On Mon, 8 Jan 2018 12:00:28 +0000 David Laight <David.Laight@xxxxxxxxxx> wrote: > From: Linus Torvalds > > Sent: 07 January 2018 19:47 > ... > > Also, people definitely *are* noticing the performance issues with the > > current set of patches, and they are causing real problems. Go search > > for reports of Amazon AWS slowdowns. > > Try over 35% slowdown.... > Given that AWS instance runs known code (user and kernel) why do we > need to worry about any of these sideband attacks? You may not need to. Amazon themselves obviously need to worry that no other VM steals your data (or vice versa) but above that (and with raw hardware appliances) if you control all the code you run then the nopti and other disables may be useful (At the end of the day as with anything else you do your own risk assessment). Do remember to consider if you are running untrusted but supposedly sandboxed code (eg Java, js). I'm not using pti etc on my minecraft VMs - no point. If anyone gets to run arbitrary code on them except me then it's already compromised. Alan
