--- Begin Message ---
|
Subject: |
[PATCH] gnu: Add spectre-meltdown-checker. |
|
Date: |
Sat, 05 Nov 2022 23:57:31 +0800 |
*
gnu/packages/patches/spectre-meltdown-checker-support-guix-system-kernel.patch:
New file.
* gnu/packages/linux.scm (spectre-meltdown-checker): New variable.
* gnu/local.mk (dist_patch_DATA): Add it.
---
gnu/local.mk | 1 +
gnu/packages/linux.scm | 41 +++++++++++++++++++
...n-checker-support-guix-system-kernel.patch | 26 ++++++++++++
3 files changed, 68 insertions(+)
create mode 100644
gnu/packages/patches/spectre-meltdown-checker-support-guix-system-kernel.patch
diff --git a/gnu/local.mk b/gnu/local.mk
index eb6ac3df58..88c1fa6278 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -1848,6 +1848,7 @@ dist_patch_DATA =
\
%D%/packages/patches/syslinux-strip-gnu-property.patch \
%D%/packages/patches/snappy-add-O2-flag-in-CmakeLists.txt.patch \
%D%/packages/patches/snappy-add-inline-for-GCC.patch \
+
%D%/packages/patches/spectre-meltdown-checker-support-guix-system-kernel.patch \
%D%/packages/patches/sphinxbase-fix-doxygen.patch \
%D%/packages/patches/spice-vdagent-glib-2.68.patch \
%D%/packages/patches/sssd-optional-systemd.patch \
diff --git a/gnu/packages/linux.scm b/gnu/packages/linux.scm
index cf11a7fc1b..db199869a7 100644
--- a/gnu/packages/linux.scm
+++ b/gnu/packages/linux.scm
@@ -9512,3 +9512,44 @@ (define-public tp-smapi-module
@acronym{SMAPI, System Management Application Program Interface} and direct
access to the embedded controller.")
(license license:gpl2+)))
+
+(define-public spectre-meltdown-checker
+ (package
+ (name "spectre-meltdown-checker")
+ (version "0.45")
+ (source (origin
+ (method git-fetch)
+ (uri (git-reference
+ (url "https://github.com/speed47/spectre-meltdown-checker";)
+ (commit (string-append "v" version))))
+ (file-name (git-file-name name version))
+ (patches
+ (search-patches
+ ;; https://github.com/speed47/spectre-meltdown-checker/pull/441
+ "spectre-meltdown-checker-support-guix-system-kernel.patch"))
+ (sha256
+ (base32
+ "1xx8h5791lhc2xw0dcbzjkklzvlxwxkjzh8di4g8divfy24fqsn8"))))
+ (build-system copy-build-system)
+ (arguments
+ (list #:install-plan
+ #~'(("spectre-meltdown-checker.sh" "bin/spectre-meltdown-checker"))
+ #:phases
+ #~(modify-phases %standard-phases
+ (add-after 'unpack 'fixpath
+ (lambda* (#:key inputs #:allow-other-keys)
+ (substitute* "spectre-meltdown-checker.sh"
+ (("\\$\\{opt_arch_prefix\\}readelf")
+ (search-input-file inputs "/bin/readelf"))
+ (("perl")
+ (search-input-file inputs "/bin/perl"))))))))
+ (inputs (list binutils perl))
+ (home-page "https://github.com/speed47/spectre-meltdown-checker";)
+ (synopsis
+ "Spectre, Meltdown, Foreshadow, Fallout, RIDL, ZombieLoad vulnerability /
+mitigation checker for Linux & BSD")
+ (description
+ "A shell script to assess your system's resilience against the several
+transient execution CVEs that were published since early 2018, and give you
+guidance as to how to mitigate them.")
+ (license license:gpl3)))
diff --git
a/gnu/packages/patches/spectre-meltdown-checker-support-guix-system-kernel.patch
b/gnu/packages/patches/spectre-meltdown-checker-support-guix-system-kernel.patch
new file mode 100644
index 0000000000..afec52b418
--- /dev/null
+++
b/gnu/packages/patches/spectre-meltdown-checker-support-guix-system-kernel.patch
@@ -0,0 +1,26 @@
+From 5b757d930ec0cf102b03fb9817d17e06c72e74b3 Mon Sep 17 00:00:00 2001
+From: Hilton Chain <hako@ultrarare.space>
+Date: Sat, 5 Nov 2022 23:22:31 +0800
+Subject: [PATCH] Add support for Guix System kernel.
