Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5385 > unrolled thread

retpoline-enabled GCC build for jessie

Back to article view | Back to linux.debian.security

Contents

  retpoline-enabled GCC build for jessie Moritz Mühlenhoff <jmm@inutil.org> - 2018-02-13 23:10 +0100
    Re: retpoline-enabled GCC build for jessie Fabian Grünbichler <f.gruenbichler@proxmox.com> - 2018-02-14 16:30 +0100
      Re: retpoline-enabled GCC build for jessie Moritz Mühlenhoff <jmm@inutil.org> - 2018-02-14 23:00 +0100
        Re: retpoline-enabled GCC build for jessie Fabian Grünbichler <f.gruenbichler@proxmox.com> - 2018-02-15 15:20 +0100
          Re: retpoline-enabled GCC build for jessie Moritz Mühlenhoff <jmm@inutil.org> - 2018-02-15 22:20 +0100
          Re: retpoline-enabled GCC build for jessie Moritz Mühlenhoff <jmm@inutil.org> - 2018-02-17 14:40 +0100
            Re: retpoline-enabled GCC build for jessie Holger Levsen <holger@layer-acht.org> - 2018-02-17 20:10 +0100
              Re: retpoline-enabled GCC build for jessie who.are.you@posteo.no - 2018-02-18 10:40 +0100
                Re: retpoline-enabled GCC build for jessie Davide Prina <davide.prina@gmail.com> - 2018-02-19 20:30 +0100
              Re: retpoline-enabled GCC build for jessie Moritz Mühlenhoff <jmm@inutil.org> - 2018-02-22 23:00 +0100

#5385 — retpoline-enabled GCC build for jessie

Hi,
I've created a GCC 4.9 package for jessie with backported support for
-mindirect-branch (as needed to build kernels with retpoline support).
packages are available at https://people.debian.org/~jmm/gcc/. I've run some
tests, but would appreciate additional testing feedback; the update is planned
to be released end of week/weekend.

Cheers,
        Moritz

[toc] | [next] | [standalone]

#5386

> Hi,
> I've created a GCC 4.9 package for jessie with backported support for
> -mindirect-branch (as needed to build kernels with retpoline support).
> packages are available at https://people.debian.org/~jmm/gcc/. I've run some
> tests, but would appreciate additional testing feedback; the update is planned
> to be released end of week/weekend.
> 
> Cheers,
>        Moritz

is there a debdiff / source available as well?

or is it "just" Jessie's current state plus the 9 patches from hjl's 4.9
backport branch? (and is the Stretch / gcc-6 update planned in the same
time frame as well?)

anyway, will report back with some test results (with a custom 4.4-based
kernel) tomorrow.

[toc] | [prev] | [next] | [standalone]

#5387

On Wed, Feb 14, 2018 at 03:26:31PM +0100, Fabian Grünbichler wrote:
> is there a debdiff / source available as well?

Above URL includes the source, but no debdiff (you can simply debdiff against
the latest jessie package).

> or is it "just" Jessie's current state plus the 9 patches from hjl's 4.9
> backport branch?

hjl's patches and some modifications dropping the texinfo which are stripped
for DFSGish reasons.

> (and is the Stretch / gcc-6 update planned in the same
> time frame as well?)

Yes, an update for GCC 6 is also in the works, but will probably a few days
after the jessie update.

> anyway, will report back with some test results (with a custom 4.4-based
> kernel) tomorrow.

Thanks.

Cheers,
        Moritz

[toc] | [prev] | [next] | [standalone]

#5388

On Wed, Feb 14, 2018 at 10:55:27PM +0100, Moritz Mühlenhoff wrote:
> On Wed, Feb 14, 2018 at 03:26:31PM +0100, Fabian Grünbichler wrote:
> > is there a debdiff / source available as well?
> 
> Above URL includes the source, but no debdiff (you can simply debdiff against
> the latest jessie package).

seems I overlooked that on the first glance. functionally identical to our
parallel work, which is probably a good sign.

> 
> > or is it "just" Jessie's current state plus the 9 patches from hjl's 4.9
> > backport branch?
> 
> hjl's patches and some modifications dropping the texinfo which are stripped
> for DFSGish reasons.

and also don't apply as-is anyway ;)

> 
> > (and is the Stretch / gcc-6 update planned in the same
> > time frame as well?)
> 
> Yes, an update for GCC 6 is also in the works, but will probably a few days
> after the jessie update.

any special reason for that? (out of curiosity, since we had also
already prepared a gcc-6 package based on Stretch 6.3.0-18 using the
same approach which seems to work fine so far..)

> 
> > anyway, will report back with some test results (with a custom 4.4-based
> > kernel) tomorrow.

no issues cropped up during intial internal testing, so we'll probably
publish a public test kernel tomorrow and wait for more feedback.

