The Latest Kernel Release.

avian · 07-24-2022, 12:33 AM

Quote:

Originally Posted by Aeterna

shrug,
if your processor was released in 2021/22 then the above will most likely not affect CPU performance. It is easy to check what affects cpu and which mitigations are needed.

Yep its pretty trivial. To see all vulnerabilities and if they are being mitigated -

Code:

grep -r . /sys/devices/system/cpu/vulnerabilities

or for just retbleed (on 5.18.14+ or 5.19-rcx+) -

Code:

cat /sys/devices/system/cpu/vulnerabilities/retbleed

If it's being mitigated and you dont like the performance drop, the option is always there to turn off retbleed mitigations with the "retbleed=off" kernel command line.

burdi01 · 07-24-2022, 03:19 AM

Quote:

Originally Posted by marav

Quote:

Just built 5.18.14
The build time went up from 6m19.851s to 6m36.141s, which is a 4.7% increase.

I'm curious to know your hardware
With my Ryzen 7:
make -j17 15124,96s user 1624,00s system 1536% cpu 18:10,43 total

It is a 32GB 12 cores AMD Ryzen 9 3900XT, which on cpubenchmark.net has a 32963 score.

Quote:

Originally Posted by Aeterna

shrug,
if your processor was released in 2021/22 then the above will most likely not affect CPU performance. It is easy to check what affects cpu and which mitigations are needed.

The CPU was released in 2020. As my kernel is a distribution type one all mitigations are needed.

kjhambrick · 07-24-2022, 09:57 AM

all --

Generic Kernel Version 5.15.57.kjh is running fine on my Slackware64 15.0 + Multilib LapTop.

Note that kernel 5.15.57 included the following new configs:

Code:

* Restart config...
*
* Mitigations for speculative execution vulnerabilities
*
Mitigations for speculative execution vulnerabilities (SPECULATION_MITIGATIONS) [Y/n/?] (NEW) Y

  Remove the kernel mapping in user mode (PAGE_TABLE_ISOLATION) [Y/n/?] Y
  Avoid speculative indirect branches in kernel (RETPOLINE) [Y/n/?] Y
    Enable return-thunks (RETHUNK) [Y/n/?] (NEW) Y

      Enable UNRET on kernel entry (CPU_UNRET_ENTRY) [Y/n/?] (NEW) Y

  Enable IBPB on kernel entry (CPU_IBPB_ENTRY) [Y/n/?] (NEW) Y

  Enable IBRS on kernel entry (CPU_IBRS_ENTRY) [Y/n/?] (NEW) Y
#
# configuration written to .config

The Latest Vulnerabilities and Mitigations are below my sig

Also note that I updated VMware WorkStation Pro from 16.2.3 to 16.2.4 from runlevel 3 like so:

Code:

# cd /dld/15.0/vmware
# sh ./VMware-Workstation-Full-16.2.4-20089737.x86_64.bundle --ignore-errors --console --custom

Finally, since my 11th Gen Intel(R) Core(TM) i9-11900K CPU SHOULD BE UNAFFECTED by RetBleed (

RATBleed

) I plan to build, install and boot 5.15.57.kjh-no-retbleed as soon as I have a little time ... will let you know how that goes ...

HTH

-- kjh

Code:

uname -msrpn: Linux kjhlt7.kjh.home 5.15.57.kjh x86_64 11th Gen Intel(R) Core(TM) i9-11900K @ 3.50GHz
firmware ...: kernel-firmware-20220719_4421586-noarch-1
NVidia Blob : NVIDIA-Linux-x86_64-515.57.run
VMWare Blob : VMware-Workstation-Full-16.2.4-20089737.x86_64.bundle
VMware-Workstation-Full-16.2.4-19376536.x86_64.bundle

Code:

