Re: [PATCH v2 19/35] Documentation/x86: Document the new attack vector controls

[Manwaring, Derek]

On 2024-11-13 at 14:15+0000, Brendan Jackman wrote:
> On Wed, 13 Nov 2024 at 04:58, Manwaring, Derek <derekmn@xxxxxxxxxx> wrote:
> > Personally I wouldn't put too much weight on the possibility of
> > disabling kernel mitigations with these future approaches. For what
> > we're looking at with direct map removal, I would still keep kernel
> > mitigations on unless we really needed one off. Brendan, I know you were
> > looking at this differently though for ASI. What are your thoughts?
>
> [...]
>
> At first I wanted to say the same thing about your work to remove
> stuff from the direct map. Basically that's about architecting
> ourselves towards a world where the "guest->kernel" attack vector just
> isn't meaningful, right?

Right, that is definitely the goal. The approach is like Microsoft
describes in the Secret-Free Hypervisor paper [1].

Call me belt-and-suspenders, but I prefer to leave mitigations in place
as well unless the performance is terrible. Like rappelling with a good
harness but still pad the fall zone.

Derek


[1] https://www.microsoft.com/en-us/research/uploads/prod/2022/07/sf-hypervisor.pdf