1

I installed ChromeOS Flex on my late 2008 Macbook. Unfortunately I cannot enable Linux mode yet. These threads on reddit (1 and 2) that suggest changing ChromeOS Flex to developer mode would fix it.

So I added the cros_debug flag to GRUB (efi and syslinux) configuration files and I also checked for the kvm-intel.vmentry_l1d_flush=always flag and it was already present in every single grub config file entry.

Still when I try to start termina I get the following:

crosh> vmc start termina --untrusted
Error: operation `vm_start` failed: bad VM status: `VM_STATUS_FAILURE`: Host vulnerable against untrusted VM
[ERROR:src/main.rs:184] ERROR: command failed

Next I tried looking up the l1tf vulnerabilities on my laptop and this is what I encountered:

crosh> shell
chronos@localhost / $ cat /sys/devices/system/cpu/vulnerabilities/l1tf
Mitigation: PTE Inversion; VMX: EPT disabled

Edit: I have now also added the kvm-intel.ept=0 too, see bellow:

chronos@localhost / $ cat /proc/cmdline 
BOOT_IMAGE=/syslinux/vmlinuz.A init=/sbin/init boot=local rootwait ro noresume noswap loglevel=7 noinitrd console= kvm-intel.vmentry_l1d_flush=always kvm-intel.ept=0 dm_verity.error_behavior=3 dm_verity.max_bios=-1 dm_verity.dev_wait=1 i915.modeset=1 cros_efi cros_debug root=/dev/dm-0 "dm=1 vroot none ro 1,0 4710400 verity payload=PARTUUID=E09BB354-34E7-5343-B0A2-BB06778C6B78 hashtree=PARTUUID=E09BB354-34E7-5343-B0A2-BB06778C6B78 hashstart=4710400 alg=sha256 root_hexdigest=<...> salt=<...>"

I am not sure what the mitigations mean in practical terms, but I wonder if are there any other GRUB flags I could add to overcome the error I am having starting crostini?

1

1 Answer 1

1

You can use the following command in the shell of crosh to check the kernel vulnerabilities.

For example, there are still two vulnerabilities for chromeOS Flex 105.0.5195.4 dev on iMac8,1.

$ cat /sys/class/dmi/id/product_name 
iMac8,1
$ grep -i Vulnerable /sys/devices/system/cpu/vulnerabilities/*
/sys/devices/system/cpu/vulnerabilities/mds:Vulnerable: Clear CPU buffers attempted, no microcode; SMT disabled
/sys/devices/system/cpu/vulnerabilities/spec_store_bypass:Vulnerable

I guess it can only use Linux when all vulnerabilities are mitigated or not affected.

These two vulnerabilities on iMac8,1 may need Intel microcode to fix them but Intel seems not to update the microcode for this CPU.

$ sudo dmesg | grep microcode
[    0.000000] microcode: microcode updated early to revision 0x60f, date = 2010-09-29
[    0.217648] MDS: Vulnerable: Clear CPU buffers attempted, no microcode
[    0.802913] microcode: sig=0x10676, pf=0x80, revision=0x60f
[    0.802975] microcode: Microcode Update Driver: v2.2.
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .