diff options
author | pmikus <peter.mikus@protonmail.ch> | 2022-10-03 14:42:34 +0200 |
---|---|---|
committer | Peter Mikus <peter.mikus@protonmail.ch> | 2022-10-03 14:09:10 +0000 |
commit | 7931974228faf0900ab01273fa1edc60a170b2f4 (patch) | |
tree | f3059f198c4b408892775d09a59e86c89da93ae5 /docs/report/introduction/environment | |
parent | 64a688096073d08fe063b78615971aafab53cdb8 (diff) |
fix(docs): Static content
Signed-off-by: pmikus <peter.mikus@protonmail.ch>
Change-Id: I29c2c108cec7badbe302095d5797d39c0d34ad58
(cherry picked from commit 14fe52e81c59a5a3558f4f587e56b75e388191dc)
Diffstat (limited to 'docs/report/introduction/environment')
22 files changed, 1703 insertions, 0 deletions
diff --git a/docs/report/introduction/environment/changes_tg.rst b/docs/report/introduction/environment/changes_tg.rst new file mode 100644 index 0000000000..d21e43e04a --- /dev/null +++ b/docs/report/introduction/environment/changes_tg.rst @@ -0,0 +1,14 @@ +To identify performance changes due to TRex code development between previous +and current TRex version, both have been tested in CSIT environment of latest +version and compared against each other. All substantial progressions and +regressions have been marked up with RCA analysis. See :ref:`trex_known_issues`. + +Physical Testbeds +----------------- + +FD.io CSIT performance tests are executed in physical testbeds hosted by +:abbr:`LF (Linux Foundation)` for FD.io project. Physical testbed +topology used: + +- **1-Node Topology**: Consisting of TG with 1 NIC with 2 ports connected + together - loopback connection. diff --git a/docs/report/introduction/environment/changes_vpp.rst b/docs/report/introduction/environment/changes_vpp.rst new file mode 100644 index 0000000000..b720766b48 --- /dev/null +++ b/docs/report/introduction/environment/changes_vpp.rst @@ -0,0 +1,33 @@ +To identify performance changes due to VPP code development between previous +and current VPP release version, both have been tested in CSIT environment of +latest version and compared against each other. All substantial progressions and +regressions have been marked up with RCA analysis. See +:ref:`vpp_throughput_comparisons` and :ref:`vpp_known_issues`. + +Physical Testbeds +----------------- + +FD.io CSIT performance tests are executed in physical testbeds hosted by +:abbr:`LF (Linux Foundation)` for FD.io project. Two physical testbed +topology types are used: + +- **3-Node Topology**: Consisting of two servers acting as SUTs + (Systems Under Test) and one server as TG (Traffic Generator), all + connected in ring topology. +- **2-Node Topology**: Consisting of one server acting as SUTs and one + server as TG both connected in ring topology. + +Tested SUT servers are based on a range of processors. More detailed description +is provided in :ref:`tested_physical_topologies`. Tested logical topologies are +described in :ref:`tested_logical_topologies`. + +Server Specifications +--------------------- + +Complete technical specifications of compute servers used in CSIT +physical testbeds are maintained in FD.io CSIT repository: +`FD.io CSIT testbeds - Xeon Cascade Lake`_, +`FD.io CSIT testbeds - Xeon Ice Lake`_, +`FD.io CSIT testbeds - EPYC Zen2`_, +`FD.io CSIT testbeds - Atom Denverton`_, +`FD.io CSIT testbeds - Atom Snowridge`_. diff --git a/docs/report/introduction/environment/intro.rst b/docs/report/introduction/environment/intro.rst new file mode 100644 index 0000000000..1cba24a2bb --- /dev/null +++ b/docs/report/introduction/environment/intro.rst @@ -0,0 +1,132 @@ +Test Environment +================ + +.. _test_environment_versioning: + +Environment Versioning +---------------------- + +CSIT test environment versioning has been introduced to track +modifications of the test environment. + +Any benchmark anomalies (progressions, regressions) between releases of +a DUT application (e.g. VPP, DPDK), are determined by testing it in the +same test environment, to avoid test environment changes clouding the +picture. +To beter distinguish impact of test environment changes, +we also execute tests without any SUT (just with TRex TG sending packets +over a link looping back to TG). + +A mirror approach is introduced to determine benchmarking anomalies due +to the test environment change. This is achieved by testing the same DUT +application version between releases of CSIT test system. This works +under the assumption that the behaviour of the DUT is deterministic +under the test conditions. + +CSIT test environment versioning scheme ensures integrity of all the +test system components, including their HW revisions, compiled SW code +versions and SW source code, within a specific CSIT version. Components +included in the CSIT environment versioning include: + +- **HW** Server hardware firmware and BIOS (motherboard, processsor, + NIC(s), accelerator card(s)), tracked in CSIT branch. +- **Linux** Server Linux OS version and configuration, tracked in CSIT + Reports. +- **TRex** TRex Traffic Generator version, drivers and configuration + tracked in TG Settings. +- **CSIT** CSIT framework code tracked in CSIT release branches. + +Following is the list of CSIT versions to date: + +- Ver. 1 associated with CSIT rls1908 branch (`HW + <https://git.fd.io/csit/tree/docs/lab?h=rls1908>`_, `Linux + <https://docs.fd.io/csit/rls1908/report/vpp_performance_tests/test_environment.html#sut-settings-linux>`_, + `TRex + <https://docs.fd.io/csit/rls1908/report/vpp_performance_tests/test_environment.html#tg-settings-trex>`_, + `CSIT <https://git.fd.io/csit/tree/?h=rls1908>`_). +- Ver. 2 associated with CSIT rls2001 branch (`HW + <https://git.fd.io/csit/tree/docs/lab?h=rls2001>`_, `Linux + <https://docs.fd.io/csit/rls2001/report/vpp_performance_tests/test_environment.html#sut-settings-linux>`_, + `TRex + <https://docs.fd.io/csit/rls2001/report/vpp_performance_tests/test_environment.html#tg-settings-trex>`_, + `CSIT <https://git.fd.io/csit/tree/?h=rls2001>`_). +- Ver. 4 associated with CSIT rls2005 branch (`HW + <https://git.fd.io/csit/tree/docs/lab?h=rls2005>`_, `Linux + <https://docs.fd.io/csit/rls2005/report/vpp_performance_tests/test_environment.html#sut-settings-linux>`_, + `TRex + <https://docs.fd.io/csit/rls2005/report/vpp_performance_tests/test_environment.html#tg-settings-trex>`_, + `CSIT <https://git.fd.io/csit/tree/?h=rls2005>`_). +- Ver. 5 associated with CSIT rls2009 branch (`HW + <https://git.fd.io/csit/tree/docs/lab?h=rls2009>`_, `Linux + <https://docs.fd.io/csit/rls2009/report/vpp_performance_tests/test_environment.html#sut-settings-linux>`_, + `TRex + <https://docs.fd.io/csit/rls2009/report/vpp_performance_tests/test_environment.html#tg-settings-trex>`_, + `CSIT <https://git.fd.io/csit/tree/?h=rls2009>`_). + + - The main change is TRex data-plane core resource adjustments: + `increase from 7 to 8 cores and pinning cores to interfaces <https://gerrit.fd.io/r/c/csit/+/28184>`_ + for better TRex performance with symmetric traffic profiles. +- Ver. 6 associated with CSIT rls2101 branch (`HW + <https://git.fd.io/csit/tree/docs/lab?h=rls2101>`_, `Linux + <https://docs.fd.io/csit/rls2101/report/vpp_performance_tests/test_environment.html#sut-settings-linux>`_, + `TRex + <https://docs.fd.io/csit/rls2101/report/vpp_performance_tests/test_environment.html#tg-settings-trex>`_, + `CSIT <https://git.fd.io/csit/tree/?h=rls2101>`_). + + - The main change is TRex version upgrade: + `increase from 2.82 to 2.86 <https://gerrit.fd.io/r/c/csit/+/29980>`_. +- Ver. 7 associated with CSIT rls2106 branch (`HW + <https://git.fd.io/csit/tree/docs/lab?h=rls2106>`_, `Linux + <https://s3-docs.fd.io/csit/rls2106/report/vpp_performance_tests/test_environment.html#sut-settings-linux>`_, + `TRex + <https://s3-docs.fd.io/csit/rls2106/report/vpp_performance_tests/test_environment.html#tg-settings-trex>`_, + `CSIT <https://git.fd.io/csit/tree/?h=rls2106>`_). + + - TRex version upgrade: + `increase from 2.86 to 2.88 <https://gerrit.fd.io/r/c/csit/+/31652>`_. + - Ubuntu upgrade: + `upgrade from 18.04 LTS to 20.04.2 LTS <https://gerrit.fd.io/r/c/csit/+/31290>`_. +- Ver. 8 associated with CSIT rls2110 branch (`HW + <https://git.fd.io/csit/tree/docs/lab?h=rls2110>`_, `Linux + <https://s3-docs.fd.io/csit/rls2110/report/vpp_performance_tests/test_environment.html#sut-settings-linux>`_, + `TRex + <https://s3-docs.fd.io/csit/rls2110/report/vpp_performance_tests/test_environment.html#tg-settings-trex>`_, + `CSIT <https://git.fd.io/csit/tree/?h=rls2110>`_). + + - Intel NIC 700/800 series firmware upgrade based on DPDK compatibility + matrix. +- Ver. 9 associated with CSIT rls2202 branch (`HW + <https://git.fd.io/csit/tree/docs/lab?h=rls2202>`_, `Linux + <https://s3-docs.fd.io/csit/rls2202/report/vpp_performance_tests/test_environment.html#sut-settings-linux>`_, + `TRex + <https://s3-docs.fd.io/csit/rls2202/report/vpp_performance_tests/test_environment.html#tg-settings-trex>`_, + `CSIT <https://git.fd.io/csit/tree/?h=rls2202>`_). + + - Intel NIC 700/800 series firmware upgrade based on DPDK compatibility + matrix. +- Ver. 10 associated with CSIT rls2206 branch (`HW + <https://git.fd.io/csit/tree/docs/lab?h=rls2206>`_, `Linux + <https://s3-docs.fd.io/csit/rls2206/report/vpp_performance_tests/test_environment.html#sut-settings-linux>`_, + `TRex + <https://s3-docs.fd.io/csit/rls2206/report/vpp_performance_tests/test_environment.html#tg-settings-trex>`_, + `CSIT <https://git.fd.io/csit/tree/?h=rls2206>`_). + + - Intel NIC 700/800 series firmware upgrade based on DPDK compatibility + matrix. + - Mellanox 556A series firmware upgrade based on DPDK compatibility + matrix. + - Intel IceLake all core turbo frequency turned off. Current base frequency + is 2.6GHz. + +- Ver. 11 associated with CSIT rls2210 branch (`HW + <https://git.fd.io/csit/tree/docs/lab?h=rls2210>`_, `Linux + <https://s3-docs.fd.io/csit/rls2210/report/vpp_performance_tests/test_environment.html#sut-settings-linux>`_, + `TRex + <https://s3-docs.fd.io/csit/rls2210/report/vpp_performance_tests/test_environment.html#tg-settings-trex>`_, + `CSIT <https://git.fd.io/csit/tree/?h=rls2210>`_). + + - Intel NIC 700/800 series firmware upgrade based on DPDK compatibility + matrix. + - Mellanox 556A series firmware upgrade based on DPDK compatibility + matrix. + - Ubuntu 22.04 LTS upgrade. diff --git a/docs/report/introduction/environment/pre_test_server_calib.rst b/docs/report/introduction/environment/pre_test_server_calib.rst new file mode 100644 index 0000000000..325c61b212 --- /dev/null +++ b/docs/report/introduction/environment/pre_test_server_calib.rst @@ -0,0 +1,26 @@ +Pre-Test Server Calibration +--------------------------- + +Number of SUT server sub-system runtime parameters have been identified +as impacting data plane performance tests. Calibrating those parameters +is part of FD.io CSIT pre-test activities, and includes measuring and +reporting following: + +#. System level core jitter - measure duration of core interrupts by + Linux in clock cycles and how often interrupts happen. Using + `CPU core jitter tool <https://git.fd.io/pma_tools/tree/jitter>`_. + +#. Memory bandwidth - measure bandwidth with `Intel MLC tool + <https://software.intel.com/en-us/articles/intelr-memory-latency-checker>`_. + +#. Memory latency - measure memory latency with Intel MLC tool. + +#. Cache latency at all levels (L1, L2, and Last Level Cache) - measure + cache latency with Intel MLC tool. + +Measured