Want A More Secure Computer At The Cost Of Performance? Linux 5.8 Landing L1d Flushing

Written by Michael Larabel in Linux Security on 1 June 2020 at 01:46 PM EDT. 15 Comments
For those very concerned about CPU data sampling vulnerabilities, the Linux 5.8 kernel comes with the ability to flush the L1 data cache on each context switch. That's good for security, but will hurt the system performance with all the excess L1 cache flushing.

This work stems from a proposal earlier this year to flush the L1d cache on context switches due to recent snoop assisted data sampling vulnerabilites or the cache data leaked via side channels. This work was carried out by an Amazon engineer so presumably there is some interest in offering this functionality in the AWS space.

The patch went through a few rounds of review for improving the code in light of the Load Value Injection (LVI) vulnerability and others and a belief this will help other yet to be discovered vulnerabilities.

Now with Linux 5.8 the x86/mm changes have the patches for offering this opt-in L1d cache flushing on context switching. Toggling this functionality can be done via prctl with the new ARCH_SET_L1D_FLUSH / ARCH_GET_L1D_FLUSH options. On supported CPUs the hardware mechanism for cache flushing is used but with support for a software fallback similar to L1TF mitigations. With clearing out of the L1 data cache so frequently the performance is likely to be impacted quite much, thus not enabled by default, but no numbers have yet to be posted by those working on this feature.

The rest of the x86/mm changes for Linux 5.8 aren't as noteworthy but there is some tightening up access to the TLB state as well.
Related News
About The Author
Michael Larabel

Michael Larabel is the principal author of Phoronix.com and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and OpenBenchmarking.org automated benchmarking software. He can be followed via Twitter, LinkedIn, or contacted via MichaelLarabel.com.

Popular News This Week