Gracias Gracias:  0
Me Gusta Me Gusta:  0
No me Gusta No me Gusta:  0
Mostrando resultados del 1 al 4 de 4

Tema: ¿IBRS o Reptoline?

  1. #1
    Fecha de Ingreso
    16-noviembre-2010
    Ubicación
    Delante del ordenador
    Mensajes
    917
    Post Thanks / Like
    Poder de Credibilidad
    10

    ¿IBRS o Reptoline?

    Hola:


    En Phoronix (aquí) hablan de cómo openSUSE utiliza IBRS para mitigar Spectre v2 lo que hace bajar el rendimiento del Sistema un 23%.

    Si en lugar de IBRS se usará Reptoline (como todas, o casi, las distribuciones) no se perdería ese 23% de rendimiento. Si no entendí mal, para usar Reptoline es añadir a la línea de parámetros del kernel (que imagino es la que pone splash, vga, etc etc) el parámetro:

    Código:
    spectre_v2=retpoline,generic


    En esta lista de correo de openSUSE:

    https://lists.opensuse.org/opensuse-.../msg00140.html

    se habla del tema y hay un enlace que lleva a una comparativa entre un sistema mitigado con IBRS (1ª columna) y el mismo sistema pero mitigado con Reptoline (2ª columna). El aumento de rendimiento es considerable.


    No entiendo en qué consiste uno y otro. Tampoco me queda claro (como dicen en la lista de openSUSE) si tengo la opción o no de elegir entre ambos modos (y sus ventajas e inconvenientes aparte del 23% de rendimiento).

    Mi búsqueda en Internet no me aclara nada (demasiado técnico para mi) de qué es una cosa y qué es otra. Mi CPU es Skylake (i5 6600K).


    Saludos

  2. #2
    Fecha de Ingreso
    19-marzo-2005
    Ubicación
    En un lugar del planeta Tierra
    Mensajes
    17.465
    Post Thanks / Like
    Poder de Credibilidad
    10
    No conocía esa opción, pero si lo quieres tenerlo tendrás que compilar tu mismo el kernel.
    Lo que no entiendo es porque usa IBRS en TW.
    NORMAS A CUMPLIR EN LOS FOROS (Lectura obligatoria) Lo siento, no contesto privados sobre problemas con GNU/Linux.
    Síguenos en TWITTER y en FACEBOOK
    Código:
    Buscador de   Alojamiento      Alojamiento     Otros
     paquetes:    de imágenes:     de ficheros:    buscadores:
    Search        TinyPic          Ifile Wuala     Simple y Facil
    Webpinstant   Paste Suse       SendSpace       TextSnip  Cl1p

  3. #3
    Fecha de Ingreso
    16-noviembre-2010
    Ubicación
    Delante del ordenador
    Mensajes
    917
    Post Thanks / Like
    Poder de Credibilidad
    10
    Leap también usa IBRS.

    Código:
    krovikan@linux:~/Descargas> sudo sh spectre-meltdown-checker.sh 
    [sudo] password for root: 
    Spectre and Meltdown mitigation detection tool v0.40
    
    Checking for vulnerabilities on current system
    Kernel is Linux 5.0.6-1.gdff56e4-default #1 SMP Thu Apr 4 04:40:16 UTC 2019 (dff56e4) x86_64
    CPU is Intel(R) Core(TM) i5-6600K CPU @ 3.50GHz
    
    Hardware check
    * Hardware support (CPU microcode) for mitigation techniques
      * Indirect Branch Restricted Speculation (IBRS)
        * SPEC_CTRL MSR is available:  YES 
        * CPU indicates IBRS capability:  YES  (SPEC_CTRL feature bit)
      * Indirect Branch Prediction Barrier (IBPB)
        * PRED_CMD MSR is available:  YES 
        * CPU indicates IBPB capability:  YES  (SPEC_CTRL feature bit)
      * Single Thread Indirect Branch Predictors (STIBP)
        * SPEC_CTRL MSR is available:  YES 
        * CPU indicates STIBP capability:  YES  (Intel STIBP feature bit)
      * Speculative Store Bypass Disable (SSBD)
        * CPU indicates SSBD capability:  YES  (Intel SSBD)
      * L1 data cache invalidation
        * FLUSH_CMD MSR is available:  YES 
        * CPU indicates L1D flush capability:  YES  (L1D flush feature bit)
      * Enhanced IBRS (IBRS_ALL)
        * CPU indicates ARCH_CAPABILITIES MSR availability:  NO 
        * ARCH_CAPABILITIES MSR advertises IBRS_ALL capability:  NO 
      * CPU explicitly indicates not being vulnerable to Meltdown (RDCL_NO):  NO 
      * CPU explicitly indicates not being vulnerable to Variant 4 (SSB_NO):  NO 
      * CPU/Hypervisor indicates L1D flushing is not necessary on this system:  NO 
      * Hypervisor indicates host CPU might be vulnerable to RSB underflow (RSBA):  NO 
      * CPU supports Software Guard Extensions (SGX):  YES 
      * CPU microcode is known to cause stability problems:  NO  (model 0x5e family 0x6 stepping 0x3 ucode 0xc6 cpuid 0x506e3)
      * CPU microcode is the latest known available version:  YES  (latest version is 0xc6 dated 2018/04/17 according to builtin MCExtractor DB v96 - 2019/01/15)
    * CPU vulnerability to the speculative execution attack variants
      * Vulnerable to CVE-2017-5753 (Spectre Variant 1, bounds check bypass):  YES 
      * Vulnerable to CVE-2017-5715 (Spectre Variant 2, branch target injection):  YES 
      * Vulnerable to CVE-2017-5754 (Variant 3, Meltdown, rogue data cache load):  YES 
      * Vulnerable to CVE-2018-3640 (Variant 3a, rogue system register read):  YES 
      * Vulnerable to CVE-2018-3639 (Variant 4, speculative store bypass):  YES 
      * Vulnerable to CVE-2018-3615 (Foreshadow (SGX), L1 terminal fault):  YES 
      * Vulnerable to CVE-2018-3620 (Foreshadow-NG (OS), L1 terminal fault):  YES 
      * Vulnerable to CVE-2018-3646 (Foreshadow-NG (VMM), L1 terminal fault):  YES 
    