values of listed parameters are especially important for +repeatable zero packet loss throughput measurements across multiple +system instances. Generally they come useful as a background data for +comparing data plane performance results across disparate servers. + +Following sections include measured calibration data for testbeds. diff --git a/docs/report/introduction/environment/sut_calib_alt.rst b/docs/report/introduction/environment/sut_calib_alt.rst new file mode 100644 index 0000000000..fb799b9a9b --- /dev/null +++ b/docs/report/introduction/environment/sut_calib_alt.rst @@ -0,0 +1,22 @@ +Altra +~~~~~ + +Following sections include sample calibration data measured on server running in +one of the Altra testbeds. + + +Linux cmdline +^^^^^^^^^^^^^ + +:: + + $ cat /proc/cmdline + BOOT_IMAGE=/boot/vmlinuz-5.15.0-46-generic root=UUID=7d1d0e77-4df0-43df-9619-a99db29ffb83 ro audit=0 default_hugepagesz=2M hugepagesz=1G hugepages=32 hugepagesz=2M hugepages=32768 iommu.passthrough=1 isolcpus=1-10,29-38 nmi_watchdog=0 nohz_full=1-10,29-38 nosoftlockup processor.max_cstate=1 rcu_nocbs=1-10,29-38 console=ttyAMA0,115200n8 quiet + +Linux uname +^^^^^^^^^^^ + +:: + + $ uname -a + Linux 5.15.0-46-generic #49-Ubuntu SMP Thu Aug 4 18:08:11 UTC 2022 aarch64 aarch64 aarch64 GNU/Linux diff --git a/docs/report/introduction/environment/sut_calib_clx.rst b/docs/report/introduction/environment/sut_calib_clx.rst new file mode 100644 index 0000000000..af4ee098b1 --- /dev/null +++ b/docs/report/introduction/environment/sut_calib_clx.rst @@ -0,0 +1,65 @@ +Cascade Lake +~~~~~~~~~~~~ + +Following sections include sample calibration data measured on server running in +one of the Intel Xeon Skylake testbeds. + +Linux cmdline +^^^^^^^^^^^^^ + +:: + + $ cat /proc/cmdline + BOOT_IMAGE=/boot/vmlinuz-5.15.0-46-generic root=UUID=2d6f4d44-76b1-4343-bc73-c066a3e95b32 ro audit=0 default_hugepagesz=2M hugepagesz=1G hugepages=32 hugepagesz=2M hugepages=32768 hpet=disable intel_idle.max_cstate=1 intel_iommu=on intel_pstate=disable iommu=pt isolcpus=1-23,25-47,49-71,73-95 mce=off nmi_watchdog=0 nohz_full=1-23,25-47,49-71,73-95 nosoftlockup numa_balancing=disable processor.max_cstate=1 rcu_nocbs=1-23,25-47,49-71,73-95 tsc=reliable console=ttyS0,115200n8 quiet + +Linux uname +^^^^^^^^^^^ + +:: + + $ uname -a + Linux 5.15.0-46-generic #49-Ubuntu SMP Thu Aug 4 18:03:25 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux + +System-level Core Jitter +^^^^^^^^^^^^^^^^^^^^^^^^ + +:: + + $ sudo taskset -c 3 /home/testuser/pma_tools/jitter/jitter -i 30 + Linux Jitter testing program version 1.9 + Iterations=20 + The pragram will execute a dummy function 80000 times + Display is updated every 20000 displayUpdate intervals + Thread affinity will be set to core_id:7 + Timings are in CPU Core cycles + Inst_Min: Minimum Excution time during the display update interval(default is ~1 second) + Inst_Max: Maximum Excution time during the display update interval(default is ~1 second) + Inst_jitter: Jitter in the Excution time during rhe display update interval. This is the value of interest + last_Exec: The Excution time of last iteration just before the display update + Abs_Min: Absolute Minimum Excution time since the program started or statistics were reset + Abs_Max: Absolute Maximum Excution time since the program started or statistics were reset + tmp: Cumulative value calcualted by the dummy function + Interval: Time interval between the display updates in Core Cycles + Sample No: Sample number + + Inst_Min,Inst_Max,Inst_jitter,last_Exec,Abs_min,Abs_max,tmp,Interval,Sample No + 160026,167568,7542,160032,160026,167568,183238656,3204033176,1 + 160026,171174,11148,160028,160026,171174,3563847680,3204142488,2 + 160024,170002,9978,160032,160024,171174,2649489408,3204224288,3 + 160026,169124,9098,160032,160024,171174,1735131136,3204142126,4 + 160026,169096,9070,160030,160024,171174,820772864,3204069082,5 + 160026,168788,8762,160028,160024,171174,4201381888,3204056954,6 + 160024,169196,9172,160030,160024,171174,3287023616,3204364824,7 + 160026,168176,8150,160028,160024,171174,2372665344,3204073670,8 + 160026,169466,9440,160032,160024,171174,1458307072,3204068092,9 + 160026,168858,8832,160032,160024,171174,543948800,3204109862,10 + 160026,169418,9392,160028,160024,171174,3924557824,3204289508,11 + 160026,167776,7750,160032,160024,171174,3010199552,3204089538,12 + 160024,170538,10514,160032,160024,171174,2095841280,3204109170,13 + 160026,169320,9294,160034,160024,171174,1181483008,3204108772,14 + 160026,169976,9950,160034,160024,171174,267124736,3204259754,15 + 160026,166826,6800,160030,160024,171174,3647733760,3204058488,16 + 160026,168314,8288,160032,160024,171174,2733375488,3204110518,17 + 160026,170176,10150,160028,160024,171174,1819017216,3204283146,18 + 160024,168698,8674,160030,160024,171174,904658944,3204162904,19 + 160026,168234,8208,160034,160024,171174,4285267968,3204059562,20 diff --git a/docs/report/introduction/environment/sut_calib_dnv.rst b/docs/report/introduction/environment/sut_calib_dnv.rst new file mode 100644 index 0000000000..310d8df039 --- /dev/null +++ b/docs/report/introduction/environment/sut_calib_dnv.rst @@ -0,0 +1,67 @@ +Denverton +~~~~~~~~~ + +Following sections include sample calibration data measured on +server running in one of the Intel Atom Denverton testbeds. + + +Linux cmdline +^^^^^^^^^^^^^ + +:: + + $ cat /proc/cmdline + BOOT_IMAGE=/boot/vmlinuz-5.4.0-65-generic root=UUID=26ca7b0f-904a-462d-a1c6-98c420c29515 ro audit=0 hpet=disable intel_idle.max_cstate=1 intel_iommu=on intel_pstate=disable iommu=pt isolcpus=1-5 mce=off nmi_watchdog=0 nohz_full=1-5 nosoftlockup numa_balancing=disable processor.max_cstate=1 rcu_nocbs=1-5 tsc=reliable console=tty0 console=ttyS0,115200n8 + + +Linux uname +^^^^^^^^^^^ + +:: + + $ uname -a + Linux 5.4.0-65-generic #73-Ubuntu SMP Mon Jan 18 17:25:17 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux + + +System-level Core Jitter +^^^^^^^^^^^^^^^^^^^^^^^^ + +:: + + $ sudo taskset -c 2 /home/testuser/pma_tools/jitter/jitter -c 2 -i 20 + Linux Jitter testing program version 1.9 + Iterations=20 + The pragram will execute a dummy function 80000 times + Display is updated every 20000 displayUpdate intervals + Thread affinity will be set to core_id:7 + Timings are in CPU Core cycles + Inst_Min: Minimum Excution time during the display update interval(default is ~1 second) + Inst_Max: Maximum Excution time during the display update interval(default is ~1 second) + Inst_jitter: Jitter in the Excution time during rhe display update interval. This is the value of interest + last_Exec: The Excution time of last iteration just before the display update + Abs_Min: Absolute Minimum Excution time since the program started or statistics were reset + Abs_Max: Absolute Maximum Excution time since the program started or statistics were reset + tmp: Cumulative value calcualted by the dummy function + Interval: Time interval between the display updates in Core Cycles + Sample No: Sample number + Inst_Min,Inst_Max,Inst_jitter,last_Exec,Abs_min,Abs_max,tmp,Interval,Sample No + 177008,217292,40284,177552,177008,217292,80543744,3555521762,1 + 167862,222370,54508,177552,167862,222370,191692800,3555482758,2 + 172576,251932,79356,177538,167862,251932,302841856,3556013278,3 + 177368,215300,37932,177552,167862,251932,413990912,3555428816,4 + 167914,215066,47152,177552,167862,251932,525139968,3555415700,5 + 177494,241748,64254,177552,167862,251932,636289024,3555835494,6 + 177038,210186,33148,177552,167862,251932,747438080,3555398164,7 + 170956,211022,40066,177552,167862,251932,858587136,3555435464,8 + 174130,237428,63298,177552,167862,251932,969736192,3555771752,9 + 174726,205252,30526,177552,167862,251932,1080885248,3555426516,10 + 177104,234502,57398,177554,167862,251932,1192034304,3555785760,11 + 175304,240416,65112,177550,167862,251932,1303183360,3555908234,12 + 166674,216176,49502,177552,166674,251932,1414332416,3555468016,13 + 177532,205792,28260,177552,166674,251932,1525481472,3555440968,14 + 177516,235032,57516,177550,166674,251932,1636630528,3555832414,15 + 177522,207292,29770,177552,166674,251932,1747779584,3555495058,16 + 177532,205174,27642,177552,166674,251932,1858928640,3555458754,17 + 177528,234230,56702,177552,166674,251932,1970077696,3555837046,18 + 177530,209364,31834,177552,166674,251932,2081226752,3555469590,19 + 177530,205002,27472,177552,166674,251932,2192375808,3555397840,20 diff --git a/docs/report/introduction/environment/sut_calib_icx.rst b/docs/report/introduction/environment/sut_calib_icx.rst new file mode 100644 index 0000000000..d9d725319c --- /dev/null +++ b/docs/report/introduction/environment/sut_calib_icx.rst @@ -0,0 +1,65 @@ +Ice Lake +~~~~~~~~ + +Following sections include sample calibration data measured on server running in +one of the Intel Xeon Ice Lake testbeds. + +Linux cmdline +^^^^^^^^^^^^^ + +:: + + $ cat /proc/cmdline + BOOT_IMAGE=/boot/vmlinuz-5.15.0-46-generic root=UUID=6ff26c8a-8c65-4025-a6e7-d97dee6025d0 ro audit=0 default_hugepagesz=2M hugepagesz=1G hugepages=32 hugepagesz=2M hugepages=32768 hpet=disable intel_idle.max_cstate=1 intel_iommu=on intel_pstate=disable iommu=pt isolcpus=1-31,33-63,65-95,97-127 mce=off nmi_watchdog=0 nohz_full=1-31,33-63,65-95,97-127 nosoftlockup numa_balancing=disable processor.max_cstate=1 rcu_nocbs=1-31,33-63,65-95,97-127 tsc=reliable console=ttyS0,115200n8 quiet + +Linux uname +^^^^^^^^^^^ + +:: + + $ uname -a + Linux 5.15.0-46-generic #49-Ubuntu SMP Thu Aug 4 18:03:25 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux + +System-level Core Jitter +^^^^^^^^^^^^^^^^^^^^^^^^ + +:: + + $ sudo taskset -c 3 /home/testuser/pma_tools/jitter/jitter -i 30 + Linux Jitter testing program version 1.9 + Iterations=20 + The pragram will execute a dummy function 80000 times + Display is updated every 20000 displayUpdate intervals + Thread affinity will be set to core_id:7 + Timings are in CPU Core cycles + Inst_Min: Minimum Excution time during the display update interval(default is ~1 second) + Inst_Max: Maximum Excution time during the display update interval(default is ~1 second) + Inst_jitter: Jitter in the Excution time during rhe display update interval. This is the value of interest + last_Exec: The Excution time of last iteration just before the display update + Abs_Min: Absolute Minimum Excution time since the program started or statistics were reset + Abs_Max: Absolute Maximum Excution time since the program started or statistics were reset + tmp: Cumulative value calcualted by the dummy function + Interval: Time interval between the display updates in Core Cycles + Sample No: Sample number + + Inst_Min,Inst_Max,Inst_jitter,last_Exec,Abs_min,Abs_max,tmp,Interval,Sample No + 160022,167912,7890,160034,160022,167912,854327296,3203987030,1 + 160022,168114,8092,160042,160022,168114,4234936320,3204004240,2 + 160022,168386,8364,160040,160022,168386,3320578048,3204007496,3 + 160022,169432,9410,160028,160022,169432,2406219776,3204213462,4 + 160022,168050,8028,160040,160022,169432,1491861504,3203982428,5 + 160022,166384,6362,160040,160022,169432,577503232,3203969006,6 + 160022,168962,8940,160042,160022,169432,3958112256,3204002514,7 + 160020,169248,9228,160038,160020,169432,3043753984,3204208318,8 + 160022,168854,8832,160038,160020,169432,2129395712,3203987894,9 + 160022,166754,6732,160042,160020,169432,1215037440,3203984104,10 + 