Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #60219 > unrolled thread

[stretch] ABI bump for 4.9 with retpoline support?

Back to article view | Back to linux.debian.kernel

Contents

  [stretch] ABI bump for 4.9 with retpoline support? Yves-Alexis Perez <corsac@debian.org> - 2018-02-16 12:00 +0100
    Re: [stretch] ABI bump for 4.9 with retpoline support? Yves-Alexis Perez <corsac@debian.org> - 2018-02-16 18:40 +0100
      Re: [stretch] ABI bump for 4.9 with retpoline support? Yves-Alexis Perez <corsac@debian.org> - 2018-02-17 21:00 +0100
        Re: [stretch] ABI bump for 4.9 with retpoline support? Moritz Mühlenhoff <jmm@inutil.org> - 2018-02-18 12:20 +0100
      Re: [stretch] ABI bump for 4.9 with retpoline support? Ben Hutchings <ben@decadent.org.uk> - 2018-02-17 21:00 +0100

#60219 — [stretch] ABI bump for 4.9 with retpoline support?

[Multipart message — attachments visible in raw view] — view raw

Hi kernel team

I am currently working on 4.9.81 (and will work on 4.9.82 when it's out) for
stretch-pu. Fixes for Spectre started appearing in recent versions (especially
retpoline) and Moritz has worked a lot on gcc with retpoline support, so it
looks that we'll be able to ship a kernel with retpoline enabled and
functional in stretch-pu before the next point release.

It doesn't seem that building with a retpoline-aware gcc will bump the ABI by
itself, but do we still want to do it?

There's a bunch of ABI breaks in 4.9.81 again, and we ignored/reverted a lot
of them since 4.9.65+kaiser, so maybe it'll be a good idea at one point, but I
don't have a strong opinion on this right now.

Regards, 
-- 
Yves-Alexis

[toc] | [next] | [standalone]

#60224

[Multipart message — attachments visible in raw view] — view raw

On Fri, 2018-02-16 at 11:54 +0100, Yves-Alexis Perez wrote:
> 
> There's a bunch of ABI breaks in 4.9.81 again, and we ignored/reverted a lot
> of them since 4.9.65+kaiser, so maybe it'll be a good idea at one point, but I
> don't have a strong opinion on this right now.

I've pushed my work to the stretch branch. It builds fine on x86 and powerpc
after some fixes. When built with gcc-6 just uploaded to security-master,
retpoline is enabled:

/sys/devices/system/cpu/vulnerabilities/spectre_v2:Mitigation: Full generic
retpoline

Depending on the opinion, we can either revert the various ABI fixes and bump
the ABI, or try an upload as-is.

Regards,
-- 
Yves-Alexis

[toc] | [prev] | [next] | [standalone]

#60231

[Multipart message — attachments visible in raw view] — view raw

On Sat, 2018-02-17 at 19:51 +0000, Ben Hutchings wrote:
> I think we should bump ABI again.

Thanks for the feedback. I'll do that and remove all the ABI reverts and
ignores.

>   We should also do the equivalent of
> these changes in sid, with s/gcc-7/gcc-6/.
> 
>   * [x86] Add versioned build-dependency on gcc-7 for retpoline support
>   * [x86] linux-compiler-gcc-7-x86: Add versioned dependency on gcc-7 for
>     retpoline support
>   * [x86] linux-headers: Depend on updated linux-compiler-gcc-7-x86

I did the linux-compiler-gcc-6-x86 one but not the other two, Will do as well.

Should we upload this one through security-master (for the CVE-2017-5715 fix)
or through stretch-pu again?

Regards,
-- 
Yves-Alexis

[toc] | [prev] | [next] | [standalone]

#60242

On Sat, Feb 17, 2018 at 08:57:42PM +0100, Yves-Alexis Perez wrote:
> On Sat, 2018-02-17 at 19:51 +0000, Ben Hutchings wrote:
> > I think we should bump ABI again.
> 
> Thanks for the feedback. I'll do that and remove all the ABI reverts and
> ignores.
> 
> >   We should also do the equivalent of
> > these changes in sid, with s/gcc-7/gcc-6/.
> > 
> >   * [x86] Add versioned build-dependency on gcc-7 for retpoline support
> >   * [x86] linux-compiler-gcc-7-x86: Add versioned dependency on gcc-7 for
> >     retpoline support
> >   * [x86] linux-headers: Depend on updated linux-compiler-gcc-7-x86
> 
> I did the linux-compiler-gcc-6-x86 one but not the other two, Will do as well.
> 
> Should we upload this one through security-master (for the CVE-2017-5715 fix)
> or through stretch-pu again?

I'd say via security.debian.org, to get the CVE-2017-5715 fix out to users.

At this point it seems that for spectre/v1 it will take quite some until all
the affected code paths are identified, so maybe these will rather trickle in
piece by piece now array_index_nospec() has landed.

Cheers,
        Moritz

[toc] | [prev] | [next] | [standalone]

#60233

[Multipart message — attachments visible in raw view] — view raw

On Fri, 2018-02-16 at 18:30 +0100, Yves-Alexis Perez wrote:
> On Fri, 2018-02-16 at 11:54 +0100, Yves-Alexis Perez wrote:
> > 
> > There's a bunch of ABI breaks in 4.9.81 again, and we ignored/reverted a lot
> > of them since 4.9.65+kaiser, so maybe it'll be a good idea at one point, but I
> > don't have a strong opinion on this right now.
> 
> I've pushed my work to the stretch branch. It builds fine on x86 and powerpc
> after some fixes. When built with gcc-6 just uploaded to security-master,
> retpoline is enabled:
> 
> /sys/devices/system/cpu/vulnerabilities/spectre_v2:Mitigation: Full generic
> retpoline
> 
> Depending on the opinion, we can either revert the various ABI fixes and bump
> the ABI, or try an upload as-is.

I think we should bump ABI again.  We should also do the equivalent of
these changes in sid, with s/gcc-7/gcc-6/.

  * [x86] Add versioned build-dependency on gcc-7 for retpoline support
  * [x86] linux-compiler-gcc-7-x86: Add versioned dependency on gcc-7 for
    retpoline support
  * [x86] linux-headers: Depend on updated linux-compiler-gcc-7-x86

Ben.

-- 
Ben Hutchings
One of the nice things about standards is that there are so many of
them.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.kernel

csiph-web