The package rpms/java-latest-openjdk.git has added or updated architecture specific
content in its
spec file (ExclusiveArch/ExcludeArch or %ifarch/%ifnarch) in commit(s):
https://src.fedoraproject.org/cgit/rpms/java-latest-openjdk.git/commit/?i....
Change:
+%ifarch %{ssbd_arches}
Thanks.
Full change:
============
commit dd485dcd4e72d3c26a1f0cf85ec1a9483ff1019a
Author: Jiri Vanek <jvanek(a)redhat.com>
Date: Thu Dec 17 15:00:23 2020 +0100
Added checks and restrictions around alt-java
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index 9b75fcd..9d8c29f 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -89,6 +89,8 @@
%global jit_arches %{ix86} x86_64 sparcv9 sparc64 %{aarch64} %{power64} %{arm}
s390x
%global aot_arches x86_64 %{aarch64}
%global fastdebug_arches x86_64 ppc64le aarch64 s390x
+# Set of architectures for which alt-java has SSB mitigation
+%global ssbd_arches x86_64
# By default, we build a debug build during main build on JIT architectures
%if %{with slowdebug}
@@ -247,7 +249,7 @@
%global top_level_dir_name %{origin}
%global minorver 0
%global buildver 9
-%global rpmrelease 4
+%global rpmrelease 5
# priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
%global priority %( printf '%02d%02d%02d%02d' %{majorver} %{minorver}
%{securityver} %{buildver} )
@@ -1634,6 +1636,16 @@ $JAVA_HOME/bin/java --add-opens java.base/javax.crypto=ALL-UNNAMED
TestCryptoLev
$JAVA_HOME/bin/javac -d . %{SOURCE14}
$JAVA_HOME/bin/java $(echo $(basename %{SOURCE14})|sed "s|\.java||")
+# Check java launcher has no SSB mitigation
+if ! nm $JAVA_HOME/bin/java | grep set_speculation ; then true ; else false; fi
+
+# Check alt-java launcher has SSB mitigation on supported architectures
+%ifarch %{ssbd_arches}
+nm $JAVA_HOME/bin/%{alt_java_name} | grep set_speculation
+%else
+if ! nm $JAVA_HOME/bin/%{alt_java_name} | grep set_speculation ; then true ; else false;
fi
+%endif
+
# Check debug symbols in static libraries (smoke test)
export STATIC_LIBS_HOME=$(pwd)/%{buildoutputdir -- $suffix}/images/%{static_libs_image}
readelf --debug-dump $STATIC_LIBS_HOME/lib/libfdlibm.a | grep w_remainder.c
@@ -2059,6 +2071,11 @@ require "copy_jdk_configs.lua"
%endif
%changelog
+* Thu Dec 17 2020 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:15.0.1.9-5.rolling
+- introduced nm based check to verify alt-java on x86_64 is patched, and no other
alt-java or java is patched
+- patch600 rh1750419-redhat_alt_java.patch amended to die, if it is used wrongly
+- introduced ssbd_arches with currently only valid arch of x86_64 to separate real
alt-java architectures
+
* Wed Dec 7 2020 Jiri Vanek <jvanek(a)redhat.com> - 1:15.0.1.9-4.rolling
- moved wrongly placed icenses to acompany other ones
- this bad placement was killng parallel-installability and thus having bad impact to
leapp if used
diff --git a/rh1750419-redhat_alt_java.patch b/rh1750419-redhat_alt_java.patch
index a563a43..70f45d4 100644
--- a/rh1750419-redhat_alt_java.patch
+++ b/rh1750419-redhat_alt_java.patch
@@ -1,7 +1,7 @@
diff -r 1356affa5e44 make/modules/java.base/Launcher.gmk
--- openjdk/make/modules/java.base/Launcher.gmk
+++ openjdk/make/modules/java.base/Launcher.gmk
-@@ -37,6 +37,13 @@
+@@ -37,6 +37,14 @@
$(eval $(call SetupBuildLauncher, java, \
CFLAGS := -DEXPAND_CLASSPATH_WILDCARDS -DENABLE_ARG_FILES, \
@@ -10,8 +10,9 @@ diff -r 1356affa5e44 make/modules/java.base/Launcher.gmk
+ OPTIMIZATION := HIGH, \
+))
+
++#Wno-error=cpp is present to allow commented warning in ifdef part of main.c
+$(eval $(call SetupBuildLauncher, alt-java, \
-+ CFLAGS := -DEXPAND_CLASSPATH_WILDCARDS -DENABLE_ARG_FILES -DREDHAT_ALT_JAVA, \
++ CFLAGS := -DEXPAND_CLASSPATH_WILDCARDS -DENABLE_ARG_FILES -DREDHAT_ALT_JAVA
-Wno-error=cpp, \
EXTRA_RC_FLAGS := $(JAVA_RC_FLAGS), \
VERSION_INFO_RESOURCE := $(JAVA_VERSION_INFO_RESOURCE), \
OPTIMIZATION := HIGH, \
