From e7c1dde9d320f73a3a8fdfbce49ba6123eae876c Mon Sep 17 00:00:00 2001 From: Mikaela Suomalainen Date: Wed, 28 Aug 2019 13:48:27 +0300 Subject: [PATCH] operating-systems: expand the Linux instructions for MDS mitigation --- _includes/sections/operating-systems.html | 29 ++++++++++++++++++++++- 1 file changed, 28 insertions(+), 1 deletion(-) diff --git a/_includes/sections/operating-systems.html b/_includes/sections/operating-systems.html index 2e16743d..62544ec9 100644 --- a/_includes/sections/operating-systems.html +++ b/_includes/sections/operating-systems.html @@ -39,7 +39,34 @@ tor="http://sejnfjrq6szgca7v.onion" + +

Remember to check CPU vulnerability mitigations on Linux

+ +

This also affects Windows 10, but it doesn't expose this information or mitigation instructions as easily.

+ +

When running a enough recent kernel, you can check the CPU vulnerabilities it detects by tail -n +1 /sys/devices/system/cpu/vulnerabilities/*. By using tail -n +1 instead of cat the file names are also visible.

+ +

In case you have a Intel CPU, you will likely see that MDS - Microarchitectural Data Sampling is only partially mitigated ("SMT vulnerable"), unless you have disabled it in UEFI BIOS as the full mitigation disables Simultaneous multithreading which may be the cause of the highest performance impact.

+ +

The following steps can be took to enable the full mitigation assuming your system/distribution uses grub and supports /etc/default/grub.d/:

+ +
    +
  1. sudo mkdir /etc/default/grub.d/ to create a directory for additional grub configuration +
  2. echo GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT mds=full,nosmt" | sudo tee /etc/default/grub.d/mds.conf to create a new grub config file source with the echoed content
    3. +
  3. sudo update-grub to generate a new config file including these kernel flags +
  4. sudo reboot to reboot +
  5. afterward the reboot check tail -n +1 /sys/devices/system/cpu/vulnerabilities/* again to see that MDS now says SMT disabled. +
+ +
Further reading
+ +

Worth Mentioning