Hacker News Reader

Comment by chousuke | Hacker News Reader

This looks like a mechanism that allows more efficient use of CPU resources. You would still be able to schedule workloads on multiple cores as usual, but if they're all in the same "trusted" set, you can skip side-channel mitigations and recover performance. The system would still fall back to using the mitigations when you have too much work to be able to keep workload sets isolated via scheduling.

View on HN

Sounds like the right approach. Hasn’t there been anything like this up till now?

You could do it by setting boot options that tell the Linux kernel to only make some of the CPU cores generally available, then run programs on the unused cores. That's a technique that developers of software with real-time requirements have used to make sure they have resources dedicated to their program.

How is this different from CPU pinning? I assume the side channel attack mitigations only happen during a context switch, so if you exclusively pin the core to an application, they shouldn't run anyway?

I think it's in fact CPU pinning while taking into account some basic security requirements.

In CPU pinning, the threads do not leave the assigned CPU-cores. So this is not exactly CPU pinning, it is a new "trusted" thread group scheduling implemented through cgroups where threads can move around CPU-cores as long as they end up in "trusted" groups of threads/processes. So, if two non trusted threads are to be scheduled, they won't be in the same CPU-core/CPU/resource/etc.

* Edited for clarification

It seems to be dynamic.

CPU pinning means the pinned process always runs on the specified cores. If you instead group processes into trust domains, workloads can still be scheduled on arbitrary cores, but the scheduler can use the grouping information to arrange things such that it can skip the side-channel mitigations.

Is it that easy to turn mitigations on/off? I thought much of it required recompile.

I think it's just some kernel command-line switches. Like `mitigations=off`.

there is the handy https://make-linux-fast-again.com/

That requires reboot and is just the kernel part - so still not easy enough to flip on/off depending on task scheduling.

Reply on news.ycombinator.com