Fixes rust-lang#68104

Previous, we were encoding AnonConst as a regular Const, causing us to
treat them differently after being deserialized in another compilation
session.

This will run all tests for `riscv64gc-unknown-linux-gnu` in a QEMU
instance. This is based upon the armhf QEMU test image.

Thanks to jfrimmel for pointing this out

Co-authored-by: J. Frimmel <[email protected]>

In our GitHub Actions setup macOS is too unreliable to gate on it, but
the other builders work fine. This commit splits the macOS builders into
a separate job (called auto-fallible), allowing us to gate on the auto
job without failing due to macOS spurious failures.

The build is not actually needed often, and it can be added back on a
case-by-case basis if a specific PR needs access to it.

Insufficient sanitization of the x87 FPU tag word in the trusted enclave runtime allowed unprivileged adversaries in the containing host application to induce incoherent or unexpected results for ABI-compliant compiled enclave application code that uses the x87 FPU.

Vulnerability was disclosed to us by Fritz Alder, Jo Van Bulck, David Oswald and Frank Piessens

…r=varkor

Properly encode AnonConst into crate metadata

Fixes rust-lang#68104

Previous, we were encoding AnonConst as a regular Const, causing us to
treat them differently after being deserialized in another compilation
session.

Support sanitizers on aarch64-unknown-linux-gnu

RISC-V Emulated Testing

Adds a disabled docker image on which to run RISC-V tests. Based on the armhf image.

Test using
```
./src/ci/docker/run.sh riscv64gc-linux
```

cc: @msizanoen1

…ulacrum

Update CFGuard syntax

Update the naming and syntax of the control-flow-guard option, as discussed in rust-lang#68793.

r? @Mark-Simulacrum

…ark-Simulacrum

ci: allow gating GHA on everything but macOS

In our GitHub Actions setup macOS is too unreliable to gate on it, but the other builders work fine. This commit splits the macOS builders into a separate job (called `auto-fallible`), allowing us to gate on the auto job without failing due to macOS spurious failures.

cc rust-lang/rust-central-station#848
r? @Mark-Simulacrum

…ark-Simulacrum

ci: disable alt build during try builds

The alt build is not actually needed often, and it can be added back on a case-by-case basis if a specific PR needs access to it.

This will free up a builder.

r? @Mark-Simulacrum

…jethrogb

Prevent attacker from manipulating FPU tag word used in SGX enclave

Insufficient sanitization of the x87 FPU tag word in the trusted enclave runtime allowed unprivileged adversaries in the containing host application to induce incoherent or unexpected results for ABI-compliant compiled enclave application code that uses the x87 FPU.

Vulnerability was disclosed to us by Fritz Alder, Jo Van Bulck, David Oswald and Frank Piessens

cc: @jethrogb