The Latest Kernel Release.

kjhambrick · 01-24-2018, 04:53 AM

basmadrigal --

Check it out ( re AMD is no longer 'guilty until proven innocent' ) !

-- kjh

From the 4.4.113 ChangeLog

Code:

<<snip>>--------------------------------------------------------------------
commit 6b1c99e275c034e4650044a7bb1a0bc274e1eb45
Author: Tom Lendacky <thomas.lendacky@amd.com>
Date:   Tue Dec 26 23:43:54 2017 -0600

    x86/cpu, x86/pti: Do not enable PTI on AMD processors
    
    commit 694d99d40972f12e59a3696effee8a376b79d7c8 upstream.
    
    AMD processors are not subject to the types of attacks that the kernel
    page table isolation feature protects against.  The AMD microarchitecture
    does not allow memory references, including speculative references, that
    access higher privileged data when running in a lesser privileged mode
    when that access would result in a page fault.
    
    Disable page table isolation by default on AMD processors by not setting
    the X86_BUG_CPU_INSECURE feature, which controls whether X86_FEATURE_PTI
    is set.
<<snip>>--------------------------------------------------------------------

orbea · 01-24-2018, 10:31 AM

In case you are unaware, AMD cpus are vulnerable to spectre which are associated with the retpoline patches. They are not vulnerable to meltdown which are the PTI patches that commit talks about. Intel is vulnerable to both.

bassmadrigal · 01-24-2018, 12:00 PM

Quote:

Originally Posted by kjhambrick

basmadrigal --

Check it out ( re AMD is no longer 'guilty until proven innocent' ) !

-- kjh

From the 4.4.113 ChangeLog

Code:

<<snip>>--------------------------------------------------------------------
commit 6b1c99e275c034e4650044a7bb1a0bc274e1eb45
Author: Tom Lendacky <thomas.lendacky@amd.com>
Date:   Tue Dec 26 23:43:54 2017 -0600

    x86/cpu, x86/pti: Do not enable PTI on AMD processors
    
    commit 694d99d40972f12e59a3696effee8a376b79d7c8 upstream.
    
    AMD processors are not subject to the types of attacks that the kernel
    page table isolation feature protects against.  The AMD microarchitecture
    does not allow memory references, including speculative references, that
    access higher privileged data when running in a lesser privileged mode
    when that access would result in a page fault.
    
    Disable page table isolation by default on AMD processors by not setting
    the X86_BUG_CPU_INSECURE feature, which controls whether X86_FEATURE_PTI
    is set.
<<snip>>--------------------------------------------------------------------

This was actually included in 4.14.12 (4.14.11 was the initial kernel with PTI), but I guess it may have taken a bit for them to backport it to the 4.4 series. But as orbea mentioned, PTI is only used to mitigate against Meltdown, which AMD is not susceptible to. However, PTI can also be used to prevent KASLR bypass, which means AMD would be vulnerable to that (but AFAIK, this is not a hardware bug, but software related and I assume they're looking for a fix that won't be as performance hurting as PTI is).

ivandi · 01-26-2018, 09:20 PM

Just compiled 4.4.113 on current with gcc-7.3, CONFIG_RETPOLINE=y and installed it on 14.2. No problems so far.

Code:

CVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1'
* Mitigated according to the /sys interface:  NO  (kernel confirms your system is vulnerable)
> STATUS:  VULNERABLE  (Vulnerable)

CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2'
* Mitigated according to the /sys interface:  YES  (kernel confirms that the mitigation is active)
* Mitigation 1
  * Kernel is compiled with IBRS/IBPB support:  NO 
  * Currently enabled features
    * IBRS enabled for Kernel space:  NO 
    * IBRS enabled for User space:  NO 
    * IBPB enabled:  NO 
* Mitigation 2
  * Kernel compiled with retpoline option:  YES 
  * Kernel compiled with a retpoline-aware compiler:  YES  (kernel reports full retpoline compilation)
  * Retpoline enabled:  YES 
> STATUS:  NOT VULNERABLE  (Mitigation: Full generic retpoline)

CVE-2017-5754 [rogue data cache load] aka 'Meltdown' aka 'Variant 3'
* Mitigated according to the /sys interface:  YES  (kernel confirms that the mitigation is active)
* Kernel supports Page Table Isolation (PTI):  YES 
* PTI enabled and active:  YES 
* Running as a Xen PV DomU:  NO 
> STATUS:  NOT VULNERABLE  (Mitigation: PTI)

Cheers

Drakeo · 01-26-2018, 11:22 PM

Quote:

Originally Posted by ivandi

Just compiled 4.4.113 on current with gcc-7.3, CONFIG_RETPOLINE=y and installed it on 14.2. No problems so far.

