Re: Better communication about spectre/meltdown

2018-04-16 Thread Roberto C . Sánchez
On Mon, Apr 16, 2018 at 06:44:31PM +0100, Ben Hutchings wrote: > On Fri, 2018-04-13 at 21:18 -0400, Roberto C. Sánchez wrote: > > > > Hi Ben, > > > > I feel like I am standing idly by and you are doing all the work. I > > admit that this involves some arcane things that I do not fully grok at > >

Re: Better communication about spectre/meltdown

2018-04-16 Thread Ben Hutchings
On Fri, 2018-04-13 at 21:18 -0400, Roberto C. Sánchez wrote: > On Sat, Apr 14, 2018 at 02:11:28AM +0100, Ben Hutchings wrote: > > On Sat, 2018-04-14 at 01:57 +0100, Ben Hutchings wrote: > > [...] > > > I've pushed my version to: > > > https://people.debian.org/~benh/packages/wheezy-security/ > > >

Re: Better communication about spectre/meltdown

2018-04-16 Thread Ben Hutchings
On Sun, 2018-04-15 at 00:42 +0100, Ben Hutchings wrote: > On Sat, 2018-04-14 at 02:11 +0100, Ben Hutchings wrote: > > On Sat, 2018-04-14 at 01:57 +0100, Ben Hutchings wrote: > > [...] > > > I've pushed my version to: > > > https://people.debian.org/~benh/packages/wheezy-security/ > > > > > > I bel

Re: Better communication about spectre/meltdown

2018-04-15 Thread Emilio Pozuelo Monfort
On 15/04/18 01:42, Ben Hutchings wrote: > On Sat, 2018-04-14 at 02:11 +0100, Ben Hutchings wrote: >> On Sat, 2018-04-14 at 01:57 +0100, Ben Hutchings wrote: >> [...] >>> I've pushed my version to: >>> https://people.debian.org/~benh/packages/wheezy-security/ >>> >>> I believe this builds the right

Re: Better communication about spectre/meltdown

2018-04-14 Thread Ben Hutchings
On Sat, 2018-04-14 at 02:11 +0100, Ben Hutchings wrote: > On Sat, 2018-04-14 at 01:57 +0100, Ben Hutchings wrote: > [...] > > I've pushed my version to: > > https://people.debian.org/~benh/packages/wheezy-security/ > > > > I believe this builds the right set of binary packages, and the files > > c

Re: Better communication about spectre/meltdown

2018-04-13 Thread Roberto C . Sánchez
On Sat, Apr 14, 2018 at 02:11:28AM +0100, Ben Hutchings wrote: > On Sat, 2018-04-14 at 01:57 +0100, Ben Hutchings wrote: > [...] > > I've pushed my version to: > > https://people.debian.org/~benh/packages/wheezy-security/ > > > > I believe this builds the right set of binary packages, and the file

Re: Better communication about spectre/meltdown

2018-04-13 Thread Ben Hutchings
On Sat, 2018-04-14 at 01:57 +0100, Ben Hutchings wrote: [...] > I've pushed my version to: > https://people.debian.org/~benh/packages/wheezy-security/ > > I believe this builds the right set of binary packages, and the files > contained in them match the binaries built from 4.9.2-10+deb8u1 with a

Re: Better communication about spectre/meltdown

2018-04-13 Thread Ben Hutchings
On Thu, 2018-04-12 at 23:02 +0100, Ben Hutchings wrote: > [Trimmed the cc list] > > On Thu, 2018-04-12 at 18:39 +0100, Ben Hutchings wrote: > > On Thu, 2018-04-12 at 17:00 +0100, Ben Hutchings wrote: > > [...] > > > I didn't know how it worked, only that it does work. Anyway, I've > > > looked n

Re: Better communication about spectre/meltdown

2018-04-12 Thread Ben Hutchings
[Trimmed the cc list] On Thu, 2018-04-12 at 18:39 +0100, Ben Hutchings wrote: > On Thu, 2018-04-12 at 17:00 +0100, Ben Hutchings wrote: [...] > > I didn't know how it worked, only that it does work. Anyway, I've > > looked now and I think you need to apply the following patch: > > > > --- gcc-4.

