On Sat, 10 Feb 2018 11:21:59 +0100, Joakim Hernberg wrote:

On Sat, 10 Feb 2018 11:10:08 +0100 Ralf Mardorf wrote:

...

Intel Spectre v2 broken microcode detected; disabling Speculation Control

And what is wrong with this?

Hi, it's not my domain, the hits I get by https://www.google.de/search?source=hp&ei=ucp-WpKfFIrhkgX_uI-oCQ&q=Intel+Spectre+v2+broken+microcode+detected%3B+disabling+Speculation+Control&oq=Intel+Spectre+v2+broken+microcode+detected%3B+disabling+Speculation+Control&gs_l=psy-ab.3...1303.6725.0.10760.4.4.0.0.0.0.62.237.4.4.0....0...1c.1.64.psy-ab..0.0.0....0.anug6P_zxF8 don't help me. Is it good? To me "broken microcode" in combination with "Spectre" sounds like a serious warning. -- $ pacman -Q linux{,-rt-securityink,-rt,-rt-pussytoes,-rt-cornflower} linux 4.15.2-2 linux-rt-securityink 4.14.18_rt15-1 linux-rt 4.14.12_rt10-1 linux-rt-pussytoes 4.14.8_rt9-2 linux-rt-cornflower 4.11.12_rt16-1

On Sat, 10 Feb 2018 15:49:45 +0100, Joakim Hernberg wrote:

I think that refers to the fact that you have ucode loaded that was determined to cause problems on some systems.

To check if you have mitigations enabled, cat the files in /sys/devices/system/cpu/vulnerabilities, none ought to say vulnerable.

Thank you, so... [rocketmouse@archlinux ~]$ ls -hAl /sys/devices/system/cpu/vulnerabilities/ total 0 -r--r--r-- 1 root root 4.0K Feb 10 15:52 meltdown -r--r--r-- 1 root root 4.0K Feb 10 15:52 spectre_v1 -r--r--r-- 1 root root 4.0K Feb 10 15:52 spectre_v2 [rocketmouse@archlinux ~]$ cat /sys/devices/system/cpu/vulnerabilities/* Mitigation: PTI Mitigation: __user pointer sanitization Mitigation: Full generic retpoline ...means that they are enabled? Regards, Ralf

On Sat, 10 Feb 2018 16:09:17 +0100, Joakim Hernberg wrote:

On Sat, 10 Feb 2018 16:00:14 +0100 Ralf Mardorf wrote:

...

cat /sys/devices/system/cpu/vulnerabilities/* Mitigation: PTI Mitigation: __user pointer sanitization Mitigation: Full generic retpoline

...means that they are enabled?

Yes, how well they protect the system is of course another question, and I'm not 100% sure where the Intel ucode fits in all this. But it seems fairly clear that Intel dropped the ball on all of this including firmware updates...

I see. Apart from the µcode the kernel already includes the page-table isolation patch set. When booting with "nopti" the output for "meltdown" is "Vulnerable". [rocketmouse@archlinux ~]$ grep Securityink_nopti -B3 -A5 /boot/syslinux/syslinux.cfg # "KPTI was merged into Linux kernel version 4.15,[snip] and backported to Linux kernels 4.14.11, 4.9.75, 4.4.110." # - https://en.wikipedia.org/wiki/Kernel_page-table_isolation LABEL Securityink_nopti MENU LABEL Arch Linux Rt Securityink nopt^i LINUX ../vmlinuz-linux-rt-securityink APPEND root=LABEL=archlinux ro nopti INITRD ../intel-ucode.img,../initramfs-linux-rt-securityink.img [rocketmouse@archlinux ~]$ ls -hAl /sys/devices/system/cpu/vulnerabilities/ total 0 -r--r--r-- 1 root root 4.0K Feb 10 16:44 meltdown -r--r--r-- 1 root root 4.0K Feb 10 16:44 spectre_v1 -r--r--r-- 1 root root 4.0K Feb 10 16:44 spectre_v2 [rocketmouse@archlinux ~]$ cat /sys/devices/system/cpu/vulnerabilities/* Vulnerable Mitigation: __user pointer sanitization Mitigation: Full generic retpoline

On Sat, 10 Feb 2018 19:39:07 +0100 Ralf Mardorf wrote:

Now that you bump to 4.14.18_rt15-1, too and since I read the diff

https://aur.archlinux.org/cgit/aur.git/diff/?h=linux-rt&id=aee56edc0ffc7c315d462ae337f446b7ed8007c5

I notice that my config "suffers" from a spectre 2 "misconfiguration".

[rocketmouse@archlinux ~]$ zgrep CONFIG_BPF_JIT_ALWAYS_ON /proc/config.gz # CONFIG_BPF_JIT_ALWAYS_ON is not set

It should be enabled, right? I followed upstream Archlinux on this. -- Joakim