-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Hi,
Am Fr den 27. Apr 2018 um 6:42 schrieb Nikos Chantziaras:
> On 26/04/18 14:42, Mick wrote:
> > Hmm ... why is my Intel system missing 'IBPB' & 'IBRS_FW' ?
> >
> > $ grep . /sys/devices/system/cpu/vulnerabilities/*
> > /sys/devices/system/cpu/vulnerabilities/meltdown:Mitigation: PTI
> > /sys/devices/system/cpu/vulnerabilities/spectre_v1:Mitigation: __user
> > pointer
> > sanitization
> > /sys/devices/system/cpu/vulnerabilities/spectre_v2:Mitigation: Full generic
> > retpoline
I did install and compile 4.15.18, the last version from branch 4.15.
Unfortunatelly I just get the following:
~> uname -a
Linux tha 4.15.18-gentoo #2 Fri Apr 27 13:33:03 CET 2018 i686 Intel(R)
Pentium(R) M processor 1.86GHz GenuineIntel GNU/Linux
~> grep . /sys/devices/system/cpu/vulnerabilities/*
/sys/devices/system/cpu/vulnerabilities/meltdown:Vulnerable
/sys/devices/system/cpu/vulnerabilities/spectre_v1:Mitigation: __user
pointer sanitization
/sys/devices/system/cpu/vulnerabilities/spectre_v2:Vulnerable: Minimal
generic ASM retpoline
The problem here is, that this is a 32bit system and the CPU is not able
to run 64bit.
So there are some points I want to point to:
- - Meltdown is fully vulnerable. While there is a fix for 64bit kernel, I
would like to know when or if gentoo will port the mitigation for
32bit systems.
- - For Spectre 2, there is some mitigation in kernel but the compiler is
to old to support retpoline.
When I look to gcc meta data, I see a couples of versions:
~> equery m gcc
* sys-devel/gcc [gentoo]
Maintainer: toolch...@gentoo.org (Gentoo Toolchain Project)
Upstream: Remote-ID: cpe:/a:gnu:gcc ID: cpe
Remote-ID: dgcc ID: sourceforge
Homepage: https://gcc.gnu.org/
Location: /usr/portage/sys-devel/gcc
Keywords: 2.95.3-r10:2.95.3: ~alpha ~ppc ~sparc ~x86
Keywords: 3.3.6-r1:3.3.6: ~amd64 ~x86
Keywords: 3.4.6-r2:3.4.6: alpha amd64 arm ppc ppc64 sparc x86 ~ia64
~mips ~s390 ~sh -* ~x86-fbsd
Keywords: 4.0.4:4.0.4:
Keywords: 4.1.2:4.1.2: alpha amd64 arm hppa ia64 ppc ppc64 sparc x86
~m68k ~mips ~s390 ~sh -* ~x86-fbsd
Keywords: 4.2.4-r1:4.2.4: hppa ~alpha ~amd64 ~arm ~ia64 ~m68k ~ppc
~ppc64 ~sparc ~x86 ~x86-fbsd
Keywords: 4.3.6-r1:4.3.6: -hppa alpha amd64 arm ia64 ppc ppc64 sparc
x86 ~m68k ~mips ~s390 ~sh ~x86-fbsd
Keywords: 4.4.7:4.4.7: alpha amd64 arm hppa ia64 ppc ppc64 sparc x86
~m68k ~mips ~s390 ~sh ~x86-fbsd
Keywords: 4.5.4:4.5.4: alpha amd64 arm hppa ia64 ppc ppc64 sparc x86
~amd64-fbsd ~m68k ~mips ~s390 ~sh ~x86-fbsd
Keywords: 4.6.4:4.6.4: alpha amd64 arm hppa ia64 ppc ppc64 sparc x86
~amd64-fbsd ~m68k ~mips ~s390 ~sh ~x86-fbsd
Keywords: 4.7.4-r1:4.7.4: -amd64-fbsd -x86-fbsd alpha amd64 arm hppa
ia64 m68k ppc ppc64 s390 sh sparc x86 ~mips
Keywords: 4.8.5-r1:4.8.5: alpha amd64 arm arm64 hppa ia64 m68k ppc