Re: Better communication about spectre/meltdown

2018-04-12 Thread Ben Hutchings
On Thu, 2018-04-12 at 17:00 +0100, Ben Hutchings wrote: > On Tue, 2018-04-03 at 05:52 -0400, Roberto C. Sánchez wrote: > > On Mon, Apr 02, 2018 at 01:45:40AM +0100, Ben Hutchings wrote: > > > > > > I would suggest looking at how non-default compiler versions are built > > > in other suites. > > >

Re: Better communication about spectre/meltdown

2018-04-12 Thread Ben Hutchings
On Tue, 2018-04-03 at 05:52 -0400, Roberto C. Sánchez wrote: > On Mon, Apr 02, 2018 at 01:45:40AM +0100, Ben Hutchings wrote: > > > > I would suggest looking at how non-default compiler versions are built > > in other suites. > > > > Ben. > > > > Hi Ben, > > Could you provide some more specifi

Re: Better communication about spectre/meltdown

2018-04-03 Thread Roberto C . Sánchez
On Mon, Apr 02, 2018 at 01:45:40AM +0100, Ben Hutchings wrote: > > I would suggest looking at how non-default compiler versions are built > in other suites. > > Ben. > Hi Ben, Could you provide some more specific pointers at what I should look at? I tried looking at gcc-4.8 in jessie, but I was

Re: Better communication about spectre/meltdown

2018-04-01 Thread Ben Hutchings
On Sun, 2018-04-01 at 20:44 +0200, Florian Weimer wrote: > * Emilio Pozuelo Monfort: > > > Your new GCC builds binaries such as libgcc1 and libstdc++6. That is > > going to affect nearly all the archive at runtime, and I wonder if > > it's the right approach. We introduced GCC 4.8 in wheezy, named

Re: Better communication about spectre/meltdown

2018-04-01 Thread Ben Hutchings
On Sun, 2018-04-01 at 13:37 -0400, Roberto C. Sánchez wrote: > On Sun, Apr 01, 2018 at 05:04:03PM +0200, Emilio Pozuelo Monfort wrote: > > > > Your new GCC builds binaries such as libgcc1 and libstdc++6. That is going > > to > > affect nearly all the archive at runtime, and I wonder if it's the r

Re: Better communication about spectre/meltdown

2018-04-01 Thread Ben Hutchings
On Sun, 2018-04-01 at 07:48 -0400, Roberto C. Sánchez wrote: [...] > That said, I did notice a difference between the built packages on > jessie and wheezy. Specifically, none of the lib64, libn32, > and libx32 packages were built on wheezy. I expected the libx32 > packages to be missing, but I was

Re: Better communication about spectre/meltdown

2018-04-01 Thread Florian Weimer
* Emilio Pozuelo Monfort: > Your new GCC builds binaries such as libgcc1 and libstdc++6. That is > going to affect nearly all the archive at runtime, and I wonder if > it's the right approach. We introduced GCC 4.8 in wheezy, named > gcc-mozilla (a bad name I know) which didn't build these librari

Re: Better communication about spectre/meltdown

2018-04-01 Thread Roberto C . Sánchez
On Sun, Apr 01, 2018 at 05:04:03PM +0200, Emilio Pozuelo Monfort wrote: > > Your new GCC builds binaries such as libgcc1 and libstdc++6. That is going to > affect nearly all the archive at runtime, and I wonder if it's the right > approach. We introduced GCC 4.8 in wheezy, named gcc-mozilla (a bad

