Message-ID: <20250925155051.2959-1-roypat@amazon.co.uk>
Date: Thu, 25 Sep 2025 15:50:53 +0000
From: "Roy, Patrick" <roypat@...zon.co.uk>
To: "david@...hat.com" <david@...hat.com>
CC: "Liam.Howlett@...cle.com" <Liam.Howlett@...cle.com>,
	"ackerleytng@...gle.com" <ackerleytng@...gle.com>,
	"akpm@...ux-foundation.org" <akpm@...ux-foundation.org>, "andrii@...nel.org"
	<andrii@...nel.org>, "ast@...nel.org" <ast@...nel.org>, "bp@...en8.de"
	<bp@...en8.de>, "bpf@...r.kernel.org" <bpf@...r.kernel.org>,
	"catalin.marinas@....com" <catalin.marinas@....com>, "corbet@....net"
	<corbet@....net>, "daniel@...earbox.net" <daniel@...earbox.net>,
	"dave.hansen@...ux.intel.com" <dave.hansen@...ux.intel.com>,
	"derekmn@...zon.co.uk" <derekmn@...zon.co.uk>, "eddyz87@...il.com"
	<eddyz87@...il.com>, "haoluo@...gle.com" <haoluo@...gle.com>, "hpa@...or.com"
	<hpa@...or.com>, "Thomson, Jack" <jackabt@...zon.co.uk>, "jannh@...gle.com"
	<jannh@...gle.com>, "jgg@...pe.ca" <jgg@...pe.ca>, "jhubbard@...dia.com"
	<jhubbard@...dia.com>, "joey.gouly@....com" <joey.gouly@....com>,
	"john.fastabend@...il.com" <john.fastabend@...il.com>, "jolsa@...nel.org"
	<jolsa@...nel.org>, "Kalyazin, Nikita" <kalyazin@...zon.co.uk>,
	"kpsingh@...nel.org" <kpsingh@...nel.org>, "kvm@...r.kernel.org"
	<kvm@...r.kernel.org>, "kvmarm@...ts.linux.dev" <kvmarm@...ts.linux.dev>,
	"linux-arm-kernel@...ts.infradead.org"
	<linux-arm-kernel@...ts.infradead.org>, "linux-doc@...r.kernel.org"
	<linux-doc@...r.kernel.org>, "linux-fsdevel@...r.kernel.org"
	<linux-fsdevel@...r.kernel.org>, "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>, "linux-kselftest@...r.kernel.org"
	<linux-kselftest@...r.kernel.org>, "linux-mm@...ck.org" <linux-mm@...ck.org>,
	"lorenzo.stoakes@...cle.com" <lorenzo.stoakes@...cle.com>, "luto@...nel.org"
	<luto@...nel.org>, "martin.lau@...ux.dev" <martin.lau@...ux.dev>,
	"maz@...nel.org" <maz@...nel.org>, "mhocko@...e.com" <mhocko@...e.com>,
	"mingo@...hat.com" <mingo@...hat.com>, "oliver.upton@...ux.dev"
	<oliver.upton@...ux.dev>, "pbonzini@...hat.com" <pbonzini@...hat.com>,
	"peterx@...hat.com" <peterx@...hat.com>, "peterz@...radead.org"
	<peterz@...radead.org>, "pfalcato@...e.de" <pfalcato@...e.de>, "Roy, Patrick"
	<roypat@...zon.co.uk>, "rppt@...nel.org" <rppt@...nel.org>, "sdf@...ichev.me"
	<sdf@...ichev.me>, "seanjc@...gle.com" <seanjc@...gle.com>,
	"shuah@...nel.org" <shuah@...nel.org>, "song@...nel.org" <song@...nel.org>,
	"surenb@...gle.com" <surenb@...gle.com>, "suzuki.poulose@....com"
	<suzuki.poulose@....com>, "tabba@...gle.com" <tabba@...gle.com>,
	"tglx@...utronix.de" <tglx@...utronix.de>, "vbabka@...e.cz" <vbabka@...e.cz>,
	"will@...nel.org" <will@...nel.org>, "willy@...radead.org"
	<willy@...radead.org>, "x86@...nel.org" <x86@...nel.org>, "Cali, Marco"
	<xmarcalx@...zon.co.uk>, "yonghong.song@...ux.dev" <yonghong.song@...ux.dev>,
	"yuzenghui@...wei.com" <yuzenghui@...wei.com>
Subject: Re: [PATCH v7 06/12] KVM: guest_memfd: add module param for disabling
 TLB flushing

