Messages in this thread | | | Subject | Re: [PATCH v4 5/6] Optionally flush L1D on context switch | From | "Singh, Balbir" <> | Date | Fri, 24 Apr 2020 09:56:39 +0000 |
| |
On Thu, 2020-04-23 at 12:19 -0700, Kees Cook wrote: > CAUTION: This email originated from outside of the organization. Do not > click links or open attachments unless you can confirm the sender and know > the content is safe. > > > > On Fri, Apr 24, 2020 at 12:01:24AM +1000, Balbir Singh wrote: > > Implement a mechanism to selectively flush the L1D cache. The goal is to > > allow tasks that are paranoid due to the recent snoop assisted data > > sampling > > vulnerabilites, to flush their L1D on being switched out. This protects > > their data from being snooped or leaked via side channels after the task > > has context switched out. > > > > There are two scenarios we might want to protect against, a task leaving > > the CPU with data still in L1D (which is the main concern of this patch), > > the second scenario is a malicious task coming in (not so well trusted) > > for which we want to clean up the cache before it starts. Only the case > > for the former is addressed. > > > > A new thread_info flag TIF_SPEC_FLUSH_L1D is added to track tasks which > > opt-into L1D flushing. cpu_tlbstate.last_user_mm_spec is used to convert > > the TIF flags into mm state (per cpu via last_user_mm_spec) in > > cond_mitigation(), which then used to do decide when to call flush_l1d(). > > > > Add prctl()'s to opt-in to the L1D cache on context switch out, the > > existing mechanisms of tracking prev_mm via cpu_tlbstate is > > reused to track state of the tasks and to flush the L1D cache. > > The prctl interface is generic and can be ported over to other > > architectures. > > > > Suggested-by: Thomas Gleixner <tglx@linutronix.de> > > Signed-off-by: Balbir Singh <sblbir@amazon.com> > > I'm not a huge fan of __weak (I like CONFIGs better), but that's no > enough to NAK this. ;) Thanks for the prctl() change! > > Reviewed-by: Kees Cook <keescook@chromium.org> >
Thanks, the CONFIG_* seemed a bit much for two functions.
Balbir Singh.
| |