Backport retpoline support to gcc 4.9 #38394
Comments
|
sounds good to me. |
nlewo
added a commit
to nlewo/nixpkgs
that referenced
this issue
May 3, 2018
To mitigate Spectre Variant 2, GCC needs to have retpoline support (-mindirect-branch and -mfunction-return arguments on amd64 and i386). Patches were pulled from H.J. Lu's backport branch to 4.9 (hjl/indirect/gcc-4_9-branch), available at https://github.com/hjl-tools/gcc/tree/hjl/indirect/gcc-4_9-branch/master. Upstream GCC does not apply patches to anything older than the gcc-6-branch. H.J. Lu is the author of the upstream retpoline commits as well. Several Linux distributions already backported these patches to GCC 4 branches and some old kernels (3.13 for instance) have been recompiled with these GCC patches. These kernels only allow to load kernel modules that are compiled with the retpoline support. References: - Ubuntu bug: https://bugs.launchpad.net/ubuntu/+source/gcc-4.8/+bug/1749261 - Ubuntu package: https://launchpad.net/ubuntu/+source/gcc-4.8/4.8.4-2ubuntu1~14.04.4 Fixes NixOS#38394
nlewo
added a commit
that referenced
this issue
May 5, 2018
To mitigate Spectre Variant 2, GCC needs to have retpoline support (-mindirect-branch and -mfunction-return arguments on amd64 and i386). Patches were pulled from H.J. Lu's backport branch to 4.9 (hjl/indirect/gcc-4_9-branch), available at https://github.com/hjl-tools/gcc/tree/hjl/indirect/gcc-4_9-branch/master. Upstream GCC does not apply patches to anything older than the gcc-6-branch. H.J. Lu is the author of the upstream retpoline commits as well. Several Linux distributions already backported these patches to GCC 4 branches and some old kernels (3.13 for instance) have been recompiled with these GCC patches. These kernels only allow to load kernel modules that are compiled with the retpoline support. References: - Ubuntu bug: https://bugs.launchpad.net/ubuntu/+source/gcc-4.8/+bug/1749261 - Ubuntu package: https://launchpad.net/ubuntu/+source/gcc-4.8/4.8.4-2ubuntu1~14.04.4 Fixes #38394 (cherry picked from commit ada2fc0)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Currently, the retpoline mitigation is only available in gcc7 #34383. However, it still exists some old kernels that only compile with
gcc < 5, such as those in Ubuntu Trusty LTS (kernel 3.13). Moreover, kernel modules loaded on these kernel have also to be compiled with the retpoline mitigation.Ubuntu (and Debian) integrated retpoline mitigation in their
gcc 4releases https://bugs.launchpad.net/ubuntu/+source/gcc-4.8/+bug/1749261 .Latest Ubuntu 3.13 kernel now requires kernel modules compiled with retpoline mitigation. They can no longer be built with Nix gcc toolchain.
What do you think about backporting these patches?
Someone could help on this?
The text was updated successfully, but these errors were encountered: