Re: [PATCH v7 06/12] KVM: guest_memfd: add module param for disabling TLB flushing

David Hildenbrand
2025-09-25T19:20:32Z

On 25.09.25 20:27, Dave Hansen wrote:
> On 9/24/25 08:22, Roy, Patrick wrote:
>> Add an option to not perform TLB flushes after direct map manipulations.
>
> I'd really prefer this be left out for now. It's a massive can of worms.
> Let's agree on something that works and has well-defined behavior before
> we go breaking it on purpose.

May I ask what the big concern here is? Not to challenge your position
but to understand the involved problems and what would have to be
documented at some point in a patch.

Essentially we're removing the direct map from some memory we allocated
through the buddy to reinstall it before we free the memory back to the
buddy.

So from the buddy POV whether we flush or don't flush the TLB shouldn't
matter, right?

Where the missing TLB flush would be relevant is to the workload (VM)
where some (speculative) access through the direct map would be possible
until the TLB was flushed.

So until flushed, it's not-as-secure-as-you think. A flush after some
time (batched over multiple page allocations?) could make it deterministic.

Is there something else that's problematic?

--
Cheers

David / dhildenb