July 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1227900] Speculative Store Bypass disabled via prctl
by bugzilla_noreply＠suse.com 16 Jul '24

16 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1227900 https://bugzilla.suse.com/show_bug.cgi?id=1227900#c4 --- Comment #4 from Nikolay Borisov <nik.borisov(a)suse.com> --- (In reply to Fabian Vogt from comment #3) > (In reply to Nikolay Borisov from comment #2) > > The timing of those printk's can't be trusted. The early microcode patcher > > is being run right after the kernel has been loaded from > > > > > x86_64_start_kernel -> load_ucode_bsp > > > > While the mitigation related code gets executed from : > > > > > arch_cpu_finalize_init -> cpu_select_mitigations -> ssb_select_mitigation > > > > And the default (if seccomp is not compiled) is to use the prctl bypass. So > > the only worrying thing here would be the ibpb-related warn about using > > microcode that fixes the rstack vulnerability. > > > > > > According to the AMD security bulletin > > https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7005.html > > > > > > the require microcode for AMD MILAN (which this Epyc seems to be is): > > > > Milan B0 – 0x0A001079 > > Milan B1 – 0x0A0011CF or 0x0A0011D1 > > Which is installed: > > CPU0: patch_level=0x0a0011d1 Indeed, I guess it's possible that the document is wrong, is there a newer firmware that could be installed? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1227900] Speculative Store Bypass disabled via prctl
by bugzilla_noreply＠suse.com 16 Jul '24

16 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1227900 https://bugzilla.suse.com/show_bug.cgi?id=1227900#c3 --- Comment #3 from Fabian Vogt <fvogt(a)suse.com> --- (In reply to Nikolay Borisov from comment #2) > The timing of those printk's can't be trusted. The early microcode patcher > is being run right after the kernel has been loaded from > > > x86_64_start_kernel -> load_ucode_bsp > > While the mitigation related code gets executed from : > > > arch_cpu_finalize_init -> cpu_select_mitigations -> ssb_select_mitigation > > And the default (if seccomp is not compiled) is to use the prctl bypass. So > the only worrying thing here would be the ibpb-related warn about using > microcode that fixes the rstack vulnerability. > > > According to the AMD security bulletin > https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7005.html > > > the require microcode for AMD MILAN (which this Epyc seems to be is): > > Milan B0 – 0x0A001079 > Milan B1 – 0x0A0011CF or 0x0A0011D1 Which is installed: > CPU0: patch_level=0x0a0011d1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1227887] Installer can't be restarted
by bugzilla_noreply＠suse.com 16 Jul '24

16 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1227887 https://bugzilla.suse.com/show_bug.cgi?id=1227887#c1 Stefan Hundhammer <shundhammer(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |WORKSFORME --- Comment #1 from Stefan Hundhammer <shundhammer(a)suse.com> --- When you hit the "Abort" button (no matter if ssh installation or otherwise), you will fall back to linuxrc, and your ssh session is over. But you can also simply use normal shell job control key combinations from the ssh session; then the ssh session remains active. Ctrl-C will normally not work, but Ctrl-Z does, and then kill %1 which will send a SIGTERM to the last suspended job, in this case yast.ssh. If you use the Qt UI, this may leave a disfunct window behind; just use the "WM_CLOSE" icon (the [x] at the top right corner) to close it. If you used the NCurses UI, and the terminal was left behind in an undefined weird state, use stty sane to restore reasonable defaults. Check with pstree if you still have any YaST processes running, like here: >> 1:install:~ # pstree >> >> init─┬─3*[bash] >> ├─dash───sleep >> ├─dbus-daemon >> ├─2*[gpg-agent] >> ├─haveged >> ├─init───inst_setup───sleep >> ├─klogd >> ├─nscd───8*[{nscd}] >> ├─rsyslogd───4*[{rsyslogd}] >> ├─sh >> ├─sshd─┬─sshd───sshd───bash───yast.ssh───YaST2.First-Sta───YaST2.call───Zypp-main───5*[{Zypp-main}] >> │ └─sshd───sshd───bash───pstree >> ├─udevd >> ├─wickedd >> ├─wickedd-auto4 >> ├─wickedd-dhcp4 >> ├─wickedd-dhcp6 >> ├─wickedd-nanny >> └─wpa_supplicant If everything is cleaned up correctly, it should look like this: >> 1:install:~ # pstree >> >> init─┬─3*[bash] >> ├─dbus-daemon >> ├─haveged >> ├─init───inst_setup───sleep >> ├─klogd >> ├─nscd───8*[{nscd}] >> ├─rsyslogd───4*[{rsyslogd}] >> ├─sh >> ├─sshd─┬─sshd───sshd───bash───pstree >> │ └─sshd───sshd───bash >> ├─udevd >> ├─wickedd >> ├─wickedd-auto4 >> ├─wickedd-dhcp4 >> ├─wickedd-dhcp6 >> ├─wickedd-nanny >> └─wpa_supplicant I.e. no "yast.ssh", no "Yast2.First-Stage", no "Zypp-Main". Be advised that in any case, this will leave quite some mess in the log directory, so remember to clean it up in case you need to collect y2logs for a bug report: rm -rf /var/log/YaST2/* Also remember that you can always start another ssh session from another terminal window (or tab). But make sure not to have multiple YaST installations running at the same time. HTH -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1227900] Speculative Store Bypass disabled via prctl
by bugzilla_noreply＠suse.com 16 Jul '24

