Home
Help
Search
Login
Register
OPNsense Forum
»
Archive
»
18.1 Legacy Series
»
[CALL FOR TESTING] Speculative Execution Kernel Patch for amd64
« previous
next »
Print
Pages: [
1
]
2
Author
Topic: [CALL FOR TESTING] Speculative Execution Kernel Patch for amd64 (Read 10123 times)
franco
Administrator
Hero Member
Posts: 17485
Karma: 1589
[CALL FOR TESTING] Speculative Execution Kernel Patch for amd64
«
on:
March 14, 2018, 08:28:28 pm »
Good news everyone,
FreeBSD officially released its speculative execution patch[1] consisting of PTI (Meltdown) and IBRS (Spectre V2) mitigation for version 11.1. It is worth mentioning that it is only available for the amd64 architecture.
Before we start releasing it as well we would like to invite as many of you to try the patch and report back your results to ensure a smooth and timely integration. At the moment this integration is planned for 18.1.5 some time next week.
Testing and discussion went on internally the last couple of days. We did not encounter problems and were surprised by the lack of noticeable slowdown that was feared initially. Following the HardenedBSD perspective we are going to adopt an opt-out approach for all mitigation. That means in contrast to FreeBSD both PTI and IBRS are enabled by default and can be persistently modified by users if required. In the case of Meltdown this means AMD CPUs are mitigated as well for increased security in case of yet unknown exploits.
There is one more quirk that is worth mentioning: IBRS requires microcode updates to the hardware in order to be effective at all.
If the patch gives you boot trouble you can use option "5" from the boot menu to switch to "kernel.old". Make sure you are on version 18.1.4 before continuing.
The kernel is installed and rebooted as follows:
# opnsense-update -kr 18.1-cft
# /usr/local/etc/rc.reboot
To get back to the release kernel simply rerun as follows:
# opnsense-update -k
# /usr/local/etc/rc.reboot
(Additional info from the FreeBSD SA for the opt-out process)
The status of PTI can be checked via the vm.pmap.pti sysctl:
# sysctl vm.pmap.pti
vm.pmap.pti: 1
The default setting can be overridden by setting the loader tunable vm.pmap.pti to 1 or 0 in /boot/loader.conf. This setting takes effect only at boot.
IBRS can be disabled via the hw.ibrs_disable sysctl (and tunable), and the status can be checked via the hw.ibrs_active sysctl. IBRS may be enabled or disabled at runtime.
Very special thanks to Shawn Webb for his dedication on both HardenedBSD and OPNsense. We are lucky to have him available as a core developer.
Thanks in advance,
Franco on behalf of the OPNsense team
--
[1]
https://www.freebsd.org/security/advisories/FreeBSD-SA-18:03.speculative_execution.asc
Logged
marjohn56
Hero Member
Posts: 1699
Karma: 179
Re: [CALL FOR TESTING] Speculative Execution Kernel Patch for amd64
«
Reply #1 on:
March 14, 2018, 11:39:49 pm »
Installed and running here...
Logged
OPNsense 24.7
-
Qotom Q355G4
- ISP -
Squirrel 1Gbps
.
Team Rebellion Member
- If we've helped you remember to applaud
elektroinside
Hero Member
Posts: 574
Karma: 51
Re: [CALL FOR TESTING] Speculative Execution Kernel Patch for amd64
«
Reply #2 on:
March 14, 2018, 11:42:51 pm »
I will try this as well in the upcoming days. Thank you for all your hard work!
Logged
OPNsense v18
| HW: Gigabyte Z370N-WIFI, i3-8100, 8GB RAM, 60GB SSD, | Controllers: 82575GB-quad, 82574, I221, I219-V | PPPoE: RDS Romania | Down: 980Mbit/s | Up: 500Mbit/s
Team Rebellion Member
Julien
Hero Member
Posts: 666
Karma: 33
Re: [CALL FOR TESTING] Speculative Execution Kernel Patch for amd64
«
Reply #3 on:
March 15, 2018, 01:13:12 am »
installed here on a real hardware on a production.
will report back in case of any bug
Logged
OPNsense 23.1.7_3-amd64
FreeBSD 13.1-RELEASE-p7
OpenSSL 1.1.1t 7 Feb 2023
franco
Administrator
Hero Member
Posts: 17485
Karma: 1589
Re: [CALL FOR TESTING] Speculative Execution Kernel Patch for amd64
«
Reply #4 on:
March 15, 2018, 02:29:16 pm »
Thank you all. No red flags so far. Looking good.
