section\t.note.GNU-stack,\"\",\@progbits\n" if ($elf);
     print "#endif\n" unless ($win32 || $netware);
 }
 

crypto/poly1305/poly1305_arm_asm.S

@@ -2022,4 +2022,8 @@ vst1.8 d4,[r0,: 64]
 add sp,sp,#0
 bx lr
 
+#if defined(__ELF__)
+.section	.note.GNU-stack,"",%progbits
+#endif
+
 #endif  /* __arm__ && !OPENSSL_NO_ASM && !__APPLE__ */