    CVE-2017-5753 aka 'Spectre Variant 1, bounds check bypass'
    * Mitigated according to the /sys interface:  YES  (Mitigation: __user pointer sanitization)
    * Kernel has array_index_mask_nospec:  YES  (1 occurrence(s) found of x86 64 bits array_index_mask_nospec())
    * Kernel has the Red Hat/Ubuntu patch:  NO 
    * Kernel has mask_nospec64 (arm64):  NO 
    > STATUS:  NOT VULNERABLE  (Mitigation: __user pointer sanitization)
    
    CVE-2017-5715 aka 'Spectre Variant 2, branch target injection'
    * Mitigated according to the /sys interface:  YES  (Mitigation: Indirect Branch Restricted Speculation, IBPB: conditional, IBRS_FW, STIBP: disabled, RSB filling)
    * Mitigation 1
      * Kernel is compiled with IBRS support:  YES 
        * IBRS enabled and active:  YES  (for kernel and firmware code)
      * Kernel is compiled with IBPB support:  YES 
        * IBPB enabled and active:  YES 
    * Mitigation 2
      * Kernel has branch predictor hardening (arm):  NO 
      * Kernel compiled with retpoline option:  YES 
      * Kernel supports RSB filling:  YES 
    > STATUS:  NOT VULNERABLE  (IBRS + IBPB are mitigating the vulnerability)
    
    CVE-2017-5754 aka 'Variant 3, Meltdown, rogue data cache load'
    * Mitigated according to the /sys interface:  YES  (Mitigation: PTI)
    * Kernel supports Page Table Isolation (PTI):  YES 
      * PTI enabled and active:  YES 
      * Reduced performance impact of PTI:  YES  (CPU supports INVPCID, performance impact of PTI will be greatly reduced)
    * Running as a Xen PV DomU:  NO 
    > STATUS:  NOT VULNERABLE  (Mitigation: PTI)
    
    CVE-2018-3640 aka 'Variant 3a, rogue system register read'
    * CPU microcode mitigates the vulnerability:  YES 
    > STATUS:  NOT VULNERABLE  (your CPU microcode mitigates the vulnerability)
    
    CVE-2018-3639 aka 'Variant 4, speculative store bypass'
    * Mitigated according to the /sys interface:  YES  (Mitigation: Speculative Store Bypass disabled via prctl and seccomp)
    * Kernel supports speculation store bypass:  YES  (found in /proc/self/status)
    > STATUS:  NOT VULNERABLE  (Mitigation: Speculative Store Bypass disabled via prctl and seccomp)
    
    CVE-2018-3615 aka 'Foreshadow (SGX), L1 terminal fault'
    * CPU microcode mitigates the vulnerability:  YES 
    > STATUS:  NOT VULNERABLE  (your CPU microcode mitigates the vulnerability)
    
    CVE-2018-3620 aka 'Foreshadow-NG (OS), L1 terminal fault'
    * Mitigated according to the /sys interface:  YES  (Mitigation: PTE Inversion)
    * Kernel supports PTE inversion:  YES  (found in kernel image)
    * PTE inversion enabled and active:  YES 
    > STATUS:  NOT VULNERABLE  (Mitigation: PTE Inversion)
    
    CVE-2018-3646 aka 'Foreshadow-NG (VMM), L1 terminal fault'
    * Information from the /sys interface: VMX: conditional cache flushes, SMT disabled
    * This system is a host running a hypervisor:  NO 
    * Mitigation 1 (KVM)
      * EPT is disabled:  NO 
    * Mitigation 2
      * L1D flush is supported by kernel:  YES  (found flush_l1d in /proc/cpuinfo)
      * L1D flush enabled:  YES  (conditional flushes)
      * Hardware-backed L1D flush supported:  YES  (performance impact of the mitigation will be greatly reduced)
      * Hyper-Threading (SMT) is enabled:  NO 
    > STATUS:  NOT VULNERABLE  (this system is not running a hypervisor)
    
    > SUMMARY: CVE-2017-5753:OK CVE-2017-5715:OK CVE-2017-5754:OK CVE-2018-3640:OK CVE-2018-3639:OK CVE-2018-3615:OK CVE-2018-3620:OK CVE-2018-3646:OK

    Saludos

  4. #4
    Fecha de Ingreso
    19-marzo-2005
    Ubicación
    En un lugar del planeta Tierra
    Mensajes
    17.465
    Post Thanks / Like
    Poder de Credibilidad
    10
    Pues debe ser que viene de la casa matriz, supongo.
    NORMAS A CUMPLIR EN LOS FOROS (Lectura obligatoria) Lo siento, no contesto privados sobre problemas con GNU/Linux.
    Síguenos en TWITTER y en FACEBOOK
    Código:
    Buscador de   Alojamiento      Alojamiento     Otros
     paquetes:    de imágenes:     de ficheros:    buscadores:
    Search        TinyPic          Ifile Wuala     Simple y Facil
    Webpinstant   Paste Suse       SendSpace       TextSnip  Cl1p

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Marcadores

Normas de Publicación

  • No puedes crear nuevos temas
  • No puedes responder mensajes
  • No puedes subir archivos adjuntos
  • No puedes editar tus mensajes
  •