160022,168208,8186,160040,160020,169432,300679168,3203980640,11 + 160022,172450,12428,160040,160020,172450,3681288192,3204208216,12 + 160022,168244,8222,160042,160020,172450,2766929920,3204037074,13 + 160022,166894,6872,160040,160020,172450,1852571648,3203979376,14 + 160022,169068,9046,160038,160020,172450,938213376,3204009714,15 + 160020,168528,8508,160036,160020,172450,23855104,3204028382,16 + 160022,169458,9436,160042,160020,172450,3404464128,3204179220,17 + 160020,167056,7036,160040,160020,172450,2490105856,3203990218,18 + 160022,167038,7016,160038,160020,172450,1575747584,3203976712,19 + 160022,168610,8588,160040,160020,172450,661389312,3204025230,20 diff --git a/docs/report/introduction/environment/sut_calib_snr.rst b/docs/report/introduction/environment/sut_calib_snr.rst new file mode 100644 index 0000000000..fd4d17812a --- /dev/null +++ b/docs/report/introduction/environment/sut_calib_snr.rst @@ -0,0 +1,65 @@ +Snowridge +~~~~~~~~~ + +Following sections include sample calibration data measured on server running in +one of the Intel Atom Snowridge testbeds. + +Linux cmdline +^^^^^^^^^^^^^ + +:: + + $ cat /proc/cmdline + BOOT_IMAGE=/vmlinuz-5.15.0-46-generic root=/dev/mapper/ubuntu--vg-ubuntu--lv ro audit=0 default_hugepagesz=2M hugepagesz=1G hugepages=2 hugepagesz=2M hugepages=4096 hpet=disable intel_idle.max_cstate=1 intel_iommu=on intel_pstate=disable iommu=pt isolcpus=1-23 mce=off nmi_watchdog=0 nohz_full=1-23 nosoftlockup numa_balancing=disable processor.max_cstate=1 rcu_nocbs=1-23 tsc=reliable console=ttyS0,115200n8 quiet + +Linux uname +^^^^^^^^^^^ + +:: + + $ uname -a + Linux 5.15.0-46-generic #49-Ubuntu SMP Thu Aug 4 18:03:25 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux + +System-level Core Jitter +^^^^^^^^^^^^^^^^^^^^^^^^ + +:: + + $ sudo taskset -c 2 /home/testuser/pma_tools/jitter/jitter -c 2 -i 20 + Linux Jitter testing program version 1.9 + Iterations=20 + The pragram will execute a dummy function 80000 times + Display is updated every 20000 displayUpdate intervals + Thread affinity will be set to core_id:7 + Timings are in CPU Core cycles + Inst_Min: Minimum Excution time during the display update interval(default is ~1 second) + Inst_Max: Maximum Excution time during the display update interval(default is ~1 second) + Inst_jitter: Jitter in the Excution time during rhe display update interval. This is the value of interest + last_Exec: The Excution time of last iteration just before the display update + Abs_Min: Absolute Minimum Excution time since the program started or statistics were reset + Abs_Max: Absolute Maximum Excution time since the program started or statistics were reset + tmp: Cumulative value calcualted by the dummy function + Interval: Time interval between the display updates in Core Cycles + Sample No: Sample number + + Inst_Min,Inst_Max,Inst_jitter,last_Exec,Abs_min,Abs_max,tmp,Interval,Sample No + 160370,165364,4994,160380,160370,165364,1042874368,3211228620,1 + 160370,165308,4938,160430,160370,165364,1279852544,3211283594,2 + 160370,169968,9598,160394,160370,169968,1516830720,3211446352,3 + 160370,166026,5656,160430,160370,169968,1753808896,3211263720,4 + 160370,165516,5146,160414,160370,169968,1990787072,3211249674,5 + 160370,165594,5224,160448,160370,169968,2227765248,3211267504,6 + 160370,169988,9618,160374,160370,169988,2464743424,3211426160,7 + 160370,165384,5014,160382,160370,169988,2701721600,3211243706,8 + 160370,165514,5144,160444,160370,169988,2938699776,3211233152,9 + 160370,168954,8584,160392,160370,169988,3175677952,3211338334,10 + 160370,167270,6900,160374,160370,169988,3412656128,3211329846,11 + 160370,165430,5060,160408,160370,169988,3649634304,3211240244,12 + 160370,166196,5826,160398,160370,169988,3886612480,3211256920,13 + 160370,169678,9308,160398,160370,169988,4123590656,3211415892,14 + 160370,165718,5348,160418,160370,169988,65601536,3211259448,15 + 160370,165256,4886,160372,160370,169988,302579712,3211236834,16 + 160370,167840,7470,160382,160370,169988,539557888,3211260000,17 + 160370,169332,8962,160400,160370,169988,776536064,3211432972,18 + 160370,165272,4902,160428,160370,169988,1013514240,3211246698,19 + 160370,165906,5536,160398,160370,169988,1250492416,3211262146,20 diff --git a/docs/report/introduction/environment/sut_calib_tsh.rst b/docs/report/introduction/environment/sut_calib_tsh.rst new file mode 100644 index 0000000000..8e3c6f6b42 --- /dev/null +++ b/docs/report/introduction/environment/sut_calib_tsh.rst @@ -0,0 +1,22 @@ +TaiShan +~~~~~~~ + +Following sections include sample calibration data measured on +s17-t33-sut1 server running in one of the Cortex-A72 testbeds. + + +Linux cmdline +^^^^^^^^^^^^^ + +:: + + $ cat /proc/cmdline + BOOT_IMAGE=/boot/vmlinuz-5.4.0-65-generic root=UUID=7d1d0e77-4df0-43df-9619-a99db29ffb83 ro audit=0 intel_iommu=on isolcpus=1-27,29-55 nmi_watchdog=0 nohz_full=1-27,29-55 nosoftlockup processor.max_cstate=1 rcu_nocbs=1-27,29-55 console=ttyAMA0,115200n8 quiet + +Linux uname +^^^^^^^^^^^ + +:: + + $ uname -a + Linux 5.4.0-65-generic #73-Ubuntu SMP Mon Jan 18 17:25:17 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux diff --git a/docs/report/introduction/environment/sut_calib_tx2.rst b/docs/report/introduction/environment/sut_calib_tx2.rst new file mode 100644 index 0000000000..17f98c0d01 --- /dev/null +++ b/docs/report/introduction/environment/sut_calib_tx2.rst @@ -0,0 +1,22 @@ +ThunderX2 +~~~~~~~~~ + +Following sections include sample calibration data measured on +s27-t211-sut1 server running in one of the ThunderX2 testbeds. + + +Linux cmdline +^^^^^^^^^^^^^ + +:: + + $ cat /proc/cmdline + BOOT_IMAGE=/boot/vmlinuz-5.4.0-65-generic root=UUID=7d1d0e77-4df0-43df-9619-a99db29ffb83 ro audit=0 intel_iommu=on isolcpus=1-27,29-55 nmi_watchdog=0 nohz_full=1-27,29-55 nosoftlockup processor.max_cstate=1 rcu_nocbs=1-27,29-55 console=ttyAMA0,115200n8 quiet + +Linux uname +^^^^^^^^^^^ + +:: + + $ uname -a + Linux 5.4.0-65-generic #73-Ubuntu SMP Mon Jan 18 17:25:17 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux diff --git a/docs/report/introduction/environment/sut_calib_zn2.rst b/docs/report/introduction/environment/sut_calib_zn2.rst new file mode 100644 index 0000000000..19223cbf92 --- /dev/null +++ b/docs/report/introduction/environment/sut_calib_zn2.rst @@ -0,0 +1,65 @@ +EPYC Zen2 +~~~~~~~~~ + +Following sections include sample calibration data measured on server running in +one of the AMD EPYC testbeds. + +Linux cmdline +^^^^^^^^^^^^^ + +:: + + $ cat /proc/cmdline + BOOT_IMAGE=/boot/vmlinuz-5.15.0-46-generic root=UUID=cac1254f-9426-4ea6-a8db-2554f075db99 ro amd_iommu=on audit=0 default_hugepagesz=2M hugepagesz=1G hugepages=32 hugepagesz=2M hugepages=32768 hpet=disable iommu=pt isolcpus=1-15,17-31,33-47,49-63 nmi_watchdog=0 nohz_full=off nosoftlockup numa_balancing=disable processor.max_cstate=0 rcu_nocbs=1-15,17-31,33-47,49-63 tsc=reliable console=ttyS0,115200n8 quiet + +Linux uname +^^^^^^^^^^^ + +:: + + $ uname -a + Linux s60-t210-sut1 5.15.0-46-generic #49-Ubuntu SMP Thu Aug 4 18:03:25 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux + +System-level Core Jitter +^^^^^^^^^^^^^^^^^^^^^^^^ + +:: + + $ sudo taskset -c 3 /home/testuser/pma_tools/jitter/jitter -i 30 + Linux Jitter testing program version 1.9 + Iterations=20 + The pragram will execute a dummy function 80000 times + Display is updated every 20000 displayUpdate intervals + Thread affinity will be set to core_id:7 + Timings are in CPU Core cycles + Inst_Min: Minimum Excution time during the display update interval(default is ~1 second) + Inst_Max: Maximum Excution time during the display update interval(default is ~1 second) + Inst_jitter: Jitter in the Excution time during rhe display update interval. This is the value of interest + last_Exec: The Excution time of last iteration just before the display update + Abs_Min: Absolute Minimum Excution time since the program started or statistics were reset + Abs_Max: Absolute Maximum Excution time since the program started or statistics were reset + tmp: Cumulative value calcualted by the dummy function + Interval: Time interval between the display updates in Core Cycles + Sample No: Sample number + + Inst_Min,Inst_Max,Inst_jitter,last_Exec,Abs_min,Abs_max,tmp,Interval,Sample No + 116400,145848,29448,116400,116400,145848,2076377088,2375383296,1 + 116400,145848,29448,116400,116400,145848,388169728,2363555544,2 + 116400,145848,29448,116400,116400,145848,2994929664,2359881480,3 + 116400,145848,29448,116400,116400,145848,1306722304,2367487104,4 + 116400,145848,29448,116400,116400,145848,3913482240,2357721768,5 + 116400,145848,29448,116400,116400,145848,2225274880,2381723112,6 + 116400,145848,29448,116424,116400,145848,537067520,2373138432,7 + 116400,145848,29448,116424,116400,145848,3143827456,2372221464,8 + 116400,145848,29448,116400,116400,145848,1455620096,2365450272,9 + 116400,145848,29448,116400,116400,145848,4062380032,2364814440,10 + 116400,145848,29448,116400,116400,145848,2374172672,2375992608,11 + 116400,145848,29448,116400,116400,145848,685965312,2362608552,12 + 116400,145848,29448,116400,116400,145848,3292725248,2362597944,13 + 116400,145848,29448,145512,116400,145848,1604517888,2370049344,14 + 116400,145848,29448,116400,116400,145848,4211277824,2366291784,15 + 116400,145848,29448,116400,116400,145848,2523070464,2349077352,16 + 116400,145848,29448,116400,116400,145848,834863104,2375406360,17 + 116400,145848,29448,116400,116400,145848,3441623040,2373272976,18 + 116400,145848,29448,116400,116400,145848,1753415680,2382267192,19 + 116400,145848,29448,116400,116400,145848,65208320,2359406040,20 diff --git a/docs/report/introduction/environment/sut_conf_1.rst b/docs/report/introduction/environment/sut_conf_1.rst new file mode 100644 index 0000000000..7f724dd6ea --- /dev/null +++ b/docs/report/introduction/environment/sut_conf_1.rst @@ -0,0 +1,53 @@ +SUT Settings - Linux +-------------------- + +System provisioning is done by combination of PXE boot unattented +install and +`Ansible <https://www.ansible.com>`_ described in `CSIT Testbed Setup`_. + +Linux Boot Parameters +~~~~~~~~~~~~~~~~~~~~~ + +- **isolcpus=<cpu number>-<cpu number>** used for all cpu cores apart from + first core of each socket used for running VPP worker threads and Qemu/LXC + processes + https://www.kernel.org/doc/Documentation/admin-guide/kernel-parameters.txt +- **intel_pstate=disable** - [X86] Do not enable intel_pstate as the default + scaling driver for the supported processors. Intel P-State driver decide what + P-state (CPU core power state) to use based on requesting policy from the + cpufreq core. [X86 - Either 32-bit or 64-bit x86] + https://www.kernel.org/doc/Documentation/cpu-freq/intel-pstate.txt +- **nohz_full=<cpu number>-<cpu number>** - [KNL,BOOT] In kernels built with + CONFIG_NO_HZ_FULL=y, set the specified list of CPUs whose tick will be stopped + whenever possible. The boot CPU will be forced outside the range to maintain + the timekeeping. The CPUs in this range must also be included in the + rcu_nocbs= set. Specifies the adaptive-ticks CPU cores, causing kernel to + avoid sending scheduling-clock interrupts to listed cores as long as they have + a single runnable task. [KNL - Is a kernel start-up parameter, SMP - The + kernel is an SMP kernel]. + https://www.kernel.org/doc/Documentation/timers/NO_HZ.txt +- **rcu_nocbs** - [KNL] In kernels built with CONFIG_RCU_NOCB_CPU=y, set the + specified list of CPUs to be no-callback CPUs, that never queue RCU callbacks + (read-copy update). + https://www.kernel.org/doc/Documentation/admin-guide/kernel-parameters.txt +- **numa_balancing=disable** - [KNL,X86] Disable automatic NUMA balancing. +- **intel_iommu=enable** - [DMAR] Enable Intel IOMMU driver (DMAR) option. +- **iommu=on, iommu=pt** - [x86, IA-64] Disable IOMMU bypass, using IOMMU for + PCI devices. +- **nmi_watchdog=0** - [KNL,BUGS=X86] Debugging features for SMP kernels. Turn + hardlockup detector in nmi_watchdog off. +- **nosoftlockup** - [KNL] Disable the soft-lockup detector. +- **tsc=reliable** - Disable clocksource stability checks for TSC. + [x86] reliable: mark tsc clocksource as reliable, this disables clocksource + verification at runtime, as well as the stability checks done at bootup. + Used to enable high-resolution timer mode on older hardware, and in + virtualized environment. +- **hpet=disable** - [X86-32,HPET] Disable HPET and use PIT instead. + +Hugepages Configuration +~~~~~~~~~~~~~~~~~~~~~~~ + +Huge pages are managed via sysctl configuration located in +`/etc/sysctl.d/90-csit.conf` on each testbed. Default huge page size is 2M. +The exact amount of huge pages depends on testbed. All the values are defined +in `Ansible inventory - hosts` files. diff --git a/docs/report/introduction/environment/sut_meltspec_alt.rst b/docs/report/introduction/environment/sut_meltspec_alt.rst new file mode 100644 index 0000000000..a92bfa2792 --- /dev/null +++ b/docs/report/introduction/environment/sut_meltspec_alt.rst @@ -0,0 +1,96 @@ +Spectre and Meltdown Checks +^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +Following section displays the output of a running shell script to tell if +system is vulnerable against the several "speculative execution" CVEs that were +made public in 2018. Script is available on `Spectre & Meltdown Checker Github +<https://github.com/speed47/spectre-meltdown-checker>`_. + +:: + + Spectre and Meltdown mitigation detection tool v0.45 + + Checking for vulnerabilities on current system + Kernel is Linux 5.15.0-46-generic #49-Ubuntu SMP Thu Aug 4 18:08:11 UTC 2022 aarch64 + CPU is ARM v8 model 0xd0c + + Hardware check + * CPU vulnerability to the speculative execution attack variants + * Affected by CVE-2017-5753 (Spectre Variant 1, bounds check bypass): YES + * Affected by CVE-2017-5715 (Spectre Variant 2, branch target injection): NO + * Affected by CVE-2017-5754 (Variant 3, Meltdown, rogue data cache load): NO + * Affected by CVE-2018-3640 (Variant 3a, rogue system register read): NO + * Affected by CVE-2018-3639 (Variant 4, speculative store bypass): YES + * Affected by CVE-2018-3615 (Foreshadow (SGX), L1 terminal fault): NO + * Affected by CVE-2018-3620 (Foreshadow-NG (OS), L1 terminal fault): NO + * Affected by CVE-2018-3646 (Foreshadow-NG (VMM), L1 terminal fault): NO + * Affected by CVE-2018-12126 (Fallout, microarchitectural store buffer data sampling (MSBDS)): NO + * Affected by CVE-2018-12130 (ZombieLoad, microarchitectural fill buffer data sampling (MFBDS)): NO + * Affected by CVE-2018-12127 (RIDL, microarchitectural load port data sampling (MLPDS)): NO + * Affected by CVE-2019-11091 (RIDL, microarchitectural data sampling uncacheable memory (MDSUM)): NO + * Affected by CVE-2019-11135 (ZombieLoad V2, TSX Asynchronous Abort (TAA)): NO + * Affected by CVE-2018-12207 (No eXcuses, iTLB Multihit, machine check exception on page size changes (MCEPSC)): NO + * Affected by CVE-2020-0543 (Special Register Buffer Data Sampling (SRBDS)): NO + + CVE-2017-5753 aka Spectre Variant 1, bounds check bypass + * Mitigated according to the /sys interface: YES (Mitigation: __user pointer sanitization) + > STATUS: UNKNOWN (/sys vulnerability interface use forced, but its not available!) + + CVE-2017-5715 aka Spectre Variant 2, branch target injection + * Mitigated according to the /sys interface: YES (Mitigation: CSV2, BHB) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2017-5754 aka Variant 3, Meltdown, rogue data cache load + * Mitigated according to the /sys interface: YES (Not affected) + * Running as a Xen PV DomU: NO + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-3640 aka Variant 3a, rogue system register read + * CPU microcode mitigates the vulnerability: NO + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-3639 aka Variant 4, speculative store bypass + * Mitigated according to the /sys interface: YES (Mitigation: Speculative Store Bypass disabled via prctl) + > STATUS: NOT VULNERABLE (Mitigation: Speculative Store Bypass disabled via prctl) + + CVE-2018-3615 aka Foreshadow (SGX), L1 terminal fault + * CPU microcode mitigates the vulnerability: N/A + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-3620 aka Foreshadow-NG (OS), L1 terminal fault + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-3646 aka Foreshadow-NG (VMM), L1 terminal fault + * Information from the /sys interface: Not affected + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-12126 aka Fallout, microarchitectural store buffer data sampling (MSBDS) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-12130 aka ZombieLoad, microarchitectural fill buffer data sampling (MFBDS) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-12127 aka RIDL, microarchitectural load port data sampling (MLPDS) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2019-11091 aka RIDL, microarchitectural data sampling uncacheable memory (MDSUM) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2019-11135 aka ZombieLoad V2, TSX Asynchronous Abort (TAA) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-12207 aka No eXcuses, iTLB Multihit, machine check exception on page size changes (MCEPSC) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2020-0543 aka Special Register Buffer Data Sampling (SRBDS) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + > SUMMARY: CVE-2017-5753:?? CVE-2017-5715:OK CVE-2017-5754:OK CVE-2018-3640:OK CVE-2018-3639:OK CVE-2018-3615:OK CVE-2018-3620:OK CVE-2018-3646:OK CVE-2018-12126:OK CVE-2018-12130:OK CVE-2018-12127:OK CVE-2019-11091:OK CVE-2019-11135:OK CVE-2018-12207:OK CVE-2020-0543:OK diff --git a/docs/report/introduction/environment/sut_meltspec_clx.rst b/docs/report/introduction/environment/sut_meltspec_clx.rst new file mode 100644 index 0000000000..19fb831e8f --- /dev/null +++ b/docs/report/introduction/environment/sut_meltspec_clx.rst @@ -0,0 +1,133 @@ +Spectre and Meltdown Checks +^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +Following section displays the output of a running shell script to tell if +system is vulnerable against the several speculative execution CVEs that were +made public in 2018. Script is available on `Spectre & Meltdown Checker Github +<https://github.com/speed47/spectre-meltdown-checker>`_. + +:: + + Spectre and Meltdown mitigation detection tool v0.45 + + Checking for vulnerabilities on current system + Kernel is Linux 5.15.0-46-generic #49-Ubuntu SMP Thu Aug 4 18:03:25 UTC 2022 x86_64 + CPU is Intel(R) Xeon(R) Gold 6252N CPU @ 2.30GHz + + Hardware check + * Hardware support (CPU microcode) for mitigation techniques + * Indirect Branch Restricted Speculation (IBRS) + * SPEC_CTRL MSR is available: YES + * CPU indicates IBRS capability: YES (SPEC_CTRL feature bit) + * Indirect Branch Prediction Barrier (IBPB) + * CPU indicates IBPB capability: YES (SPEC_CTRL feature bit) + * Single Thread Indirect Branch Predictors (STIBP) + * SPEC_CTRL MSR is available: YES + * CPU indicates STIBP capability: YES (Intel STIBP feature bit) + * Speculative Store Bypass Disable (SSBD) + * CPU indicates SSBD capability: YES (Intel SSBD) + * L1 data cache invalidation + * CPU indicates L1D flush capability: YES (L1D flush feature bit) + * Microarchitectural Data Sampling + * VERW instruction is available: YES (MD_CLEAR feature bit) + * Indirect Branch Predictor Controls + * Indirect Predictor Disable feature is available: NO + * Bottomless RSB Disable feature is available: NO + * BHB-Focused Indirect Predictor Disable feature is available: NO + * Enhanced IBRS (IBRS_ALL) + * CPU indicates ARCH_CAPABILITIES MSR availability: YES + * ARCH_CAPABILITIES MSR advertises IBRS_ALL capability: YES + * CPU explicitly indicates not being affected by Meltdown/L1TF (RDCL_NO): YES + * CPU explicitly indicates not being affected by Variant 4 (SSB_NO): NO + * CPU/Hypervisor indicates L1D flushing is not necessary on this system: YES + * Hypervisor indicates host CPU might be affected by RSB underflow (RSBA): NO + * CPU explicitly indicates not being affected by Microarchitectural Data Sampling (MDS_NO): YES + * CPU explicitly indicates not being affected by TSX Asynchronous Abort (TAA_NO): NO + * CPU explicitly indicates not being affected by iTLB Multihit (PSCHANGE_MSC_NO): NO + * CPU explicitly indicates having MSR for TSX control (TSX_CTRL_MSR): YES + * TSX_CTRL MSR indicates TSX RTM is disabled: YES + * TSX_CTRL MSR indicates TSX CPUID bit is cleared: YES + * CPU supports Transactional Synchronization Extensions (TSX): NO + * CPU supports Software Guard Extensions (SGX): NO + * CPU supports Special Register Buffer Data Sampling (SRBDS): NO + * CPU microcode is known to cause stability problems: NO (family 0x6 model 0x55 stepping 0x7 ucode 0x500002c cpuid 0x50657) + * CPU microcode is the latest known available version: NO (latest version is 0x500320a dated 2021/08/13 according to builtin firmwares DB v222+i20220208) + * CPU vulnerability to the speculative execution attack variants + * Affected by CVE-2017-5753 (Spectre Variant 1, bounds check bypass): YES + * Affected by CVE-2017-5715 (Spectre Variant 2, branch target injection): YES + * Affected by CVE-2017-5754 (Variant 3, Meltdown, rogue data cache load): NO + * Affected by CVE-2018-3640 (Variant 3a, rogue system register read): YES + * Affected by CVE-2018-3639 (Variant 4, speculative store bypass): YES + * Affected by CVE-2018-3615 (Foreshadow (SGX), L1 terminal fault): NO + * Affected by CVE-2018-3620 (Foreshadow-NG (OS), L1 terminal fault): YES + * Affected by CVE-2018-3646 (Foreshadow-NG (VMM), L1 terminal fault): YES + * Affected by CVE-2018-12126 (Fallout, microarchitectural store buffer data sampling (MSBDS)): NO + * Affected by CVE-2018-12130 (ZombieLoad, microarchitectural fill buffer data sampling (MFBDS)): NO + * Affected by CVE-2018-12127 (RIDL, microarchitectural load port data sampling (MLPDS)): NO + * Affected by CVE-2019-11091 (RIDL, microarchitectural data sampling uncacheable memory (MDSUM)): NO + * Affected by CVE-2019-11135 (ZombieLoad V2, TSX Asynchronous Abort (TAA)): NO + * Affected by CVE-2018-12207 (No eXcuses, iTLB Multihit, machine check exception on page size changes (MCEPSC)): YES + * Affected by CVE-2020-0543 (Special Register Buffer Data Sampling (SRBDS)): NO + + CVE-2017-5753 aka Spectre Variant 1, bounds check bypass + * Mitigated according to the /sys interface: YES (Mitigation: usercopy/swapgs barriers and __user pointer sanitization) + > STATUS: UNKNOWN (/sys vulnerability interface use forced, but its not available!) + + CVE-2017-5715 aka Spectre Variant 2, branch target injection + * Mitigated according to the /sys interface: YES (Mitigation: Enhanced IBRS, IBPB: conditional, RSB filling) + > STATUS: VULNERABLE (IBRS+IBPB or retpoline+IBPB+RSB filling, is needed to mitigate the vulnerability) + + CVE-2017-5754 aka Variant 3, Meltdown, rogue