lkml.org 
[lkml]   [2020]   [May]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH v2 4/4] arch/x86: Add L1D flushing Documentation
From
Date
On Tue, 2020-05-19 at 08:39 -0700, Randy Dunlap wrote:
>
> Hi--
>
> Comments below. Sorry about the delay.
>
> On 4/5/20 8:19 PM, Balbir Singh wrote:
> > Add documentation of l1d flushing, explain the need for the
> > feature and how it can be used.
> >
> > Signed-off-by: Balbir Singh <sblbir@amazon.com>
> > ---
> > Documentation/admin-guide/hw-vuln/index.rst | 1 +
> > .../admin-guide/hw-vuln/l1d_flush.rst | 40 +++++++++++++++++++
> > 2 files changed, 41 insertions(+)
> > create mode 100644 Documentation/admin-guide/hw-vuln/l1d_flush.rst
> > diff --git a/Documentation/admin-guide/hw-vuln/l1d_flush.rst b/Documentation/admin-guide/hw-vuln/l1d_flush.rst
> > new file mode 100644
> > index 000000000000..73ee9e491a74
> > --- /dev/null
> > +++ b/Documentation/admin-guide/hw-vuln/l1d_flush.rst
> > @@ -0,0 +1,40 @@
> > +L1D Flushing for the paranoid
> > +=============================
> > +
> > +With an increasing number of vulnerabilities being reported around data
> > +leaks from L1D, a new user space mechanism to flush the L1D cache on
> > +context switch is added to the kernel. This should help address
> > +CVE-2020-0550 and for paranoid applications, keep them safe from any
> > +yet to be discovered vulnerabilities, related to leaks from the L1D
> > +cache.
> > +
> > +Tasks can opt in to this mechanism by using an architecture specific
> > +prctl (x86 only at the moment).
> > +
> > +Related CVES
>
> CVEs
>
> > +------------
> > +At the present moment, the following CVEs can be addressed by this
> > +mechanism
> > +
> > + ============= ======================== ==================
> > + CVE-2020-0550 Improper Data Forwarding OS related aspects
> > + ============= ======================== ==================
> > +
> > +Usage Guidelines
> > +----------------
> > +Applications can call ``arch_prctl(2)`` with one of these two arguments
>
> end above sentence with period or colon (colon might require the following
> bullet items to be indented -- I'm not sure about that).

I'll take a look

>
> > +
> > +1. ARCH_SET_L1D_FLUSH - flush the L1D cache on context switch (out)
> > +2. ARCH_GET_L1D_FLUSH - get the current state of the L1D cache flush, returns 1
> > + if set and 0 if not set.
> > +
> > +**NOTE**: The feature is disabled by default, applications to need to specifically
>
> default; applications need to
>
> > +opt into the feature to enable it.
> > +
> > +Mitigation
> > +----------
> > +When ARCH_SET_L1D_FLUSH is enabled for a task, on switching tasks (when
> > +the address space changes), a flush of the L1D cache is performed for
> > +the task when it leaves the CPU. If the underlying CPU supports L1D
> > +flushing in hardware, the hardware mechanism is used, otherwise a software
> > +fallback, similar to the mechanism used by L1TF is used.
> >
>

I'll work on these and update based on more feedback on the rest of the series.

Balbir Singh.

\
 
 \ /
  Last update: 2020-05-20 02:47    [W:0.043 / U:2.564 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site