# ./.do-get-spectre-meltdown.sh

Sun Jul 24 09:33:39 CDT 2022

  Linux kjhlt7.kjh.home 5.15.57.kjh #1 SMP PREEMPT Sun Jul 24 08:51:22 CDT 2022 x86_64 11th Gen Intel(R) Core(TM) i9-11900K @ 3.50GHz GenuineIntel GNU/Linux

  dmesg
    microcode: microcode updated early to revision 0x53, date = 2022-03-09
    Linux version 5.15.57.kjh (root@kjhlt7.kjh.home) (gcc (GCC) 11.2.0, GNU ld version 2.37-slack15) #1 SMP PREEMPT Sun Jul 24 08:51:22 CDT 2022
    Command line: BOOT_IMAGE=/boot/vmlinuz-generic-5.15.57.kjh root=UUID=6c71cd77-2463-408e-a992-ad6064b0651b ro nvidia-drm.modeset=1
    DMI: Notebook X170KM-G/X170KM-G, BIOS 1.07.06LS1 01/11/2020

  cpuinfo
    CPU Name:   11th Gen Intel(R) Core(TM) i9-11900K @ 3.50GHz
    Microcode:  0x53
    CPU FMS:    06-a7-01
    UCode Pkg:  intel-microcode-20220510-noarch-1_SBo_kjh  ( updated May 18 1package-kernel-5.15.57.kjh.log3:20 )
    UCode File: /lib/firmware/intel-ucode/06-a7-01         ( updated May 18 13:19 )
    UCode Info: 001/001: sig 0x000a0671, pf_mask 0x02, 2022-03-09, rev 0x0053, size 103424
    CPU bugs:   spectre_v1, spectre_v2, spec_store_bypass, swapgs, mmio_stale_data, retbleed

  vulnerability and mitigation files in /sys/devices/system/cpu/vulnerabilities/
    itlb_multihit:       Not affected
    l1tf:                Not affected
    mds:                 Not affected
    meltdown:            Not affected
    mmio_stale_data:     Mitigation: Clear CPU buffers; SMT vulnerable
    retbleed:            Mitigation: Enhanced IBRS
    spec_store_bypass:   Mitigation: Speculative Store Bypass disabled via prctl and seccomp
    spectre_v1:          Mitigation: usercopy/swapgs barriers and __user pointer sanitization
    spectre_v2:          Mitigation: Enhanced IBRS, IBPB: conditional, RSB filling
    srbds:               Not affected
    tsx_async_abort:     Not affected

cwizardone · 07-24-2022, 10:34 AM

An interesting (IMHO) article on the continuing problems with the "Retbleed" patches.

Quote:

.....There were follow-up fixes that came to address various issues with the Retbleed code and now today another round of Retbleed fallout is being bandaged for Linux 5.19-rc8. Nearly two weeks later, the Retbleed mitigations still haven't appeared in the Linux stable series as back-ports due to various issues coming up. But with the Retbleed fixes slowing down, it looks like the mitigation and all the fixes will premiere soon in the currently supported stable/LTS series.......

The full story can be found at, https://www.phoronix.com/news/Linux-...Retbleed-Fixes

kjhambrick · 07-24-2022, 01:32 PM

Thanks for the link cwizardone.

I suppose I will wait until 'later' to try a 'no-retbleed' kernel ...

-- kjh

cwizardone · 07-24-2022, 03:31 PM

5.19-rc8
Release Candidate 8, for the 5.19 "mainline" development kernel has been been made available for testing.

The tarball, https://git.kernel.org/pub/scm/linux....19-rc8.tar.gz

Mr. Torvalds' announcement, https://lkml.iu.edu/hypermail/linux/...7.3/00300.html

garpu · 07-24-2022, 11:11 PM

Granted, I haven't been doing anything too crazy today in the heat, but I'm not noticing much difference.

cwizardone · 07-25-2022, 05:32 AM

Kernel update 5.10.133 is now available at, https://www.kernel.org

The change log, https://cdn.kernel.org/pub/linux/ker...geLog-5.10.133

cwizardone · 07-25-2022, 09:12 AM

FWIW, I've been running the 5.19-rc8 kernel for about 16 hours and haven't had a single sneeze, cough or hiccup.

First generation Zen CPU.
Nvidia GPU and nvidia-legacy470-driver-470.129.06_multilib-x86_64-1_SBo.tgz
VirtualBox-6.1.36-152435-Linux_amd64.run

cwizardone · 07-27-2022, 11:47 PM

Year 2022, Round 46.

Another batch of updates has been scheduled for release on Friday, 29 July 2022, at approximately 16:00 GMT. If no problems are found while testing the release candidates, they might be available sometime on Thursday (depending on your time zone).