+
+---
+ spectre-meltdown-checker.sh | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/spectre-meltdown-checker.sh b/spectre-meltdown-checker.sh
+index 248a444..855a090 100755
+--- a/spectre-meltdown-checker.sh
++++ b/spectre-meltdown-checker.sh
+@@ -2251,6 +2251,8 @@ if [ "$opt_live" = 1 ]; then
+ [ -e "/boot/kernel-genkernel-$(uname -m)-$(uname -r)" ] &&
opt_kernel="/boot/kernel-genkernel-$(uname -m)-$(uname -r)"
+ # NixOS:
+ [ -e "/run/booted-system/kernel" ] &&
opt_kernel="/run/booted-system/kernel"
++ # Guix System:
++ [ -e "/run/booted-system/kernel/bzImage" ] &&
opt_kernel="/run/booted-system/kernel/bzImage"
+ # systemd kernel-install:
+ [ -e "/etc/machine-id" ] && [ -e "/boot/$(cat
/etc/machine-id)/$(uname -r)/linux" ] && opt_kernel="/boot/$(cat
/etc/machine-id)/$(uname -r)/linux"
+ # Clear Linux:
+
+base-commit: a6c943d38f315f339697ec26e7374a09b88f2183
+--
+2.38.0
base-commit: 2211f50ec1ebcf5f880454b4133ac40e41abac21
--
2.38.0
--- End Message ---
--- Begin Message ---
|
Subject: |
Re: [PATCH v5] gnu: Add spectre-meltdown-checker. |
|
Date: |
Sun, 13 Nov 2022 23:02:06 +0100 |
|
User-agent: |
Evolution 3.46.0 |
Am Sonntag, dem 13.11.2022 um 21:09 +0800 schrieb Hilton Chain:
> * gnu/packages/linux.scm (spectre-meltdown-checker): New variable.
> * gnu/packages/patches/spectre-meltdown-checker-support-guix-system-
> kernel.patch:
> New file.
> * gnu/packages/patches/spectre-meltdown-checker-remove-builtin-
> firmware-database.patch:
> New file.
> * gnu/local.mk (dist_patch_DATA): Add patches.
I renamed the patches for the ChangeLog, slightly rewrote their
explanations, ...
> gnu/local.mk | 2 +
> gnu/packages/linux.scm | 130 ++++++++++
> ...ker-remove-builtin-firmware-database.patch | 243
> ++++++++++++++++++
> ...n-checker-support-guix-system-kernel.patch | 26 ++
> 4 files changed, 401 insertions(+)
> create mode 100644 gnu/packages/patches/spectre-meltdown-checker-
> remove-builtin-firmware-database.patch
> create mode 100644 gnu/packages/patches/spectre-meltdown-checker-
> support-guix-system-kernel.patch
>
> diff --git a/gnu/local.mk b/gnu/local.mk
> index e3e02314bb..1e85790983 100644
> --- a/gnu/local.mk
> +++ b/gnu/local.mk
> @@ -1857,6 +1857,8 @@ dist_patch_DATA
> = \
> %D%/packages/patches/syslinux-strip-gnu-property.patch \
> %D%/packages/patches/snappy-add-O2-flag-in-
> CmakeLists.txt.patch \
> %D%/packages/patches/snappy-add-inline-for-GCC.patch \
> + %D%/packages/patches/spectre-meltdown-checker-remove-builtin-
> firmware-database.patch \
> + %D%/packages/patches/spectre-meltdown-checker-support-guix-system-
> kernel.patch \
> %D%/packages/patches/sphinxbase-fix-doxygen.patch \
> %D%/packages/patches/spice-vdagent-glib-2.68.patch \
> %D%/packages/patches/sssd-optional-systemd.patch \
> diff --git a/gnu/packages/linux.scm b/gnu/packages/linux.scm
> index fea33dfa0b..03b7ce46b0 100644
> --- a/gnu/packages/linux.scm
> +++ b/gnu/packages/linux.scm
> @@ -9595,3 +9595,133 @@ (define-public edac-utils
> error detection and correction (EDAC).")
