1

I used the spectre-meltdown-checker, version 0.42, without any option resulting in all-green results. But, in a help page, I found the --paranoid switch, which resulted in about a half of later CVEs to become red. I read what it told me, that for full mitigation I would have to disable hyper-threading, it scared me off a little bit, so I better did so, resulting in only one remaining red flag being CVE-2018-3646 = L1D unconditional flushing should be enabled to fully mitigate the vulnerability.


Laptop: Dell Inspiron 15 with latest BIOS (1.8.0, link for details).

Processor: Intel© Core™ i7-7700HQ (link to Intel Ark).

Linux Kernel: 4.15.0-65-generic; full uname -a:

Linux dell-7577 4.15.0-65-generic #74-Ubuntu SMP Tue Sep 17 17:06:04 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

For completeness, I add info from the help on the --paranoid switch:

--paranoid      require IBPB to deem Variant 2 as mitigated
                also require SMT disabled + unconditional L1D flush to deem Foreshadow-NG VMM as mitigated
                also require SMT disabled to deem MDS vulnerabilities mitigated

CVE-2018-3646 aka 'Foreshadow-NG (VMM), L1 terminal fault'
* Information from the /sys interface: Mitigation: PTE Inversion; VMX: conditional cache flushes, SMT vulnerable
* This system is a host running a hypervisor:  YES  (paranoid mode)
* Mitigation 1 (KVM)
  * EPT is disabled:  NO 
* Mitigation 2
  * L1D flush is supported by kernel:  YES  (found flush_l1d in /proc/cpuinfo)
  * L1D flush enabled:  YES  (conditional flushes)
  * Hardware-backed L1D flush supported:  YES  (performance impact of the mitigation will be greatly reduced)
  * Hyper-Threading (SMT) is enabled:  YES 
> STATUS:  VULNERABLE  (enable L1D unconditional flushing and disable Hyper-Threading to fully mitigate the vulnerability)

Actual question

Apart from disabling Hyper-Threading, how do I enable this unconditional L1D flush?

3

I did a little bit of digging, and this vulnerability in the documentation is referred to as:

L1TF = L1 Terminal Fault

Actually I found the kernel documentation directly, a quote:

l1tf=   [X86] Control mitigation of the L1TF vulnerability on
        affected CPUs

        The kernel PTE inversion protection is unconditionally
        enabled and cannot be disabled.

        full
            Provides all available mitigations for the
            L1TF vulnerability. Disables SMT and
            enables all mitigations in the
            hypervisors, i.e. unconditional L1D flush.

            SMT control and L1D flush control via the
            sysfs interface is still possible after
            boot.  Hypervisors will issue a warning
            when the first VM is started in a
            potentially insecure configuration,
            i.e. SMT enabled or L1D flush disabled.

        full,force
            Same as 'full', but disables SMT and L1D
            flush runtime control. Implies the
            'nosmt=force' command line option.
            (i.e. sysfs control of SMT is disabled.)

        flush
            Leaves SMT enabled and enables the default
            hypervisor mitigation, i.e. conditional
            L1D flush.

            SMT control and L1D flush control via the
            sysfs interface is still possible after
            boot.  Hypervisors will issue a warning
            when the first VM is started in a
            potentially insecure configuration,
            i.e. SMT enabled or L1D flush disabled.

        flush,nosmt

            Disables SMT and enables the default
            hypervisor mitigation.

            SMT control and L1D flush control via the
            sysfs interface is still possible after
            boot.  Hypervisors will issue a warning
            when the first VM is started in a
            potentially insecure configuration,
            i.e. SMT enabled or L1D flush disabled.

        flush,nowarn
            Same as 'flush', but hypervisors will not
            warn when a VM is started in a potentially
            insecure configuration.

        off
            Disables hypervisor mitigations and doesn't
            emit any warnings.
            It also drops the swap size and available
            RAM limit restriction on both hypervisor and
            bare metal.

        Default is 'flush'.

        For details see: Documentation/admin-guide/hw-vuln/l1tf.rst

I tried some of these options, ending up with the full,force. But that is my personal choice only.


How to use

If you're asking now how to use (what to edit), then the answer is to:

  1. Edit the following file with your favorite text editor:

    /etc/default/grub
    
  2. Add one of the options, for example let me use l1tf=full,force, to this line:

    GRUB_CMDLINE_LINUX_DEFAULT="... l1tf=full,force"
    
  3. Update your bootloader config with:

    sudo update-grub
    
  4. Changes are effective after reboot:

    reboot --reboot
    

Result

In case you decide to proceed with testing this solution, you should end up with similar results:

CVE-2018-3646 aka 'Foreshadow-NG (VMM), L1 terminal fault'
* Information from the /sys interface: Mitigation: PTE Inversion; VMX: cache flushes, SMT disabled
* This system is a host running a hypervisor:  YES  (paranoid mode)
* Mitigation 1 (KVM)
  * EPT is disabled:  NO 
* Mitigation 2
  * L1D flush is supported by kernel:  YES  (found flush_l1d in /proc/cpuinfo)
  * L1D flush enabled:  YES  (unconditional flushes)
  * Hardware-backed L1D flush supported:  YES  (performance impact of the mitigation will be greatly reduced)
  * Hyper-Threading (SMT) is enabled:  NO 
> STATUS:  NOT VULNERABLE  (L1D unconditional flushing and Hyper-Threading disabled are mitigating the vulnerability)

An image in UHD, can be enlarged:

L1TF--mitigated


Stephen Kitt's notes

It's also worth reading the L1TF-specific kernel documentation, which explains the vulnerabilities and mitigations in detail, and explains how to enable and disable mitigations (including disabling SMT) at runtime, without rebooting or altering the system's configuration.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.