Re: Meltdown / Spectre

[Mark H Weaver <mhw@netris.org>]

ludo@gnu.org (Ludovic Courtès) writes:

> Leo Famulari <leo@famulari.name> skribis:
>
>> On Wed, Jan 10, 2018 at 05:39:59AM +0800, Alex Vong wrote:
>>> About the "Retpoline" mitigation technique[1]. Right now only GCC 7.2.0
>>> is patched, but our default gcc version is 5.4.0 in master and 5.5.0 in
>>> core-updates.  So I tried to apply the patches apply the patches to
>>> 5.5.0. There are totally 17 commits/patches. The first 3 patch can be
>>> modified to work while the 4th patch cannot be easily modified to work
>>> because the function ``ix86_nopic_noplt_attribute_p'' is not present on
>>> 5.5.0. Perhaps discarding the hunk would be fine, but we need to be
>>> careful about it (maybe running tests make sure the fix really works).
>>> 
>>> Do you think we should modify the patch to make it work on GCC 5 or
>>> update core-updates to GCC 7 instead?
>>
>> So far I haven't had time to read about Retpoline, how it works, and the
>> degree to which other mitigations work without it. So the following
>> opinion is from a place of ignorance. I'm very interested to hear what
>> everyone else thinks about your suggestion.
>>
>> Having said that, my opinion is that it's too late in this core-updates
>> cycle to change the default GCC version, especially two major versions,
>> from 5 to 7.
>
> No doubt about it.  :-)
>
>> Something we can do very easily, even on the master branch, is to build
>> specific packages with GCC 7, assuming the Retpoline technique would be
>> effective in that context.
>
> Yes, I see Alex submitted a patch already.

There's now a GCC 7.3 release candidate that apparently contains the
necessary compiler support to allow linux-libre-4.14.14 to use the
retpoline technique internally.

  https://gcc.gnu.org/ml/gcc/2018-01/msg00115.html

They hope to release GCC 7.3 on January 24th.  It would be good to
promptly add GCC 7.3 to Guix when its released, and to start using it to
build linux-libre-4.14 on selected systems: x86_64 and possibly aarch64.

I'd prefer to continue using our default compiler to build linux-libre
on systems where GCC 7.3 is not known to help with this issue.

       Mark