Want A More Secure Computer At The Cost Of Performance? Linux 5.8 Landing L1d Flushing

For those very concerned about CPU data sampling vulnerabilities, the Linux 5.8 kernel comes with the ability to flush the L1 data cache on each context switch. That's good for security, but will hurt the system performance with all the excess L1 cache flushing.

This work stems from a proposal earlier this year to flush the L1d cache on context switches due to recent snoop assisted data sampling vulnerabilites or the cache data leaked via side channels. This work was carried out by an Amazon engineer so presumably there is some interest in offering this functionality in the AWS space.

The patch went through a few rounds of review for improving the code in light of the Load Value Injection (LVI) vulnerability and others and a belief this will help other yet to be discovered vulnerabilities.

Now with Linux 5.8 the x86/mm changes have the patches for offering this opt-in L1d cache flushing on context switching. Toggling this functionality can be done via prctl with the new ARCH_SET_L1D_FLUSH / ARCH_GET_L1D_FLUSH options. On supported CPUs the hardware mechanism for cache flushing is used but with support for a software fallback similar to L1TF mitigations. With clearing out of the L1 data cache so frequently the performance is likely to be impacted quite much, thus not enabled by default, but no numbers have yet to be posted by those working on this feature.

The rest of the x86/mm changes for Linux 5.8 aren't as noteworthy but there is some tightening up access to the TLB state as well.