limetech

For tehuti in this 6.7.1 release we're using tn40xx-0.3.6.17 for 6.8 beta we're using tn40xx-0.3.6.17.2 - which only change supposedly is to compile against 5.x Linux kernel. For intel in 6.7.1 release, correct: 5.5.5 for Unraid 6.8 beta - we still use stock ixgbe drivers because still Intel has not released build for Linux 5.x kernel.

Damn, I do follow that repo and also the slackware64-current package list. What happened with this release, was that it was actually built and tested a couple days ago when 4.19.53 was released. Then noticed kernel was up to .55 very quickly and in looking at change log there is a single change (probably related to 'sack panic' changes) - and any time Greg K-H creates another patch release with a single change, it's probably important 😳 So I did a quick kernel update and rebuilt this 6.7.1 release & didn't notice that firmware update from yesterday - yeah this stuff is changing rapidly these days! How important is the f/w update to you? I can generate a 6.7.2 pretty quickly if so...

To upgrade: If you are running any 6.4 or later release, click 'Check for Updates' on the Tools/Update OS page. If you are running a pre-6.4 release, click 'Check for Updates' on the Plugins page. If the above doesn't work, navigate to Plugins/Install Plugin, select/copy/paste this plugin URL and click Install: https://s3.amazonaws.com/dnld.lime-technology.com/stable/unRAIDServer.plg Refer also to @ljm42 excellent 6.4 Update Notes which are helpful especially if you are upgrading from a pre-6.4 release. Bugs: If you discover a bug or other issue in this release, please open a Stable Releases Bug Report. This is a bug fix and security update release. Due to another set of processor vulnerabilities called Zombieland, and a set of TCP denial-of-service vulnerabilities called SACK panic, all users are encouraged to update. We are also still trying to track down the source of SQLite Database corruption. It will also be very helpful for those affected by this issue to also upgrade to this release. Version 6.7.1 2019-06-22 Base distro: btrfs-progs: version 5.1.1 curl: version 7.65.1 (CVE-2019-5435, CVE-2019-5436) dhcpcd: version 7.2.2 docker: version 18.09.6 kernel-firmware: version 20190607_1884732 mozilla-firefox: version 66.0.5 openssl: version 1.1.1c openssl-solibs: version 1.1.1c php: version 7.2.19 (removed sqlite support) samba: version 4.9.8 (CVE-2018-16860) xfsprogs: version 5.0.0 Linux kernel: version: 4.19.55 (CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091, CVE-2019-11833, CVE-2019-11477, CVE-2019-11478, CVE-2019-11479) intel-microcode: version 20190618 Management: shfs: support FUSE use_ino option Dashboard: added draggable fields in table Dashboard: added custom case image selection Dashboard: enhanced sorting Docker + VM: enhanced sorting Docker: disable button "Update All" instead of hiding it when no updates are available Fix OS update banner overhanging in Auzre / Gray themes Do not allow plugin updates to same version misc style corrections

Yup.

Link?

There have been 5 kernel patch releases since 6.7.1-rc1 and there don't appear to be any problems with Zombieland mitigation. We updated a few security-related patches, but I want to give this a few days of wider testing before publishing to stable. Please post here in this topic, any issues you run across which are not present in 6.7.0 also - that is, issue that you think can be directly attributed to the microcode and/or kernel changes. Version 6.7.1-rc2 2019-06-08 Base distro: curl: version 7.65.0 (CVE-2019-5435, CVE-2019-5436) docker: version 18.09.6 kernel-firmware: version 20190514_711d329 mozilla-firefox: version 66.0.5 samba: version 4.9.8 (CVE-2018-16860) Linux kernel: version: 4.19.48 (CVE-2019-11833) Management: shfs: support FUSE use_ino option Dashboard: added draggable fields in table Dashboard: added custom case image selection Dashboard: enhanced sorting Docker + VM: enhanced sorting Docker: disable button "Update All" instead of hiding it when no updates are available Fix OS update banner overhanging in Auzre / Gray themes Don't allow plugin updates to same version misc style corrections

This has been cleared up.

