Although, there is ongoing research regarding time protection (https://trustworthy.systems/projects/timeprotection/) which prevents exactly timing channels. Including proofs of seL4 providing time protection.
Security-partition switches that carefully reset all shared micro-architectural state, while making switch times completely deterministic, and in particular, independent of previous execution history.
I'm afraid it means clearing all caches at each context switch. The performance penalty is really high.
Not all caches are cleared. There are some clever techniques to partition off-core caches (i.e. the L3) as part of the isolation boundaries enforced by the kernel. What I think is particularly exciting is that a new RISCV64 instruction to clear microarchitectural state is in the process of being standardised! So I'm hopeful that, while it should not be ignored, the performance penalty will not be too high.
Not using this, but tangentially related is (full disclosure, i am a maintainer of this project) live-bootstrap, which uses about a KB of binary to do a full "Linux from scratch" style thing - read https://github.com/fosslinux/live-bootstrap/blob/master/part... for all 143 steps you have to go through to get there.
I do plan to integrate this, or something very similar, into live-bootstrap. This is essentially the type of thing we would do to compile the Linux kernel within the bootstrap, which has not been done yet. However tccboot/derivative needs to be compiled from source within live-bootstrap which is not simple.
The kernel is still an unsolved problem, unfortunately. We need an appropriate, small seed kernel to be able to successfully run everything up until we can recompile linux (which also has proved difficult and is not why it is in the repo yet) :(