Re: Better communication about spectre/meltdown

2018-04-01 Thread Emilio Pozuelo Monfort
On 01/04/18 13:48, Roberto C. Sánchez wrote: > On Tue, Mar 20, 2018 at 12:30:28AM +, Ben Hutchings wrote: >> >> I released Linux 3.2.101 today with a backport of the retpoline >> changes, and have rebased that branch onto it. The new orig tarball is >> at https://people.debian.org/~benh/linux_

Re: Better communication about spectre/meltdown

2018-04-01 Thread Roberto C . Sánchez
On Sun, Apr 01, 2018 at 07:48:55AM -0400, Roberto C. Sánchez wrote: > > At this point I feel like the packages are ready for upload, but it > seems prudent to first wait for confirmation that the kernel build on > wheezy works with this backported gcc. Once I receive that confirmation, > I will pr

Re: Better communication about spectre/meltdown

2018-04-01 Thread Roberto C . Sánchez
On Sun, Apr 01, 2018 at 01:53:44PM +0200, Moritz Muehlenhoff wrote: > On Sun, Apr 01, 2018 at 07:48:55AM -0400, Roberto C. Sánchez wrote: > > Additionally, when I checked the PTS for information on the recent jessie > > upload it > > was a binary upload built for amd64. > > Source uploads to the

Re: Better communication about spectre/meltdown

2018-04-01 Thread Moritz Muehlenhoff
On Sun, Apr 01, 2018 at 07:48:55AM -0400, Roberto C. Sánchez wrote: > Additionally, when I checked the PTS for information on the recent jessie > upload it > was a binary upload built for amd64. Source uploads to the security archive are only possible from stretch onwards. Cheers, Moritz

Re: Better communication about spectre/meltdown

2018-04-01 Thread Roberto C . Sánchez
On Tue, Mar 20, 2018 at 12:30:28AM +, Ben Hutchings wrote: > > I released Linux 3.2.101 today with a backport of the retpoline > changes, and have rebased that branch onto it. The new orig tarball is > at https://people.debian.org/~benh/linux_3.2.101.orig.tar.xz > > I was able to build this

Re: Better communication about spectre/meltdown

2018-03-19 Thread Ben Hutchings
On Fri, 2018-03-09 at 02:05 +, Ben Hutchings wrote: > On Sat, 2018-03-03 at 20:40 +, Ben Hutchings wrote: > > On Sat, 2018-03-03 at 11:07 -0500, Roberto C. Sánchez wrote: > > > On Sat, Mar 03, 2018 at 03:22:14PM +, Ben Hutchings wrote: > > > > > > > > I think that backporting gcc-4.9 a

Re: Better communication about spectre/meltdown

2018-03-08 Thread Ben Hutchings
On Sat, 2018-03-03 at 20:40 +, Ben Hutchings wrote: > On Sat, 2018-03-03 at 11:07 -0500, Roberto C. Sánchez wrote: > > On Sat, Mar 03, 2018 at 03:22:14PM +, Ben Hutchings wrote: > > > > > > I think that backporting gcc-4.9 and building the kernel with it (for > > > x86) is lower risk than

Re: Better communication about spectre/meltdown

2018-03-03 Thread Ben Hutchings
On Sat, 2018-03-03 at 11:07 -0500, Roberto C. Sánchez wrote: > On Sat, Mar 03, 2018 at 03:22:14PM +, Ben Hutchings wrote: > > > > I think that backporting gcc-4.9 and building the kernel with it (for > > x86) is lower risk than backporting the retpoline patches to gcc-4.7 > > and building the

Re: Better communication about spectre/meltdown

2018-03-03 Thread Fabian Grünbichler
On Sat, Mar 03, 2018 at 11:07:12AM -0500, Roberto C. Sánchez wrote: > On Sat, Mar 03, 2018 at 03:22:14PM +, Ben Hutchings wrote: > > > > I think that backporting gcc-4.9 and building the kernel with it (for > > x86) is lower risk than backporting the retpoline patches to gcc-4.7 > > and buildi

