Kernel PTI not enabled by default on Atom C3558 in latest 2.4.4RC

Grimson

Make sure you have a BIOS with the required microcode update, AFAIK Kernel PTI will not self-activate without it.

Chucko

I have the latest BIOS on this system, version 1.1, dated 8/28/2018.

Chucko

@stephenw10 /boot/loader.conf.local was NOT preserved when I upgraded to 2.4.4 RELEASE.

This is a bug.

Fortunately KPTI is enabled by default this time.

stephenw10

Please open a bug report and give as much detail as possible. https://redmine.pfsense.org

Steve

maoe-tsuru

I have the same issue on my Netgate XG-7100 here:

Hardware: XG-7100
CPU: C3558
BIOS: ADI_PLCC-01.00.00.10
2.4.4-RELEASE

The kernel PTI checkbox is unchecked and the dashboard says Kernel PTI is disabled. /boot/loader.conf doesn't contain vm.pmap.pti: 1.

stephenw10

Was that after upgrading to 2.4.4 or a clean install?

Steve

MikeV7896

I thought that Atom C3xxx support was added with FreeBSD 11.2, so at some point it would have been a clean install of 2.4.4... though it could have been an upgrade from beta to release...

BTW, I have the same SuperMicro board as the OP, with the same BIOS update, and I'm still not seeing PTI enabled, even after checking and unchecking the advanced setting box. I haven't tried forcing it myself with loader.conf.local. My system was running 2.4.4 snapshots, and is currently running 2.4.4 release, though it was an upgrade from the RC version.

jimp

If PTI defaults to off, congratulations, your CPU is not affected by Meltdown and does not need PTI.

Some extra clarification text here: https://redmine.pfsense.org/issues/9026

stephenw10

It was for C3000 in general but we backported the drivers for our XG-7100 into 2.4.3.

However looking into this kernel pti can be disabled by default if the CPU indicates it is not required using the IA32_ARCH_CAP_RDCL_NO bit:
https://github.com/freebsd/freebsd/blob/master/sys/x86/x86/identcpu.c#L1627

So if you have a new enough CPU you may see this.

We have put in some changes to indicate that. The checkbox is effectively 'forced disabled' or default. There is no force enabled option currently.

Steve

Chucko

@virgiliomi As of 2.4.4 release, my system is showing KPTI enabled on the dashboard.