Messages in this thread | | | Subject | Re: [PATCH v2 4/4] arch/x86: Add L1D flushing Documentation | From | "Singh, Balbir" <> | Date | Wed, 20 May 2020 00:47:23 +0000 |
| |
On Tue, 2020-05-19 at 08:39 -0700, Randy Dunlap wrote: > > Hi-- > > Comments below. Sorry about the delay. > > On 4/5/20 8:19 PM, Balbir Singh wrote: > > Add documentation of l1d flushing, explain the need for the > > feature and how it can be used. > > > > Signed-off-by: Balbir Singh <sblbir@amazon.com> > > --- > > Documentation/admin-guide/hw-vuln/index.rst | 1 + > > .../admin-guide/hw-vuln/l1d_flush.rst | 40 +++++++++++++++++++ > > 2 files changed, 41 insertions(+) > > create mode 100644 Documentation/admin-guide/hw-vuln/l1d_flush.rst > > diff --git a/Documentation/admin-guide/hw-vuln/l1d_flush.rst b/Documentation/admin-guide/hw-vuln/l1d_flush.rst > > new file mode 100644 > > index 000000000000..73ee9e491a74 > > --- /dev/null > > +++ b/Documentation/admin-guide/hw-vuln/l1d_flush.rst > > @@ -0,0 +1,40 @@ > > +L1D Flushing for the paranoid > > +============================= > > + > > +With an increasing number of vulnerabilities being reported around data > > +leaks from L1D, a new user space mechanism to flush the L1D cache on > > +context switch is added to the kernel. This should help address > > +CVE-2020-0550 and for paranoid applications, keep them safe from any > > +yet to be discovered vulnerabilities, related to leaks from the L1D > > +cache. > > + > > +Tasks can opt in to this mechanism by using an architecture specific > > +prctl (x86 only at the moment). > > + > > +Related CVES > > CVEs > > > +------------ > > +At the present moment, the following CVEs can be addressed by this > > +mechanism > > + > > + ============= ======================== ================== > > + CVE-2020-0550 Improper Data Forwarding OS related aspects > > + ============= ======================== ================== > > + > > +Usage Guidelines > > +---------------- > > +Applications can call ``arch_prctl(2)`` with one of these two arguments > > end above sentence with period or colon (colon might require the following > bullet items to be indented -- I'm not sure about that).
I'll take a look
> > > + > > +1. ARCH_SET_L1D_FLUSH - flush the L1D cache on context switch (out) > > +2. ARCH_GET_L1D_FLUSH - get the current state of the L1D cache flush, returns 1 > > + if set and 0 if not set. > > + > > +**NOTE**: The feature is disabled by default, applications to need to specifically > > default; applications need to > > > +opt into the feature to enable it. > > + > > +Mitigation > > +---------- > > +When ARCH_SET_L1D_FLUSH is enabled for a task, on switching tasks (when > > +the address space changes), a flush of the L1D cache is performed for > > +the task when it leaves the CPU. If the underlying CPU supports L1D > > +flushing in hardware, the hardware mechanism is used, otherwise a software > > +fallback, similar to the mechanism used by L1TF is used. > > >
I'll work on these and update based on more feedback on the rest of the series.
Balbir Singh.
| |