From mboxrd@z Thu Jan 1 00:00:00 1970 Return-path: Received: from mail-wr0-x243.google.com ([2a00:1450:400c:c0c::243]) by bombadil.infradead.org with esmtps (Exim 4.87 #1 (Red Hat Linux)) id 1dTlyv-0006bz-3W for kexec@lists.infradead.org; Sat, 08 Jul 2017 09:24:54 +0000 Received: by mail-wr0-x243.google.com with SMTP id 77so12730489wrb.3 for ; Sat, 08 Jul 2017 02:24:31 -0700 (PDT) Date: Sat, 8 Jul 2017 11:24:26 +0200 From: Ingo Molnar Subject: Re: [PATCH v9 00/38] x86: Secure Memory Encryption (AMD) Message-ID: <20170708092426.prf7xmmnv6xvdqx4@gmail.com> References: <20170707133804.29711.1616.stgit@tlendack-t1.amdoffice.net> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20170707133804.29711.1616.stgit@tlendack-t1.amdoffice.net> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "kexec" Errors-To: kexec-bounces+dwmw2=infradead.org@lists.infradead.org To: Tom Lendacky Cc: linux-efi@vger.kernel.org, Brijesh Singh , Toshimitsu Kani , linux-doc@vger.kernel.org, Matt Fleming , x86@kernel.org, linux-mm@kvack.org, Radim =?utf-8?B?S3LEjW3DocWZ?= , Alexander Potapenko , "H. Peter Anvin" , Larry Woodman , linux-arch@vger.kernel.org, kvm@vger.kernel.org, Jonathan Corbet , Joerg Roedel , "Michael S. Tsirkin" , kasan-dev@googlegroups.com, Ingo Molnar , Andrey Ryabinin , Dave Young , Rik van Riel , Arnd Bergmann , Konrad Rzeszutek Wilk , Borislav Petkov , Andy Lutomirski , Boris Ostrovsky , Dmitry Vyukov , Juergen Gross , kexec@lists.infradead.org, linux-kernel@vger.kernel.org, xen-devel@lists.xen.org, iommu@lists.linux-foundation.org, Thomas Gleixner , Paolo Bonzini * Tom Lendacky wrote: > This patch series provides support for AMD's new Secure Memory Encryption (SME) > feature. I'm wondering, what's the typical performance hit to DRAM access latency when SME is enabled? On that same note, if the performance hit is noticeable I'd expect SME to not be enabled in native kernels typically - but still it looks like a useful hardware feature. Since it's controlled at the page table level, have you considered allowing SME-activated vmas via mmap(), even on kernels that are otherwise not using encrypted DRAM? One would think that putting encryption keys into such encrypted RAM regions would generally improve robustness against various physical space attacks that want to extract keys but don't have full control of the CPU. Thanks, Ingo _______________________________________________ kexec mailing list kexec@lists.infradead.org http://lists.infradead.org/mailman/listinfo/kexec