Code:

CVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1'
* Mitigated according to the /sys interface:  NO  (kernel confirms your system is vulnerable)
> STATUS:  VULNERABLE  (Vulnerable)

CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2'
* Mitigated according to the /sys interface:  YES  (kernel confirms that the mitigation is active)
* Mitigation 1
  * Kernel is compiled with IBRS/IBPB support:  NO 
  * Currently enabled features
    * IBRS enabled for Kernel space:  NO 
    * IBRS enabled for User space:  NO 
    * IBPB enabled:  NO 
* Mitigation 2
  * Kernel compiled with retpoline option:  YES 
  * Kernel compiled with a retpoline-aware compiler:  YES  (kernel reports full retpoline compilation)
  * Retpoline enabled:  YES 
> STATUS:  NOT VULNERABLE  (Mitigation: Full generic retpoline)

CVE-2017-5754 [rogue data cache load] aka 'Meltdown' aka 'Variant 3'
* Mitigated according to the /sys interface:  YES  (kernel confirms that the mitigation is active)
* Kernel supports Page Table Isolation (PTI):  YES 
* PTI enabled and active:  YES 
* Running as a Xen PV DomU:  NO 
> STATUS:  NOT VULNERABLE  (Mitigation: PTI)

Cheers

does it build the nvidia blob ?

Drakeo · 01-26-2018, 11:24 PM

Quote:

Originally Posted by bassmadrigal

This was actually included in 4.14.12 (4.14.11 was the initial kernel with PTI), but I guess it may have taken a bit for them to backport it to the 4.4 series. But as orbea mentioned, PTI is only used to mitigate against Meltdown, which AMD is not susceptible to. However, PTI can also be used to prevent KASLR bypass, which means AMD would be vulnerable to that (but AFAIK, this is not a hardware bug, but software related and I assume they're looking for a fix that won't be as performance hurting as PTI is).

your wrong. prove me right. your wrong. did my home work now read read code.

ivandi · 01-27-2018, 10:31 PM

Quote:

Originally Posted by Drakeo

does it build the nvidia blob ?

No idea. Last time I played video games was on six-five-oh-two.

Cheers

bassmadrigal · 01-27-2018, 11:01 PM

Quote:

Originally Posted by Drakeo

your wrong. prove me right. your wrong. did my home work now read read code.

What am I wrong about?

PTI disabled for AMD processors in 4.14.12

PTI is only used to mitigate against Meltdown. AMD is not susceptible to Meltdown. PTI can be used to prevent KASLR bypass. AMD would remain vulnerable to KASLR bypass if PTI is not enabled.

You do realize that I was not responding to you, right? So I don't know how I am supposed to prove you right since I wasn't saying you were wrong about anything (at least with that post... I don't remember what we were discussing previously -- and if that's what you're referencing, you really should quote that so we have a reference). The burden should be on you to explain why I am wrong. I'm all for people correcting my mistakes so myself and others can learn. But if you just say I'm wrong without any indication on what I'm wrong about and what is actually correct, it doesn't help anyone. Please provide the forum with your knowledge so we can all benefit.

cwizardone · 01-28-2018, 04:52 PM

FINALLY!

The 4.15 kernel has been released!

This one finally supports the AMD Ryzen CPU temperature sensors, among other things. It would be nice to see it in /testing.

The tarball, https://cdn.kernel.org/pub/linux/ker...ux-4.15.tar.xz

Mr. Torvalds' announcement,
http://lkml.iu.edu/hypermail/linux/k...1.3/02794.html

Quote:

After a release cycle that was unusual in so many (bad) ways, this
last week was really pleasant. Quiet and small, and no last-minute
panics, just small fixes for various issues. I never got a feeling
that I'd need to extend things by yet another week, and 4.15 looks
fine to me.

