Open adrelanos opened 2 months ago
vstakhov
commented
2 months ago Rspamd is expected to get SIGILL when testing instructions set. Why it is not handled properly is likely your system's issue, not an Rspamd one. Please check your OS documentation.
adrelanos
commented
2 months ago This was caused by security-misc configuration file /etc/default/grub.d/40_cpu_mitigations.cfg (https://github.com/Kicksecure/security-misc/pull/218), namely by kernel parameter:
## Enable Gather Data Sampling (GDS) mitigation.
## Note for systems that have not received a suitable microcode update this will
## entirely disable use of the AVX instructions set.
##
## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/gather_data_sampling.html
##
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX gather_data_sampling=force"Quote from the kernel manual:
GDS can also be mitigated on systems that don’t have updated microcode by disabling AVX. This can be done by setting gather_data_sampling=”force” or “clearcpuid=avx” on the kernel command-line.
If used, these options will disable AVX use by turning off XSAVE YMM support. However, the processor will still enumerate AVX support. Userspace that does not follow proper AVX enumeration to check both AVX and XSAVE YMM support will break.
Does rspamd follow proper AVX enumeration to check both AVX and XSAVE YMM support?
GNU wc - (from coreutils) also had this issue.
Debian bookworm:
wc -lzsh: illegal hardware instruction (core dumped) wc -l
Debian bookworm with a Debian trixie chroot:
functional
rspamd is still broken in the Debian trixie chroot.
Perhaps GNU wc fixed it with this commit?
Perhaps there is an old AVX API and a new AVX API? wc (trixie version) using the newer API. rspamd using the older AVX API, therefore broken?
rspamd is now the only broken binary for me with no upstream fix available and with no confirmed upstream bug.
vstakhov
commented
2 months ago Gnu binutils use __builtin_cpu_supports and that's why it works - merely with the most recent gcc/clang. I don't see that as a good alternative to what Rspamd does (at least a necessary one)... However, I'd be happy to review any patches on that.
vstakhov
commented
2 months ago Or maybe it's now quite an old compiler's feature from what I see, so we can/should presumably rely on it.
vstakhov
commented
2 months ago Could you please check if https://github.com/rspamd/rspamd/pull/5140 helps with your issue?
adrelanos
commented
2 months ago I need to figure out how to compile rspamd from source code, while using that pull request, which could take a while. If it was available from the Debian repository, I could test it much faster.
fatalbanana
commented
2 months ago I need to figure out how to compile rspamd from source code, while using that pull request, which could take a while. If it was available from the Debian repository, I could test it much faster.
On Debianalikes the easiest way is to build the package, you can find hints about how to do that here. Missing step from those instructions is installation of libhyperscan-dev, which is currently intentionally missing from debian/control.
adrelanos
commented
2 months ago Could you please check if #5140 helps with your issue?
Yes, fixed.
Prerequisites
Done.
Not module related, not applicable, not done.
Done.
Done. (Described below in this report.)
Not experimental / master branch.
Steps to Reproduce
(But
--versionis just to show that there is a grave issue here.rspamdis totally broken, unsuable for me on that system.)Expected behavior
Show version, no error.
Actual behavior
Versions
3.9.1-1from rspamd repository.Actually, Kicksecure which comes with security-misc, which enables a lot of kernel security related kernel parameters and sysctl.
Additional Information
cpuinfo of broken system:
Here is another cpuinfo of a functional system with an idential system configuration.
Here is the
diff broken ok(broken /proc/cpuinfo CPU versus functional /proc/cpuinfo CPU):Why did I attach the CPU info of both, a broken machine and a functional machine? Because I am suspecting this could be CPU related. The broken CPU for example lacks a few CPU flags such as
avx.In summary:
model name : Intel(R) Core(TM) i7-6700 CPU @ 3.40GHz- issuemodel name : Intel(R) Core(TM) i7-7700 CPU @ 3.60GHz- no issueASAN build
How about ASAN builds?
It does not create a core file. I have no idea why. Only rspamd / rspamd-dbg version creates core files. Why rspamd-asan does not create core files I don't know. Should be the same, right? Once I figured out how to create core files it should always be functional?