[toc] | [prev] | [next] | [standalone]

#5389

On Thu, Feb 15, 2018 at 02:55:02PM +0100, Fabian Grünbichler wrote:
> > > (and is the Stretch / gcc-6 update planned in the same
> > > time frame as well?)
> > 
> > Yes, an update for GCC 6 is also in the works, but will probably a few days
> > after the jessie update.
> 
> any special reason for that? (out of curiosity, since we had also
> already prepared a gcc-6 package based on Stretch 6.3.0-18 using the
> same approach which seems to work fine so far..)

Just a lack of time, I've prepared a build, but want to run more tests
before I'll make it public for further testing (probably during the
weekend).

> > > anyway, will report back with some test results (with a custom 4.4-based
> > > kernel) tomorrow.
> 
> no issues cropped up during intial internal testing, so we'll probably
> publish a public test kernel tomorrow and wait for more feedback.

OK, thanks.

Cheers,
        Moritz

[toc] | [prev] | [next] | [standalone]

#5390

Fabian Grünbichler wrote:
> > > (and is the Stretch / gcc-6 update planned in the same
> > > time frame as well?)
> > 
> > Yes, an update for GCC 6 is also in the works, but will probably a few days
> > after the jessie update.
> 
> any special reason for that? (out of curiosity, since we had also
> already prepared a gcc-6 package based on Stretch 6.3.0-18 using the
> same approach which seems to work fine so far..)

The update for gcc-4.9 has just been released.

Test packages for gcc-6/stretch are now available at https://people.debian.org/~jmm/gcc6/
Additional test feedback also very welcome.

Cheers,
        Moritz

[toc] | [prev] | [next] | [standalone]

#5391

[Multipart message — attachments visible in raw view] — view raw

On Sat, Feb 17, 2018 at 02:35:22PM +0100, Moritz Mühlenhoff wrote:
> The update for gcc-4.9 has just been released.
> Test packages for gcc-6/stretch are now available at https://people.debian.org/~jmm/gcc6/
 
Thanks for your work on this, Moritz.

I have a stupid/uninformed question: is this gcc only useful for
rebuilding the kernel or would it "in theory" (and practice) be better
to rebuild everything with it? (of course the latter is probably not really
practical for Debian, but others could do it more easily.)


-- 
cheers,
	Holger

[toc] | [prev] | [next] | [standalone]

#5392

Does this mean re-installing Debain is the best way to mitigate Spectre?
If yes, would re-installing Debian from now (and onwards) be a good time to avoid Spectre vulnerabilities?


On Sat, Feb 17, 2018 at 07:03:00PM +0000, Holger Levsen wrote:
> On Sat, Feb 17, 2018 at 02:35:22PM +0100, Moritz Mühlenhoff wrote:
> > The update for gcc-4.9 has just been released.
> > Test packages for gcc-6/stretch are now available at https://people.debian.org/~jmm/gcc6/
>  
> Thanks for your work on this, Moritz.
> 
> I have a stupid/uninformed question: is this gcc only useful for
> rebuilding the kernel or would it "in theory" (and practice) be better
> to rebuild everything with it? (of course the latter is probably not really
> practical for Debian, but others could do it more easily.)
> 
> 
> -- 
> cheers,
> 	Holger

[toc] | [prev] | [next] | [standalone]

#5393

On 18/02/2018 10:44, who.are.you wrote:

> On Sat, Feb 17, 2018 at 07:03:00PM +0000, Holger Levsen wrote:

>> is this gcc only useful for
>> rebuilding the kernel or would it "in theory" (and practice) be better
>> to rebuild everything with it? (of course the latter is probably not really
>> practical for Debian, but others could do it more easily.)

> Does this mean re-installing Debain is the best way to mitigate Spectre?
> If yes, would re-installing Debian from now (and onwards) be a good time to avoid Spectre vulnerabilities?

If a Debian package is recompiled then this package is a new version of 
the previous package and you get it as a Debian update. So if it is 
better to rebuild all with retpoline-enabled I think that someone in 
Debian will recompile all the packages and you get they as Debian 
update... and so you don't have to re-install Debian (or if you 
reinstall Debian you get the same system you have already... without 
retpoline-enabled, because I don't have see any package recompiled with 
that, for now).

Ciao
Davide

PS: I am I

[toc] | [prev] | [next] | [standalone]

#5394

Moin,

Holger Levsen <holger@layer-acht.org> schrieb:
> I have a stupid/uninformed question: is this gcc only useful for
> rebuilding the kernel or would it "in theory" (and practice) be better
> to rebuild everything with it? (of course the latter is probably not really
> practical for Debian, but others could do it more easily.)

The immediate specific need for the GCC update in oldstable and stable
is the Linux kernel, there are no plans to rebuild other packages in
released distributions at this point.

We might add this to the dpkg-buildflags default flags for buster
as a generic hardening measure, but that requires additional
work/consideration/discussion. Fortunately the buster freeze is
still quite some time away, so we're in the comfortable position
to evaluate without time pressure.

Cheers,
        Moritz

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.security

csiph-web