<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto">Are there any plans to enable IBRS/IBPB in the kernel-ml kernels?<div><br></div><div>While I understand the desire to keep the builds as ‘stock’ as possible, given the potential impact of the this I’d consider it a worth enabling unless I’m misunderstanding the situation?</div><div><br><div><div class=""><div class=""><div class=""><div dir="auto" class="" style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><div dir="auto" class="" style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><div dir="auto" class="" style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><div><font color="#000000"><span style="background-color: rgba(255, 255, 255, 0);">--<br class="">Sam McLeod<br class=""><a href="https://smcleod.net" class="">https://smcleod.net</a><br class=""><a href="https://twitter.com/s_mcleod">https://twitter.com/s_mcleod</a></span></font></div><div><font color="#000000"><span style="background-color: rgba(255, 255, 255, 0);"><br></span></font></div></div></div></div></div></div></div></div><div><br>On 30 Jan 2018, at 10:09 am, Sam McLeod <<a href="mailto:mailinglists@smcleod.net">mailinglists@smcleod.net</a>> wrote:<br><br></div><blockquote type="cite"><div><meta http-equiv="Content-Type" content="text/html; charset=us-ascii">For those wondering about the status of Spectre and Meltdown on kernel-ml 4.15, below is the output of the speed47 test (<a href="https://github.com/speed47/spectre-meltdown-checker" class="">https://github.com/speed47/spectre-meltdown-checker</a>).<div class=""><br class=""></div><div class="">I've found this to be consistent between CentOS 7 VMs (PVHVM) on XenServer 7.2 w/ E5-2660 CPUs and physical servers using older X5650 CPUs.</div><div class=""><br class=""></div><div class="">So it looks like at present we're still vulnerable to Spectre Variant 1 and 2 with Kernel 4.15, obviously resolving this in full will require a working microcode update from Intel.<br class=""><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0);" class=""># ./spectre-meltdown-checker.sh</div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(100, 181, 246); background-color: rgb(0, 0, 0);" class="">Spectre and Meltdown mitigation detection tool v0.33+</div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0); min-height: 18px;" class=""><br class=""></div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0);" class="">Checking for vulnerabilities on current system</div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(106, 30, 154); background-color: rgb(0, 0, 0);" class=""><span style="color: #eaeaea" class="">Kernel is </span>Linux 4.15.0-1.el7.elrepo.x86_64 #1 SMP Sun Jan 28 20:45:20 EST 2018 x86_64</div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(106, 30, 154); background-color: rgb(0, 0, 0);" class=""><span style="color: #eaeaea" class="">CPU is </span>Intel(R) Xeon(R) CPU E5-2660 0 @ 2.20GHz</div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0); min-height: 18px;" class=""><br class=""></div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(100, 181, 246); background-color: rgb(0, 0, 0);" class="">Hardware check</div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0);" class="">* Hardware support (CPU microcode) for mitigation techniques</div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0);" class=""> * Indirect Branch Restricted Speculation (IBRS)</div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0);" class=""> * SPEC_CTRL MSR is available: <span style="color: #2c2c2c; background-color: #c62828" class=""> NO</span></div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0);" class=""> * CPU indicates IBRS capability: <span style="color: #2c2c2c; background-color: #c62828" class=""> NO</span></div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0);" class=""> * Indirect Branch Prediction Barrier (IBPB)</div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0);" class=""> * PRED_CMD MSR is available: <span style="color: #2c2c2c; background-color: #c62828" class=""> NO</span></div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0);" class=""> * CPU indicates IBPB capability: <span style="color: #2c2c2c; background-color: #c62828" class=""> NO</span></div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0);" class=""> * Single Thread Indirect Branch Predictors (STIBP)</div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0);" class=""> * SPEC_CTRL MSR is available: <span style="color: #2c2c2c; background-color: #c62828" class=""> NO</span></div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0);" class=""> * CPU indicates STIBP capability: <span style="color: #2c2c2c; background-color: #c62828" class=""> NO</span></div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0);" class=""> * Enhanced IBRS (IBRS_ALL)</div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0);" class=""> * CPU indicates ARCH_CAPABILITIES MSR availability: <span style="color: #2c2c2c; background-color: #c62828" class=""> NO</span></div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0);" class=""> * ARCH_CAPABILITIES MSR advertises IBRS_ALL capability: <span style="color: #2c2c2c; background-color: #c62828" class=""> NO</span></div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0);" class=""> * CPU explicitly indicates not being vulnerable to Meltdown (RDCL_NO): <span style="color: #2c2c2c; background-color: #1565c0" class=""> NO</span></div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0);" class=""> * CPU microcode is known to cause stability problems: <span style="color: #2c2c2c; background-color: #558b2f" class=""> NO</span></div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0);" class="">* CPU vulnerability to the three speculative execution attacks variants</div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0);" class=""> * Vulnerable to Variant 1: <span style="color: #2c2c2c; background-color: #c62828" class=""> YES</span></div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0);" class=""> * Vulnerable to Variant 2: <span style="color: #2c2c2c; background-color: #c62828" class=""> YES</span></div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0);" class=""> * Vulnerable to Variant 3: <span style="color: #2c2c2c; background-color: #c62828" class=""> YES</span></div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0); min-height: 18px;" class=""><br class=""></div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(100, 181, 246); background-color: rgb(0, 0, 0);" class="">CVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1'</div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0);" class="">* Mitigated according to the /sys interface: <span style="color: #2c2c2c; background-color: #c62828" class=""> NO </span> (kernel confirms your system is vulnerable)</div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(44, 44, 44); background-color: rgb(0, 0, 0);" class=""><span style="color: #eaeaea" class="">> </span><span style="background-color: #00838f" class="">STATUS:</span><span style="color: #eaeaea" class=""> </span><span style="background-color: #c62828" class=""> VULNERABLE </span><span style="color: #eaeaea" class=""> (Vulnerable)</span></div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0); min-height: 18px;" class=""><br class=""></div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(100, 181, 246); background-color: rgb(0, 0, 0);" class="">CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2'</div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0);" class="">* Mitigated according to the /sys interface: <span style="color: #2c2c2c; background-color: #c62828" class=""> NO </span> (kernel confirms your system is vulnerable)</div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0);" class="">* Mitigation 1</div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0);" class=""> * Kernel is compiled with IBRS/IBPB support: <span style="color: #2c2c2c; background-color: #c62828" class=""> NO</span></div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0);" class=""> * Currently enabled features</div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0);" class=""> * IBRS enabled for Kernel space: <span style="color: #2c2c2c; background-color: #c62828" class=""> NO</span></div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0);" class=""> * IBRS enabled for User space: <span style="color: #2c2c2c; background-color: #c62828" class=""> NO</span></div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0);" class=""> * IBPB enabled: <span style="color: #2c2c2c; background-color: #c62828" class=""> NO</span></div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0);" class="">* Mitigation 2</div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0);" class=""> * Kernel compiled with retpoline option: <span style="color: #2c2c2c; background-color: #558b2f" class=""> YES</span></div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0);" class=""> * Kernel compiled with a retpoline-aware compiler: <span style="color: #2c2c2c; background-color: #c62828" class=""> NO </span> (kernel reports minimal retpoline compilation)</div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0);" class=""> * Retpoline enabled: <span style="color: #2c2c2c; background-color: #558b2f" class=""> YES</span></div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0);" class="">> <span style="color: #2c2c2c; background-color: #00838f" class="">STATUS:</span> <span style="color: #2c2c2c; background-color: #c62828" class=""> VULNERABLE </span> (Vulnerable: Minimal generic ASM retpoline)</div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0); min-height: 18px;" class=""><br class=""></div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(100, 181, 246); background-color: rgb(0, 0, 0);" class="">CVE-2017-5754 [rogue data cache load] aka 'Meltdown' aka 'Variant 3'</div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0);" class="">* Mitigated according to the /sys interface: <span style="color: #2c2c2c; background-color: #558b2f" class=""> YES </span> (kernel confirms that the mitigation is active)</div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0);" class="">* Kernel supports Page Table Isolation (PTI): <span style="color: #2c2c2c; background-color: #558b2f" class=""> YES</span></div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0);" class="">* PTI enabled