Show Your Support: This site is primarily supported by advertisements. Ads are what have allowed this site to be maintained on a daily basis for the past 18+ years. We do our best to ensure only clean, relevant ads are shown, when any nasty ads are detected, we work to remove them ASAP. If you would like to view the site without ads while still supporting our work, please consider our ad-free Phoronix Premium.
Kernel Address Space Isolation Still Baking To Limit Data Leaks From Foreshadow & Co
Complementing the "Core Scheduling" work, Kernel Address Space Isolation was also talked about at this week's Linux Plumbers Conference in Lisbon, Portugal. The address space isolation work for the kernel was RFC'ed a few months ago as a feature to prevent leaking sensitive data during attacks like L1 Terminal Fault and MDS. The focus on this Kernel ASI is for pairing with hypervisors like KVM as well as being a generic address space isolation framework.
This ASI implementation aims to prevent guest-to-host attacks and guest-to-guest attacks via the host in a virtualized environment. But the KVM ASI support does not prevent guest-to-guest attacks and they also still recommend pinning VMs to distinct physical CPU cores, similar to the core scheduling work.
Kernel Address Space Isolation isn't ready to go into the kernel this year but the developers do have more improvements planned as well as implementing kernel local memory and still ultimately weighing "is the complexity worth the benefit?" They also have yet to assess the performance implications of Kernel ASI, but the hope is that it still performs better than disabling Hyper Threading.
More details on the Linux Kernel Address Space Isolation via this slide deck (PDF) from the joint Oracle-IBM presentation at LPC 2019.