Re: Redoing eXclusive Page Frame Ownership (XPFO) with isolated CPUs in mind (for KVM to isolate its guests per CPU)

From: Wes Turner <wes.turner@gmail.com>
To: Linus Torvalds <torvalds@linux-foundation.org>
Cc: "jsteckli@amazon.de" <jsteckli@amazon.de>,
	David Woodhouse <dwmw@amazon.co.uk>,
	Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>,
	"juerg.haefliger@hpe.com" <juerg.haefliger@hpe.com>,
	"deepa.srinivasan@oracle.com" <deepa.srinivasan@oracle.com>,
	Jim Mattson <jmattson@google.com>,
	Andrew Cooper <andrew.cooper3@citrix.com>,
	Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
	Boris Ostrovsky <boris.ostrovsky@oracle.com>,
	linux-mm <linux-mm@kvack.org>,
	Thomas Gleixner <tglx@linutronix.de>,
	"joao.m.martins@oracle.com" <joao.m.martins@oracle.com>,
	"pradeep.vincent@oracle.com" <pradeep.vincent@oracle.com>,
	Andi Kleen <ak@linux.intel.com>,
	Khalid Aziz <khalid.aziz@oracle.com>,
	"kanth.ghatraju@oracle.com" <kanth.ghatraju@oracle.com>,
	Liran Alon <liran.alon@oracle.com>,
	Kees Cook <keescook@google.com>,
	Kernel Hardening <kernel-hardening@lists.openwall.com>,
	"chris.hyser@oracle.com" <chris.hyser@oracle.com>,
	Tyler Hicks <tyhicks@canonical.com>,
	John Haxby <john.haxby@oracle.com>, Jon Masters <jcm@redhat.com>
Subject: Re: Redoing eXclusive Page Frame Ownership (XPFO) with isolated CPUs in mind (for KVM to isolate its guests per CPU)
Date: Sat, 1 Sep 2018 18:33:22 -0400	[thread overview]
Message-ID: <CACfEFw_h5uup-anKZwfBcWMJB7gHxb9NEPTRSUAY0+t11RiQbg@mail.gmail.com> (raw)
In-Reply-To: <CA+55aFzHj_GNZWG4K2oDu4DPP9sZdTZ9PY7sBxGB6WoN9g8d=A@mail.gmail.com>

[-- Attachment #1: Type: text/plain, Size: 1635 bytes --]

Speaking of pages and slowdowns,
is there a better place to ask this question:

>From "'Turning Tables' shared page tables vuln":

"""
'New "Turning Tables" Technique Bypasses All Windows Kernel Mitigations'
https://www.bleepingcomputer.com/news/security/new-turning-tables-technique-bypasses-all-windows-kernel-mitigations/

> Furthermore, since the concept of page tables is also used by Apple and
the Linux project, macOS and Linux are, in theory, also vulnerable to this
technique, albeit the researchers have not verified such attacks, as of yet.

Slides:
https://cdn2.hubspot.net/hubfs/487909/Turning%20(Page)%20Tables_Slides.pdf

Naturally, I took notice and decided to forward the latest scary headline
to this list to see if this is already being addressed?
"""

On Saturday, September 1, 2018, Linus Torvalds <
torvalds@linux-foundation.org> wrote:

> On Fri, Aug 31, 2018 at 12:45 AM Julian Stecklina <jsteckli@amazon.de>
> wrote:
> >
> > I've been spending some cycles on the XPFO patch set this week. For the
> > patch set as it was posted for v4.13, the performance overhead of
> > compiling a Linux kernel is ~40% on x86_64[1]. The overhead comes almost
> > completely from TLB flushing. If we can live with stale TLB entries
> > allowing temporary access (which I think is reasonable), we can remove
> > all TLB flushing (on x86). This reduces the overhead to 2-3% for
> > kernel compile.
>
> I have to say, even 2-3% for a kernel compile sounds absolutely horrendous.
>
> Kernel bullds are 90% user space at least for me, so a 2-3% slowdown
> from a kernel is not some small unnoticeable thing.
>
>            Linus
>

[-- Attachment #2: Type: text/html, Size: 2398 bytes --]