Re: [gentoo-user] Re: Kernel 4.9.95

[Klaus Ethgen <Klaus+gentoo@Ethgen.de>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Hi,

Am Fr den 27. Apr 2018 um  6:42 schrieb Nikos Chantziaras:
> On 26/04/18 14:42, Mick wrote:
> > Hmm ... why is my Intel system missing 'IBPB' & 'IBRS_FW' ?
> > 
> > $ grep . /sys/devices/system/cpu/vulnerabilities/*
> > /sys/devices/system/cpu/vulnerabilities/meltdown:Mitigation: PTI
> > /sys/devices/system/cpu/vulnerabilities/spectre_v1:Mitigation: __user pointer
> > sanitization
> > /sys/devices/system/cpu/vulnerabilities/spectre_v2:Mitigation: Full generic
> > retpoline

I did install and compile 4.15.18,  the last version from branch 4.15.
Unfortunatelly I just get the following:
   ~> uname -a
   Linux tha 4.15.18-gentoo #2 Fri Apr 27 13:33:03 CET 2018 i686 Intel(R) Pentium(R) M processor 1.86GHz GenuineIntel GNU/Linux
   ~> grep . /sys/devices/system/cpu/vulnerabilities/*
   /sys/devices/system/cpu/vulnerabilities/meltdown:Vulnerable
   /sys/devices/system/cpu/vulnerabilities/spectre_v1:Mitigation: __user pointer sanitization
   /sys/devices/system/cpu/vulnerabilities/spectre_v2:Vulnerable: Minimal generic ASM retpoline

The problem here is, that this is a 32bit system and the CPU is not able
to run 64bit.

So there are some points I want to point to:
- - Meltdown is fully vulnerable. While there is a fix for 64bit kernel, I
  would like to know when or if gentoo will port the mitigation for
  32bit systems.
- - For Spectre 2, there is some mitigation in kernel but the compiler is
  to old to support retpoline.
  When I look to gcc meta data, I see a couples of versions:
      ~> equery m gcc
       * sys-devel/gcc [gentoo]
      Maintainer:  toolchain@gentoo.org (Gentoo Toolchain Project)
      Upstream:    Remote-ID:   cpe:/a:gnu:gcc ID: cpe
		   Remote-ID:   dgcc ID: sourceforge
      Homepage:    https://gcc.gnu.org/
      Location:    /usr/portage/sys-devel/gcc
      Keywords:    2.95.3-r10:2.95.3: ~alpha ~ppc ~sparc ~x86
      Keywords:    3.3.6-r1:3.3.6: ~amd64 ~x86
      Keywords:    3.4.6-r2:3.4.6: alpha amd64 arm ppc ppc64 sparc x86 ~ia64 ~mips ~s390 ~sh -* ~x86-fbsd
      Keywords:    4.0.4:4.0.4: 
      Keywords:    4.1.2:4.1.2: alpha amd64 arm hppa ia64 ppc ppc64 sparc x86 ~m68k ~mips ~s390 ~sh -* ~x86-fbsd
      Keywords:    4.2.4-r1:4.2.4: hppa ~alpha ~amd64 ~arm ~ia64 ~m68k ~ppc ~ppc64 ~sparc ~x86 ~x86-fbsd
      Keywords:    4.3.6-r1:4.3.6: -hppa alpha amd64 arm ia64 ppc ppc64 sparc x86 ~m68k ~mips ~s390 ~sh ~x86-fbsd
      Keywords:    4.4.7:4.4.7: alpha amd64 arm hppa ia64 ppc ppc64 sparc x86 ~m68k ~mips ~s390 ~sh ~x86-fbsd
      Keywords:    4.5.4:4.5.4: alpha amd64 arm hppa ia64 ppc ppc64 sparc x86 ~amd64-fbsd ~m68k ~mips ~s390 ~sh ~x86-fbsd
      Keywords:    4.6.4:4.6.4: alpha amd64 arm hppa ia64 ppc ppc64 sparc x86 ~amd64-fbsd ~m68k ~mips ~s390 ~sh ~x86-fbsd
      Keywords:    4.7.4-r1:4.7.4: -amd64-fbsd -x86-fbsd alpha amd64 arm hppa ia64 m68k ppc ppc64 s390 sh sparc x86 ~mips
      Keywords:    4.8.5-r1:4.8.5: alpha amd64 arm arm64 hppa ia64 m68k ppc ppc64 s390 sh sparc x86 ~amd64-fbsd ~mips ~x86-fbsd
      Keywords:    4.9.4:4.9.4: alpha amd64 arm arm64 hppa ia64 m68k ppc ppc64 s390 sh sparc x86 ~amd64-fbsd ~mips ~x86-fbsd
      Keywords:    5.4.0-r4:5.4.0: alpha amd64 arm arm64 hppa ia64 m68k ppc ppc64 s390 sh sparc x86 ~amd64-fbsd ~mips ~x86-fbsd
      Keywords:    6.4.0:6.4.0: 
      Keywords:    6.4.0-r1:6.4.0: alpha amd64 arm arm64 hppa ia64 ppc ppc64 sparc x86 ~amd64-fbsd ~m68k ~mips ~s390 ~sh ~x86-fbsd
      Keywords:    7.2.0:7.2.0: 
      Keywords:    7.2.0-r1:7.2.0: ~alpha ~amd64 ~amd64-fbsd ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~x86-fbsd
      Keywords:    7.3.0:7.3.0: 
      Keywords:    7.3.0-r1:7.3.0: ~alpha ~amd64 ~amd64-fbsd ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~x86-fbsd
      Keywords:    7.3.0-r2:7.3.0: 
      License:     GPL-3+ LGPL-3+ || ( GPL-3+ libgcc libstdc++ gcc-runtime-library-exception-3.1 ) FDL-1.3+