@@ -96,12 +97,16 @@ diff -r 25e94aa812b2 src/share/bin/alt_main.h
diff -r 25e94aa812b2 src/share/bin/main.c
--- openjdk/src/java.base/share/native/launcher/main.c Wed Feb 05 12:20:36 2020 -0300
+++ openjdk/src/java.base/share/native/launcher/main.c Tue Jun 02 17:15:28 2020 +0100
-@@ -34,6 +34,10 @@
+@@ -34,6 +34,14 @@
#include "jli_util.h"
#include "jni.h"
++#ifdef REDHAT_ALT_JAVA
+#if defined(__linux__) && defined(__x86_64__)
+#include "alt_main.h"
++#else
++#warning alt-java requested but SSB mitigation not available on this platform.
++#endif
+#endif
+
#ifdef _MSC_VER
commit c2143101b0d83d99855c64c52e54cbd12735e573
Author: Jiri Vanek <jvanek(a)redhat.com>
Date: Wed Oct 14 14:49:31 2020 +0200
Fixed not-including fastdebugbuild in case of --without fastdebug
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index 47f8870..9b75fcd 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -119,6 +119,8 @@
%else
%global include_fastdebug_build 0
%endif
+%else
+%global include_fastdebug_build 0
%endif
%if %{include_debug_build}
commit bc6ed4dabe3715ee31c8995d369dda3b0fa42997
Author: Jiri Vanek <jvanek(a)redhat.com>
Date: Wed Oct 14 14:41:34 2020 +0200
moved wrongly placed icenses to acompany other ones
this bad placement was killng parallel-installability and thus having bad impact to
leapp if used
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index a2092e3..47f8870 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -245,7 +245,7 @@
%global top_level_dir_name %{origin}
%global minorver 0
%global buildver 9
-%global rpmrelease 3
+%global rpmrelease 4
# priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
%global priority %( printf '%02d%02d%02d%02d' %{majorver} %{minorver}
%{securityver} %{buildver} )
@@ -851,7 +851,7 @@ exit 0
%define files_javadoc() %{expand:
%doc %{_javadocdir}/%{uniquejavadocdir -- %{?1}}
-%license %{buildoutputdir -- %{?1}}/images/%{jdkimage}/legal
+%license %{_jvmdir}/%{sdkdir -- %{?1}}/legal
%if %is_system_jdk
%if %{is_release_build -- %{?1}}
%ghost %{_javadocdir}/java
@@ -861,7 +861,7 @@ exit 0
%define files_javadoc_zip() %{expand:
%doc %{_javadocdir}/%{uniquejavadocdir -- %{?1}}.zip
-%license %{buildoutputdir -- %{?1}}/images/%{jdkimage}/legal
+%license %{_jvmdir}/%{sdkdir -- %{?1}}/legal
%if %is_system_jdk
%if %{is_release_build -- %{?1}}
%ghost %{_javadocdir}/java-zip
@@ -2057,6 +2057,10 @@ require "copy_jdk_configs.lua"
%endif
%changelog
+* Wed Dec 7 2020 Jiri Vanek <jvanek(a)redhat.com> - 1:15.0.1.9-4.rolling
+- moved wrongly placed icenses to acompany other ones
+- this bad placement was killng parallel-installability and thus having bad impact to
leapp if used
+
* Tue Dec 01 2020 Jiri Vanek <jvanek(a)redhat.com> - 1:15.0.1.9-3.rolling
- added patch600, rh1750419-redhat_alt_java.patch, suprassing removed patch
- no longer copying of java->alt-java as it is created by patch600
commit 81ad8a3a4dd4b38cc86ff6f0becc9ad2c1e8f840
Author: Jiri <jvanek(a)redhat.com>
Date: Tue Dec 8 13:38:34 2020 +0100
Redeffined linux -> __linux__ and __x86_64 -> __x86_64__; should be backported
to jdk11 and jdk8
diff --git a/rh1750419-redhat_alt_java.patch b/rh1750419-redhat_alt_java.patch
index 45c4ad3..a563a43 100644
--- a/rh1750419-redhat_alt_java.patch
+++ b/rh1750419-redhat_alt_java.patch
@@ -100,7 +100,7 @@ diff -r 25e94aa812b2 src/share/bin/main.c
#include "jli_util.h"
#include "jni.h"
-+#if defined(linux) && defined(__x86_64)
++#if defined(__linux__) && defined(__x86_64__)
+#include "alt_main.h"
+#endif
+
commit 20d245ecd7af5e88e794934f7e15f04f78bfa331
Author: Jiri <jvanek(a)redhat.com>
Date: Mon Dec 7 19:54:31 2020 +0100
Fixes comment for speculative store bypass patch
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index 0df8765..a2092e3 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -1078,7 +1078,7 @@ Source14: TestECDSA.java
# NSS via SunPKCS11 Provider (disabled comment
# due to memory leak).
Patch1000: rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
-# enable build of spectre/meltdown hardened alt-java
+# enable build of speculative store bypass hardened alt-java
Patch600: rh1750419-redhat_alt_java.patch
# Ignore AWTError when assistive technologies are loaded
commit faca292328384ee1150ce33ddd345148f872f6c3
Author: Jiri <jvanek(a)redhat.com>
Date: Mon Dec 7 19:37:12 2020 +0100
Replaced alt-java palceholder by real pathced alt-java
- added patch600, rh1750419-redhat_alt_java.patch, suprassing removed patch
- no longer copying of java->alt-java as it is created by patch600
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index c3902b6..0df8765 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -245,7 +245,7 @@
%global top_level_dir_name %{origin}
%global minorver 0
%global buildver 9
-%global rpmrelease 2
+%global rpmrelease 3
# priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
%global priority %( printf '%02d%02d%02d%02d' %{majorver} %{minorver}
%{securityver} %{buildver} )
@@ -1078,6 +1078,8 @@ Source14: TestECDSA.java
# NSS via SunPKCS11 Provider (disabled comment
# due to memory leak).
Patch1000: rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
+# enable build of spectre/meltdown hardened alt-java
+Patch600: rh1750419-redhat_alt_java.patch
# Ignore AWTError when assistive technologies are loaded
Patch1: rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch
@@ -1438,6 +1440,7 @@ pushd %{top_level_dir_name}
popd # openjdk
%patch1000
+%patch600
# Extract systemtap tapsets
%if %{with_systemtap}
@@ -1601,7 +1604,6 @@ ln -s %{_datadir}/javazi-1.8/tzdb.dat $JAVA_HOME/lib/tzdb.dat
# Create fake alt-java as a placeholder for future alt-java
pushd ${JAVA_HOME}
-cp -a bin/java bin/%{alt_java_name}
# add alt-java man page
echo "Hardened java binary recommended for launching untrusted code from the Web
e.g. javaws" > man/man1/%{alt_java_name}.1
cat man/man1/java.1 >> man/man1/%{alt_java_name}.1
@@ -2055,6 +2057,10 @@ require "copy_jdk_configs.lua"
%endif
%changelog
+* Tue Dec 01 2020 Jiri Vanek <jvanek(a)redhat.com> - 1:15.0.1.9-3.rolling
+- added patch600, rh1750419-redhat_alt_java.patch, suprassing removed patch
+- no longer copying of java->alt-java as it is created by patch600
+
* Mon Nov 23 2020 Jiri Vanek <jvanek(a)redhat.com> - 1:15.0.1.9-2.rolling
- Create a copy of java as alt-java with alternatives and man pages
- java-11-openjdk doesn't have a JRE tree, so don't try and copy alt-java
there...