16 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1227900 https://bugzilla.suse.com/show_bug.cgi?id=1227900#c2 --- Comment #2 from Nikolay Borisov <nik.borisov(a)suse.com> --- The timing of those printk's can't be trusted. The early microcode patcher is being run right after the kernel has been loaded from > x86_64_start_kernel -> load_ucode_bsp While the mitigation related code gets executed from : > arch_cpu_finalize_init -> cpu_select_mitigations -> ssb_select_mitigation And the default (if seccomp is not compiled) is to use the prctl bypass. So the only worrying thing here would be the ibpb-related warn about using microcode that fixes the rstack vulnerability. According to the AMD security bulletin https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7005.html the require microcode for AMD MILAN (which this Epyc seems to be is): Milan B0 – 0x0A001079 Milan B1 – 0x0A0011CF or 0x0A0011D1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1214353] New: mhi: Enabling broadband connecting not working
by bugzilla_noreply＠suse.com 16 Jul '24

16 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1214353 Bug ID: 1214353 Summary: mhi: Enabling broadband connecting not working Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: x86-64 OS: openSUSE Leap 15.5 Status: NEW Severity: Normal Priority: P5 - None Component: Network Assignee: screening-team-bugs(a)suse.de Reporter: holgi(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 868851 --> https://bugzilla.suse.com/attachment.cgi?id=868851&action=edit hwinfo.txt When trying to use broadband connecting with network manager, I can not get beyond entering SIM code - starting connection does not work System Slot: #36 Designation: "M.2 WWAN Connector (J3702)" Type: 0xa6 (Other) Bus Width: 0x08 (Other) Status: 0x03 (Available) Length: 0x04 (Long) Slot ID: 4 Characteristics: 0x0704 (3.3 V, PME#, Hot-Plug) -- You are receiving this mail because: You are on the CC list for the bug.

1 12

[Bug 1227912] agetty fails to open credentials directory
by bugzilla_noreply＠suse.com 16 Jul '24

16 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1227912 https://bugzilla.suse.com/show_bug.cgi?id=1227912#c1 Fabian Vogt <fvogt(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Component|Other |Basesystem Status|NEW |CONFIRMED Assignee|screening-team-bugs(a)suse.de |systemd-maintainers(a)suse.de CC| |fvogt(a)suse.com --- Comment #1 from Fabian Vogt <fvogt(a)suse.com> --- According to https://github.com/util-linux/util-linux/issues/2896 that's fixed by https://github.com/systemd/systemd/pull/31202 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1227900] Speculative Store Bypass disabled via prctl
by bugzilla_noreply＠suse.com 16 Jul '24

16 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1227900 Takashi Iwai <tiwai(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |nik.borisov(a)suse.com, | |tiwai(a)suse.com -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1227900] Speculative Store Bypass disabled via prctl
by bugzilla_noreply＠suse.com 16 Jul '24

16 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1227900 https://bugzilla.suse.com/show_bug.cgi?id=1227900#c1 Fabian Vogt <fvogt(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fvogt(a)suse.com --- Comment #1 from Fabian Vogt <fvogt(a)suse.com> --- The VM host shows similar messages: [ 0.147174] Speculative Store Bypass: Mitigation: Speculative Store Bypass disabled via prctl and seccomp [ 0.147174] Speculative Return Stack Overflow: IBPB-extending microcode not applied! [ 0.147175] Speculative Return Stack Overflow: WARNING: See https://kernel.org/doc/html/latest/admin-guide/hw-vuln/srso.html for mitigation options. [ 0.147176] Speculative Return Stack Overflow: Mitigation: Safe RET It appears to update the microcode after that (not so early after all...): [ 1.300212] microcode: microcode updated early to new patch_level=0x0a0011d1 [ 1.300232] microcode: CPU0: patch_level=0x0a0011d1 If the VM still reports it as not having the needed IBPB fixes applied, then it might not be fixed in ucode-amd-20230724-150500.3.9.1.noarch? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1227778] Raspberry Pi 5 cannot boot up to system
by bugzilla_noreply＠suse.com 16 Jul '24