Re: Better communication about spectre/meltdown

2018-03-03 Thread Roberto C . Sánchez
On Sat, Mar 03, 2018 at 03:22:14PM +, Ben Hutchings wrote: > > I think that backporting gcc-4.9 and building the kernel with it (for > x86) is lower risk than backporting the retpoline patches to gcc-4.7 > and building the kernel with that. (In fact it's not just the kernel; > if you change g

Re: Better communication about spectre/meltdown

2018-03-03 Thread Ben Hutchings
On Sat, 2018-03-03 at 10:18 -0500, Roberto C. Sánchez wrote: > On Sat, Mar 03, 2018 at 02:31:20PM +, Ben Hutchings wrote: > > On Thu, 2018-03-01 at 07:56 -0500, Roberto C. Sánchez wrote: > > > > > Of course, if this looks like it would be substantially more complex, I > > > will again ask for

Re: Better communication about spectre/meltdown

2018-03-03 Thread Roberto C . Sánchez
On Sat, Mar 03, 2018 at 02:31:20PM +, Ben Hutchings wrote: > On Thu, 2018-03-01 at 07:56 -0500, Roberto C. Sánchez wrote: > > > Of course, if this looks like it would be substantially more complex, I > > will again ask for guidance, but the likely course at that point seems > > to implement th

Re: Better communication about spectre/meltdown

2018-03-03 Thread Ben Hutchings
On Thu, 2018-03-01 at 07:56 -0500, Roberto C. Sánchez wrote: > On Mon, Feb 26, 2018 at 11:06:03PM +, Ben Hutchings wrote: > > > > It will almost certainly build correctly with 4.9 on x86. AIUI the > > Spectre mitigations in gcc are x86-specific, so there's no value in > > changing it for ARM

Re: Better communication about spectre/meltdown

2018-03-01 Thread Antoine Beaupré
On 2018-03-01 07:56:45, Roberto C. Sánchez wrote: [...] > I suppose another possibility would be to backport the patches to gcc > 4.7 instead of 4.6 and switch the kernel build to gcc 4.7. Would that be > considered to introduce less risk than bringing gcc 4.9 into wheezy at > this stage? Maybe

Re: Better communication about spectre/meltdown

2018-03-01 Thread Roberto C . Sánchez
On Mon, Feb 26, 2018 at 11:06:03PM +, Ben Hutchings wrote: > > It will almost certainly build correctly with 4.9 on x86. AIUI the > Spectre mitigations in gcc are x86-specific, so there's no value in > changing it for ARM and there would be a risk of exceeding code size > limits on armel. Th

Re: Better communication about spectre/meltdown

2018-02-26 Thread Ben Hutchings
On Mon, 2018-02-26 at 14:40 -0500, Antoine Beaupré wrote: > On 2018-02-25 13:57:07, Roberto C. Sánchez wrote: > > On Sun, Feb 25, 2018 at 07:04:12PM +0100, Moritz Mühlenhoff wrote: > > > On Sun, Feb 25, 2018 at 08:54:06AM -0500, Roberto C. Sánchez wrote: > > > > Hi all, > > > > > > > > Please see

Re: Better communication about spectre/meltdown

2018-02-26 Thread Antoine Beaupré
On 2018-02-25 13:57:07, Roberto C. Sánchez wrote: > On Sun, Feb 25, 2018 at 07:04:12PM +0100, Moritz Mühlenhoff wrote: >> On Sun, Feb 25, 2018 at 08:54:06AM -0500, Roberto C. Sánchez wrote: >> > Hi all, >> > >> > Please see my rather long-winded summary of the current state of the >> > gcc-4.6/gcc

Re: Better communication about spectre/meltdown

2018-02-25 Thread Roberto C . Sánchez
On Sun, Feb 25, 2018 at 07:04:12PM +0100, Moritz Mühlenhoff wrote: > On Sun, Feb 25, 2018 at 08:54:06AM -0500, Roberto C. Sánchez wrote: > > Hi all, > > > > Please see my rather long-winded summary of the current state of the > > gcc-4.6/gcc-4.7 update. The bottom line is that I am looking for opi

