linux-kernel - Re: [PATCH] x86, msr: Allow read access to /dev/cpu/X/msr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 02 Jul 2015 12:22:59 -0700
From:	"H. Peter Anvin" <hpa@...or.com>
To:	"Brown, Len" <len.brown@...el.com>,
	Andy Lutomirski <luto@...capital.net>,
	Ingo Molnar <mingo@...nel.org>,
	Prarit Bhargava <prarit@...hat.com>
CC:	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	Thomas Gleixner <tglx@...utronix.de>,
	Ingo Molnar <mingo@...hat.com>, X86 ML <x86@...nel.org>,
	"Chandramouli, Dasaratharaman" 
	<dasaratharaman.chandramouli@...el.com>,
	Peter Zijlstra <a.p.zijlstra@...llo.nl>,
	Borislav Petkov <bp@...en8.de>,
	Andy Lutomirski <luto@...nel.org>,
	Denys Vlasenko <dvlasenk@...hat.com>,
	Brian Gerst <brgerst@...il.com>,
	Arnaldo Carvalho de Melo <acme@...radead.org>
Subject: Re: [PATCH] x86, msr: Allow read access to /dev/cpu/X/msr

On 07/01/2015 09:38 AM, Brown, Len wrote:
> 
> BTW. I've had a discussion w/ LLNL about their needs,
> both for security and performance.  For security, as concluded
> by this thread, a white list is the only way to go.
> I'm thinking a bit-vector of allowed MSR offsets...
> For performance, they absolutely can not afford a system call
> for every single MSR access.  Here an ioctl to have the
> msr driver perform a vector of accesses in a single system
> call seems the way to go.  I can prototype both of these
> using turbostat as the customer.
> 

Every time I have heard about people having issues with performance for
MSR access, it is because they are doing cross-CPU accesses which means
a neverending stream of IPIs.  You get immensely better performance by
tying a thread to a CPU and only accessing the local CPU from that
thread.  This has addressed any performance problems anyone has ever
come to me with.  As Andy and Ingo have already pointed out, the MSR
access itself is pretty much as expensive as the system call overhead.

	-hpa

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/