data cache load + * Mitigated according to the /sys interface: YES (Not affected) + * Running as a Xen PV DomU: NO + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-3640 aka Variant 3a, rogue system register read + * CPU microcode mitigates the vulnerability: YES + > STATUS: NOT VULNERABLE (your CPU microcode mitigates the vulnerability) + + CVE-2018-3639 aka Variant 4, speculative store bypass + * Mitigated according to the /sys interface: YES (Mitigation: Speculative Store Bypass disabled via prctl and seccomp) + > STATUS: NOT VULNERABLE (Mitigation: Speculative Store Bypass disabled via prctl and seccomp) + + CVE-2018-3615 aka Foreshadow (SGX), L1 terminal fault + * CPU microcode mitigates the vulnerability: N/A + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-3620 aka Foreshadow-NG (OS), L1 terminal fault + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (Not affected) + + CVE-2018-3646 aka Foreshadow-NG (VMM), L1 terminal fault + * Information from the /sys interface: Not affected + > STATUS: NOT VULNERABLE (your kernel reported your CPU model as not affected) + + CVE-2018-12126 aka Fallout, microarchitectural store buffer data sampling (MSBDS) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-12130 aka ZombieLoad, microarchitectural fill buffer data sampling (MFBDS) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-12127 aka RIDL, microarchitectural load port data sampling (MLPDS) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2019-11091 aka RIDL, microarchitectural data sampling uncacheable memory (MDSUM) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2019-11135 aka ZombieLoad V2, TSX Asynchronous Abort (TAA) + * Mitigated according to the /sys interface: YES (Mitigation: TSX disabled) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-12207 aka No eXcuses, iTLB Multihit, machine check exception on page size changes (MCEPSC) + * Mitigated according to the /sys interface: YES (KVM: Mitigation: VMX disabled) + > STATUS: NOT VULNERABLE (KVM: Mitigation: VMX disabled) + + CVE-2020-0543 aka Special Register Buffer Data Sampling (SRBDS) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + > SUMMARY: CVE-2017-5753:?? CVE-2017-5715:KO CVE-2017-5754:OK CVE-2018-3640:OK CVE-2018-3639:OK CVE-2018-3615:OK CVE-2018-3620:OK CVE-2018-3646:OK CVE-2018-12126:OK CVE-2018-12130:OK CVE-2018-12127:OK CVE-2019-11091:OK CVE-2019-11135:OK CVE-2018-12207:OK CVE-2020-0543:OK diff --git a/docs/report/introduction/environment/sut_meltspec_dnv.rst b/docs/report/introduction/environment/sut_meltspec_dnv.rst new file mode 100644 index 0000000000..a3c9284758 --- /dev/null +++ b/docs/report/introduction/environment/sut_meltspec_dnv.rst @@ -0,0 +1,131 @@ +Spectre and Meltdown Checks +^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +Following section displays the output of a running shell script to tell if +system is vulnerable against the several "speculative execution" CVEs that were +made public in 2018. Script is available on `Spectre & Meltdown Checker Github +<https://github.com/speed47/spectre-meltdown-checker>`_. + +:: + + Spectre and Meltdown mitigation detection tool v0.45 + + Checking for vulnerabilities on current system + Kernel is Linux 5.4.0-65-generic #73-Ubuntu SMP Mon Jan 18 17:25:17 UTC 2021 x86_64 + CPU is Intel(R) Atom(TM) CPU C3858 @ 2.00GHz + + Hardware check + * Hardware support (CPU microcode) for mitigation techniques + * Indirect Branch Restricted Speculation (IBRS) + * SPEC_CTRL MSR is available: YES + * CPU indicates IBRS capability: YES (SPEC_CTRL feature bit) + * Indirect Branch Prediction Barrier (IBPB) + * CPU indicates IBPB capability: YES (SPEC_CTRL feature bit) + * Single Thread Indirect Branch Predictors (STIBP) + * SPEC_CTRL MSR is available: YES + * CPU indicates STIBP capability: YES (Intel STIBP feature bit) + * Speculative Store Bypass Disable (SSBD) + * CPU indicates SSBD capability: NO + * L1 data cache invalidation + * CPU indicates L1D flush capability: NO + * Microarchitectural Data Sampling + * VERW instruction is available: NO + * Indirect Branch Predictor Controls + * Indirect Predictor Disable feature is available: NO + * Bottomless RSB Disable feature is available: NO + * BHB-Focused Indirect Predictor Disable feature is available: NO + * Enhanced IBRS (IBRS_ALL) + * CPU indicates ARCH_CAPABILITIES MSR availability: YES + * ARCH_CAPABILITIES MSR advertises IBRS_ALL capability: NO + * CPU explicitly indicates not being affected by Meltdown/L1TF (RDCL_NO): YES + * CPU explicitly indicates not being affected by Variant 4 (SSB_NO): NO + * CPU/Hypervisor indicates L1D flushing is not necessary on this system: NO + * Hypervisor indicates host CPU might be affected by RSB underflow (RSBA): NO + * CPU explicitly indicates not being affected by Microarchitectural Data Sampling (MDS_NO): NO + * CPU explicitly indicates not being affected by TSX Asynchronous Abort (TAA_NO): NO + * CPU explicitly indicates not being affected by iTLB Multihit (PSCHANGE_MSC_NO): NO + * CPU explicitly indicates having MSR for TSX control (TSX_CTRL_MSR): NO + * CPU supports Transactional Synchronization Extensions (TSX): NO + * CPU supports Software Guard Extensions (SGX): NO + * CPU supports Special Register Buffer Data Sampling (SRBDS): NO + * CPU microcode is known to cause stability problems: NO (family 0x6 model 0x5f stepping 0x1 ucode 0x20 cpuid 0x506f1) + * CPU microcode is the latest known available version: NO (latest version is 0x36 dated 2021/05/10 according to builtin firmwares DB v222+i20220208) + * CPU vulnerability to the speculative execution attack variants + * Affected by CVE-2017-5753 (Spectre Variant 1, bounds check bypass): YES + * Affected by CVE-2017-5715 (Spectre Variant 2, branch target injection): YES + * Affected by CVE-2017-5754 (Variant 3, Meltdown, rogue data cache load): NO + * Affected by CVE-2018-3640 (Variant 3a, rogue system register read): YES + * Affected by CVE-2018-3639 (Variant 4, speculative store bypass): YES + * Affected by CVE-2018-3615 (Foreshadow (SGX), L1 terminal fault): NO + * Affected by CVE-2018-3620 (Foreshadow-NG (OS), L1 terminal fault): NO + * Affected by CVE-2018-3646 (Foreshadow-NG (VMM), L1 terminal fault): NO + * Affected by CVE-2018-12126 (Fallout, microarchitectural store buffer data sampling (MSBDS)): NO + * Affected by CVE-2018-12130 (ZombieLoad, microarchitectural fill buffer data sampling (MFBDS)): NO + * Affected by CVE-2018-12127 (RIDL, microarchitectural load port data sampling (MLPDS)): NO + * Affected by CVE-2019-11091 (RIDL, microarchitectural data sampling uncacheable memory (MDSUM)): NO + * Affected by CVE-2019-11135 (ZombieLoad V2, TSX Asynchronous Abort (TAA)): NO + * Affected by CVE-2018-12207 (No eXcuses, iTLB Multihit, machine check exception on page size changes (MCEPSC)): NO + * Affected by CVE-2020-0543 (Special Register Buffer Data Sampling (SRBDS)): NO + + CVE-2017-5753 aka Spectre Variant 1, bounds check bypass + * Mitigated according to the /sys interface: YES (Mitigation: usercopy/swapgs barriers and __user pointer sanitization) + > STATUS: UNKNOWN (/sys vulnerability interface use forced, but its not available!) + + CVE-2017-5715 aka Spectre Variant 2, branch target injection + * Mitigated according to the /sys interface: YES (Mitigation: Full generic retpoline, IBPB: conditional, IBRS_FW, STIBP: disabled, RSB filling) + > STATUS: VULNERABLE (IBRS+IBPB or retpoline+IBPB is needed to mitigate the vulnerability) + + CVE-2017-5754 aka Variant 3, Meltdown, rogue data cache load + * Mitigated according to the /sys interface: YES (Not affected) + * Running as a Xen PV DomU: NO + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-3640 aka Variant 3a, rogue system register read + * CPU microcode mitigates the vulnerability: NO + > STATUS: VULNERABLE (an up-to-date CPU microcode is needed to mitigate this vulnerability) + + CVE-2018-3639 aka Variant 4, speculative store bypass + * Mitigated according to the /sys interface: NO (Vulnerable) + > STATUS: VULNERABLE (Neither your CPU nor your kernel support SSBD) + + CVE-2018-3615 aka Foreshadow (SGX), L1 terminal fault + * CPU microcode mitigates the vulnerability: N/A + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-3620 aka Foreshadow-NG (OS), L1 terminal fault + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-3646 aka Foreshadow-NG (VMM), L1 terminal fault + * Information from the /sys interface: Not affected + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-12126 aka Fallout, microarchitectural store buffer data sampling (MSBDS) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-12130 aka ZombieLoad, microarchitectural fill buffer data sampling (MFBDS) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-12127 aka RIDL, microarchitectural load port data sampling (MLPDS) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2019-11091 aka RIDL, microarchitectural data sampling uncacheable memory (MDSUM) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2019-11135 aka ZombieLoad V2, TSX Asynchronous Abort (TAA) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-12207 aka No eXcuses, iTLB Multihit, machine check exception on page size changes (MCEPSC) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2020-0543 aka Special Register Buffer Data Sampling (SRBDS) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + > SUMMARY: CVE-2017-5753:?? CVE-2017-5715:KO CVE-2017-5754:OK CVE-2018-3640:KO CVE-2018-3639:KO CVE-2018-3615:OK CVE-2018-3620:OK CVE-2018-3646:OK CVE-2018-12126:OK CVE-2018-12130:OK CVE-2018-12127:OK CVE-2019-11091:OK CVE-2019-11135:OK CVE-2018-12207:OK CVE-2020-0543:OK diff --git a/docs/report/introduction/environment/sut_meltspec_icx.rst b/docs/report/introduction/environment/sut_meltspec_icx.rst new file mode 100644 index 0000000000..89d82b7e1c --- /dev/null +++ b/docs/report/introduction/environment/sut_meltspec_icx.rst @@ -0,0 +1,133 @@ +Spectre and Meltdown Checks +^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +Following section displays the output of a running shell script to tell if +system is vulnerable against the several speculative execution CVEs that were +made public in 2018. Script is available on `Spectre & Meltdown Checker Github +<https://github.com/speed47/spectre-meltdown-checker>`_. + +:: + + Spectre and Meltdown mitigation detection tool v0.45 + + Checking for vulnerabilities on current system + Kernel is Linux 5.15.0-46-generic #49-Ubuntu SMP Thu Aug 4 18:03:25 UTC 2022 x86_64 + CPU is Intel(R) Xeon(R) Platinum 8358 CPU @ 2.60GHz + + Hardware check + * Hardware support (CPU microcode) for mitigation techniques + * Indirect Branch Restricted Speculation (IBRS) + * SPEC_CTRL MSR is available: YES + * CPU indicates IBRS capability: YES (SPEC_CTRL feature bit) + * Indirect Branch Prediction Barrier (IBPB) + * CPU indicates IBPB capability: YES (SPEC_CTRL feature bit) + * Single Thread Indirect Branch Predictors (STIBP) + * SPEC_CTRL MSR is available: YES + * CPU indicates STIBP capability: YES (Intel STIBP feature bit) + * Speculative Store Bypass Disable (SSBD) + * CPU indicates SSBD capability: YES (Intel SSBD) + * L1 data cache invalidation + * CPU indicates L1D flush capability: YES (L1D flush feature bit) + * Microarchitectural Data Sampling + * VERW instruction is available: YES (MD_CLEAR feature bit) + * Indirect Branch Predictor Controls + * Indirect Predictor Disable