and active: <span style="color: #2c2c2c; background-color: #558b2f" class=""> YES</span></div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0);" class="">* Running as a Xen PV DomU: <span style="color: #2c2c2c; background-color: #558b2f" class=""> NO</span></div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(44, 44, 44); background-color: rgb(0, 0, 0);" class=""><span style="color: #eaeaea" class="">> </span><span style="background-color: #00838f" class="">STATUS:</span><span style="color: #eaeaea" class=""> </span><span style="background-color: #558b2f" class=""> NOT VULNERABLE </span><span style="color: #eaeaea" class=""> (Mitigation: PTI)</span></div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0); min-height: 18px;" class=""><br class=""></div><div style="margin: 0px; font-stretch: normal; font-size: 14px; line-height: normal; font-family: "IBM Plex Mono"; color: rgb(234, 234, 234); background-color: rgb(0, 0, 0);" class="">A false sense of security is worse than no security at all, see --disclaimer</div><div class="">
<div dir="auto" style="color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><br class="">--<br class="">Sam McLeod<br class=""><a href="https://smcleod.net" class="">https://smcleod.net</a><br class=""><a href="https://twitter.com/s_mcleod">https://twitter.com/s_mcleod</a></div></div></div></div>
</div>
<div><br class=""><blockquote type="cite" class=""><div class="">On 30 Jan 2018, at 5:20 am, Alan Bartlett <<a href="mailto:ajb@elrepo.org" class="">ajb@elrepo.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">Announcing the release of the kernel-ml-4.15.0-1.el7.elrepo package<br class="">set into the EL7 elrepo-kernel repository:<br class=""><br class=""><a href="https://elrepo.org/tiki/kernel-ml" class="">https://elrepo.org/tiki/kernel-ml</a><br class=""><br class="">The following files are currently synchronising to our mirror sites:<br class=""><br class="">x86_64<br class="">kernel-ml-4.15.0-1.el7.elrepo.x86_64.rpm<br class="">kernel-ml-devel-4.15.0-1.el7.elrepo.x86_64.rpm<br class="">kernel-ml-doc-4.15.0-1.el7.elrepo.noarch.rpm<br class="">kernel-ml-headers-4.15.0-1.el7.elrepo.x86_64.rpm<br class="">kernel-ml-tools-4.15.0-1.el7.elrepo.x86_64.rpm<br class="">kernel-ml-tools-libs-4.15.0-1.el7.elrepo.x86_64.rpm<br class="">kernel-ml-tools-libs-devel-4.15.0-1.el7.elrepo.x86_64.rpm<br class="">perf-4.15.0-1.el7.elrepo.x86_64.rpm<br class="">python-perf-4.15.0-1.el7.elrepo.x86_64.rpm<br class=""><br class="">nosrc<br class="">kernel-ml-4.15.0-1.el7.elrepo.nosrc.rpm<br class=""><br class="">We provide these kernels for hardware testing in an effort to identify<br class="">new/updated drivers which can then be targeted for backporting as kmod<br class="">packages. Meanwhile, these kernels may provide interim relief to<br class="">people with non-functional hardware. We stress that we consider such<br class="">kernels as a last resort for those who are unable to get their<br class="">hardware working using the RHEL-7 kernel with supplementary kmod<br class="">packages.<br class=""><br class="">These packages are provided "As-Is" with no implied warranty or<br class="">support. Using the kernel-ml may expose your system to security,<br class="">performance and/or data corruption issues. Since timely updates may<br class="">not be available from the ELRepo Project, the end user has the<br class="">ultimate responsibility for deciding whether to continue using the<br class="">kernel-ml packages in regular service.<br class=""><br class="">The packages are intentionally named kernel-ml so as not to conflict<br class="">with the RHEL-7 kernels and, as such, they may be installed and<br class="">updated alongside the regular kernel. The kernel configuration is<br class="">based upon a default RHEL-7 configuration with added functionality<br class="">enabled as appropriate.<br class=""><br class="">If a bug is found when using these kernels, the end user is encouraged<br class="">to report it upstream to the Linux Kernel Bug Tracker [1] and, for our<br class="">reference, to the ELRepo bug tracker [2]. By taking such action, the<br class="">reporter will be assisting the kernel developers, Red Hat and the Open<br class="">Source Community as a whole.<br class=""><br class="">Thank you,<br class=""><br class="">The ELRepo Team.<br class=""><br class="">[1] <a href="https://bugzilla.kernel.org/">https://bugzilla.kernel.org/</a><br class="">[2] <a href="https://elrepo.org/bugs/">https://elrepo.org/bugs/</a><br class="">_______________________________________________<br class="">elrepo mailing list<br class=""><a href="mailto:elrepo@lists.elrepo.org">elrepo@lists.elrepo.org</a><br class=""><a href="http://lists.elrepo.org/mailman/listinfo/elrepo">http://lists.elrepo.org/mailman/listinfo/elrepo</a><br class=""></div></div></blockquote></div><br class=""></div></div></div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>elrepo mailing list</span><br><span><a href="mailto:elrepo@lists.elrepo.org">elrepo@lists.elrepo.org</a></span><br><span><a href="http://lists.elrepo.org/mailman/listinfo/elrepo">http://lists.elrepo.org/mailman/listinfo/elrepo</a></span><br></div></blockquote></div></body></html>