Re: Intel hyper-threading security issues

[Solar Designer <solar () openwall com>]

On Thu, Jun 21, 2018 at 01:54:16PM +0200, Sven Schwedas wrote:
> On 2018-06-21 12:28, Lukas Odzioba wrote:
> > Or use cpu hotplug mechanism, which should be way more convenient:
> > https://www.kernel.org/doc/html/v4.17/core-api/cpu_hotplug.html
>
> Hotplug doesn't seem differentiate between HT threads and physical
> cores,

This isn't exactly the question to ask: first vs. second thread in a
core aren't any different, neither of them is "the physical core" unless
you choose not to use the other.

And you can obtain the needed information from /proc/cpuinfo or
/sys/devices/system/cpu/cpu*/topology/* to choose which logical CPUs you
disable (so that you leave only one per physical core).

On a related note, attached is a generic Linux /proc/cpuinfo parser I
wrote a couple of years ago for SMT-aware thread affinity settings in a
userspace program.  This can be used e.g. by a program not wanting to
run trusted vs. untrusted threads on the same physical core, or on the
same physical CPU chip if there's more than one.  It can also be used
for performance optimization.  Please feel free to reuse.

> will setting maxcpus=2 on a 2 cores+HT machine reliably disable
> HT, or can it disable one core and keep HT active on the other?

The latter.  It's not reliable, except maybe on a specific machine with
a specific kernel version.

Alexander

Attachment: cpuinfo.h
Description:

Attachment: cpuinfo.c
Description: