I used the
spectre-meltdown-checker, version 0.42, without any option resulting in all-green results. But, in a help page, I found the
--paranoid switch, which resulted in about a half of later CVEs to become red. I read what it told me, that for full mitigation I would have to disable hyper-threading, it scared me off a little bit, so I better did so, resulting in only one remaining red flag being CVE-2018-3646 = L1D unconditional flushing should be enabled to fully mitigate the vulnerability.
Laptop: Dell Inspiron 15 with latest BIOS (1.8.0, link for details).
Processor: Intel© Core™ i7-7700HQ (link to Intel Ark).
Linux Kernel: 4.15.0-65-generic; full
Linux dell-7577 4.15.0-65-generic #74-Ubuntu SMP Tue Sep 17 17:06:04 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
For completeness, I add info from the help on the
--paranoid require IBPB to deem Variant 2 as mitigated also require SMT disabled + unconditional L1D flush to deem Foreshadow-NG VMM as mitigated also require SMT disabled to deem MDS vulnerabilities mitigated
CVE-2018-3646 aka 'Foreshadow-NG (VMM), L1 terminal fault' * Information from the /sys interface: Mitigation: PTE Inversion; VMX: conditional cache flushes, SMT vulnerable * This system is a host running a hypervisor: YES (paranoid mode) * Mitigation 1 (KVM) * EPT is disabled: NO * Mitigation 2 * L1D flush is supported by kernel: YES (found flush_l1d in /proc/cpuinfo) * L1D flush enabled: YES (conditional flushes) * Hardware-backed L1D flush supported: YES (performance impact of the mitigation will be greatly reduced) * Hyper-Threading (SMT) is enabled: YES > STATUS: VULNERABLE (enable L1D unconditional flushing and disable Hyper-Threading to fully mitigate the vulnerability)
Apart from disabling Hyper-Threading, how do I enable this unconditional L1D flush?