diff --git a/rh1750419-redhat_alt_java.patch b/rh1750419-redhat_alt_java.patch
new file mode 100644
index 0000000..45c4ad3
--- /dev/null
+++ b/rh1750419-redhat_alt_java.patch
@@ -0,0 +1,109 @@
+diff -r 1356affa5e44 make/modules/java.base/Launcher.gmk
+--- openjdk/make/modules/java.base/Launcher.gmk
++++ openjdk/make/modules/java.base/Launcher.gmk
+@@ -37,6 +37,13 @@
+
+ $(eval $(call SetupBuildLauncher, java, \
+ CFLAGS := -DEXPAND_CLASSPATH_WILDCARDS -DENABLE_ARG_FILES, \
++ EXTRA_RC_FLAGS := $(JAVA_RC_FLAGS), \
++ VERSION_INFO_RESOURCE := $(JAVA_VERSION_INFO_RESOURCE), \
++ OPTIMIZATION := HIGH, \
++))
++
++$(eval $(call SetupBuildLauncher, alt-java, \
++ CFLAGS := -DEXPAND_CLASSPATH_WILDCARDS -DENABLE_ARG_FILES -DREDHAT_ALT_JAVA, \
+ EXTRA_RC_FLAGS := $(JAVA_RC_FLAGS), \
+ VERSION_INFO_RESOURCE := $(JAVA_VERSION_INFO_RESOURCE), \
+ OPTIMIZATION := HIGH, \
+
+diff -r 25e94aa812b2 src/share/bin/alt_main.h
+--- /dev/null Thu Jan 01 00:00:00 1970 +0000
++++ openjdk/src/java.base/share/native/launcher/alt_main.h Tue Jun 02 17:15:28 2020
+0100
+@@ -0,0 +1,73 @@
++/*
++ * Copyright (c) 2019, Red Hat, Inc. All rights reserved.
++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
++ *
++ * This code is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 2 only, as
++ * published by the Free Software Foundation. Oracle designates this
++ * particular file as subject to the "Classpath" exception as provided
++ * by Oracle in the LICENSE file that accompanied this code.
++ *
++ * This code is distributed in the hope that it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
++ * version 2 for more details (a copy is included in the LICENSE file that
++ * accompanied this code).
++ *
++ * You should have received a copy of the GNU General Public License version
++ * 2 along with this work; if not, write to the Free Software Foundation,
++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
++ *
++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
++ * or visit
www.oracle.com if you need additional information or have any
++ * questions.
++ */
++
++#ifdef REDHAT_ALT_JAVA
++
++#include <sys/prctl.h>
++
++
++/* Per task speculation control */
++#ifndef PR_GET_SPECULATION_CTRL
++# define PR_GET_SPECULATION_CTRL 52
++#endif
++#ifndef PR_SET_SPECULATION_CTRL
++# define PR_SET_SPECULATION_CTRL 53
++#endif
++/* Speculation control variants */
++#ifndef PR_SPEC_STORE_BYPASS
++# define PR_SPEC_STORE_BYPASS 0
++#endif
++/* Return and control values for PR_SET/GET_SPECULATION_CTRL */
++
++#ifndef PR_SPEC_NOT_AFFECTED
++# define PR_SPEC_NOT_AFFECTED 0
++#endif
++#ifndef PR_SPEC_PRCTL
++# define PR_SPEC_PRCTL (1UL << 0)
++#endif
++#ifndef PR_SPEC_ENABLE
++# define PR_SPEC_ENABLE (1UL << 1)
++#endif
++#ifndef PR_SPEC_DISABLE
++# define PR_SPEC_DISABLE (1UL << 2)
++#endif
++#ifndef PR_SPEC_FORCE_DISABLE
++# define PR_SPEC_FORCE_DISABLE (1UL << 3)
++#endif
++#ifndef PR_SPEC_DISABLE_NOEXEC
++# define PR_SPEC_DISABLE_NOEXEC (1UL << 4)
++#endif
++
++static void set_speculation() __attribute__((constructor));
++static void set_speculation() {
++ if ( prctl(PR_SET_SPECULATION_CTRL,
++ PR_SPEC_STORE_BYPASS,
++ PR_SPEC_DISABLE_NOEXEC, 0, 0) == 0 ) {
++ return;
++ }
++ prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_DISABLE, 0, 0);
++}
++
++#endif // REDHAT_ALT_JAVA
+diff -r 25e94aa812b2 src/share/bin/main.c
+--- openjdk/src/java.base/share/native/launcher/main.c Wed Feb 05 12:20:36 2020 -0300
++++ openjdk/src/java.base/share/native/launcher/main.c Tue Jun 02 17:15:28 2020 +0100
+@@ -34,6 +34,10 @@
+ #include "jli_util.h"
+ #include "jni.h"
+
++#if defined(linux) && defined(__x86_64)
++#include "alt_main.h"
++#endif
++
+ #ifdef _MSC_VER
+ #if _MSC_VER > 1400 && _MSC_VER < 1600
+