linux-kernel - Re: [PATCH v5 0/2] nosnp sev command line support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <90493ac2-e1c5-f03e-9428-f6a147f37088@amd.com>
Date: Mon, 30 Sep 2024 19:09:44 -0500
From: "Paluri, PavanKumar" <papaluri@....com>
To: Dave Hansen <dave.hansen@...el.com>, linux-kernel@...r.kernel.org
Cc: linux-doc@...r.kernel.org, Borislav Petkov <bp@...en8.de>,
 Thomas Gleixner <tglx@...utronix.de>, Ingo Molnar <mingo@...hat.com>,
 Eric Van Tassell <Eric.VanTassell@....com>,
 Tom Lendacky <thomas.lendacky@....com>, Ashish Kalra <ashish.kalra@....com>,
 Michael Roth <michael.roth@....com>, "H . Peter Anvin" <hpa@...or.com>,
 Peter Zijlstra <peterz@...radead.org>,
 "Paluri, PavanKumar (Pavan Kumar)" <pavankumar.paluri@....com>
Subject: Re: [PATCH v5 0/2] nosnp sev command line support

Hello Dave,

On 9/30/2024 6:25 PM, Dave Hansen wrote:
> On 9/30/24 16:11, Pavan Kumar Paluri wrote:
>> Provide "nosnp" boot option via "sev=nosnp" kernel command line to
>> prevent SEV-SNP[1] capable host kernel from enabling SEV-SNP and
>> initializing Reverse Map Table (RMP) [1].
>>
>> On providing sev=nosnp via kernel command line:
>> cat /sys/module/kvm_amd/parameters/sev_snp should be "N".
> 
> I don't see any mention in the changelog, cover letter or Documentation/
> about why someone would want to do this.
> 
> I assume it's because of performance (walking the RMP table is non-zero
> cost).
> 
> The BIOS allocates the RMP table, right?  So this option presumably gets
> the performance back, but not the memory.  That's probably also worth
> mentioning ... somewhere.

Yes, that is correct. RMP is BIOS-allocated, so there is a performance
gain but not memory.

Besides, having a 'nosnp' command line option would benefit customers to
be able to set the BIOS option to allocate RMP, but not actually enable
it just yet. This way, they can avoid overhead incurred from RMP checks,
for when they do not want to run SEV-SNP guests.

I will include this information in the cover-letter.

Thanks,
Pavan