linux-kernel - Re: [Part1 PATCH v4 16/17] X86/KVM: Unencrypt shared per-cpu variables when SEV is active

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 20 Sep 2017 09:39:31 +0200
From:   Borislav Petkov <bp@...e.de>
To:     Brijesh Singh <brijesh.singh@....com>,
        Tom Lendacky <thomas.lendacky@....com>
Cc:     linux-kernel@...r.kernel.org, x86@...nel.org, kvm@...r.kernel.org,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>,
        "H . Peter Anvin" <hpa@...or.com>,
        Andy Lutomirski <luto@...nel.org>,
        Paolo Bonzini <pbonzini@...hat.com>,
        Radim Krčmář <rkrcmar@...hat.com>
Subject: Re: [Part1 PATCH v4 16/17] X86/KVM: Unencrypt shared per-cpu
 variables when SEV is active

On Tue, Sep 19, 2017 at 09:00:39AM -0500, Brijesh Singh wrote:
> Yes, we can revisit it later to optimize it.

Yeah, it will become pretty fugly if we need to do more decrypted pages
sharing between hv and guest. And if they have to be perCPU, it becomes
nastier.

So we definitely should think about having a proper design for this
page-sized sharing. For example, if you do a single shared page and then
you copy the actual data between host and guest, the former becomes a
bounce buffer of sorts which adds that additional copying penalty. Yuck.

So we really should think about this more...

-- 
Regards/Gruss,
    Boris.

SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg)
--