> (home-page "https://github.com/grondo/edac-utils";)
> (license license:gpl2+)))
> +
> +(define-public spectre-meltdown-checker
> + (package
> + (name "spectre-meltdown-checker")
> + (version "0.45")
> + (source (origin
> + (method git-fetch)
> + (uri (git-reference
> + (url
> "https://github.com/speed47/spectre-meltdown-checker";)
> + (commit (string-append "v" version))))
> + (file-name (git-file-name name version))
> + (patches
> + (search-patches
> + "spectre-meltdown-checker-remove-builtin-firmware-
> database.patch"
> + ;;
> https://github.com/speed47/spectre-meltdown-checker/pull/441
> + "spectre-meltdown-checker-support-guix-system-
> kernel.patch"))
> + ;; Remove builtin firmware database.
> + (modules '((guix build utils)))
> + (snippet '(substitute* "spectre-meltdown-checker.sh"
> + (("^# [AI],.*") "")))
> + (sha256
> + (base32
> +
> "1xx8h5791lhc2xw0dcbzjkklzvlxwxkjzh8di4g8divfy24fqsn8"))))
> + (build-system copy-build-system)
> + (arguments
> + (list
> + #:install-plan
> + #~'(("spectre-meltdown-checker.sh" "bin/spectre-meltdown-
> checker"))
> + #:phases
> + #~(modify-phases %standard-phases
> + (add-after 'unpack 'fixpath
> + (lambda* (#:key inputs #:allow-other-keys)
> + (define* (find-command inputs cmd #:optional (bin
> "bin")
> + #:key (prefix "") (suffix ""))
> + (string-append
> + prefix (search-input-file inputs (string-append bin
> "/" cmd))
> + suffix))
> + (substitute* "spectre-meltdown-checker.sh"
> + ;; ${opt_arch_prefix}CMD
> + (((string-append
> + "\\$\\{opt_arch_prefix\\}"
> + "\\<(nm|objdump|readelf|strings)\\>") all cmd)
> + (find-command inputs cmd))
> +
> + ;; dd
> + (("(dd)( if=)" all cmd suffix)
> + (find-command inputs cmd #:suffix suffix))
> +
> + ;; Commands safe to substitute directly.
> + (((string-append "\\<(" (string-join
> + (list "awk"
> + "basename"
> + "dirname"
> + "bunzip2"
> + "gunzip"
> + "gzip"
> + "lz4"
> + "lzop"
> + "modprobe"
> + "pgrep"
> + "rmmod"
> + "umount"
> + "unlzma"
> + "unxz"
> + "unzstd"
> + "uuencode")
> + "|")
> + ")\\>") all cmd)
replaced these "clever" tricks with dumber ones,
> + (find-command inputs cmd))
> +
> + ;; Search by suffix.
> + ;; CMD -
> + ;; CMD ^
> + (((string-append "\\<(" (string-join
> + (list "base64"
> + "cut"
> + "grep"
> + "head"
> + "id"
> + "mount"
> + "mktemp"
> + "od"
> + "perl"
> + "rm"
> + "uname"
> + "xargs")
> + "|")
> + ")\\>( [-^])") all cmd suffix)
> + (find-command inputs cmd #:suffix suffix))
> + ;; CMD |
> + (("(dmesg)( \\|)" all cmd suffix)
> + (find-command inputs cmd #:suffix suffix))
> +
> + ;; Then prefix
> + ;; | CMD
> + (("(\\| )\\<(grep|sed|sort|stat|tr)\\>" all prefix
> cmd)
> + (find-command inputs cmd #:prefix prefix))
> + ;; $(CMD
> + (("(\\$\\( *)(sysctl)" all prefix cmd)
> + (find-command inputs cmd "sbin" #:prefix prefix))
> +
> (("(\\$\\()\\<(cat|find|grep|mount|nproc|stat|tr)\\>" all prefix cmd)
> + (find-command inputs cmd #:prefix prefix))
> + ;; if CMD
> + (("(if )(sysctl)" all prefix cmd)
> + (find-command inputs cmd "sbin" #:prefix prefix))
> + ;; command -v CMD
> + (("(command -v)
> \"*\\<(base64|nproc|perl|printf)\\>\"*" all prefix cmd)
> + (find-command inputs cmd #:prefix prefix))
> +
> + ;; Cats are mysterious...