The details:

5.18.15-rc1, with 158 patches, https://lkml.iu.edu/hypermail/linux/...7.3/04038.html

5.15.58-rc1, with 201 patches, https://lkml.iu.edu/hypermail/linux/...7.3/03763.html

5.10.134-rc1, with 105 patches, https://lkml.iu.edu/hypermail/linux/...7.3/03677.html

5.4.208-rc1, with 87 patches, https://lkml.iu.edu/hypermail/linux/...7.3/03568.html

4.19.254-rc1, with 62 patches, https://lkml.iu.edu/hypermail/linux/...7.3/03508.html

4.14.290-rc1, with 37 patches, https://lkml.iu.edu/hypermail/linux/...7.3/03466.html

4.9.325-rc1, with 26 patches, https://lkml.iu.edu/hypermail/linux/...7.3/03438.html

cwizardone · 07-28-2022, 11:47 AM

A second set of release candidates for the recent kernel updates.

5.15.58-rc2, with 202 patches, https://lkml.iu.edu/hypermail/linux/...7.3/05132.html

5.10.134-rc2, with 101 patches, https://lkml.iu.edu/hypermail/linux/...7.3/05294.html

Daedra · 07-28-2022, 12:23 PM

Quote:

Originally Posted by avian

Yep its pretty trivial. To see all vulnerabilities and if they are being mitigated -

Code:

grep -r . /sys/devices/system/cpu/vulnerabilities

or for just retbleed (on 5.18.14+ or 5.19-rcx+) -

Code:

cat /sys/devices/system/cpu/vulnerabilities/retbleed

If it's being mitigated and you dont like the performance drop, the option is always there to turn off retbleed mitigations with the "retbleed=off" kernel command line.

I have been doing "mitigations=off" for a while now, I don't care about the security implications on my home desktop. Does mitigations=off also cover retbleed or do I have add both "mitigations=off" and "retbleed=off" to the boot options now?

Aeterna · 07-28-2022, 06:26 PM

Quote:

Originally Posted by Daedra

I have been doing "mitigations=off" for a while now, I don't care about the security implications on my home desktop. Does mitigations=off also cover retbleed or do I have add both "mitigations=off" and "retbleed=off" to the boot options now?

Quote:

grep -r . /sys/devices/system/cpu/vulnerabilities

this is wrong, it will only tell you if you compiled these options or not

so to see the list of cpu vulnerabilities run:

Quote:

lscpu

Quote:

mitigations=off

disables all mitigations including retbleed

Quote:

retbleed=off

disables retbleed only

either you can use kernel and disable when compiling or you can disable every mitigation individually in your boot loader config.

I think that if your cpu does not have specific vulnerability, disabling it does not fix cpu performance because... well cpu does not have this option enabled so it will be ignored.

bassmadrigal · 07-29-2022, 01:44 AM

Quote:

Originally Posted by Aeterna

this is wrong, it will only tell you if you compiled these options or not

Seems to work on my 14.2 system running kernel version 5.10.103:

Code:

jbhansen@craven-moorhead:~$ grep -r . /sys/devices/system/cpu/vulnerabilities
/sys/devices/system/cpu/vulnerabilities/spectre_v2:Mitigation: Full AMD retpoline, IBPB: conditional, STIBP: disabled, RSB filling
/sys/devices/system/cpu/vulnerabilities/itlb_multihit:Not affected
/sys/devices/system/cpu/vulnerabilities/mds:Not affected
/sys/devices/system/cpu/vulnerabilities/l1tf:Not affected
/sys/devices/system/cpu/vulnerabilities/spec_store_bypass:Mitigation: Speculative Store Bypass disabled via prctl and seccomp
/sys/devices/system/cpu/vulnerabilities/tsx_async_abort:Not affected
/sys/devices/system/cpu/vulnerabilities/spectre_v1:Mitigation: usercopy/swapgs barriers and __user pointer sanitization
/sys/devices/system/cpu/vulnerabilities/srbds:Not affected
/sys/devices/system/cpu/vulnerabilities/meltdown:Not affected

Compared to spectre-meltdown-checker for the issues my CPU is affected by:

Code:

