Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Content-Type: text/plain;
        charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 13.0 \(3601.0.10\))
Subject: Re: [FYI PATCH 0/7] Mitigation for CVE-2018-12207
From:   Nadav Amit <nadav.amit@gmail.com>
In-Reply-To: <6a317558-44c0-5a21-0310-4ae49048134f@intel.com>
Date:   Wed, 13 Nov 2019 22:02:00 -0800
Cc:     Paolo Bonzini <pbonzini@redhat.com>,
        Jan Kiszka <jan.kiszka@siemens.com>,
        linux-kernel@vger.kernel.org, kvm@vger.kernel.org,
        Ralf Ramsauer <ralf.ramsauer@oth-regensburg.de>,
        "Gupta, Pawan Kumar" <pawan.kumar.gupta@intel.com>
Content-Transfer-Encoding: quoted-printable
Message-Id: <130E72B7-E7C0-4E96-A580-8F96FAF59996@gmail.com>
References: <1573593697-25061-1-git-send-email-pbonzini@redhat.com>
 <23353382-53ea-8b20-7e30-763ef6df374c@siemens.com>
 <ea5a084b-e047-6677-b8fe-d7bb6f8c0ef8@redhat.com>
 <dffb19ab-daa2-a513-531e-c43279d8a4bf@intel.com>
 <6C0513A5-6C73-4F17-B73B-6F19E7D9EAF0@gmail.com>
 <6a317558-44c0-5a21-0310-4ae49048134f@intel.com>
To:     Dave Hansen <dave.hansen@intel.com>
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk


> On Nov 13, 2019, at 9:26 PM, Dave Hansen <dave.hansen@intel.com> =
wrote:
>=20
> On 11/13/19 5:17 PM, Nadav Amit wrote:
>> But is it always the case? Looking at __split_large_page(), it seems =
that the
>> TLB invalidation is only done after the PMD is changed. Can't this =
leave a
>> small time window in which a malicious actor triggers a machine-check =
on=20
>> another core than the one that runs __split_large_page()?
>=20
> It's not just a split.  It has to be a change that results in
> inconsistencies between two entries in the TLB.  A normal split =
doesn't
> change the resulting final translations and is never inconsistent
> between the two translations.
>=20
> To have an inconsistency, you need to change the backing physical
> address (or cache attributes?).  I'd need to go double-check the =
erratum
> to be sure about the cache attributes.
>=20
> In any case, that's why we decided that normal kernel mapping
> split/merges don't need to be mitigated.  But, we should probably
> document this somewhere if it's not clear.
>=20
> Pawan, did we document the results of the audit you did anywhere?

Thank you for explaining. I now see that it is clearly written:

"Software modifies the paging structures so that the same linear address
is translated using a large page (2 MB, 4 MB, or 1 GB) with a different
physical address or memory type.=E2=80=9D [1]

My bad.


[1] =
https://software.intel.com/security-software-guidance/insights/deep-dive-m=
achine-check-error-avoidance-page-size-change-0=