From mboxrd@z Thu Jan 1 00:00:00 1970 From: Alex Vong Subject: Re: Meltdown / Spectre Date: Wed, 10 Jan 2018 05:39:59 +0800 Message-ID: <87wp0qognk.fsf@gmail.com> References: <874lnzcedp.fsf@gmail.com> <20180106174358.GA28436@jasmine.lan> <87vageeobi.fsf@netris.org> <87incedvgv.fsf@netris.org> <87k1wtcq7m.fsf@netris.org> Mime-Version: 1.0 Content-Type: text/plain Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:48365) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1eZ1d1-0005I6-W4 for guix-devel@gnu.org; Tue, 09 Jan 2018 16:40:16 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1eZ1cx-0005X9-FP for guix-devel@gnu.org; Tue, 09 Jan 2018 16:40:15 -0500 Received: from mail-pf0-x22a.google.com ([2607:f8b0:400e:c00::22a]:41252) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1eZ1cx-0005Ve-8p for guix-devel@gnu.org; Tue, 09 Jan 2018 16:40:11 -0500 Received: by mail-pf0-x22a.google.com with SMTP id j3so5671313pfh.8 for ; Tue, 09 Jan 2018 13:40:10 -0800 (PST) In-Reply-To: <87k1wtcq7m.fsf@netris.org> (Mark H. Weaver's message of "Sun, 07 Jan 2018 16:29:49 -0500") List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Mark H Weaver Cc: guix-devel@gnu.org Mark H Weaver writes: > Mark H Weaver writes: > >> I just followed this up with a Spectre mitigation for WebKitGTK+ >> backported from upstream WebKit: >> >> https://git.savannah.gnu.org/cgit/guix.git/commit/?id=56804398a94bea941183ae4ed29d2a9f82069a6f > > FYI, adding a patch to 'webkitgtk' seems to have greatly exacerbated an > existing race condition in webkitgtk's build system, presumably due to > the zeroing of time stamps in the repacked tarball. I believe that > *any* patch would have had this effect. I filed the following bug to > track this issue: > > https://bugs.gnu.org/30015 > > Mark Thanks for all the help and quick fixes. I have an idea. Should we add a news entry to Guix blog[0] summarizing all the above? For example, we can advice users to install noscript and turn off javascript by default and only enable it on trusted site when necessary. About the "Retpoline" mitigation technique[1]. Right now only GCC 7.2.0 is patched, but our default gcc version is 5.4.0 in master and 5.5.0 in core-updates. So I tried to apply the patches apply the patches to 5.5.0. There are totally 17 commits/patches. The first 3 patch can be modified to work while the 4th patch cannot be easily modified to work because the function ``ix86_nopic_noplt_attribute_p'' is not present on 5.5.0. Perhaps discarding the hunk would be fine, but we need to be careful about it (maybe running tests make sure the fix really works). Do you think we should modify the patch to make it work on GCC 5 or update core-updates to GCC 7 instead? [0]: https://www.gnu.org/software/guix/blog/ [1]: http://git.infradead.org/users/dwmw2/gcc-retpoline.git/shortlog/refs/heads/retpoline