linux-kernel - Re: [RFC 00/10] Process-local memory allocations for hiding KVM secrets

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <3131CDA2-F6CF-43AC-A9FC-448DC6983596@gmail.com>
Date:   Mon, 17 Jun 2019 11:50:34 -0700
From:   Nadav Amit <nadav.amit@...il.com>
To:     Dave Hansen <dave.hansen@...el.com>
Cc:     Andy Lutomirski <luto@...nel.org>,
        Alexander Graf <graf@...zon.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Marius Hillenbrand <mhillenb@...zon.de>,
        kvm list <kvm@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        Kernel Hardening <kernel-hardening@...ts.openwall.com>,
        Linux-MM <linux-mm@...ck.org>, Alexander Graf <graf@...zon.de>,
        David Woodhouse <dwmw@...zon.co.uk>,
        the arch/x86 maintainers <x86@...nel.org>,
        Peter Zijlstra <peterz@...radead.org>
Subject: Re: [RFC 00/10] Process-local memory allocations for hiding KVM
 secrets

> On Jun 17, 2019, at 11:07 AM, Dave Hansen <dave.hansen@...el.com> wrote:
> 
> On 6/17/19 9:53 AM, Nadav Amit wrote:
>>>> For anyone following along at home, I'm going to go off into crazy
>>>> per-cpu-pgds speculation mode now...  Feel free to stop reading now. :)
>>>> 
>>>> But, I was thinking we could get away with not doing this on _every_
>>>> context switch at least.  For instance, couldn't 'struct tlb_context'
>>>> have PGD pointer (or two with PTI) in addition to the TLB info?  That
>>>> way we only do the copying when we change the context.  Or does that tie
>>>> the implementation up too much with PCIDs?
>>> Hmm, that seems entirely reasonable.  I think the nasty bit would be
>>> figuring out all the interactions with PV TLB flushing.  PV TLB
>>> flushes already don't play so well with PCID tracking, and this will
>>> make it worse.  We probably need to rewrite all that code regardless.
>> How is PCID (as you implemented) related to TLB flushing of kernel (not
>> user) PTEs? These kernel PTEs would be global, so they would be invalidated
>> from all the address-spaces using INVLPG, I presume. No?
> 
> The idea is that you have a per-cpu address space.  Certain kernel
> virtual addresses would map to different physical address based on where
> you are running.  Each of the physical addresses would be "owned" by a
> single CPU and would, by convention, never use a PGD that mapped an
> address unless that CPU that "owned" it.
> 
> In that case, you never really invalidate those addresses.

I understand, but as I see it, this is not related directly to PCIDs.