Re: Better communication about spectre/meltdown

2018-02-25 Thread Moritz Mühlenhoff
On Sun, Feb 25, 2018 at 08:54:06AM -0500, Roberto C. Sánchez wrote: > Hi all, > > Please see my rather long-winded summary of the current state of the > gcc-4.6/gcc-4.7 update. The bottom line is that I am looking for opions > and/or guidance for how to proceed. Why 4.6 _and_ 4.7? Only the compil

Re: Better communication about spectre/meltdown

2018-02-25 Thread Roberto C . Sánchez
Hi all, Please see my rather long-winded summary of the current state of the gcc-4.6/gcc-4.7 update. The bottom line is that I am looking for opions and/or guidance for how to proceed. On Thu, Feb 15, 2018 at 08:56:42PM +0100, Moritz Muehlenhoff wrote: > On Thu, Feb 15, 2018 at 12:33:12PM +0100,

Re: Better communication about spectre/meltdown

2018-02-18 Thread Roberto C . Sánchez
On Sun, Feb 18, 2018 at 12:16:02PM +0100, Moritz Mühlenhoff wrote: > > Maybe using HJ Lu's patches for 4.9 against 4.6 also works out > just fine, but it's hard to tell. > I in the process of doing this now. Many patches/hunks appear to apply with offset or small fuzz, but some are a bit more in

Re: Better communication about spectre/meltdown

2018-02-18 Thread Moritz Mühlenhoff
On Sun, Feb 18, 2018 at 01:39:13AM +, Ben Hutchings wrote: > On Thu, 2018-02-15 at 20:56 +0100, Moritz Muehlenhoff wrote: > > On Thu, Feb 15, 2018 at 12:33:12PM +0100, Raphael Hertzog wrote: > > > On IRC I learned that Moritz Muehlenhoff (jmm) started the work of > > > bakcporting retpoline to

Re: Better communication about spectre/meltdown

2018-02-17 Thread Ben Hutchings
On Thu, 2018-02-15 at 20:56 +0100, Moritz Muehlenhoff wrote: > On Thu, Feb 15, 2018 at 12:33:12PM +0100, Raphael Hertzog wrote: > > On IRC I learned that Moritz Muehlenhoff (jmm) started the work of > > bakcporting retpoline to gcc-4.9 for jessie. We need to do the same > > for gcc-4.6 (and maybe g

Re: Better communication about spectre/meltdown

2018-02-15 Thread Moritz Muehlenhoff
On Thu, Feb 15, 2018 at 12:33:12PM +0100, Raphael Hertzog wrote: > On IRC I learned that Moritz Muehlenhoff (jmm) started the work of > bakcporting retpoline to gcc-4.9 for jessie. We need to do the same > for gcc-4.6 (and maybe gcc-4.7) in wheezy. gcc-4.6 is used for the > kernel build so that's t

Re: Better communication about spectre/meltdown

2018-02-15 Thread Ola Lundqvist
Hi I waited some as I did not think I had any additional information to contribute with. But I realize that I can gather some data and start to compile a page for others to start with. As I said in the other mail thread I have created a first page here: https://wiki.debian.org/LTS/Wheezy/SpectreM

Re: Better communication about spectre/meltdown

2018-02-15 Thread Raphael Hertzog
Hello, On Thu, 08 Feb 2018, Raphael Hertzog wrote: > I have had enquiries of LTS sponsors about the status of spectre/meltdown > mitigations in Debian. I tried to answer but even for me as an insider who > knows the ins and outs of Debian rather well, it's really difficult for me > to be able to a

Better communication about spectre/meltdown

2018-02-08 Thread Raphael Hertzog
Hello everybody, I have had enquiries of LTS sponsors about the status of spectre/meltdown mitigations in Debian. I tried to answer but even for me as an insider who knows the ins and outs of Debian rather well, it's really difficult for me to be able to answer. IMO we should really try to mainta