Add amd64/i386 retpoline support

[Steve Beattie]

To mitigate Spectre Variant 2, gcc needs to have retpoline support (-mindirect-branch and -mfunction-return arguments on amd64 and i386).

Packages with this will go into the proposed pockets but need to be published in the -security pockets for their respective releases.

Patches for gcc-4.8 were pulled from H.J. Lu's backport branch to 4.9, available at https://github.com/hjl-tools/gcc/tree/hjl/indirect/gcc-4_9-branch/master . Upstream GCC does not seem to be applying patches to anything older than the gcc-6-branch. H.J. Lu is the author of the upstream retpoline commits as well.

[Andy Whitcroft (apw)]

Hello Steve, or anyone else affected,

Accepted gcc-4.8 into trusty-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/gcc-4.8/4.8.4-2ubuntu1~14.04.4 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-trusty to verification-done-trusty. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-trusty. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Launchpad Janitor (janitor)]

This bug was fixed in the package gcc-4.8 - 4.8.4-2ubuntu1~14.04.4

---------------
gcc-4.8 (4.8.4-2ubuntu1~14.04.4) trusty-security; urgency=medium

  * Add retpoline support for x86 via adding -mindirect-branch=,
    -mindirect-branch-register, and -mfunction-return= support
    (LP: #1749261)
    - 0001-i386-Move-struct-ix86_frame-to-machine_function.diff,
      0002-i386-Use-reference-of-struct-ix86_frame-to-avoid-cop.diff,
      0003-i386-Use-const-reference-of-struct-ix86_frame-to-avo.diff,
      0004-x86-Add-mindirect-branch.diff,
      0005-x86-Add-mfunction-return.diff,
      0006-x86-Add-mindirect-branch-register.diff,
      0007-x86-Add-V-register-operand-modifier.diff,
      0008-x86-Disallow-mindirect-branch-mfunction-return-with-.diff,
      0009-Use-INVALID_REGNUM-in-indirect-thunk-processing.diff:
      implement -mindirect-branch=<keep|thunk|thunk-inline|thunk-extern>
      with attribute support, -mindirect-branch-register, and
      -mfunction-return=<thunk|thunk-inline|thunk-extern> with
      attribute support. Thanks to H.J. Lu.

 -- Steve Beattie <email address hidden> Tue, 13 Feb 2018 10:19:48 -0800

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Alexander Stohr (alexander-stohr)]

having here gcc-4.8 (Ubuntu 4.8.5-2ubuntu1-~14.04.01) 4.8.5
and it does not honor either of the above listed switches but returns an error.

sounds a bit like a regression to me, a vanished feature.

[Alexander Stohr (alexander-stohr)]

referenced by bug #1750937

[zhanghongce (zhanghongce)]

On 14.04.5 with gcc-4.8 (Ubuntu 4.8.4-2ubuntu1~14.04.4) 4.8.4
Still waiting for the update ...

[Launchpad Janitor (janitor)]

This bug was fixed in the package gcc-4.8 - 4.8.5-4ubuntu8

---------------
gcc-4.8 (4.8.5-4ubuntu8) bionic; urgency=medium

  [ Matthias Klose ]
  * Stop build gcj in current distro releases. Addresses: #892536.
  * Split off the documentation part from the retpoline patches.
  * Fix build dependency on realpath.

  [ Steve Beattie ]
  * Add retpoline support for x86 via adding -mindirect-branch=,
    -mindirect-branch-register, and -mfunction-return= support
    (LP: #1749261)
    - 0001-i386-Move-struct-ix86_frame-to-machine_function.diff,
      0002-i386-Use-reference-of-struct-ix86_frame-to-avoid-cop.diff,
      0003-i386-Use-const-reference-of-struct-ix86_frame-to-avo.diff,
      0004-x86-Add-mindirect-branch.diff,
      0005-x86-Add-mfunction-return.diff,
      0006-x86-Add-mindirect-branch-register.diff,
      0007-x86-Add-V-register-operand-modifier.diff,
      0008-x86-Disallow-mindirect-branch-mfunction-return-with-.diff,
      0009-Use-INVALID_REGNUM-in-indirect-thunk-processing.diff:
      implement -mindirect-branch=<keep|thunk|thunk-inline|thunk-extern>
      with attribute support, -mindirect-branch-register, and
      -mfunction-return=<thunk|thunk-inline|thunk-extern> with
      attribute support. Thanks to H.J. Lu.

 -- Matthias Klose <email address hidden> Mon, 19 Mar 2018 16:12:10 +0800

[Martin W. (webi123)]

I've seen that the fix is currently only released for bionic.
What is the release date for trusty (gcc-4.8.5 Ubuntu 4.8.5-2ubuntu1~14.04.1) ?