From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id BEAB41382C5 for ; Fri, 5 Jan 2018 00:51:45 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 57EE8E0AE5; Fri, 5 Jan 2018 00:51:40 +0000 (UTC) Received: from mail-ot0-x242.google.com (mail-ot0-x242.google.com [IPv6:2607:f8b0:4003:c0f::242]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id EC58AE0ACA for ; Fri, 5 Jan 2018 00:51:39 +0000 (UTC) Received: by mail-ot0-x242.google.com with SMTP id d2so2729886oth.9 for ; Thu, 04 Jan 2018 16:51:39 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to; bh=+Of23N6zpg3ie1Y8F1R4s8hbpk+CY4as6g7ua/cB47U=; b=WK9VHrn3FpDY6rPD6Acz5/KGIQIWb7spuUWz2PsMQ5I9DeDpj182U58L1uWwAkhgVh 3JMHxjf1RHjTNV4CYFoueICMKGJhFPfxH3wuNG4GkcxC/9tRPblfx1YSl95sFzcYhgHn UUstM5w2ytT2fX3Xp6kYmBxaUAoV3PKd7Pb+LVK9dxuETohWybs6xQ1YQDzh9kGj2aaZ nJj2hmjPi4spk8Y9DX2MIljPVcDtpfJaNi4K7kYm2ze78MaCgsjJmeqIe3bOnqNhWJoZ JCZtAfCowj5YExTNEpJPxpdXuuT/TZYIMXNnmnaWQrr43Dlp/O/p+lMUiHKtY3+0VQ4Z jPSw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to; bh=+Of23N6zpg3ie1Y8F1R4s8hbpk+CY4as6g7ua/cB47U=; b=TWfH95cpk8QE/QkSxMmtBRppRlsC8iJYfCFOnBOBmDSYgrYgSSmGCiXbUiMjq+Lbrz mMQkcPvioh4OKVDRuY/0yxNms4UNf68+AfO9BruTAQ3TmjTHxn2Q6iizspPTh+ihy4Mh NTXfhrSB0amo9WXKAtQssMCOQAdT9CNDL6lD1Ptm7qhYfdh82dzhkEnIxOmHjVXEFvuH PNfItqlJ6fIKc7E/L0o8AkUAAdhqnbFr19mp6dMfSBGPGpqg+9daWI4zOpu4Mo/Louxp 9Luu+c4HnP3bnxXhNsK3mnphznpjCbq83YYFPH/qZ25WsqTT1+lDgHSHSif/H8rODeT0 miaA== X-Gm-Message-State: AKwxytdzWgbgITkq/ibvyoWfNt0LxhX4+0QzacX7Wb9uJBlHTjZmbMWc TNwjKIVsqtq11na605KuIYopqN+VjXrZK+qWAZKDe4GB X-Google-Smtp-Source: ACJfBosVGgwhGwlcbMGe9EkGPlDUwMOUg29g0pwPLgjGCMWXj2q7Dh77dAcWdsJTyBxWNK+qmUoRHxnU9cJpUGQHK/k= X-Received: by 10.157.12.221 with SMTP id o29mr904579otd.191.1515113498924; Thu, 04 Jan 2018 16:51:38 -0800 (PST) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-user@lists.gentoo.org Reply-to: gentoo-user@lists.gentoo.org MIME-Version: 1.0 Received: by 10.157.19.65 with HTTP; Thu, 4 Jan 2018 16:51:38 -0800 (PST) In-Reply-To: References: <92ab5d0f-6111-cdec-5443-4f0cb0712eaf@charter.net> From: Adam Carter Date: Fri, 5 Jan 2018 11:51:38 +1100 Message-ID: Subject: Re: [gentoo-user] Re: Expect a ~15% average slowdown if you use an Intel processor To: gentoo-user@lists.gentoo.org Content-Type: multipart/alternative; boundary="001a1139072ce5dc6b0561fcd9f0" X-Archives-Salt: e6eca7c2-1a54-4399-ad78-55a4dae6e1e5 X-Archives-Hash: 8f8453cd2d9780658dfe6f35ce96409c --001a1139072ce5dc6b0561fcd9f0 Content-Type: text/plain; charset="UTF-8" On Fri, Jan 5, 2018 at 8:39 AM, Nikos Chantziaras wrote: > On 04/01/18 18:18, Rich Freeman wrote: > >> For variant 1 the only known vulnerability is BPF which probably >> next to nobody uses >> > > I had to enable various BPF settings in the kernel because systemd > wouldn't shut up about it. It prints warning messages during boot that the > system doesn't support BPF. After enabling it, systemd was happy and > stopped barking at me. > > The vulnerability specifically mentions EBPF and JIT so I'd say its CONFIG_HAVE_EBPF_JIT, but there's also CONFIG_BPF_JIT. I notice EBPF_JIT is =y in my .config, grepping the sysctl -a output for bpf only returns; kernel.unprivileged_bpf_disabled = 0 And https://github.com/linuxkit/linuxkit/commit/720fb219cea1fea99c2bba1d01f771eb43b2000b "On 4.9.x and 4.14.x kernels ebpf verifier bugs allow ebpf programs to access (read/write) random memory. Setting kernel.unprivileged_bpf_disabled=1 mitigates this somewhat until it is fixed upstream." --001a1139072ce5dc6b0561fcd9f0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On F= ri, Jan 5, 2018 at 8:39 AM, Nikos Chantziaras <realnc@gmail.com> wrote:
On 04/01/18 18:18, Rich Freeman wrote:
For variant 1 the only known vulnerability is BPF which probably
next to nobody uses

 I had to enable various BPF settings in the kernel because systemd wouldn&#= 39;t shut up about it. It prints warning messages during boot that the syst= em doesn't support BPF. After enabling it, systemd was happy and stoppe= d barking at me.


The vulnerability specifically mentions EBPF and JIT so I'= ;d say its CONFIG_HAVE_EBPF_JIT, but there's also CONFIG_BPF_JIT.

I = notice EBPF_JIT is =3Dy in my .config, grepping the sysctl -a output for bp= f only returns;
kernel.unprivileged_bpf_dis= abled =3D 0
And
https://github.com/linuxkit/linuxkit/commit/= 720fb219cea1fea99c2bba1d01f771eb43b2000b
&= quot;On 4.9.x and 4.14.x kernels ebpf verifier bugs allow ebpf p= rograms to access (read/write) random memory. Setting kernel.unp= rivileged_bpf_disabled=3D1 mitigates this somewhat until it is fixed upstre= am."



--001a1139072ce5dc6b0561fcd9f0--