feature is available: NO + * Bottomless RSB Disable feature is available: NO + * BHB-Focused Indirect Predictor Disable feature is available: NO + * Enhanced IBRS (IBRS_ALL) + * CPU indicates ARCH_CAPABILITIES MSR availability: YES + * ARCH_CAPABILITIES MSR advertises IBRS_ALL capability: YES + * CPU explicitly indicates not being affected by Meltdown/L1TF (RDCL_NO): YES + * CPU explicitly indicates not being affected by Variant 4 (SSB_NO): NO + * CPU/Hypervisor indicates L1D flushing is not necessary on this system: YES + * Hypervisor indicates host CPU might be affected by RSB underflow (RSBA): NO + * CPU explicitly indicates not being affected by Microarchitectural Data Sampling (MDS_NO): YES + * CPU explicitly indicates not being affected by TSX Asynchronous Abort (TAA_NO): YES + * CPU explicitly indicates not being affected by iTLB Multihit (PSCHANGE_MSC_NO): YES + * CPU explicitly indicates having MSR for TSX control (TSX_CTRL_MSR): YES + * TSX_CTRL MSR indicates TSX RTM is disabled: YES + * TSX_CTRL MSR indicates TSX CPUID bit is cleared: YES + * CPU supports Transactional Synchronization Extensions (TSX): NO + * CPU supports Software Guard Extensions (SGX): YES + * CPU supports Special Register Buffer Data Sampling (SRBDS): NO + * CPU microcode is known to cause stability problems: NO (family 0x6 model 0x6a stepping 0x6 ucode 0xd000280 cpuid 0x606a6) + * CPU microcode is the latest known available version: NO (latest version is 0xd000331 dated 2021/12/03 according to builtin firmwares DB v222+i20220208) + * CPU vulnerability to the speculative execution attack variants + * Affected by CVE-2017-5753 (Spectre Variant 1, bounds check bypass): YES + * Affected by CVE-2017-5715 (Spectre Variant 2, branch target injection): YES + * Affected by CVE-2017-5754 (Variant 3, Meltdown, rogue data cache load): NO + * Affected by CVE-2018-3640 (Variant 3a, rogue system register read): YES + * Affected by CVE-2018-3639 (Variant 4, speculative store bypass): YES + * Affected by CVE-2018-3615 (Foreshadow (SGX), L1 terminal fault): YES + * Affected by CVE-2018-3620 (Foreshadow-NG (OS), L1 terminal fault): YES + * Affected by CVE-2018-3646 (Foreshadow-NG (VMM), L1 terminal fault): YES + * Affected by CVE-2018-12126 (Fallout, microarchitectural store buffer data sampling (MSBDS)): NO + * Affected by CVE-2018-12130 (ZombieLoad, microarchitectural fill buffer data sampling (MFBDS)): NO + * Affected by CVE-2018-12127 (RIDL, microarchitectural load port data sampling (MLPDS)): NO + * Affected by CVE-2019-11091 (RIDL, microarchitectural data sampling uncacheable memory (MDSUM)): NO + * Affected by CVE-2019-11135 (ZombieLoad V2, TSX Asynchronous Abort (TAA)): NO + * Affected by CVE-2018-12207 (No eXcuses, iTLB Multihit, machine check exception on page size changes (MCEPSC)): YES + * Affected by CVE-2020-0543 (Special Register Buffer Data Sampling (SRBDS)): NO + + CVE-2017-5753 aka Spectre Variant 1, bounds check bypass + * Mitigated according to the /sys interface: YES (Mitigation: usercopy/swapgs barriers and __user pointer sanitization) + > STATUS: UNKNOWN (/sys vulnerability interface use forced, but its not available!) + + CVE-2017-5715 aka Spectre Variant 2, branch target injection + * Mitigated according to the /sys interface: YES (Mitigation: Enhanced IBRS, IBPB: conditional, RSB filling) + > STATUS: VULNERABLE (IBRS+IBPB or retpoline+IBPB is needed to mitigate the vulnerability) + + CVE-2017-5754 aka Variant 3, Meltdown, rogue data cache load + * Mitigated according to the /sys interface: YES (Not affected) + * Running as a Xen PV DomU: NO + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-3640 aka Variant 3a, rogue system register read + * CPU microcode mitigates the vulnerability: YES + > STATUS: NOT VULNERABLE (your CPU microcode mitigates the vulnerability) + + CVE-2018-3639 aka Variant 4, speculative store bypass + * Mitigated according to the /sys interface: YES (Mitigation: Speculative Store Bypass disabled via prctl and seccomp) + > STATUS: NOT VULNERABLE (Mitigation: Speculative Store Bypass disabled via prctl and seccomp) + + CVE-2018-3615 aka Foreshadow (SGX), L1 terminal fault + * CPU microcode mitigates the vulnerability: YES + > STATUS: NOT VULNERABLE (your CPU microcode mitigates the vulnerability) + + CVE-2018-3620 aka Foreshadow-NG (OS), L1 terminal fault + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (Not affected) + + CVE-2018-3646 aka Foreshadow-NG (VMM), L1 terminal fault + * Information from the /sys interface: Not affected + > STATUS: NOT VULNERABLE (your kernel reported your CPU model as not affected) + + CVE-2018-12126 aka Fallout, microarchitectural store buffer data sampling (MSBDS) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-12130 aka ZombieLoad, microarchitectural fill buffer data sampling (MFBDS) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-12127 aka RIDL, microarchitectural load port data sampling (MLPDS) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2019-11091 aka RIDL, microarchitectural data sampling uncacheable memory (MDSUM) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2019-11135 aka ZombieLoad V2, TSX Asynchronous Abort (TAA) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-12207 aka No eXcuses, iTLB Multihit, machine check exception on page size changes (MCEPSC) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (Not affected) + + CVE-2020-0543 aka Special Register Buffer Data Sampling (SRBDS) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + > SUMMARY: CVE-2017-5753:?? CVE-2017-5715:KO CVE-2017-5754:OK CVE-2018-3640:OK CVE-2018-3639:OK CVE-2018-3615:OK CVE-2018-3620:OK CVE-2018-3646:OK CVE-2018-12126:OK CVE-2018-12130:OK CVE-2018-12127:OK CVE-2019-11091:OK CVE-2019-11135:OK CVE-2018-12207:OK CVE-2020-0543:OK
\ No newline at end of file diff --git a/docs/report/introduction/environment/sut_meltspec_snr.rst b/docs/report/introduction/environment/sut_meltspec_snr.rst new file mode 100644 index 0000000000..0697b27c03 --- /dev/null +++ b/docs/report/introduction/environment/sut_meltspec_snr.rst @@ -0,0 +1,131 @@ +Spectre and Meltdown Checks +^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +Following section displays the output of a running shell script to tell if +system is vulnerable against the several "speculative execution" CVEs that were +made public in 2018. Script is available on `Spectre & Meltdown Checker Github +<https://github.com/speed47/spectre-meltdown-checker>`_. + +:: + + Spectre and Meltdown mitigation detection tool v0.45 + + Checking for vulnerabilities on current system + Kernel is Linux 5.15.0-46-generic #49-Ubuntu SMP Thu Aug 4 18:03:25 UTC 2022 x86_64 + CPU is Intel Atom(R) P5362 processor + + Hardware check + * Hardware support (CPU microcode) for mitigation techniques + * Indirect Branch Restricted Speculation (IBRS) + * SPEC_CTRL MSR is available: YES + * CPU indicates IBRS capability: YES (SPEC_CTRL feature bit) + * Indirect Branch Prediction Barrier (IBPB) + * CPU indicates IBPB capability: YES (SPEC_CTRL feature bit) + * Single Thread Indirect Branch Predictors (STIBP) + * SPEC_CTRL MSR is available: YES + * CPU indicates STIBP capability: YES (Intel STIBP feature bit) + * Speculative Store Bypass Disable (SSBD) + * CPU indicates SSBD capability: YES (Intel SSBD) + * L1 data cache invalidation + * CPU indicates L1D flush capability: YES (L1D flush feature bit) + * Microarchitectural Data Sampling + * VERW instruction is available: YES (MD_CLEAR feature bit) + * Indirect Branch Predictor Controls + * Indirect Predictor Disable feature is available: NO + * Bottomless RSB Disable feature is available: NO + * BHB-Focused Indirect Predictor Disable feature is available: NO + * Enhanced IBRS (IBRS_ALL) + * CPU indicates ARCH_CAPABILITIES MSR availability: YES + * ARCH_CAPABILITIES MSR advertises IBRS_ALL capability: YES + * CPU explicitly indicates not being affected by Meltdown/L1TF (RDCL_NO): YES + * CPU explicitly indicates not being affected by Variant 4 (SSB_NO): NO + * CPU/Hypervisor indicates L1D flushing is not necessary on this system: YES + * Hypervisor indicates host CPU might be affected by RSB underflow (RSBA): NO + * CPU explicitly indicates not being affected by Microarchitectural Data Sampling (MDS_NO): YES + * CPU explicitly indicates not being affected by TSX Asynchronous Abort (TAA_NO): NO + * CPU explicitly indicates not being affected by iTLB Multihit (PSCHANGE_MSC_NO): YES + * CPU explicitly indicates having MSR for TSX control (TSX_CTRL_MSR): NO + * CPU supports Transactional Synchronization Extensions (TSX): NO + * CPU supports Software Guard Extensions (SGX): NO + * CPU supports Special Register Buffer Data Sampling (SRBDS): NO + * CPU microcode is known to cause stability problems: NO (family 0x6 model 0x86 stepping 0x7 ucode 0x4c000019 cpuid 0x80667) + * CPU microcode is the latest known available version: UNKNOWN (latest microcode version for your CPU model is unknown) + * CPU vulnerability to the speculative execution attack variants + * Affected by CVE-2017-5753 (Spectre Variant 1, bounds check bypass): YES + * Affected by CVE-2017-5715 (Spectre Variant 2, branch target injection): YES + * Affected by CVE-2017-5754 (Variant 3, Meltdown, rogue data cache load): NO + * Affected by CVE-2018-3640 (Variant 3a, rogue system register read): YES + * Affected by CVE-2018-3639 (Variant 4, speculative store bypass): YES + * Affected by CVE-2018-3615 (Foreshadow (SGX), L1 terminal fault): NO + * Affected by CVE-2018-3620 (Foreshadow-NG (OS), L1 terminal fault): NO + * Affected by CVE-2018-3646 (Foreshadow-NG (VMM), L1 terminal fault): NO + * Affected by CVE-2018-12126 (Fallout, microarchitectural store buffer data sampling (MSBDS)): NO + * Affected by CVE-2018-12130 (ZombieLoad, microarchitectural fill buffer data sampling (MFBDS)): NO + * Affected by CVE-2018-12127 (RIDL, microarchitectural load port data sampling (MLPDS)): NO + * Affected by CVE-2019-11091 (RIDL, microarchitectural data sampling uncacheable memory (MDSUM)): NO + * Affected by CVE-2019-11135 (ZombieLoad V2, TSX Asynchronous Abort (TAA)): NO + * Affected by CVE-2018-12207 (No eXcuses, iTLB Multihit, machine check exception on page size changes (MCEPSC)): YES + * Affected by CVE-2020-0543 (Special Register Buffer Data Sampling (SRBDS)): NO + + CVE-2017-5753 aka Spectre Variant 1, bounds check bypass + * Mitigated according to the /sys interface: YES (Mitigation: usercopy/swapgs barriers and __user pointer sanitization) + > STATUS: UNKNOWN (/sys vulnerability interface use forced, but its not available!) + + CVE-2017-5715 aka Spectre Variant 2, branch target injection + * Mitigated according to the /sys interface: YES (Mitigation: Enhanced IBRS, IBPB: conditional, RSB filling) + > STATUS: VULNERABLE (IBRS+IBPB or retpoline+IBPB is needed to mitigate the vulnerability) + + CVE-2017-5754 aka Variant 3, Meltdown, rogue data cache load + * Mitigated according to the /sys interface: YES (Not affected) + * Running as a Xen PV DomU: NO + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-3640 aka Variant 3a, rogue system register read + * CPU microcode mitigates the vulnerability: YES + > STATUS: NOT VULNERABLE (your CPU microcode mitigates the vulnerability) + + CVE-2018-3639 aka Variant 4, speculative store bypass + * Mitigated according to the /sys interface: YES (Mitigation: Speculative Store Bypass disabled via prctl and seccomp) + > STATUS: NOT VULNERABLE (Mitigation: Speculative Store Bypass disabled via prctl and seccomp) + + CVE-2018-3615 aka Foreshadow (SGX), L1 terminal fault + * CPU microcode mitigates the vulnerability: N/A + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-3620 aka Foreshadow-NG (OS), L1 terminal fault + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-3646 aka Foreshadow-NG (VMM), L1 terminal fault + * Information from the /sys interface: Not affected + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-12126 aka Fallout, microarchitectural store buffer data sampling (MSBDS) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-12130 aka ZombieLoad, microarchitectural fill buffer data sampling (MFBDS) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-12127 aka RIDL, microarchitectural load port data sampling (MLPDS) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2019-11091 aka RIDL, microarchitectural data sampling uncacheable memory (MDSUM) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2019-11135 aka ZombieLoad V2, TSX Asynchronous Abort (TAA) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-12207 aka No eXcuses, iTLB Multihit, machine check exception on page size changes (MCEPSC) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (Not affected) + + CVE-2020-0543 aka Special Register Buffer Data Sampling (SRBDS) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + > SUMMARY: CVE-2017-5753:?? CVE-2017-5715:KO CVE-2017-5754:OK CVE-2018-3640:OK CVE-2018-3639:OK CVE-2018-3615:OK CVE-2018-3620:OK CVE-2018-3646:OK CVE-2018-12126:OK CVE-2018-12130:OK CVE-2018-12127:OK CVE-2019-11091:OK CVE-2019-11135:OK CVE-2018-12207:OK CVE-2020-0543:OK
