[Xen-devel] [PATCH v4 0/7] xen/x86: various XPTI speedups

[Juergen Gross <jgross@xxxxxxxx>]

This patch series aims at reducing the overhead of the XPTI Meltdown
mitigation. It is based on Jan's XPTI speedup series.

Patch 1 had been posted before, the main changes in this patch are due
to addressing Jan's comments on my first version. The main objective of
that patch is to avoid copying the L4 page table each time the guest is
being activated, as often the contents didn't change while the
hypervisor was active.

Patch 2 tries to minimize flushing the TLB: there is no need to flush
it in write_ptbase() and when activating the guest.

Patch 3 sets the stage for being able to activate XPTI per domain. As a
first step it is now possible to switch XPTI off for dom0 via the xpti
boot parameter.

Patch 4 adds support for using the INVPCID instruction for flushing
the TLB.

Patch 5 reduces the costs of TLB flushes even further: as we don't make
any use of global TLB entries with XPTI being active we can avoid
removing all global TLB entries on TLB flushes by simply deactivating
the global pages in CR4.

Patch 6 was originally only meant to prepare using PCIDs in patch 6.
For that purpose it was necessary to allow CR3 values with bit 63 set
in order to avoid flushing TLB entries when writing CR3. This requires
a modification of Jan's rather clever state machine with positive and
negative CR3 values for the hypervisor by using a dedicated flag byte
instead. It turned out this modification saved one branch on interrupt
entry speeding up the handling by a few percent.

Patch 7 is the main performance contributor: by making use of the PCID
feature (if available) TLB entries can survive CR3 switches. The TLB
needs to be flushed on context switches only and not when switching
between guest and hypervisor or guest kernel and user mode.

On my machine (Intel i7-4600M) using the PCID feature in the non-XPTI
case showed a slightly worse performance than using global pages
instead (using PCID and global pages is a bad idea as invalidating
global pages in this case would need a complete TLB flush). For this
reason I've decided to use PCID for XPTI only as the default. That
can easily be changed by using the command line parameter "pcid=all".

The complete series has been verified to still mitigate against
Meltdown attacks. A simple performance test (make -j 4 in the Xen
hypervisor directory) showed significant improvements compared to the
state without this series (so with Jan's series applied),
the percentage after the numbers is always related to XPTI off:

       XPTI off     Jan, XPTI on        +this series, XPTI on
real   1m21.169s    1m52.149s (+38%)    1m25.692s (+6%)
user   2m47.652s    2m50.054s (+1%)     2m46.428s (-1%)
sys    1m11.949s    2m21.767s (+97%)    1m23.053s (+15%)


Juergen Gross (7):
  x86/xpti: avoid copying L4 page table contents when possible
  x86/xpti: don't flush TLB twice when switching to 64-bit pv context
  xen/x86: support per-domain flag for xpti
  xen/x86: use invpcid for flushing the TLB
  xen/x86: disable global pages for domains with XPTI active
  xen/x86: use flag byte for decision whether xen_cr3 is valid
  xen/x86: use PCID feature

 docs/misc/xen-command-line.markdown |  32 +++++++-
 xen/arch/x86/cpu/mtrr/generic.c     |  37 ++++++---
 xen/arch/x86/debug.c                |   2 +-
 xen/arch/x86/domain.c               |   6 +-
 xen/arch/x86/domain_page.c          |   2 +-
 xen/arch/x86/domctl.c               |   8 ++
 xen/arch/x86/flushtlb.c             |  91 ++++++++++++++++-----
 xen/arch/x86/mm.c                   |  84 ++++++++++++++++----
 xen/arch/x86/pv/dom0_build.c        |   4 +
 xen/arch/x86/pv/domain.c            | 154 +++++++++++++++++++++++++++++++++++-
 xen/arch/x86/setup.c                |  27 +++----
 xen/arch/x86/smp.c                  |   2 +-
 xen/arch/x86/smpboot.c              |   6 +-
 xen/arch/x86/x86_64/asm-offsets.c   |   2 +
 xen/arch/x86/x86_64/compat/entry.S  |   5 +-
 xen/arch/x86/x86_64/entry.S         |  87 +++++++++-----------
 xen/common/efi/runtime.c            |   4 +-
 xen/include/asm-x86/current.h       |  23 ++++--
 xen/include/asm-x86/domain.h        |  17 ++--
 xen/include/asm-x86/flushtlb.h      |   4 +-
 xen/include/asm-x86/processor.h     |   3 +
 xen/include/asm-x86/pv/domain.h     |  24 ++++++
 xen/include/asm-x86/x86-defns.h     |   4 +-
 23 files changed, 483 insertions(+), 145 deletions(-)

-- 
2.13.6


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-devel