Google Publishes Latest Linux Patches So Only Trusted Tasks Share a Core

Re:Google Publishes Latest Linux Patches So Only Trusted Tas... by chousuke on Thursday November 19, 2020 @07:08AM (#25148690)

This looks like a mechanism that allows more efficient use of CPU resources. You would still be able to schedule workloads on multiple cores as usual, but if they're all in the same "trusted" set, you can skip side-channel mitigations and recover performance. The system would still fall back to using the mitigations when you have too much work to be able to keep workload sets isolated via scheduling.

[ Parent | on HN ]

Re:Google Publishes Latest Linux Patches So Only Trusted Tas... by bjornsing on Thursday November 19, 2020 @08:05AM (#25149045)

Sounds like the right approach. Hasn’t there been anything like this up till now?

[ Parent | on HN ]

Re:Google Publishes Latest Linux Patches So Only Trusted Tas... by dx87 on Thursday November 19, 2020 @08:40AM (#25149303)

You could do it by setting boot options that tell the Linux kernel to only make some of the CPU cores generally available, then run programs on the unused cores. That's a technique that developers of software with real-time requirements have used to make sure they have resources dedicated to their program.

[ Parent | on HN ]

Re:Google Publishes Latest Linux Patches So Only Trusted Tas... by ohnoesjmr on Thursday November 19, 2020 @09:55AM (#25150116)

How is this different from CPU pinning? I assume the side channel attack mitigations only happen during a context switch, so if you exclusively pin the core to an application, they shouldn't run anyway?

[ Parent | on HN ]

Re:Google Publishes Latest Linux Patches So Only Trusted Tas... by chousuke on Thursday November 19, 2020 @10:02AM (#25150193)

It seems to be dynamic.

CPU pinning means the pinned process always runs on the specified cores. If you instead group processes into trust domains, workloads can still be scheduled on arbitrary cores, but the scheduler can use the grouping information to arrange things such that it can skip the side-channel mitigations.

[ Parent | on HN ]

Re:Google Publishes Latest Linux Patches So Only Trusted Tas... by bflesch on Thursday November 19, 2020 @09:58AM (#25150146)

I think it's in fact CPU pinning while taking into account some basic security requirements.

[ Parent | on HN ]

Re:Google Publishes Latest Linux Patches So Only Trusted Tas... by zekrioca on Thursday November 19, 2020 @11:31AM (#25151127)

In CPU pinning, the threads do not leave the assigned CPU-cores. So this is not exactly CPU pinning, it is a new "trusted" thread group scheduling implemented through cgroups where threads can move around CPU-cores as long as they end up in "trusted" groups of threads/processes. So, if two non trusted threads are to be scheduled, they won't be in the same CPU-core/CPU/resource/etc.

* Edited for clarification

[ Parent | on HN ]

Re:Google Publishes Latest Linux Patches So Only Trusted Tas... by kzrdude on Thursday November 19, 2020 @11:40AM (#25151244)

Is it that easy to turn mitigations on/off? I thought much of it required recompile.

[ Parent | on HN ]

Re:Google Publishes Latest Linux Patches So Only Trusted Tas... by brunoqc on Thursday November 19, 2020 @12:01PM (#25151509)

I think it's just some kernel command-line switches. Like `mitigations=off`.

[ Parent | on HN ]

Re:Google Publishes Latest Linux Patches So Only Trusted Tas... by detaro on Thursday November 19, 2020 @12:28PM (#25151860)

there is the handy https://make-linux-fast-again.com/

[ Parent | on HN ]

Re:Google Publishes Latest Linux Patches So Only Trusted Tas... by kzrdude on Thursday November 19, 2020 @01:24PM (#25152575)

That requires reboot and is just the kernel part - so still not easy enough to flip on/off depending on task scheduling.

[ Parent | on HN ]