SlackwareThis Forum is for the discussion of Slackware Linux.
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
I was not exactly sure what to do about the new intel-ucode-with-caveats/ directory but it is in the Package as /lib/firmware/intel-ucode-with-caveats/ if you want to use it.
In addition, the new Kernel Patches Directory is stored as /usr/doc/intel-microcode-20180425/linux-kernel-patches/
The firmware in intel-ucode-with-caveats/ is for a tiny number of Broadwell CPUs (certain Xeon E5 v4s are affected, AFAIK). The patches in linux-kernel-patches/ need to be applied to 4.4.x and 4.9.x kernel source trees (although apparently Intel is working on getting them backported) to prevent those CPUs from hanging when the firmware is uploaded. The kernel patches are otherwise unnecessary.
The firmware in intel-ucode-with-caveats/ is for a tiny number of Broadwell CPUs (certain Xeon E5 v4s are affected, AFAIK). The patches in linux-kernel-patches/ need to be applied to 4.4.x and 4.9.x kernel source trees (although apparently Intel is working on getting them backported) to prevent those CPUs from hanging when the firmware is uploaded. The kernel patches are otherwise unnecessary.
Thanks for the info CTM.
After building and installing intel-microcode.SlackBuild attached in the post above, you'll find two README files:
Reading these two files, the firmware for S-M-F == '06-4f-01' ( aka Xeon E5/E7 v4 and Core i7-69xx/68xx ) was moved from /lib/firmware/intel-ucode/ to /lib/firmware/intel-ucode-with-caveats/ with the 20180425 ucode update.
If you run one of these Skylake CPUs and you need to 'live load' the microcode for the processors and you're running a 4.4.y or 4.9.y Kernel, you'll need the kernel patches.
And as you said, these patches are being back-ported so the patches should be OBE at that point.
Or something like that ...
-- kjh
Last edited by kjhambrick; 05-14-2018 at 07:30 AM.
Reason: added link to prior post
the fact that intel points for the latest version at 20180807 could mean that something might be wrong with the newer version but I hasn't been able to find no reports of this.
it might also mean that the new version hasn't been throughly tested but I haven't been able to find any information also in this sense...
I think to recompile kernel for stable is ok - but what about -current? And please would someone be so kind to made some short summary of this thread - seems here are so many solutions of the problem stated I am completely lost - most promising for me looks what (resurrected) dark side of force proposed - I mean to concatenate initrd.gz - seems nice trick and sppose works in other situations - mhm I would really be interested to hear for what other purposes this trick can be used.
I think worked, here my load using spectro script
According to the script i am not vulnerable at all
Code:
Spectre and Meltdown mitigation detection tool v0.40
Checking for vulnerabilities on current system
Kernel is Linux 5.0.10 #1 SMP Tue Apr 30 10:39:48 -03 2019 x86_64
CPU is Intel(R) Core(TM) i5-3320M CPU @ 2.60GHz
Hardware check
* Hardware support (CPU microcode) for mitigation techniques
* Indirect Branch Restricted Speculation (IBRS)
* SPEC_CTRL MSR is available: YES
* CPU indicates IBRS capability: YES (SPEC_CTRL feature bit)
* Indirect Branch Prediction Barrier (IBPB)
* PRED_CMD MSR is available: YES
* CPU indicates IBPB capability: YES (SPEC_CTRL feature bit)
* Single Thread Indirect Branch Predictors (STIBP)
* SPEC_CTRL MSR is available: YES
* CPU indicates STIBP capability: YES (Intel STIBP feature bit)
* Speculative Store Bypass Disable (SSBD)
* CPU indicates SSBD capability: YES (Intel SSBD)
* L1 data cache invalidation
* FLUSH_CMD MSR is available: YES