\ No newline at end of file diff --git a/docs/report/introduction/environment/sut_meltspec_tsh.rst b/docs/report/introduction/environment/sut_meltspec_tsh.rst new file mode 100644 index 0000000000..bfa27fb34b --- /dev/null +++ b/docs/report/introduction/environment/sut_meltspec_tsh.rst @@ -0,0 +1,96 @@ +Spectre and Meltdown Checks +^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +Following section displays the output of a running shell script to tell if +system is vulnerable against the several "speculative execution" CVEs that were +made public in 2018. Script is available on `Spectre & Meltdown Checker Github +<https://github.com/speed47/spectre-meltdown-checker>`_. + +:: + + Spectre and Meltdown mitigation detection tool v0.45 + + Checking for vulnerabilities on current system + Kernel is Linux 5.15.0-46-generic #49-Ubuntu SMP Thu Aug 4 18:08:11 UTC 2022 aarch64 + CPU is ARM v8 model 0xd08 + + Hardware check + * CPU vulnerability to the speculative execution attack variants + * Affected by CVE-2017-5753 (Spectre Variant 1, bounds check bypass): YES + * Affected by CVE-2017-5715 (Spectre Variant 2, branch target injection): YES + * Affected by CVE-2017-5754 (Variant 3, Meltdown, rogue data cache load): NO + * Affected by CVE-2018-3640 (Variant 3a, rogue system register read): YES + * Affected by CVE-2018-3639 (Variant 4, speculative store bypass): YES + * Affected by CVE-2018-3615 (Foreshadow (SGX), L1 terminal fault): NO + * Affected by CVE-2018-3620 (Foreshadow-NG (OS), L1 terminal fault): NO + * Affected by CVE-2018-3646 (Foreshadow-NG (VMM), L1 terminal fault): NO + * Affected by CVE-2018-12126 (Fallout, microarchitectural store buffer data sampling (MSBDS)): NO + * Affected by CVE-2018-12130 (ZombieLoad, microarchitectural fill buffer data sampling (MFBDS)): NO + * Affected by CVE-2018-12127 (RIDL, microarchitectural load port data sampling (MLPDS)): NO + * Affected by CVE-2019-11091 (RIDL, microarchitectural data sampling uncacheable memory (MDSUM)): NO + * Affected by CVE-2019-11135 (ZombieLoad V2, TSX Asynchronous Abort (TAA)): NO + * Affected by CVE-2018-12207 (No eXcuses, iTLB Multihit, machine check exception on page size changes (MCEPSC)): NO + * Affected by CVE-2020-0543 (Special Register Buffer Data Sampling (SRBDS)): NO + + CVE-2017-5753 aka Spectre Variant 1, bounds check bypass + * Mitigated according to the /sys interface: YES (Mitigation: __user pointer sanitization) + > STATUS: UNKNOWN (/sys vulnerability interface use forced, but its not available!) + + CVE-2017-5715 aka Spectre Variant 2, branch target injection + * Mitigated according to the /sys interface: NO (Vulnerable) + > STATUS: VULNERABLE (Branch predictor hardening is needed to mitigate the vulnerability) + + CVE-2017-5754 aka Variant 3, Meltdown, rogue data cache load + * Mitigated according to the /sys interface: YES (Not affected) + * Running as a Xen PV DomU: NO + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-3640 aka Variant 3a, rogue system register read + * CPU microcode mitigates the vulnerability: NO + > STATUS: VULNERABLE (an up-to-date CPU microcode is needed to mitigate this vulnerability) + + CVE-2018-3639 aka Variant 4, speculative store bypass + * Mitigated according to the /sys interface: NO (Vulnerable) + > STATUS: VULNERABLE (Neither your CPU nor your kernel support SSBD) + + CVE-2018-3615 aka Foreshadow (SGX), L1 terminal fault + * CPU microcode mitigates the vulnerability: N/A + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-3620 aka Foreshadow-NG (OS), L1 terminal fault + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-3646 aka Foreshadow-NG (VMM), L1 terminal fault + * Information from the /sys interface: Not affected + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-12126 aka Fallout, microarchitectural store buffer data sampling (MSBDS) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-12130 aka ZombieLoad, microarchitectural fill buffer data sampling (MFBDS) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-12127 aka RIDL, microarchitectural load port data sampling (MLPDS) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2019-11091 aka RIDL, microarchitectural data sampling uncacheable memory (MDSUM) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2019-11135 aka ZombieLoad V2, TSX Asynchronous Abort (TAA) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-12207 aka No eXcuses, iTLB Multihit, machine check exception on page size changes (MCEPSC) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2020-0543 aka Special Register Buffer Data Sampling (SRBDS) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + > SUMMARY: CVE-2017-5753:?? CVE-2017-5715:KO CVE-2017-5754:OK CVE-2018-3640:KO CVE-2018-3639:KO CVE-2018-3615:OK CVE-2018-3620:OK CVE-2018-3646:OK CVE-2018-12126:OK CVE-2018-12130:OK CVE-2018-12127:OK CVE-2019-11091:OK CVE-2019-11135:OK CVE-2018-12207:OK CVE-2020-0543:OK diff --git a/docs/report/introduction/environment/sut_meltspec_tx2.rst b/docs/report/introduction/environment/sut_meltspec_tx2.rst new file mode 100644 index 0000000000..f12113a8bf --- /dev/null +++ b/docs/report/introduction/environment/sut_meltspec_tx2.rst @@ -0,0 +1,143 @@ +Spectre and Meltdown Checks +^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +Following section displays the output of a running shell script to tell if +system is vulnerable against the several "speculative execution" CVEs that were +made public in 2018. Script is available on `Spectre & Meltdown Checker Github +<https://github.com/speed47/spectre-meltdown-checker>`_. + +:: + + Spectre and Meltdown mitigation detection tool v0.44+ + + Checking for vulnerabilities on current system + Kernel is Linux 5.4.0-65-generic #73-Ubuntu SMP Mon Jan 18 17:27:25 UTC 2021 aarch64 + CPU is + + Hardware check + * CPU vulnerability to the speculative execution attack variants + * Affected by CVE-2017-5753 (Spectre Variant 1, bounds check bypass): YES + * Affected by CVE-2017-5715 (Spectre Variant 2, branch target injection): YES + * Affected by CVE-2017-5754 (Variant 3, Meltdown, rogue data cache load): NO + * Affected by CVE-2018-3640 (Variant 3a, rogue system register read): NO + * Affected by CVE-2018-3639 (Variant 4, speculative store bypass): YES + * Affected by CVE-2018-3615 (Foreshadow (SGX), L1 terminal fault): NO + * Affected by CVE-2018-3620 (Foreshadow-NG (OS), L1 terminal fault): NO + * Affected by CVE-2018-3646 (Foreshadow-NG (VMM), L1 terminal fault): NO + * Affected by CVE-2018-12126 (Fallout, microarchitectural store buffer data sampling (MSBDS)): NO + * Affected by CVE-2018-12130 (ZombieLoad, microarchitectural fill buffer data sampling (MFBDS)): NO + * Affected by CVE-2018-12127 (RIDL, microarchitectural load port data sampling (MLPDS)): NO + * Affected by CVE-2019-11091 (RIDL, microarchitectural data sampling uncacheable memory (MDSUM)): NO + * Affected by CVE-2019-11135 (ZombieLoad V2, TSX Asynchronous Abort (TAA)): NO + * Affected by CVE-2018-12207 (No eXcuses, iTLB Multihit, machine check exception on page size changes (MCEPSC)): NO + * Affected by CVE-2020-0543 (Special Register Buffer Data Sampling (SRBDS)): NO + + CVE-2017-5753 aka Spectre Variant 1, bounds check bypass + * Mitigated according to the /sys interface: YES (Mitigation: __user pointer sanitization) + * Kernel has array_index_mask_nospec: NO + * Kernel has the Red Hat/Ubuntu patch: NO + * Kernel has mask_nospec64 (arm64): NO + * Kernel has array_index_nospec (arm64): NO + * Checking count of LFENCE instructions following a jump in kernel... NO (only 0 jump-then-lfence instructions found, should be >= 30 (heuristic)) + > STATUS: NOT VULNERABLE (Mitigation: __user pointer sanitization) + + CVE-2017-5715 aka Spectre Variant 2, branch target injection + * Mitigated according to the /sys interface: NO (Vulnerable) + * Mitigation 1 + * Kernel is compiled with IBRS support: YES + * IBRS enabled and active: NO + * Kernel is compiled with IBPB support: NO + * IBPB enabled and active: NO + * Mitigation 2 + * Kernel has branch predictor hardening (arm): YES + * Kernel compiled with retpoline option: NO + > STATUS: NOT VULNERABLE (Branch predictor hardening mitigates the vulnerability) + + CVE-2017-5754 aka Variant 3, Meltdown, rogue data cache load + * Mitigated according to the /sys interface: YES (Not affected) + * Kernel supports Page Table Isolation (PTI): YES + * PTI enabled and active: UNKNOWN (dmesg truncated, please reboot and relaunch this script) + * Reduced performance impact of PTI: NO (PCID/INVPCID not supported, performance impact of PTI will be significant) + * Running as a Xen PV DomU: NO + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not vulnerable) + + CVE-2018-3640 aka Variant 3a, rogue system register read + * CPU microcode mitigates the vulnerability: NO + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not vulnerable) + + CVE-2018-3639 aka Variant 4, speculative store bypass + * Mitigated according to the /sys interface: NO (Vulnerable) + * Kernel supports disabling speculative store bypass (SSB): YES (found in /proc/self/status) + * SSB mitigation is enabled and active: NO + > STATUS: VULNERABLE (Your CPU doesnt support SSBD) + + CVE-2018-3615 aka Foreshadow (SGX), L1 terminal fault + * CPU microcode mitigates the vulnerability: N/A + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not vulnerable) + + CVE-2018-3620 aka Foreshadow-NG (OS), L1 terminal fault + * Mitigated according to the /sys interface: YES (Not affected) + * Kernel supports PTE inversion: NO + * PTE inversion enabled and active: NO + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not vulnerable) + + CVE-2018-3646 aka Foreshadow-NG (VMM), L1 terminal