ppc64 s390 sh sparc x86 ~amd64-fbsd ~mips ~x86-fbsd
Keywords: 4.9.4:4.9.4: alpha amd64 arm arm64 hppa ia64 m68k ppc ppc64
s390 sh sparc x86 ~amd64-fbsd ~mips ~x86-fbsd
Keywords: 5.4.0-r4:5.4.0: alpha amd64 arm arm64 hppa ia64 m68k ppc
ppc64 s390 sh sparc x86 ~amd64-fbsd ~mips ~x86-fbsd
Keywords: 6.4.0:6.4.0:
Keywords: 6.4.0-r1:6.4.0: alpha amd64 arm arm64 hppa ia64 ppc ppc64
sparc x86 ~amd64-fbsd ~m68k ~mips ~s390 ~sh ~x86-fbsd
Keywords: 7.2.0:7.2.0:
Keywords: 7.2.0-r1:7.2.0: ~alpha ~amd64 ~amd64-fbsd ~arm ~arm64 ~hppa
~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~x86-fbsd
Keywords: 7.3.0:7.3.0:
Keywords: 7.3.0-r1:7.3.0: ~alpha ~amd64 ~amd64-fbsd ~arm ~arm64 ~hppa
~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~x86-fbsd
Keywords: 7.3.0-r2:7.3.0:
License: GPL-3+ LGPL-3+ || ( GPL-3+ libgcc libstdc++
gcc-runtime-library-exception-3.1 ) FDL-1.3+
So which version is stable enough to use? 7.3.0, I use on a different
(non-Gentoo) system. But why -r1 and -r2?
> Do you have the latest sys-firmware/intel-microcode installed and configured
> correctly? You need to enable the "early microcode" kernel option, and you
> also need to add /boot/intel-uc.img to your list of initrds to load in
> grub2. Alternatively, a BIOS update for your mainboard (if one exists; most
> older mainboards won't get updates from the likes of Asus, MSI, Gigabyte,
> etc, etc, etc, so for older boards, you need the microcode package.)
So, coming to firmware. I do not think that intel is releasing firmware
update for that CPU. So I fully rely on kernel (and compiler).
Nevertheless, I need to know for other system what exactly is the way to
use firmware on gentoo. There is no /boot/intel-uc.img on my system and
genkernel complain about firmware compiling (what seems to prove that
there is none for my CPU).
However, if I read correct, genkernel should automatically include
firmware and firmware loading into the generated ramdisk. Right?
Regards
Klaus
- --
Klaus Ethgen http://www.ethgen.ch/
pub 4096R/4E20AF1C 2011-05-16 Klaus Ethgen <kl...@ethgen.ch>
Fingerprint: 85D4 CA42 952C 949B 1753 62B3 79D0 B06F 4E20 AF1C
-----BEGIN PGP SIGNATURE-----
Comment: Charset: ISO-8859-1
iQGzBAEBCgAdFiEEMWF28vh4/UMJJLQEpnwKsYAZ9qwFAlrjW74ACgkQpnwKsYAZ
9qyM5QwAsj0M5TT3O+RYPXana71nzgWjd72m0DuCDO/Yfw+79G0NuWrMFwyU/WkZ
OPlspMBRvOxo1UTuOMuUZ7wVqcQNen9m/3XZOQdmhO7NpqdfI5IozZH5dm0tdUcH
qOEcxkQQPj5h9fLqyfiOjKhOFKEtHIF4FuApaJuR2xGhTd4rV5Blm1zLBBZ1uSU6
ImpizYQ4kvCMj/n9L+1S6dd+iqlF0jQBDYw98mcYp3UU8iziA75Kq2a87ZFtjo0y
mENiyu8A4RS+WBItT5jVYDymozs3zeWsbgmNH8k1O4CTy30OqeLiZQdfGow2MC+x
4D0rLmN7Ky+ZDMZARtUPhvbkdC+nUMkfveOOKZbpe3qaAa+8QwVZVV8rC2I7fK8T
kex6adlaN1e8GU9UyeR7mKc5cjESRudM6wcZSJ1ZEx3uLq03IIcdJAoyyBHQz1OC
oQil2Vf4SP0QMhAEp/D4XziEzbkZxNErXwGJfVDHSPlB9wtRs4Mf3F2PGOI20h6S
71mhfjLK
=BqH+
-----END PGP SIGNATURE-----