* CPU indicates L1D flush capability: YES (L1D flush feature bit)
* Enhanced IBRS (IBRS_ALL)
* CPU indicates ARCH_CAPABILITIES MSR availability: NO
* ARCH_CAPABILITIES MSR advertises IBRS_ALL capability: NO
* CPU explicitly indicates not being vulnerable to Meltdown (RDCL_NO): NO
* CPU explicitly indicates not being vulnerable to Variant 4 (SSB_NO): NO
* CPU/Hypervisor indicates L1D flushing is not necessary on this system: NO
* Hypervisor indicates host CPU might be vulnerable to RSB underflow (RSBA): NO
* CPU supports Software Guard Extensions (SGX): NO
* CPU microcode is known to cause stability problems: NO (model 0x3a family 0x6 stepping 0x9 ucode 0x20 cpuid 0x306a9)
* CPU microcode is the latest known available version: YES (latest version is 0x20 dated 2018/04/10 according to builtin MCExtractor DB v96 - 2019/01/15)
* CPU vulnerability to the speculative execution attack variants
* Vulnerable to CVE-2017-5753 (Spectre Variant 1, bounds check bypass): YES
* Vulnerable to CVE-2017-5715 (Spectre Variant 2, branch target injection): YES
* Vulnerable to CVE-2017-5754 (Variant 3, Meltdown, rogue data cache load): YES
* Vulnerable to CVE-2018-3640 (Variant 3a, rogue system register read): YES
* Vulnerable to CVE-2018-3639 (Variant 4, speculative store bypass): YES
* Vulnerable to CVE-2018-3615 (Foreshadow (SGX), L1 terminal fault): NO
* Vulnerable to CVE-2018-3620 (Foreshadow-NG (OS), L1 terminal fault): YES
* Vulnerable to CVE-2018-3646 (Foreshadow-NG (VMM), L1 terminal fault): YES
CVE-2017-5753 aka 'Spectre Variant 1, bounds check bypass'
* Mitigated according to the /sys interface: YES (Mitigation: __user pointer sanitization)
* Kernel has array_index_mask_nospec: YES (1 occurrence(s) found of x86 64 bits array_index_mask_nospec())
* Kernel has the Red Hat/Ubuntu patch: NO
* Kernel has mask_nospec64 (arm64): NO
> STATUS: NOT VULNERABLE (Mitigation: __user pointer sanitization)
CVE-2017-5715 aka 'Spectre Variant 2, branch target injection'
* Mitigated according to the /sys interface: YES (Mitigation: Full generic retpoline, IBPB: conditional, IBRS_FW, STIBP: conditional, RSB filling)
* Mitigation 1
* Kernel is compiled with IBRS support: YES
* IBRS enabled and active: YES (for firmware code only)
* Kernel is compiled with IBPB support: YES
* IBPB enabled and active: YES
* Mitigation 2
* Kernel has branch predictor hardening (arm): NO
* Kernel compiled with retpoline option: YES
* Kernel compiled with a retpoline-aware compiler: YES (kernel reports full retpoline compilation)
> STATUS: NOT VULNERABLE (Full retpoline + IBPB are mitigating the vulnerability)
CVE-2017-5754 aka 'Variant 3, Meltdown, rogue data cache load'
* Mitigated according to the /sys interface: YES (Mitigation: PTI)
* Kernel supports Page Table Isolation (PTI): YES
* PTI enabled and active: YES
* Reduced performance impact of PTI: YES (CPU supports PCID, performance impact of PTI will be reduced)
* Running as a Xen PV DomU: NO
> STATUS: NOT VULNERABLE (Mitigation: PTI)
CVE-2018-3640 aka 'Variant 3a, rogue system register read'
* CPU microcode mitigates the vulnerability: YES
> STATUS: NOT VULNERABLE (your CPU microcode mitigates the vulnerability)
CVE-2018-3639 aka 'Variant 4, speculative store bypass'
* Mitigated according to the /sys interface: YES (Mitigation: Speculative Store Bypass disabled via prctl and seccomp)
* Kernel supports disabling speculative store bypass (SSB): YES (found in /proc/self/status)
* SSB mitigation is enabled and active: YES (per-thread through prctl)
* SSB mitigation currently active for selected processes: readlink: falta operando
Tente "readlink --help" para mais informações.
basename: falta operando
Tente "basename --help" para mais informações.