CVE-2017-5715 aka 'Spectre Variant 2, branch target injection'
* Mitigation 1
  * Kernel is compiled with IBRS support:  YES 
    * IBRS enabled and active:  N/A  (not testable in offline mode)
  * Kernel is compiled with IBPB support:  YES 
    * IBPB enabled and active:  N/A  (not testable in offline mode)
* Mitigation 2
  * Kernel has branch predictor hardening (arm):  UNKNOWN 
  * Kernel compiled with retpoline option:  UNKNOWN  (couldn't read your kernel configuration)
> STATUS:  NOT VULNERABLE  (offline mode: kernel supports IBRS + IBPB to mitigate the vulnerability)

CVE-2018-3639 aka 'Variant 4, speculative store bypass'
* Kernel supports disabling speculative store bypass (SSB):  YES  (found nospec_store_bypass_disable in kernel)
> STATUS:  NOT VULNERABLE  (your system provides the necessary tools for software mitigation)

CVE-2017-5753 aka 'Spectre Variant 1, bounds check bypass'
* Kernel has array_index_mask_nospec:  YES  (1 occurrence(s) found of x86 64 bits array_index_mask_nospec())
* Kernel has the Red Hat/Ubuntu patch:  NO 
* Kernel has mask_nospec64 (arm64):  NO 
* Kernel has array_index_nospec (arm64):  NO 
> STATUS:  NOT VULNERABLE  (Kernel source has been patched to mitigate the vulnerability (x86 64 bits array_index_mask_nospec))

Based on this, it seems /sys/devices/system/cpu/vulnerabilities is accurate for at least 5.10 (which I would imagine would be at least anything 5.10 and newer).

Quote:

Originally Posted by Aeterna

so to see the list of cpu vulnerabilities run:

Quote:

lscpu

Maybe this is due to 14.2's util-linux (v2.27.1), but lscpu doesn't provide any information about potential vulnerabilities.

Code:

jbhansen@craven-moorhead:~$ lscpu
Architecture:          x86_64
CPU op-mode(s):        32-bit, 64-bit
Byte Order:            Little Endian
CPU(s):                16
On-line CPU(s) list:   0-15
Thread(s) per core:    2
Core(s) per socket:    8
Socket(s):             1
NUMA node(s):          1
Vendor ID:             AuthenticAMD
CPU family:            23
Model:                 1
Model name:            AMD Ryzen 7 1800X Eight-Core Processor
Stepping:              1
CPU MHz:               2147.377
CPU max MHz:           3600.0000
CPU min MHz:           2200.0000
BogoMIPS:              7199.64
Virtualization:        AMD-V
L1d cache:             32K
L1i cache:             64K
L2 cache:              512K
L3 cache:              8192K
NUMA node0 CPU(s):     0-15
Flags:                 fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm constant_tsc rep_good nopl nonstop_tsc cpuid extd_apicid aperfmperf pni pclmulqdq monitor ssse3 fma cx16 sse4_1 sse4_2 movbe popcnt aes xsave avx f16c rdrand lahf_lm cmp_legacy svm extapic cr8_legacy abm sse4a misalignsse 3dnowprefetch osvw skinit wdt tce topoext perfctr_core perfctr_nb bpext perfctr_llc mwaitx cpb hw_pstate sme ssbd sev ibpb vmmcall fsgsbase bmi1 avx2 smep bmi2 rdseed adx smap clflushopt sha_ni xsaveopt xsavec xgetbv1 xsaves clzero irperf xsaveerptr arat npt lbrv svm_lock nrip_save tsc_scale vmcb_clean flushbyasid decodeassists pausefilter pfthreshold avic v_vmsave_vmload vgif overflow_recov succor smca

(BTW, you should use [code][/code] tags instead of [quote][/quote] tags as they stick around when quoting a post.)

cwizardone · 07-29-2022, 10:41 AM

Kernel updates 5.18.15, 5.15.58, 5.10.134, 5.4.208, 4.19.254, 4.14.290 and 4.9.325 are now available at, https://www.kernel.org

The change logs,

https://cdn.kernel.org/pub/linux/ker...ngeLog-5.18.15

https://cdn.kernel.org/pub/linux/ker...ngeLog-5.15.58

https://cdn.kernel.org/pub/linux/ker...geLog-5.10.134

https://cdn.kernel.org/pub/linux/ker...ngeLog-5.4.208

https://cdn.kernel.org/pub/linux/ker...geLog-4.19.254

https://cdn.kernel.org/pub/linux/ker...geLog-4.14.290

https://cdn.kernel.org/pub/linux/ker...ngeLog-4.9.325