| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20250924152214.7292-3-roypat@amazon.co.uk>
Date: Wed, 24 Sep 2025 15:22:40 +0000
From: "Roy, Patrick" <roypat@...zon.co.uk>
CC: "Roy, Patrick" <roypat@...zon.co.uk>, "pbonzini@...hat.com"
<pbonzini@...hat.com>, "corbet@....net" <corbet@....net>, "maz@...nel.org"
<maz@...nel.org>, "oliver.upton@...ux.dev" <oliver.upton@...ux.dev>,
"joey.gouly@....com" <joey.gouly@....com>, "suzuki.poulose@....com"
<suzuki.poulose@....com>, "yuzenghui@...wei.com" <yuzenghui@...wei.com>,
"catalin.marinas@....com" <catalin.marinas@....com>, "will@...nel.org"
<will@...nel.org>, "tglx@...utronix.de" <tglx@...utronix.de>,
"mingo@...hat.com" <mingo@...hat.com>, "bp@...en8.de" <bp@...en8.de>,
"dave.hansen@...ux.intel.com" <dave.hansen@...ux.intel.com>, "x86@...nel.org"
<x86@...nel.org>, "hpa@...or.com" <hpa@...or.com>, "luto@...nel.org"
<luto@...nel.org>, "peterz@...radead.org" <peterz@...radead.org>,
"willy@...radead.org" <willy@...radead.org>, "akpm@...ux-foundation.org"
<akpm@...ux-foundation.org>, "david@...hat.com" <david@...hat.com>,
"lorenzo.stoakes@...cle.com" <lorenzo.stoakes@...cle.com>,
"Liam.Howlett@...cle.com" <Liam.Howlett@...cle.com>, "vbabka@...e.cz"
<vbabka@...e.cz>, "rppt@...nel.org" <rppt@...nel.org>, "surenb@...gle.com"
<surenb@...gle.com>, "mhocko@...e.com" <mhocko@...e.com>, "song@...nel.org"
<song@...nel.org>, "jolsa@...nel.org" <jolsa@...nel.org>, "ast@...nel.org"
<ast@...nel.org>, "daniel@...earbox.net" <daniel@...earbox.net>,
"andrii@...nel.org" <andrii@...nel.org>, "martin.lau@...ux.dev"
<martin.lau@...ux.dev>, "eddyz87@...il.com" <eddyz87@...il.com>,
"yonghong.song@...ux.dev" <yonghong.song@...ux.dev>,
"john.fastabend@...il.com" <john.fastabend@...il.com>, "kpsingh@...nel.org"
<kpsingh@...nel.org>, "sdf@...ichev.me" <sdf@...ichev.me>,
"haoluo@...gle.com" <haoluo@...gle.com>, "jgg@...pe.ca" <jgg@...pe.ca>,
"jhubbard@...dia.com" <jhubbard@...dia.com>, "peterx@...hat.com"
<peterx@...hat.com>, "jannh@...gle.com" <jannh@...gle.com>,
"pfalcato@...e.de" <pfalcato@...e.de>, "shuah@...nel.org" <shuah@...nel.org>,
"seanjc@...gle.com" <seanjc@...gle.com>, "kvm@...r.kernel.org"
<kvm@...r.kernel.org>, "linux-doc@...r.kernel.org"
<linux-doc@...r.kernel.org>, "linux-kernel@...r.kernel.org"
<linux-kernel@...r.kernel.org>, "linux-arm-kernel@...ts.infradead.org"
<linux-arm-kernel@...ts.infradead.org>, "kvmarm@...ts.linux.dev"
<kvmarm@...ts.linux.dev>, "linux-fsdevel@...r.kernel.org"
<linux-fsdevel@...r.kernel.org>, "linux-mm@...ck.org" <linux-mm@...ck.org>,
"bpf@...r.kernel.org" <bpf@...r.kernel.org>,
"linux-kselftest@...r.kernel.org" <linux-kselftest@...r.kernel.org>, "Cali,
Marco" <xmarcalx@...zon.co.uk>, "Kalyazin, Nikita" <kalyazin@...zon.co.uk>,
"Thomson, Jack" <jackabt@...zon.co.uk>, "derekmn@...zon.co.uk"
<derekmn@...zon.co.uk>, "tabba@...gle.com" <tabba@...gle.com>,
"ackerleytng@...gle.com" <ackerleytng@...gle.com>
Subject: [PATCH v7 06/12] KVM: guest_memfd: add module param for disabling TLB
flushing
Add an option to not perform TLB flushes after direct map manipulations.
TLB flushes result in a up to 40x elongation of page faults in
guest_memfd (scaling with the number of CPU cores), or a 5x elongation
of memory population, which is inacceptable when wanting to use direct
map removed guest_memfd as a drop-in replacement for existing workloads.
TLB flushes are not needed for functional correctness (the virt->phys
mapping technically stays "correct", the kernel should simply not use it
for a while), so we can skip them to keep performance in-line with
"traditional" VMs.
Enabling this option means that the desired protection from
Spectre-style attacks is not perfect, as an attacker could try to
prevent a stale TLB entry from getting evicted, keeping it alive until
the page it refers to is used by the guest for some sensitive data, and
then targeting it using a spectre-gadget.
Cc: Will Deacon <will@...nel.org>
Signed-off-by: Patrick Roy <roypat@...zon.co.uk>
---
include/linux/kvm_host.h | 1 +
virt/kvm/guest_memfd.c | 3 ++-
virt/kvm/kvm_main.c | 3 +++
3 files changed, 6 insertions(+), 1 deletion(-)
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index 73a15cade54a..4d2bc18860fc 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -2298,6 +2298,7 @@ extern unsigned int halt_poll_ns;
extern unsigned int halt_poll_ns_grow;
extern unsigned int halt_poll_ns_grow_start;
extern unsigned int halt_poll_ns_shrink;
+extern bool guest_memfd_tlb_flush;
struct kvm_device {
const struct kvm_device_ops *ops;
diff --git a/virt/kvm/guest_memfd.c b/virt/kvm/guest_memfd.c
index b7129c4868c5..d8dd24459f0d 100644
--- a/virt/kvm/guest_memfd.c
+++ b/virt/kvm/guest_memfd.c
@@ -63,7 +63,8 @@ static int kvm_gmem_folio_zap_direct_map(struct folio *folio)
if (!r) {
unsigned long addr = (unsigned long) folio_address(folio);
folio->private = (void *) ((u64) folio->private & KVM_GMEM_FOLIO_NO_DIRECT_MAP);
- flush_tlb_kernel_range(addr, addr + folio_size(folio));
+ if (guest_memfd_tlb_flush)
+ flush_tlb_kernel_range(addr, addr + folio_size(folio));
}
return r;
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index b5e702d95230..753c06ebba7f 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -95,6 +95,9 @@ unsigned int halt_poll_ns_shrink = 2;
module_param(halt_poll_ns_shrink, uint, 0644);
EXPORT_SYMBOL_GPL(halt_poll_ns_shrink);
+bool guest_memfd_tlb_flush = true;
+module_param(guest_memfd_tlb_flush, bool, 0444);
+
/*
* Allow direct access (from KVM or the CPU) without MMU notifier protection
* to unpinned pages.
--
2.51.0
Powered by blists - more mailing lists