gcc49: backport retpoline support #39914
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
To mitigate Spectre Variant 2, GCC needs to have retpoline support (-mindirect-branch and -mfunction-return arguments on amd64 and i386). Patches were pulled from H.J. Lu's backport branch to 4.9 (hjl/indirect/gcc-4_9-branch), available at https://github.com/hjl-tools/gcc/tree/hjl/indirect/gcc-4_9-branch/master. Upstream GCC does not apply patches to anything older than the gcc-6-branch. H.J. Lu is the author of the upstream retpoline commits as well. Several Linux distributions already backported these patches to GCC 4 branches and some old kernels (3.13 for instance) have been recompiled with these GCC patches. These kernels only allow to load kernel modules that are compiled with the retpoline support. References: - Ubuntu bug: https://bugs.launchpad.net/ubuntu/+source/gcc-4.8/+bug/1749261 - Ubuntu package: https://launchpad.net/ubuntu/+source/gcc-4.8/4.8.4-2ubuntu1~14.04.4 Fixes NixOS#38394
|
@GrahamcOfBorg build gcc49 |
|
Failure on x86_64-darwin (full log) Attempted: gcc49 Partial log (click to expand)
|
|
Success on x86_64-linux (full log) Attempted: gcc49 Partial log (click to expand)
|
|
Failure on x86_64-linux (full log) Attempted: gcc49 Partial log (click to expand)
|
|
Failure on aarch64-linux (full log) Attempted: gcc49 Partial log (click to expand)
|
|
Success on aarch64-linux (full log) Attempted: gcc49 Partial log (click to expand)
|
|
Please disable darwin support for now or mark it as broken. Since this version is not widely used it should not be a big deal. |
|
Success on aarch64-linux (full log) Attempted: gcc49 Partial log (click to expand)
|
|
@Mic92 done. |
|
Failure on x86_64-linux (full log) Attempted: gcc49 Partial log (click to expand)
|
|
@GrahamcOfBorg build foundationdb |
|
If you can build |
|
No attempt on aarch64-linux (full log) The following builds were skipped because they don't evaluate on aarch64-linux: foundationdb Partial log (click to expand)
|
|
I successfully built |
|
Success on x86_64-linux (full log) Attempted: foundationdb Partial log (click to expand)
|
|
Backport to stable might be helpful as well. |
|
@Mic92 yes. I'm waiting for the local build of |
|
Backported to |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
To mitigate Spectre Variant 2, GCC needs to have retpoline
support (-mindirect-branch and -mfunction-return arguments on amd64
and i386).
Patches were pulled from H.J. Lu's backport branch to
4.9 (hjl/indirect/gcc-4_9-branch), available at
https://github.com/hjl-tools/gcc/tree/hjl/indirect/gcc-4_9-branch/master. Upstream
GCC does not apply patches to anything older than the
gcc-6-branch. H.J. Lu is the author of the upstream retpoline commits
as well.
Several Linux distributions already backported these patches to GCC 4
branches and some old kernels (3.13 for instance) have been recompiled
with these GCC patches. These kernels only allow to load kernel
modules that are compiled with the retpoline support.
References:
Fixes #38394
Things done
I built a kernel module with this
gcc49and the vermagic field contains the retpoline string.build-use-sandboxinnix.confon non-NixOS)nix-shell -p nox --run "nox-review wip"./result/bin/)