SMT: Disable when system is vulnerable to L1TF (Foreshadow)

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/config/rootfiles/core/133/filelists/files b/config/rootfiles/core/133/filelists/files
index 187b1de7f0f41feeaffe2580a4255ce168b1304b..f78013c4e35b6169337486b180ecd9878d6533f1 100644 (file)
--- a/config/rootfiles/core/133/filelists/files
+++ b/config/rootfiles/core/133/filelists/files
@@ -1,5 +1,6 @@
 etc/system-release
 etc/issue
+etc/rc.d/init.d/smt
 srv/web/ipfire/cgi-bin/credits.cgi
 srv/web/ipfire/cgi-bin/ovpnmain.cgi
 srv/web/ipfire/cgi-bin/vulnerabilities.cgi

diff --git a/src/initscripts/system/smt b/src/initscripts/system/smt
index a31cd7beabda906c79a6ebaa8757b6c8a50e91dd..f85f567fa878662965d784f3418a4366ee2a0f93 100644 (file)
--- a/src/initscripts/system/smt
+++ b/src/initscripts/system/smt
@@ -15,20 +15,24 @@ case "${1}" in
                        exit 0
                fi
 
-               # Nothing to do if this processor is not vulnerable
-               # to Fallout/RIDL.
-               if [ -r "/sys/devices/system/cpu/vulnerabilities/mds" ]; then
-                       if [ "$(</sys/devices/system/cpu/vulnerabilities/mds)" = "Not affected" ]; then
-                               exit 0
-                       fi
+               # Nothing to do when SMT is not enabled or not supported anyways
+               if [ "$(</sys/devices/system/cpu/smt/control)" != "on" ]; then
+                       exit 0
+               fi
 
-                       # Disable SMT when supported and enabled
-                       if [ "$(</sys/devices/system/cpu/smt/control)" = "on" ]; then
+               # Disable SMT when the processor is vulnerable to Foreshadow or Fallout/ZombieLoad/RIDL
+               for vuln in l1tf mds; do
+                       if [ -r "/sys/devices/system/cpu/vulnerabilities/${vuln}" ] && \
+                                       [ "$(</sys/devices/system/cpu/vulnerabilities/${vuln})" != "Not affected" ]; then
+                               # Disable SMT
                                boot_mesg "Disabling Simultaneous Multi-Threading (SMT)..."
                                echo "forceoff" > /sys/devices/system/cpu/smt/control
                                echo_ok
+
+                               # No need to check any further when we have disabled SMT already
+                               break
                        fi
-               fi
+               done
                ;;
 
        *)