Logged
elektroinside
Hero Member
Posts: 574
Karma: 51
Re: [CALL FOR TESTING] Speculative Execution Kernel Patch for amd64
«
Reply #5 on:
March 15, 2018, 04:18:12 pm »
Looking good here as well, so far no issues.
Logged
OPNsense v18
| HW: Gigabyte Z370N-WIFI, i3-8100, 8GB RAM, 60GB SSD, | Controllers: 82575GB-quad, 82574, I221, I219-V | PPPoE: RDS Romania | Down: 980Mbit/s | Up: 500Mbit/s
Team Rebellion Member
dcol
Hero Member
Posts: 635
Karma: 51
Re: [CALL FOR TESTING] Speculative Execution Kernel Patch for amd64
«
Reply #6 on:
March 15, 2018, 05:07:20 pm »
Installed here as well. No issues. Will put it though a workout.
Logged
elektroinside
Hero Member
Posts: 574
Karma: 51
Re: [CALL FOR TESTING] Speculative Execution Kernel Patch for amd64
«
Reply #7 on:
March 16, 2018, 09:26:15 am »
Keeps working well for me, awesome work guys! Well done!
Logged
OPNsense v18
| HW: Gigabyte Z370N-WIFI, i3-8100, 8GB RAM, 60GB SSD, | Controllers: 82575GB-quad, 82574, I221, I219-V | PPPoE: RDS Romania | Down: 980Mbit/s | Up: 500Mbit/s
Team Rebellion Member
marjohn56
Hero Member
Posts: 1699
Karma: 179
Re: [CALL FOR TESTING] Speculative Execution Kernel Patch for amd64
«
Reply #8 on:
March 16, 2018, 09:30:07 am »
Same here.. No issues to report, all good. There's a slight increase in CPU usage, but nothing worth worrying about. Used the VPN yesterday and no issues to report there either.
Logged
OPNsense 24.7
-
Qotom Q355G4
- ISP -
Squirrel 1Gbps
.
Team Rebellion Member
- If we've helped you remember to applaud
weust
Hero Member
Posts: 650
Karma: 57
Re: [CALL FOR TESTING] Speculative Execution Kernel Patch for amd64
«
Reply #9 on:
March 16, 2018, 09:35:20 am »
If I don't forget, again, I will test it tonight in my Gen 2 Hyper-V VM.
Logged
Hobbyist at home, sysadmin at work. Sometimes the first is mixed with the second.
phoenix
Hero Member
Posts: 545
Karma: 58
Re: [CALL FOR TESTING] Speculative Execution Kernel Patch for amd64
«
Reply #10 on:
March 16, 2018, 10:27:22 am »
Another "me too", no problems since I installed it yesterday.
Logged
Regards
Bill
odites999
Newbie
Posts: 35
Karma: 4
Re: [CALL FOR TESTING] Speculative Execution Kernel Patch for amd64
«
Reply #11 on:
March 16, 2018, 11:04:36 am »
Everything is working OK. No problems so far.
Cheers!
Logged
dcol
Hero Member
Posts: 635
Karma: 51
Re: [CALL FOR TESTING] Speculative Execution Kernel Patch for amd64
«
Reply #12 on:
March 16, 2018, 06:00:53 pm »
Is there a way to incorporate the Meltdown tools in OPNsense?
https://github.com/dag-erling/meltdown
Logged
weust
Hero Member
Posts: 650
Karma: 57
Re: [CALL FOR TESTING] Speculative Execution Kernel Patch for amd64
«
Reply #13 on:
March 16, 2018, 11:20:16 pm »
Installed, and running fine so far. Just a few hours.
Twitch is fine, webbrowsing and downloading some files all fine so far.
Logged
Hobbyist at home, sysadmin at work. Sometimes the first is mixed with the second.
lattera
Full Member
Posts: 207
Karma: 82
Re: [CALL FOR TESTING] Speculative Execution Kernel Patch for amd64
«
Reply #14 on:
March 19, 2018, 02:54:50 pm »
Quote from: dcol on March 16, 2018, 06:00:53 pm
Is there a way to incorporate the Meltdown tools in OPNsense?
https://github.com/dag-erling/meltdown
I'll try my luck at creating a port for that in HardenedBSD's ports tree, which OPNsense uses. Good idea!
Logged
Print
Pages: [
1
]
2
« previous
next »
OPNsense Forum
»
Archive
»
18.1 Legacy Series
»
[CALL FOR TESTING] Speculative Execution Kernel Patch for amd64