16 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1227778 https://bugzilla.suse.com/show_bug.cgi?id=1227778#c2 Ivan Ivanov <ivan.ivanov(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |ivan.ivanov(a)suse.com --- Comment #2 from Ivan Ivanov <ivan.ivanov(a)suse.com> --- There is no upstream Linux support for this chipset. We and others are working on it. https://www.phoronix.com/news/SUSE-Upstream-Linux-RPi-5 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1227900] New: Speculative Store Bypass disabled via prctl
by bugzilla_noreply＠suse.com 16 Jul '24

16 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1227900 Bug ID: 1227900 Summary: Speculative Store Bypass disabled via prctl Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 URL: https://openqa.opensuse.org/tests/4344305/modules/jour nal_check/steps/9 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: mloviska(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: openQA Blocker: Yes Created attachment 876064 --> https://bugzilla.suse.com/attachment.cgi?id=876064&action=edit first boot log ## Observation During the firstboot of the image, journal log scan on Minimal-VM's cloud image[1] shows below errors/warnings that we have never noticed before on other images that the same test case is being executed. I cannot reproduce the issue on my local openQA running on an intel machine. This snippet comes from opensuse worker (openqaworker20) running AMD EPYC 7543 32-Core Processor. Jul 16 04:26:30.176898 localhost> kernel: Command line: BOOT_IMAGE=/boot/vmlinuz-6.9.9-1-default root=UUID=f6566395-dd79-43c7-9364-e040b2668a54 rw quiet systemd.show_status=1 console=ttyS0,115200 console=tty0 net.ifnames=0 > Jul 16 04:26:30.177796 localhost kernel: Calibrating delay loop (skipped) preset value.. 5602.32 BogoMIPS (lpj=9333326) > Jul 16 04:26:30.177805 localhost kernel: x86/cpu: User Mode Instruction Prevention (UMIP) activated > Jul 16 04:26:30.177814 localhost kernel: Last level iTLB entries: 4KB 512, 2MB 255, 4MB 127 > Jul 16 04:26:30.177823 localhost kernel: Last level dTLB entries: 4KB 512, 2MB 255, 4MB 127, 1GB 0 > Jul 16 04:26:30.177834 localhost kernel: Spectre V1 : Mitigation: usercopy/swapgs barriers and __user pointer sanitization > Jul 16 04:26:30.177849 localhost kernel: Spectre V2 : Mitigation: Retpolines > Jul 16 04:26:30.177859 localhost kernel: Spectre V2 : Spectre v2 / SpectreRSB mitigation: Filling RSB on context switch > Jul 16 04:26:30.177869 localhost kernel: Spectre V2 : Spectre v2 / SpectreRSB : Filling RSB on VMEXIT > Jul 16 04:26:30.177879 localhost kernel: Spectre V2 : Enabling Restricted Speculation for firmware calls > Jul 16 04:26:30.177889 localhost kernel: Spectre V2 : mitigation: Enabling conditional Indirect Branch Prediction Barrier > Jul 16 04:26:30.177899 localhost kernel: Speculative Store Bypass: Mitigation: Speculative Store Bypass disabled via prctl > Jul 16 04:26:30.177908 localhost kernel: Speculative Return Stack Overflow: IBPB-extending microcode not applied! > Jul 16 04:26:30.177919 localhost kernel: Speculative Return Stack Overflow: WARNING: See https://kernel.org/doc/html/latest/admin-guide/hw-vuln/srso.html for mitigation options. > Jul 16 04:26:30.177929 localhost kernel: Speculative Return Stack Overflow: Vulnerable: Safe RET, no microcode > Jul 16 04:26:30.177939 localhost kernel: x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers' Except the presence of these messages in the boot log, the test results do not show any other related issues. ## Tested image [1] openSUSE-Tumbleweed-Minimal-VM.x86_64-1.0.0-Cloud-Snapshot20240714.qcow2 openQA test in scenario opensuse-Tumbleweed-JeOS-for-OpenStack-Cloud-x86_64-jeos-no-cloud@64bit_virtio fails in [journal_check](https://openqa.opensuse.org/tests/4344305/modules/journal_ch… ## Reproducible The image was never tested before in openQA -- You are receiving this mail because: You are on the CC list for the bug.

1 1