NO (no process found using SSB mitigation through prctl)
> STATUS: NOT VULNERABLE (Mitigation: Speculative Store Bypass disabled via prctl and seccomp)
CVE-2018-3615 aka 'Foreshadow (SGX), L1 terminal fault'
* CPU microcode mitigates the vulnerability: N/A
> STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not vulnerable)
CVE-2018-3620 aka 'Foreshadow-NG (OS), L1 terminal fault'
* Mitigated according to the /sys interface: YES (Mitigation: PTE Inversion)
* Kernel supports PTE inversion: YES (found in kernel image)
* PTE inversion enabled and active: YES
> STATUS: NOT VULNERABLE (Mitigation: PTE Inversion)
CVE-2018-3646 aka 'Foreshadow-NG (VMM), L1 terminal fault'
* Information from the /sys interface: VMX: conditional cache flushes, SMT vulnerable
* This system is a host running a hypervisor: NO
* Mitigation 1 (KVM)
* EPT is disabled: NO
* Mitigation 2
* L1D flush is supported by kernel: YES (found flush_l1d in /proc/cpuinfo)
* L1D flush enabled: YES (conditional flushes)
* Hardware-backed L1D flush supported: YES (performance impact of the mitigation will be greatly reduced)
* Hyper-Threading (SMT) is enabled: YES
> STATUS: NOT VULNERABLE (this system is not running a hypervisor)
> SUMMARY: CVE-2017-5753:OK CVE-2017-5715:OK CVE-2017-5754:OK CVE-2018-3640:OK CVE-2018-3639:OK CVE-2018-3615:OK CVE-2018-3620:OK CVE-2018-3646:OK
Last edited by Candelabrus; 04-30-2019 at 09:04 AM.
- build it & installed it & rebooted, only to find out that my CPU microcode wasn't updated, remained at its original revision=0x24 instead of updating to revision=0x25
- the release note form: https://github.com/intel/Intel-Linux...0190514.tar.gz
contains:
Haswell U
4th Generation Intel® Core™
Processor Family
Intel® Pentium® Processor Family
- well, either my CPU isn't yet supported/updated, this Intel microcode pack is still "beta" or ... I might have messed up something with the intel-microcode pack/SlackBuild. I double checked the last point and everything looks OK.
CVE-2018-12126 aka 'Fallout, microarchitectural store buffer data sampling (MSBDS)'
* CPU supports the MD_CLEAR functionality: NO
* Kernel supports using MD_CLEAR mitigation: NO
> STATUS: VULNERABLE (Neither your kernel or your microcode support mitigation, upgrade both to mitigate the vulnerability)
CVE-2018-12130 aka 'ZombieLoad, microarchitectural fill buffer data sampling (MFBDS)'
* CPU supports the MD_CLEAR functionality: NO
* Kernel supports using MD_CLEAR mitigation: NO
> STATUS: VULNERABLE (Neither your kernel or your microcode support mitigation, upgrade both to mitigate the vulnerability)
CVE-2018-12127 aka 'RIDL, microarchitectural load port data sampling (MLPDS)'
* CPU supports the MD_CLEAR functionality: NO
* Kernel supports using MD_CLEAR mitigation: NO
> STATUS: VULNERABLE (Neither your kernel or your microcode support mitigation, upgrade both to mitigate the vulnerability)
CVE-2019-11091 aka 'RIDL, microarchitectural data sampling uncacheable memory (MDSUM)'
* CPU supports the MD_CLEAR functionality: NO
* Kernel supports using MD_CLEAR mitigation: NO
> STATUS: VULNERABLE (Neither your kernel or your microcode support mitigation, upgrade both to mitigate the vulnerability)
> SUMMARY: CVE-2017-5753:OK CVE-2017-5715:OK CVE-2017-5754:OK CVE-2018-3640:OK CVE-2018-3639:OK CVE-2018-3615:OK CVE-2018-3620:OK CVE-2018-3646:KO CVE-2018-12126:KO CVE-2018-12130:KO CVE-2018-12127:KO CVE-2019-11091:KO
- build it & installed it & rebooted, only to find out that my CPU microcode wasn't updated, remained at its original revision=0x24 instead of updating to revision=0x25
If you use lilo and load the microcode via its initrd= keyword, did you remember to run (mkinitrd and) lilo?
Last edited by Petri Kaukasoina; 05-15-2019 at 02:02 AM.
It's a Haswell i3-4005U DELL Laptop, kind of a test system / road warrior. Until now, DELL has always (promptly) published a BIOS update once Intel released their microcode. I still believe that there's actually no update for this CPU in Intel's latest microcode release ... will wait for DELL to confirm/infirm (BIOS update).
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.
