TLB State Access Being Tightened Up On Linux For Better Security

The latest Linux kernel security work being pursued by Thomas Gleixner is tightening up access around the kernel's per-CPU TLB state access for the translation lookaside buffer.

Currently this x86 per-CPU TLB state access is in exported code that can be accessed by kernel modules, originally done just to satisfy KVM virtualization needs. In beefing up the security, Gleixner has been reworking the x86 TLB state code so only the few bits needed by KVM can still be accessed outside of the core kernel code while the rest will now be hidden away given that there should be no legitimate access needs of it outside of the core kernel code.

These improvements should help prevent potentially sensitive information from possibly being leaked.

The patches are now under review.