Re: [RFC PATCH v2 0/4] arch/x86: Optionally flush L1D on context switch

Singh, Balbir
2020-03-30T01:14:03Z

On Wed, 2020-03-25 at 18:10 +1100, Balbir Singh wrote:
> This patch is a continuation of RFC/PoC to start the discussion on
> optionally
> flushing L1D cache. The goal is to allow tasks that are paranoid due to the
> recent snoop assisted data sampling vulnerabilites, to flush their L1D on
> being
> switched out. This protects their data from being snooped or leaked via
> side channels after the task has context switched out.
>
> The points of discussion/review are (with updates):
>
> 1. Discuss the use case and the right approach to address this
> A. Generally there seems to be consensus that we need this
>
> 2. Does an arch prctl allowing for opt-in flushing make sense, would other
> arches care about something similar?
> A. We definitely build this for x86, have not heard from any other arch
> maintainers. There was suggestion to make this a prctl and let each
> arch implement L1D flushing if needed, there is no arch agnostic
> software L1D flush.
>
> 3. There is a fallback software L1D load, similar to what L1TF does, but
> we don't prefetch the TLB, is that sufficient?
> A. There was no conclusion, I suspect we don't need this
>
> 4. Should we consider cleaning up the L1D on arrival of tasks?
> A. For now, we think this case is not the priority for this patchset.
>
> In summary, this is an early PoC to start the discussion on the need for
> conditional L1D flushing based on the security posture of the
> application and the sensitivity of the data it has access to or might
> have access to.
>
> Changelog v2:
> - Reuse existing code for allocation and flush
> - Simplify the goto logic in the actual l1d_flush function
> - Optimize the code path with jump labels/static functions
>
> Cc: keescook@chromium.org
>
> Balbir Singh (4):
> arch/x86/kvm: Refactor l1d flush lifecycle management
> arch/x86: Refactor tlbflush and l1d flush
> arch/x86: Optionally flush L1D on context switch
> arch/x86: L1D flush, optimize the context switch
>

Ping, looking for comments and criticism of the approach. I understand with
the merge window around the corner everyone is busy. There is a bug in the v2
RFC series, I am happy to post a version without the RFC for broader testing
and feedback.

I am quite keen to hear about the interface and any concerns with the
arch_prctl() interface.

Balbir Singh.