Nice work! Right, I think a better place would be in the Security Board. If you want to add the post there, I'll make it 'sticky'. Also, thanks to all testing this out. We have no choice but to keep marching on with new kernel releases.

At least Intel admits their mistakes, AMD has never chimed in on an obvious power issue with Ryzen: https://bugzilla.kernel.org/show_bug.cgi?id=196683#c602 The Kernel knows what CPU you are using and adjusts appropriately.

phoronix articles are good but the comments always make my eyes bleed 😱

There are several ways to disable the various mitigations, both via kernel parameters and at run-time (though this will require us to include 'debugfs' which we can do). Google 'linux disable meltdown spectre zombieland mitigations' for a number of how-to articles. If it gets serious enough we'll probably add debugfs support and perhaps a config page. Having all these mitigations in place is mainly a C.Y.A. move in my opinion.

A better article, complete with scary videos: https://www.bleepingcomputer.com/news/security/new-ridl-and-fallout-attacks-impact-all-modern-intel-cpus/

Unless something broke inadvertently in the kernel.

No, don't need to make any changes if all is working as it should.

This is a special release in light of the recent so-called Zombieland vulnerability revealed by Intel earlier this week. Normally we don't generate -rc stable patch releases, however in the interest of maintaining our, and the Community's sanity, this release is exactly the same as 6.7.0 except for updated Intel CPU microcode and corresponding Linux kernel (4.19.43). If 6.7.1-rc1 "fails" with something but 6.7.0 "works" then we can be fairly confident microcode/kernel to blame. We have released this on the next branch in order to get some testing before publishing for everyone on stable. Please post here in this topic, any issues you run across which are not present in 6.7.0 also - that is, issue that you think can be directly attributed to the microcode and/or kernel changes. Version 6.7.1-rc1 2019-05-17 Linux kernel: version: 4.19.43 intel-microcode: version 20190514a

I think the main concern are the Enterprise and Cloud compute servers which make use of virtualization to let multiple clients use the same h/w.

At present we don't have a stance. To my knowledge I don't think there have been any verified spectre/meltdown/zombieland attacks "in the wild" to date.

Thanks, saw that. The plan is to release 6.7.1-rc1 on the 'next' release branch with only differences from 6.7.0 are updated Intel microcode and corresponding Linux kernel. The microcode seems to be a "moving target" so we'll let this soak for a while before release 6.7.1.

You can try this:

Yes we're watching this and waiting for the microcode release. Interesting comment from Greg K-H: Doesn't exactly give you the "warm and fuzzies" right? Then again, could be worse: think of the headaches over at Intel 🤣

Def has an icon, maybe clear your browser cache.

For those suffering Marvell-Dropped-Drives-Syndrome, please try this test:

I guess you guys weren't around when all the colored indicators were changed to shapes to accommodate color blind users 😮 An idea which may or may not gain traction is to keep icons for built-in functionality in the new style, and icons for add-ons colored.

Not blaming the user, simply offering an alternative to get server back working again. Sometimes the easiest solution is a h/w one. Sometimes the only solution is a h/w one. But to your point: You're right: something broke in the kernel. When this was first reported we spent quite a bit of time, short of bisecting the kernel, to find out what might have caused this. We are willing to try any patch you, or someone else might run across. For example, take a look at this post in the -rc8 release topic regarding the 'hpsa' storage driver. I delayed this 6.7.0 release a day to put this patch in, and user has reported that it works and fixes the issue. Note that we never see these kinds of issues in the h/w we have - we would not publish a release where we see problems like this. When I see an issue like this, first thing I do is 'google' the error message and start searching for similar reports. But I can't spend more than a few hours doing this on any one issue. If a solution is not apparent, then I let it sit for a while because eventually it will happen in one of the bigger distros such as Ubuntu or Fedora, and those guys have the resources to further investigate the problem. This is kinda how it works with open source unfortunately.

Sure