From f4c81846e07f82551890ea865fe47f40d0957f5a Mon Sep 17 00:00:00 2001 From: Donald Buczek Date: Sun, 11 Feb 2018 00:04:00 +0100 Subject: [PATCH 1/4] gcc: Update version from 5.5.0 to 7.3.0 gcc 7.3 supports `-mindirect-branch=thunk-extern` which is used (if available) by the kernel build to mitigate Spectre attacks with a method called retpoline. If `-mindirect-branch=thunk-extern` is not available, the kernel build will not (no longer) emit a warning [1]. The insufficient protection will be visible on the running system root@dose:/sys# cat /sys/devices/system/cpu/vulnerabilities/spectre_v2 Vulnerable: Minimal generic ASM retpoline whereas when the kernel is compiled with gcc 7.3 (`prun gcc-7.3.0-0 ./linux-4.14.18-207.bee`) the output is: root@dose:~# cat /sys/devices/system/cpu/vulnerabilities/spectre_v2 Mitigation: Full generic retpoline 1. Changes GCC 7: https://gcc.gnu.org/gcc-7/changes.html 2. Changes GCC 6: https://gcc.gnu.org/gcc-6/changes.html 1. Porting to GCC 7: https://gcc.gnu.org/gcc-7/porting_to.html 2. Porting to GCC 6: https://gcc.gnu.org/gcc-6/porting_to.html [1] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/?h=linux-4.14.y&id=198660b7a5dd33b114001023d540c9072603e2a8 --- gcc.be0 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gcc.be0 b/gcc.be0 index 72ca474fe..659ae7d79 100755 --- a/gcc.be0 +++ b/gcc.be0 @@ -1,6 +1,6 @@ #!/bin/env beesh -# BEE_VERSION gcc-5.5.0-1 +# BEE_VERSION gcc-7.3.0-0 SRCURL[0]="https://ftp.gnu.org/gnu/gcc/gcc-${PKGVERSION}/gcc-${PKGVERSION}.tar.xz" From 763527c3325721fb7977927c41a14aa48741f93d Mon Sep 17 00:00:00 2001 From: Donald Buczek Date: Sun, 11 Feb 2018 00:04:30 +0100 Subject: [PATCH 2/4] gcc: Add comment regarding vm.overcommit_memory --- gcc.be0 | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/gcc.be0 b/gcc.be0 index 659ae7d79..751f56259 100755 --- a/gcc.be0 +++ b/gcc.be0 @@ -2,6 +2,11 @@ # BEE_VERSION gcc-7.3.0-0 +# Note: The test suite runs address sanitizer tests. In the current mariux64 environment +# this requires +# +# sudo sysctl vm.overcommit_memory=0 + SRCURL[0]="https://ftp.gnu.org/gnu/gcc/gcc-${PKGVERSION}/gcc-${PKGVERSION}.tar.xz" LIBEXECDIR=/usr/lib From ebc98ef9876ec7cd64d064e67faf583ad53bb83f Mon Sep 17 00:00:00 2001 From: Donald Buczek Date: Sun, 11 Feb 2018 12:35:26 +0100 Subject: [PATCH 3/4] Add scripts/TEMPLATE.be0 This is a template be0 file. --- scripts/TEMPLATE.be0 | 85 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 85 insertions(+) create mode 100755 scripts/TEMPLATE.be0 diff --git a/scripts/TEMPLATE.be0 b/scripts/TEMPLATE.be0 new file mode 100755 index 000000000..5645262a8 --- /dev/null +++ b/scripts/TEMPLATE.be0 @@ -0,0 +1,85 @@ +#!/usr/bin/env beesh + +# BEE_VERSION NAME-1.0-0 + +## this file was created by bee init and should be executed to build a +## bee-package. (Additional hints are located at the end of this file.) + +############################################################################### +## The source URL(s) define the location of the sources that will be +## downloaded. Version variables may be used to simplify reuse of this bee-file. + +SRCURL[0]="https://SERVER/PATH/NAME.${PKGVERSION}.tar.gz" + +############################################################################### +## Add URLs/pathes to patch files to the PATCHURL array. +## The sources will be patched in the order of the array. + +# PATCHURL+=() + +############################################################################### +## Add filename patterns to the EXCLUDE array of files that should not +## be added to you package but may be present in the image directory. + +# EXCLUDE+=() + +############################################################################### +## Uncomment the next statement, if the software may not be able to be built +## outside the source directory and needs to be built inside the source +## directory. + +# build_in_sourcedir + +############################################################################### +## bee cannot detect buildtypes specified in subdirectories. +## Sometimes packages "hide" the real sources in a subdirectory named +## 'src' or 'cmake' or .. +## use 'sourcesubdir_append' to specify this directory if known. + +# sourcesubdir_append src + + +############################################################################### +## Change the default (auto-detected) steps to +## extract, patch, configure/setup, build and install the software. +## Make sure the mee_install function does install everything to the +## image directory "${D}" + +#mee_extract() { +# bee_extract "${@}" +#} + +#mee_patch() { +# bee_patch "${@}" +#} + +#mee_configure() { +# bee_configure +#} + +#mee_build() { +# bee_build +#} + +#mee_install() { +# bee_install +#} +## by default this may be 'make install DESTDIR="${D}"' + +############################################################################### +## +## Additional hints: +## +## The name of this bee-file should follow the following naming convention: +## pkgname-pkgversion-pkgrevision.bee +## +## You may remove all comments as long as SRCURL[0] is set. +## +## Everything in this file will be executed in a bash environment. +## +## Build the package by executing +## './pkg-version-N.bee' or +## 'beesh ./pkg-version-N.bee' +## +## see http://beezinga.org/ +## From 066422372cf0103d25e93726f53476ed9946dc91 Mon Sep 17 00:00:00 2001 From: Donald Buczek Date: Sun, 11 Feb 2018 12:21:17 +0100 Subject: [PATCH 4/4] Add gcc_compat_5.5.0 Installed shared libraries of gcc-5.5.0 which are not available in gcc-7.3.0 and are required by other packages. Currently the only library identified is `libgfortran.so.3`. Created with cp scripts/TEMPLATE.be0 gcc_compat_5.5.0.be0 and the following changes: < # BEE_VERSION NAME-1.0-0 --- > # BEE_VERSION gcc_compat_5.5.0-1.0-0 12c12 < SRCURL[0]="https://SERVER/PATH/NAME.${PKGVERSION}.tar.gz" --- > SRCURL=() 64,67c64,69 < #mee_install() { < # bee_install < #} < ## by default this may be 'make install DESTDIR="${D}"' --- > mee_install() { > cd ${D} > tar xpf /src/mariux/beeroot/packages/gcc-5.5.0-1.x86_64.bee.tar.bz2 \ > /usr/lib/libgfortran.so.3/ \ > /usr/lib/libgfortran.so.3.0.0 > } --- gcc_compat_5.5.0.be0 | 87 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 87 insertions(+) create mode 100755 gcc_compat_5.5.0.be0 diff --git a/gcc_compat_5.5.0.be0 b/gcc_compat_5.5.0.be0 new file mode 100755 index 000000000..df20a61fb --- /dev/null +++ b/gcc_compat_5.5.0.be0 @@ -0,0 +1,87 @@ +#!/usr/bin/env beesh + +# BEE_VERSION gcc_compat_5.5.0-1.0-0 + +## this file was created by bee init and should be executed to build a +## bee-package. (Additional hints are located at the end of this file.) + +############################################################################### +## The source URL(s) define the location of the sources that will be +## downloaded. Version variables may be used to simplify reuse of this bee-file. + +SRCURL=() + +############################################################################### +## Add URLs/pathes to patch files to the PATCHURL array. +## The sources will be patched in the order of the array. + +# PATCHURL+=() + +############################################################################### +## Add filename patterns to the EXCLUDE array of files that should not +## be added to you package but may be present in the image directory. + +# EXCLUDE+=() + +############################################################################### +## Uncomment the next statement, if the software may not be able to be built +## outside the source directory and needs to be built inside the source +## directory. + +# build_in_sourcedir + +############################################################################### +## bee cannot detect buildtypes specified in subdirectories. +## Sometimes packages "hide" the real sources in a subdirectory named +## 'src' or 'cmake' or .. +## use 'sourcesubdir_append' to specify this directory if known. + +# sourcesubdir_append src + + +############################################################################### +## Change the default (auto-detected) steps to +## extract, patch, configure/setup, build and install the software. +## Make sure the mee_install function does install everything to the +## image directory "${D}" + +#mee_extract() { +# bee_extract "${@}" +#} + +#mee_patch() { +# bee_patch "${@}" +#} + +#mee_configure() { +# bee_configure +#} + +#mee_build() { +# bee_build +#} + +mee_install() { + cd ${D} + tar xpf /src/mariux/beeroot/packages/gcc-5.5.0-1.x86_64.bee.tar.bz2 \ + /usr/lib/libgfortran.so.3/ \ + /usr/lib/libgfortran.so.3.0.0 +} + +############################################################################### +## +## Additional hints: +## +## The name of this bee-file should follow the following naming convention: +## pkgname-pkgversion-pkgrevision.bee +## +## You may remove all comments as long as SRCURL[0] is set. +## +## Everything in this file will be executed in a bash environment. +## +## Build the package by executing +## './pkg-version-N.bee' or +## 'beesh ./pkg-version-N.bee' +## +## see http://beezinga.org/ +##