  So which version is stable enough to use? 7.3.0, I use on a different
  (non-Gentoo) system. But why -r1 and -r2?

> Do you have the latest sys-firmware/intel-microcode installed and configured
> correctly? You need to enable the "early microcode" kernel option, and you
> also need to add /boot/intel-uc.img to your list of initrds to load in
> grub2. Alternatively, a BIOS update for your mainboard (if one exists; most
> older mainboards won't get updates from the likes of Asus, MSI, Gigabyte,
> etc, etc, etc, so for older boards, you need the microcode package.)

So, coming to firmware. I do not think that intel is releasing firmware
update for that CPU. So I fully rely on kernel (and compiler).

Nevertheless, I need to know for other system what exactly is the way to
use firmware on gentoo. There is no /boot/intel-uc.img on my system and
genkernel complain about firmware compiling (what seems to prove that
there is none for my CPU).

However, if I read correct, genkernel should automatically include
firmware and firmware loading into the generated ramdisk. Right?

Regards
   Klaus
- -- 
Klaus Ethgen                                       http://www.ethgen.ch/
pub  4096R/4E20AF1C 2011-05-16            Klaus Ethgen <Klaus@Ethgen.ch>
Fingerprint: 85D4 CA42 952C 949B 1753  62B3 79D0 B06F 4E20 AF1C
-----BEGIN PGP SIGNATURE-----
Comment: Charset: ISO-8859-1

iQGzBAEBCgAdFiEEMWF28vh4/UMJJLQEpnwKsYAZ9qwFAlrjW74ACgkQpnwKsYAZ
9qyM5QwAsj0M5TT3O+RYPXana71nzgWjd72m0DuCDO/Yfw+79G0NuWrMFwyU/WkZ
OPlspMBRvOxo1UTuOMuUZ7wVqcQNen9m/3XZOQdmhO7NpqdfI5IozZH5dm0tdUcH
qOEcxkQQPj5h9fLqyfiOjKhOFKEtHIF4FuApaJuR2xGhTd4rV5Blm1zLBBZ1uSU6
ImpizYQ4kvCMj/n9L+1S6dd+iqlF0jQBDYw98mcYp3UU8iziA75Kq2a87ZFtjo0y
mENiyu8A4RS+WBItT5jVYDymozs3zeWsbgmNH8k1O4CTy30OqeLiZQdfGow2MC+x
4D0rLmN7Ky+ZDMZARtUPhvbkdC+nUMkfveOOKZbpe3qaAa+8QwVZVV8rC2I7fK8T
kex6adlaN1e8GU9UyeR7mKc5cjESRudM6wcZSJ1ZEx3uLq03IIcdJAoyyBHQz1OC
oQil2Vf4SP0QMhAEp/D4XziEzbkZxNErXwGJfVDHSPlB9wtRs4Mf3F2PGOI20h6S
71mhfjLK
=BqH+
-----END PGP SIGNATURE-----