linux-kernel - Re: Populating multiple ptes at fault time

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 18 Sep 2008 13:26:24 -0700
From:	Avi Kivity <avi@...hat.com>
To:	Jeremy Fitzhardinge <jeremy@...p.org>
CC:	Nick Piggin <nickpiggin@...oo.com.au>,
	Hugh Dickens <hugh@...itas.com>,
	Linux Memory Management List <linux-mm@...ck.org>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Avi Kivity <avi@...ranet.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Rik van Riel <riel@...hat.com>,
	Marcelo Tosatti <mtosatti@...hat.com>
Subject: Re: Populating multiple ptes at fault time

(potential victim cc'ed)

Jeremy Fitzhardinge wrote:
> Avi Kivity wrote:
>   
>> We could work around it by having a hypercall to read and clear
>> accessed bits.  If we know the guest will only do that via the
>> hypercall, we can keep the accessed (and dirty) bits in the host, and
>> not update them in the guest at all.  Given good batching, there's
>> potential for a large win there.
>>     
>
> We added a hypercall to update just the AD bits, though it was primarily
> to update D without losing the hardware-set A bit.
>
> I don't think it would be practical to add a hypercall to read the A
> bit.  There's too much code which just assumes it can grab a pte and
> test the bit state.  There's no pv_op for reading a pte in general, and
> even if there were you'd need to have a specialized pv-op for
> specifically reading the A bit to avoid unnecessary hypercalls.
>
>   

I didn't think so much code would be interested in the accessed bit.  I 
can think of

 - pte teardown (to mark the page accessed)
 - scanning the active list
 - fork (which copies ptes)

> Setting/clearing the A bit could be done via the normal set_pte pv_op,
> so that's not a big deal.
>
> Do you need to set the A bit synchronously?  

Yes, of course (if no guest cooperation).

> What happens if you install
> the guest and shadow pte with A clear, and then lazily transfer the A
> bit state from the shadow to guest pte?  Maybe at some significant event
> like  a tlb flush or:
>
>   
>> (If the host throws away a shadow page, it could sync the bits back
>> into the guest pte for safekeeping)
>>     

I'll fail my own unit tests.

If we add an async mode for guests that can cope, maybe this is 
workable.  I guess this is what you're suggesting.

-- 
I have a truly marvellous patch that fixes the bug which this
signature is too narrow to contain.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/