[MODERATED] Re: [PATCH v5 15/27] MDSv5 1

[Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>]

On Fri, Jan 18, 2019 at 04:50:30PM -0800, speck for Andi Kleen wrote:
> From: Andi Kleen <ak@linux.intel.com>
> Subject:  mds: Schedule cpu clear for memzero_explicit and
>  kzfree
> 
> Assume that any code using these functions is sensitive and shouldn't
> leak any data.
> 
> This handles clearing for key data used in the kernel.
> 
> Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
> Signed-off-by: Andi Kleen <ak@linux.intel.com>
Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>

> ---
>  lib/string.c     | 6 ++++++
>  mm/slab_common.c | 5 ++++-
>  2 files changed, 10 insertions(+), 1 deletion(-)
> 
> diff --git a/lib/string.c b/lib/string.c
> index 38e4ca08e757..9ce59dd86541 100644
> --- a/lib/string.c
> +++ b/lib/string.c
> @@ -28,6 +28,7 @@
>  #include <linux/bug.h>
>  #include <linux/errno.h>
>  #include <linux/slab.h>
> +#include <linux/clearcpu.h>
>  
>  #include <asm/byteorder.h>
>  #include <asm/word-at-a-time.h>
> @@ -715,12 +716,17 @@ EXPORT_SYMBOL(memset);
>   * necessary, memzero_explicit() should be used instead in
>   * order to prevent the compiler from optimising away zeroing.
>   *
> + * As a side effect this may also trigger extra cleaning
> + * of CPU state before the next kernel exit to avoid
> + * side channels.
> + *
>   * memzero_explicit() doesn't need an arch-specific version as
>   * it just invokes the one of memset() implicitly.
>   */
>  void memzero_explicit(void *s, size_t count)
>  {
>  	memset(s, 0, count);
> +	lazy_clear_cpu();
>  	barrier_data(s);
>  }
>  EXPORT_SYMBOL(memzero_explicit);
> diff --git a/mm/slab_common.c b/mm/slab_common.c
> index 81732d05e74a..7b5e2e1318a2 100644
> --- a/mm/slab_common.c
> +++ b/mm/slab_common.c
> @@ -1576,6 +1576,9 @@ EXPORT_SYMBOL(krealloc);
>   * Note: this function zeroes the whole allocated buffer which can be a good
>   * deal bigger than the requested buffer size passed to kmalloc(). So be
>   * careful when using this function in performance sensitive code.
> + *
> + * As a side effect this may also clear CPU state later before the
> + * next kernel exit to avoid side channels.
>   */
>  void kzfree(const void *p)
>  {
> @@ -1585,7 +1588,7 @@ void kzfree(const void *p)
>  	if (unlikely(ZERO_OR_NULL_PTR(mem)))
>  		return;
>  	ks = ksize(mem);
> -	memset(mem, 0, ks);
> +	memzero_explicit(mem, ks);
>  	kfree(mem);
>  }
>  EXPORT_SYMBOL(kzfree);
> -- 
> 2.17.2