Half the changes in the last week were misc driver stuff (gpu, input,
networking) with the other half being a mix of networking, core kernel
and arch updates (mainly x86). But all of it is tiny.

So at least we had one good week. This obviously was not a pleasant
release cycle, with the whole meltdown/spectre thing coming in in the
middle of the cycle and not really gelling with our normal release
cycle. The extra two weeks were obviously mainly due to that whole
timing issue.

Also, it is worth pointing out that it's not like we're "done" with
spectre/meltdown. There is more work pending (arm, spectre-v1, misc
details), and perhaps equally importantly, to actually get the biggest
fix for the indirect branch mitigations, you need not just the kernel
updates, you need to have a compiler with support for the "retpoline"
indirect branch model.

You can do

cat /sys/devices/system/cpu/vulnerabilities/spectre_v2

and if you don't have a compiler that supports the retpoline
mitigations, you'll get:

Vulnerable: Minimal generic ASM retpoline

because only the assembly code (not the C code) will have the
retpoline mitigation. So keep that in mind.

Anyway, while spectre/meltdown has obviously been the big news this
release cycle, it's worth noting that we obviously had all the
*normal* updates going on too, and the work everywhere else didn't
just magically stop, even if some developers have been distracted by
CPU issues. In the *big* picture, 4.15 looks perfectly normal, with
two thirds of the full 4.15 patch being about drivers, and even the
arch updates are dominated by the arm DTS diffs, not by CPU bug
mitigation.

So the news cycle notwithstanding, the bulk of the 4.15 work is all
the regular plodding "boring" stuff. And I mean that in the best
possible way. It may not be glamorous and get the headlines, but it's
the bread and butter of kernel development, and is in many ways the
really important stuff.

Go forth and play with it, things actually look pretty good despite everything.

And obviously this also means that the merge window for 4.16 is open.
I already have a number of pull requests pending that I will start
merging tomorrow. Hopefully we'll have a _normal_ and entirely boring
release cycle for 4.16. Because boring really is good.

Linus

---

cwizardone · 01-30-2018, 10:35 AM

About an hour ago I installed the DUSK* 4.15.0 kernel from Board Member 55020.
Other than having to update to the latest version of VirtualBox, it has been running perfectly. I've ran every application I use daily, and a few others, and there hasn't been a single problem.
This has been a much better experience than the first release of 4.14.

(YMMV)

Many thanks to 55020!

*Dave's Unofficial SlackBuilt Kernels
https://dusk.idlemoor.tk/linux-4.15/

55020 · 01-30-2018, 11:31 AM

lol, you don't miss a thing do you

cwizardone · 01-31-2018, 07:26 AM

Kernel updates 4.14.16, 4.9.79, 4.4.114 and 3.18.93 [EOL] are now available at, https://www.kernel.org/.

The change logs,

https://cdn.kernel.org/pub/linux/ker...ngeLog-4.14.16

https://cdn.kernel.org/pub/linux/ker...angeLog-4.9.79

https://cdn.kernel.org/pub/linux/ker...ngeLog-4.4.114

https://cdn.kernel.org/pub/linux/ker...ngeLog-3.18.93

dwblas · 01-31-2018, 02:54 PM

Quote:

Originally Posted by cwizardone

About an hour ago I installed the DUSK* 4.15.0 kernel from Board Member 55020.
Other than having to update to the latest version of VirtualBox, it has been running perfectly. I've ran every application I use daily, and a few others, and there hasn't been a single problem.
This has been a much better experience than the first release of 4.14.

(YMMV)

Many thanks to 55020!

*Dave's Unofficial SlackBuilt Kernels
https://dusk.idlemoor.tk/linux-4.15/

+1 Also use the dusk kernel. Thanks Dave for saving us some time.

PROBLEMCHYLD · 01-31-2018, 03:26 PM

@ 55020

I notice you don't have a 4.9 branch. Would it be too much to add it to top off the 4.xx series of kernels? Just asking.

55020 · 01-31-2018, 04:09 PM

Too much hassle, sorry. There's an old 4.9 config at https://dusk.idlemoor.tk/config/ if that helps?