> + ;; cat <<EOF
> + (("(cat)( <<EOF)" all cmd suffix)
> + (find-command inputs cmd #:suffix suffix))
> + ;; cat "$
> + (("(cat)(\"\\$)" all cmd suffix)
> + (find-command inputs cmd #:suffix suffix))
> + ;; 'cat'
> + (("(')(cat)(')" all prefix cmd suffix)
> + (find-command inputs cmd #:prefix prefix #:suffix
> suffix))
> + ;; "cat"
> + (("(\")(cat)(\")" all prefix cmd suffix)
> + (find-command inputs cmd #:prefix prefix #:suffix
> suffix))))))))
> + (inputs (list kmod lz4 lzop perl procps sharutils util-linux
> zstd))
> + (home-page
> "https://github.com/speed47/spectre-meltdown-checker";)
> + (synopsis "CPU vulnerability / mitigation checker")
> + (description
> + "This package provides a shell script to assess your system's
> resilience
> +against the several transient execution CVEs that were published
> since early
> +2018, and give you guidance as to how to mitigate them.")
> + (license license:gpl3)))
> diff --git a/gnu/packages/patches/spectre-meltdown-checker-remove-
> builtin-firmware-database.patch b/gnu/packages/patches/spectre-
> meltdown-checker-remove-builtin-firmware-database.patch
> new file mode 100644
> index 0000000000..809763cf4f
> --- /dev/null
> +++ b/gnu/packages/patches/spectre-meltdown-checker-remove-builtin-
> firmware-database.patch
> @@ -0,0 +1,243 @@
> +From 340b08737e552c3c186863d76d123808d853a159 Mon Sep 17 00:00:00
> 2001
> +From: Hilton Chain <hako@ultrarare.space>
> +Date: Sat, 12 Nov 2022 22:45:24 +0800
> +Subject: [PATCH] Remove builtin firmware database.
> +
> +1. Remove downloading function.
> +2. Add option for supplying a local database.
> +---
> + spectre-meltdown-checker.sh | 180 +++------------------------------
> ---
> + 1 file changed, 15 insertions(+), 165 deletions(-)
> +
> +diff --git a/spectre-meltdown-checker.sh b/spectre-meltdown-
> checker.sh
> +index 30f760c..ce46970 100755
> +--- a/spectre-meltdown-checker.sh
> ++++ b/spectre-meltdown-checker.sh
> +@@ -22,8 +22,6 @@ exit_cleanup()
> + [ -n "${dumped_config:-}" ] && [ -f "$dumped_config" ] && rm
> -f "$dumped_config"
> + [ -n "${kerneltmp:-}" ] && [ -f "$kerneltmp" ] && rm
> -f "$kerneltmp"
> + [ -n "${kerneltmp2:-}" ] && [ -f "$kerneltmp2" ] && rm
> -f "$kerneltmp2"
> +- [ -n "${mcedb_tmp:-}" ] && [ -f "$mcedb_tmp" ] && rm
> -f "$mcedb_tmp"
> +- [ -n "${intel_tmp:-}" ] && [ -d "$intel_tmp" ] && rm
> -rf "$intel_tmp"
> + [ "${mounted_debugfs:-}" = 1 ] && umount /sys/kernel/debug
> 2>/dev/null
> + [ "${mounted_procfs:-}" = 1 ] && umount "$procfs"
> 2>/dev/null
> + [ "${insmod_cpuid:-}" = 1 ] && rmmod cpuid 2>/dev/null
> +@@ -93,9 +91,7 @@ show_usage()
> + --vmm [auto,yes,no] override the detection of the
> presence of a hypervisor, default: auto
> + --allow-msr-write allow probing for write-only
> MSRs, this might produce kernel logs or be blocked by your system
> + --cpu [#,all] interact with CPUID and MSR
> of CPU core number #, or all (default: CPU core 0)
> +- --update-fwdb update our local copy of the
> CPU microcodes versions database (using the awesome
> +- MCExtractor project and the
> Intel firmwares GitHub repository)
> +- --update-builtin-fwdb same as --update-fwdb but
> update builtin DB inside the script itself
> ++ --with-fwdb FILE supply the CPU microcodes
> versions database
and added a note regarding the (lack of) freedom for proprietary
microcode.
I also added your name and email to the authors of linux.scm, since
this was a very non-trivial package.
Cheers
--- End Message ---