Date: Thu, 10 Jan 2019 17:20:42 -0700 From: Khalid Aziz <khalid.aziz@...cle.com> To: Kees Cook <keescook@...omium.org> Cc: Andy Lutomirski <luto@...nel.org>, Dave Hansen <dave.hansen@...el.com>, Ingo Molnar <mingo@...nel.org>, Juerg Haefliger <juergh@...il.com>, Tycho Andersen <tycho@...ho.ws>, jsteckli@...zon.de, Andi Kleen <ak@...ux.intel.com>, Linus Torvalds <torvalds@...ux-foundation.org>, liran.alon@...cle.com, Konrad Rzeszutek Wilk <konrad.wilk@...cle.com>, deepa.srinivasan@...cle.com, chris hyser <chris.hyser@...cle.com>, Tyler Hicks <tyhicks@...onical.com>, "Woodhouse, David" <dwmw@...zon.co.uk>, Andrew Cooper <andrew.cooper3@...rix.com>, Jon Masters <jcm@...hat.com>, Boris Ostrovsky <boris.ostrovsky@...cle.com>, kanth.ghatraju@...cle.com, joao.m.martins@...cle.com, Jim Mattson <jmattson@...gle.com>, pradeep.vincent@...cle.com, John Haxby <john.haxby@...cle.com>, "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>, Christoph Hellwig <hch@....de>, steven.sistare@...cle.com, Kernel Hardening <kernel-hardening@...ts.openwall.com>, Linux-MM <linux-mm@...ck.org>, LKML <linux-kernel@...r.kernel.org>, Thomas Gleixner <tglx@...utronix.de> Subject: Re: [RFC PATCH v7 00/16] Add support for eXclusive Page Frame Ownership Thanks for looking this over. On 1/10/19 4:07 PM, Kees Cook wrote: > On Thu, Jan 10, 2019 at 1:10 PM Khalid Aziz <khalid.aziz@...cle.com> wrote: >> I implemented a solution to reduce performance penalty and >> that has had large impact. When XPFO code flushes stale TLB entries, >> it does so for all CPUs on the system which may include CPUs that >> may not have any matching TLB entries or may never be scheduled to >> run the userspace task causing TLB flush. Problem is made worse by >> the fact that if number of entries being flushed exceeds >> tlb_single_page_flush_ceiling, it results in a full TLB flush on >> every CPU. A rogue process can launch a ret2dir attack only from a >> CPU that has dual mapping for its pages in physmap in its TLB. We >> can hence defer TLB flush on a CPU until a process that would have >> caused a TLB flush is scheduled on that CPU. I have added a cpumask >> to task_struct which is then used to post pending TLB flush on CPUs >> other than the one a process is running on. This cpumask is checked >> when a process migrates to a new CPU and TLB is flushed at that >> time. I measured system time for parallel make with unmodified 4.20 >> kernel, 4.20 with XPFO patches before this optimization and then >> again after applying this optimization. Here are the results: >> >> Hardware: 96-core Intel Xeon Platinum 8160 CPU @ 2.10GHz, 768 GB RAM >> make -j60 all >> >> 4.20 915.183s >> 4.20+XPFO 24129.354s 26.366x >> 4.20+XPFO+Deferred flush 1216.987s 1.330xx >> >> >> Hardware: 4-core Intel Core i5-3550 CPU @ 3.30GHz, 8G RAM >> make -j4 all >> >> 4.20 607.671s >> 4.20+XPFO 1588.646s 2.614x >> 4.20+XPFO+Deferred flush 794.473s 1.307xx > > Well that's an impressive improvement! Nice work. :) > > (Are the cpumask improvements possible to be extended to other TLB > flushing needs? i.e. could there be other performance gains with that > code even for a non-XPFO system?) It may be usable for other situations as well but I have not given it any thought yet. I will take a look. > >> 30+% overhead is still very high and there is room for improvement. >> Dave Hansen had suggested batch updating TLB entries and Tycho had >> created an initial implementation but I have not been able to get >> that to work correctly. I am still working on it and I suspect we >> will see a noticeable improvement in performance with that. In the >> code I added, I post a pending full TLB flush to all other CPUs even >> when number of TLB entries being flushed on current CPU does not >> exceed tlb_single_page_flush_ceiling. There has to be a better way >> to do this. I just haven't found an efficient way to implemented >> delayed limited TLB flush on other CPUs. >> >> I am not entirely sure if switch_mm_irqs_off() is indeed the right >> place to perform the pending TLB flush for a CPU. Any feedback on >> that will be very helpful. Delaying full TLB flushes on other CPUs >> seems to help tremendously, so if there is a better way to implement >> the same thing than what I have done in patch 16, I am open to >> ideas. > > Dave, Andy, Ingo, Thomas, does anyone have time to look this over? > >> Performance with this patch set is good enough to use these as >> starting point for further refinement before we merge it into main >> kernel, hence RFC. >> >> Since not flushing stale TLB entries creates a false sense of >> security, I would recommend making TLB flush mandatory and eliminate >> the "xpfotlbflush" kernel parameter (patch "mm, x86: omit TLB >> flushing by default for XPFO page table modifications"). > > At this point, yes, that does seem to make sense. > >> What remains to be done beyond this patch series: >> >> 1. Performance improvements >> 2. Remove xpfotlbflush parameter >> 3. Re-evaluate the patch "arm64/mm: Add support for XPFO to swiotlb" >> from Juerg. I dropped it for now since swiotlb code for ARM has >> changed a lot in 4.20. >> 4. Extend the patch "xpfo, mm: Defer TLB flushes for non-current >> CPUs" to other architectures besides x86. > > This seems like a good plan. > > I've put this series in one of my tree so that 0day will find it and > grind tests... > https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git/log/?h=kspp/xpfo/v7 Thanks for doing that! -- Khalid Download attachment "pEpkey.asc" of type "application/pgp-keys" (2461 bytes)
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.