fault + * Information from the /sys interface: Not affected + * This system is a host running a hypervisor: NO + * Mitigation 1 (KVM) + * EPT is disabled: N/A (the kvm_intel module is not loaded) + * Mitigation 2 + * L1D flush is supported by kernel: NO + * L1D flush enabled: NO + * Hardware-backed L1D flush supported: NO (flush will be done in software, this is slower) + * Hyper-Threading (SMT) is enabled: UNKNOWN + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not vulnerable) + + CVE-2018-12126 aka Fallout, microarchitectural store buffer data sampling (MSBDS) + * Mitigated according to the /sys interface: YES (Not affected) + * Kernel supports using MD_CLEAR mitigation: NO + * Kernel mitigation is enabled and active: NO + * SMT is either mitigated or disabled: NO + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not vulnerable) + + CVE-2018-12130 aka ZombieLoad, microarchitectural fill buffer data sampling (MFBDS) + * Mitigated according to the /sys interface: YES (Not affected) + * Kernel supports using MD_CLEAR mitigation: NO + * Kernel mitigation is enabled and active: NO + * SMT is either mitigated or disabled: NO + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not vulnerable) + + CVE-2018-12127 aka RIDL, microarchitectural load port data sampling (MLPDS) + * Mitigated according to the /sys interface: YES (Not affected) + * Kernel supports using MD_CLEAR mitigation: NO + * Kernel mitigation is enabled and active: NO + * SMT is either mitigated or disabled: NO + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not vulnerable) + + CVE-2019-11091 aka RIDL, microarchitectural data sampling uncacheable memory (MDSUM) + * Mitigated according to the /sys interface: YES (Not affected) + * Kernel supports using MD_CLEAR mitigation: NO + * Kernel mitigation is enabled and active: NO + * SMT is either mitigated or disabled: NO + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not vulnerable) + + CVE-2019-11135 aka ZombieLoad V2, TSX Asynchronous Abort (TAA) + * Mitigated according to the /sys interface: YES (Not affected) + * TAA mitigation is supported by kernel: YES (found tsx_async_abort in kernel image) + * TAA mitigation enabled and active: NO + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not vulnerable) + + CVE-2018-12207 aka No eXcuses, iTLB Multihit, machine check exception on page size changes (MCEPSC) + * Mitigated according to the /sys interface: YES (Not affected) + * This system is a host running a hypervisor: NO + * iTLB Multihit mitigation is supported by kernel: YES (found itlb_multihit in kernel image) + * iTLB Multihit mitigation enabled and active: NO + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not vulnerable) + + CVE-2020-0543 aka Special Register Buffer Data Sampling (SRBDS) + * Mitigated according to the /sys interface: YES (Not affected) + * SRBDS mitigation control is supported by the kernel: NO + * SRBDS mitigation control is enabled and active: NO + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not vulnerable) + + > SUMMARY: CVE-2017-5753:OK CVE-2017-5715:OK CVE-2017-5754:OK CVE-2018-3640:OK CVE-2018-3639:KO CVE-2018-3615:OK CVE-2018-3620:OK CVE-2018-3646:OK CVE-2018-12126:OK CVE-2018-12130:OK CVE-2018-12127:OK CVE-2019-11091:OK CVE-2019-11135:OK CVE-2018-12207:OK CVE-2020-0543:OK
\ No newline at end of file diff --git a/docs/report/introduction/environment/sut_meltspec_zn2.rst b/docs/report/introduction/environment/sut_meltspec_zn2.rst new file mode 100644 index 0000000000..160585dac1 --- /dev/null +++ b/docs/report/introduction/environment/sut_meltspec_zn2.rst @@ -0,0 +1,117 @@ +Spectre and Meltdown Checks +^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +Following section displays the output of a running shell script to tell if +system is vulnerable against the several speculative execution CVEs that were +made public in 2018. Script is available on `Spectre & Meltdown Checker Github +<https://github.com/speed47/spectre-meltdown-checker>`_. + +:: + + Spectre and Meltdown mitigation detection tool v0.45 + + Checking for vulnerabilities on current system + Kernel is Linux 5.15.0-46-generic #49-Ubuntu SMP Thu Aug 4 18:03:25 UTC 2022 x86_64 + CPU is AMD EPYC 7532 32-Core Processor + + Hardware check + * Hardware support (CPU microcode) for mitigation techniques + * Indirect Branch Restricted Speculation (IBRS) + * SPEC_CTRL MSR is available: YES + * CPU indicates IBRS capability: YES (IBRS_SUPPORT feature bit) + * CPU indicates preferring IBRS always-on: NO + * CPU indicates preferring IBRS over retpoline: YES + * Indirect Branch Prediction Barrier (IBPB) + * CPU indicates IBPB capability: YES (IBPB_SUPPORT feature bit) + * Single Thread Indirect Branch Predictors (STIBP) + * SPEC_CTRL MSR is available: YES + * CPU indicates STIBP capability: YES (AMD STIBP feature bit) + * CPU indicates preferring STIBP always-on: NO + * Speculative Store Bypass Disable (SSBD) + * CPU indicates SSBD capability: YES (AMD SSBD in SPEC_CTRL) + * L1 data cache invalidation + * CPU indicates L1D flush capability: NO + * CPU supports Transactional Synchronization Extensions (TSX): NO + * CPU supports Software Guard Extensions (SGX): NO + * CPU supports Special Register Buffer Data Sampling (SRBDS): NO + * CPU microcode is known to cause stability problems: NO (family 0x17 model 0x31 stepping 0x0 ucode 0x8301038 cpuid 0x830f10) + * CPU microcode is the latest known available version: NO (latest version is 0x8301052 dated 2021/11/11 according to builtin firmwares DB v222+i20220208) + * CPU vulnerability to the speculative execution attack variants + * Affected by CVE-2017-5753 (Spectre Variant 1, bounds check bypass): YES + * Affected by CVE-2017-5715 (Spectre Variant 2, branch target injection): YES + * Affected by CVE-2017-5754 (Variant 3, Meltdown, rogue data cache load): NO + * Affected by CVE-2018-3640 (Variant 3a, rogue system register read): NO + * Affected by CVE-2018-3639 (Variant 4, speculative store bypass): YES + * Affected by CVE-2018-3615 (Foreshadow (SGX), L1 terminal fault): NO + * Affected by CVE-2018-3620 (Foreshadow-NG (OS), L1 terminal fault): NO + * Affected by CVE-2018-3646 (Foreshadow-NG (VMM), L1 terminal fault): NO + * Affected by CVE-2018-12126 (Fallout, microarchitectural store buffer data sampling (MSBDS)): NO + * Affected by CVE-2018-12130 (ZombieLoad, microarchitectural fill buffer data sampling (MFBDS)): NO + * Affected by CVE-2018-12127 (RIDL, microarchitectural load port data sampling (MLPDS)): NO + * Affected by CVE-2019-11091 (RIDL, microarchitectural data sampling uncacheable memory (MDSUM)): NO + * Affected by CVE-2019-11135 (ZombieLoad V2, TSX Asynchronous Abort (TAA)): NO + * Affected by CVE-2018-12207 (No eXcuses, iTLB Multihit, machine check exception on page size changes (MCEPSC)): NO + * Affected by CVE-2020-0543 (Special Register Buffer Data Sampling (SRBDS)): NO + + CVE-2017-5753 aka Spectre Variant 1, bounds check bypass + * Mitigated according to the /sys interface: YES (Mitigation: usercopy/swapgs barriers and __user pointer sanitization) + > STATUS: UNKNOWN (/sys vulnerability interface use forced, but its not available!) + + CVE-2017-5715 aka Spectre Variant 2, branch target injection + * Mitigated according to the /sys interface: YES (Mitigation: Retpolines, IBPB: conditional, IBRS_FW, STIBP: always-on, RSB filling) + > STATUS: VULNERABLE (retpoline+IBPB is needed to mitigate the vulnerability) + + CVE-2017-5754 aka Variant 3, Meltdown, rogue data cache load + * Mitigated according to the /sys interface: YES (Not affected) + * Running as a Xen PV DomU: NO + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-3640 aka Variant 3a, rogue system register read + * CPU microcode mitigates the vulnerability: YES + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-3639 aka Variant 4, speculative store bypass + * Mitigated according to the /sys interface: YES (Mitigation: Speculative Store Bypass disabled via prctl and seccomp) + > STATUS: NOT VULNERABLE (Mitigation: Speculative Store Bypass disabled via prctl and seccomp) + + CVE-2018-3615 aka Foreshadow (SGX), L1 terminal fault + * CPU microcode mitigates the vulnerability: N/A + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-3620 aka Foreshadow-NG (OS), L1 terminal fault + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-3646 aka Foreshadow-NG (VMM), L1 terminal fault + * Information from the /sys interface: Not affected + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-12126 aka Fallout, microarchitectural store buffer data sampling (MSBDS) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-12130 aka ZombieLoad, microarchitectural fill buffer data sampling (MFBDS) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-12127 aka RIDL, microarchitectural load port data sampling (MLPDS) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2019-11091 aka RIDL, microarchitectural data sampling uncacheable memory (MDSUM) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2019-11135 aka ZombieLoad V2, TSX Asynchronous Abort (TAA) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2018-12207 aka No eXcuses, iTLB Multihit, machine check exception on page size changes (MCEPSC) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + CVE-2020-0543 aka Special Register Buffer Data Sampling (SRBDS) + * Mitigated according to the /sys interface: YES (Not affected) + > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not affected) + + > SUMMARY: CVE-2017-5753:?? CVE-2017-5715:KO CVE-2017-5754:OK CVE-2018-3640:OK CVE-2018-3639:OK CVE-2018-3615:OK CVE-2018-3620:OK CVE-2018-3646:OK CVE-2018-12126:OK CVE-2018-12130:OK CVE-2018-12127:OK CVE-2019-11091:OK CVE-2019-11135:OK CVE-2018-12207:OK CVE-2020-0543:OK
\ No newline at end of file diff --git a/docs/report/introduction/environment/tg.rst b/docs/report/introduction/environment/tg.rst new file mode 100644 index 0000000000..411af83eb5 --- /dev/null +++ b/docs/report/introduction/environment/tg.rst @@ -0,0 +1,72 @@ +.. _test_environment_tg: + +TG Settings - TRex +------------------ + +TG Version +~~~~~~~~~~ + +|trex-release| + +DPDK Version +~~~~~~~~~~~~ + +DPDK v21.02 + +TG Installation +~~~~~~~~~~~~~~~ + +T-Rex installation is managed via Ansible role. + +TG Startup Configuration +~~~~~~~~~~~~~~~~~~~~~~~~ + +:: + + $ sudo -E -S sh -c 'cat << EOF > /etc/trex_cfg.yaml + - version: 2 + c: 8 + limit_memory: 8192 + interfaces: ["${pci1}","${pci2}"] + port_info: + - dest_mac: [${dest_mac1}] + src_mac: [${src_mac1}] + - dest_mac: [${dest_mac2}] + src_mac: [${src_mac2}] + platform : + master_thread_id: 0 + latency_thread_id: 9 + dual_if: + - socket: 0 + threads: [1, 2, 3, 4, 5, 6, 7, 8] + EOF' + +TG Startup Command (Stateless Mode) +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +:: + + $ sudo -E -S sh -c "cd '${trex_install_dir}/scripts/' && \ + nohup ./t-rex-64 -i --prefix $(hostname) --hdrh --no-scapy-server \ + --mbuf-factor 32 > /tmp/trex.log 2>&1 &" > /dev/null + +Also, Python client is now starting traffic with: + +:: + + core_mask=STLClient.CORE_MASK_PIN + +TG Startup Command (Stateful Mode) +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +:: + + $ sudo -E -S sh -c "cd '${trex_install_dir}/scripts/' && \ + nohup ./t-rex-64 -i --prefix $(hostname) --astf --hdrh --no-scapy-server \ + --mbuf-factor 32 > /tmp/trex.log 2>&1 &" > /dev/null + + +TG API Driver +~~~~~~~~~~~~~ + +`TRex driver`_ |