On Thu, 2025-09-25 at 12:02 +0100, David Hildenbrand wrote:
> On 24.09.25 17:22, Roy, Patrick wrote:
>> Add an option to not perform TLB flushes after direct map manipulations.
>> TLB flushes result in a up to 40x elongation of page faults in
>> guest_memfd (scaling with the number of CPU cores), or a 5x elongation
>> of memory population, which is inacceptable when wanting to use direct
>> map removed guest_memfd as a drop-in replacement for existing workloads.
>>
>> TLB flushes are not needed for functional correctness (the virt->phys
>> mapping technically stays "correct", the kernel should simply not use it
>> for a while), so we can skip them to keep performance in-line with
>> "traditional" VMs.
>>
>> Enabling this option means that the desired protection from
>> Spectre-style attacks is not perfect, as an attacker could try to
>> prevent a stale TLB entry from getting evicted, keeping it alive until
>> the page it refers to is used by the guest for some sensitive data, and
>> then targeting it using a spectre-gadget.
>>
>> Cc: Will Deacon <will@...nel.org>
>> Signed-off-by: Patrick Roy <roypat@...zon.co.uk>
>> ---
>>   include/linux/kvm_host.h | 1 +
>>   virt/kvm/guest_memfd.c   | 3 ++-
>>   virt/kvm/kvm_main.c      | 3 +++
>>   3 files changed, 6 insertions(+), 1 deletion(-)
>>
>> diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
>> index 73a15cade54a..4d2bc18860fc 100644
>> --- a/include/linux/kvm_host.h
>> +++ b/include/linux/kvm_host.h
>> @@ -2298,6 +2298,7 @@ extern unsigned int halt_poll_ns;
>>   extern unsigned int halt_poll_ns_grow;
>>   extern unsigned int halt_poll_ns_grow_start;
>>   extern unsigned int halt_poll_ns_shrink;
>> +extern bool guest_memfd_tlb_flush;
>>
>>   struct kvm_device {
>>       const struct kvm_device_ops *ops;
>> diff --git a/virt/kvm/guest_memfd.c b/virt/kvm/guest_memfd.c
>> index b7129c4868c5..d8dd24459f0d 100644
>> --- a/virt/kvm/guest_memfd.c
>> +++ b/virt/kvm/guest_memfd.c
>> @@ -63,7 +63,8 @@ static int kvm_gmem_folio_zap_direct_map(struct folio *folio)
>>       if (!r) {
>>               unsigned long addr = (unsigned long) folio_address(folio);
>>               folio->private = (void *) ((u64) folio->private & KVM_GMEM_FOLIO_NO_DIRECT_MAP);
>> -             flush_tlb_kernel_range(addr, addr + folio_size(folio));
>> +             if (guest_memfd_tlb_flush)
>> +                     flush_tlb_kernel_range(addr, addr + folio_size(folio));
>>       }
>>
>>       return r;
>> diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
>> index b5e702d95230..753c06ebba7f 100644
>> --- a/virt/kvm/kvm_main.c
>> +++ b/virt/kvm/kvm_main.c
>> @@ -95,6 +95,9 @@ unsigned int halt_poll_ns_shrink = 2;
>>   module_param(halt_poll_ns_shrink, uint, 0644);
>>   EXPORT_SYMBOL_GPL(halt_poll_ns_shrink);
>>
>> +bool guest_memfd_tlb_flush = true;
>> +module_param(guest_memfd_tlb_flush, bool, 0444);
> 
> The parameter name is a bit too generic. I think you somehow have to
> incorporate the "direct_map" aspects.

Fair :)

> Also, I wonder if this could be a capability per vm/guest_memfd?

I don't really have any opinions on how to expose this knob, but I
thought capabilities should be additive? (e.g. we only have
KVM_ENABLE_EXTENSION(), and then having a capability with a negative
polarity "enable to _not_ do TLB flushes" is a bit weird in my head).
Then again, if people are fine having TLB flushes be opt-in instead of
opt-out (Will's comment on v6 makes me believe that the opt-out itself
might already be controversial for arm64), a capability would work.

> Then, you could also nicely document the semantics, considerations,
> impact etc :)

Yup, I got so lost in trying to figure out why flush_kernel_tlb_range()
didnt refused to let itself be exported that docs slipped my mind haha.

> -- 
> Cheers
> 
> David / dhildenb
> 

Best,
Patrick

Powered by blists - more mailing lists