Received-SPF: pass (google.com: domain of linux-kernel+bounces-101276-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
Date: Wed, 13 Mar 2024 16:55:04 +0800
From: Yan Zhao <yan.y.zhao@intel.com>
To: "Tian, Kevin" <kevin.tian@intel.com>
CC: Sean Christopherson <seanjc@google.com>, "jgg@nvidia.com"
	<jgg@nvidia.com>, Paolo Bonzini <pbonzini@redhat.com>, Lai Jiangshan
	<jiangshanlai@gmail.com>, "Paul E. McKenney" <paulmck@kernel.org>, "Josh
 Triplett" <josh@joshtriplett.org>, "kvm@vger.kernel.org"
	<kvm@vger.kernel.org>, "rcu@vger.kernel.org" <rcu@vger.kernel.org>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>, Yiwei Zhang
	<zzyiwei@google.com>
Subject: Re: [PATCH 5/5] KVM: VMX: Always honor guest PAT on CPUs that
 support self-snoop
Message-ID: <ZfFp6HtYSmO4Q6sW@yzhao56-desk.sh.intel.com>
Reply-To: Yan Zhao <yan.y.zhao@intel.com>
References: <20240309010929.1403984-1-seanjc@google.com>
 <20240309010929.1403984-6-seanjc@google.com>
 <Ze5bee/qJ41IESdk@yzhao56-desk.sh.intel.com>
 <Ze-hC8NozVbOQQIT@google.com>
 <BN9PR11MB527600EC915D668127B97E3C8C2B2@BN9PR11MB5276.namprd11.prod.outlook.com>
 <ZfB9rzqOWmbaOeHd@google.com>
 <ZfD++pl/3pvyi0xD@yzhao56-desk.sh.intel.com>
 <BN9PR11MB527688657D92896F1B19C2F98C2A2@BN9PR11MB5276.namprd11.prod.outlook.com>
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <BN9PR11MB527688657D92896F1B19C2F98C2A2@BN9PR11MB5276.namprd11.prod.outlook.com>
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?ZT4HrKQvW53Sp+cysZDaoYfshSnMOU781v15cQaHuGAOAWTSHft1D7cbW4rd?=
 =?us-ascii?Q?NfJYER7ZTrYEnRjTqHvPj3mhKJVXNQz88amsnQEp71ZG7SVLt6K3X5yUBjz7?=
 =?us-ascii?Q?ExvbdoNzLgud1Goj3dDQt0O61xjejTvkflFRCeexxA83nGUy5WKrBE9IfE9x?=
 =?us-ascii?Q?ft4cJewBP2TFDaobeKWbeDucmuzithYu7YG2jEooypCM1eFljW/iDX3UQ7Rf?=
 =?us-ascii?Q?ASaABep24GBOkk5J5aQ8llmMzgfQ112tJ2tPQqz0N7nJt/KgR6DJsiF+dlas?=
 =?us-ascii?Q?wvPoTB+T/lPxPdO1cquGwzZO9fi24tbwzFPeLilkz0LAlQ496OXvaBlw1Bvf?=
 =?us-ascii?Q?Xo0bz9dl1kg2ioaCY9+sfIhHDhovc/Nrvlvo/A0dW0KvpuOjUPL7OQnewK5h?=
 =?us-ascii?Q?nBLora/bLlLbNJCyqaXSB+XMYPdS77h7wETvcr5s2GLqjrtraIdVi0FUzOyD?=
 =?us-ascii?Q?5l91coc0fXZFvzUR+ebu9aAhuDGARXS0t/Ubdd0969QMbzJPvQBuWs427Wck?=
 =?us-ascii?Q?0pW4tT5UG/iDg+CHMy2Y+MmlP3T29wyOOYpg2GLThsWN5KOUaaZ0i8Dn2KVG?=
 =?us-ascii?Q?HNE7Z7a4sWUh2z6Zit1AsanMHbtCDW2qdthet5/uIoPb7svrK54a9nEFrB9G?=
 =?us-ascii?Q?stZggO024OJnLlfJxQDXn1A7LYqKJVF6JskgzG7yfcjD0dhfEmhw49tIOxM4?=
 =?us-ascii?Q?VKPUzIyvbFQTonvTE0lhesEa0Paq79w7i/aNg5nXfcQl7MMj0d597CG3S5wZ?=
 =?us-ascii?Q?cV+oZvjDEr0AQcPphOk3wSvt8VRRYQtf4TG3JFa1jWA8aGalszd11Q1xf9kH?=
 =?us-ascii?Q?f84iCCCVLn2eTb76XsaRSEO2WKp6l4yjDC84dZ09yrPxlGq5UrYsfJH4lVps?=
 =?us-ascii?Q?XXsh462F/YhDZXEc1ocuNwmIDM5FkQhu2bJ0ACFWLzPNXfPggp98gF/sXbk8?=
 =?us-ascii?Q?5szUcEuSfMFLJag0IoFueWBOT815ObA7OGr6vFpggJE+hNxZDx952IQZXmHt?=
 =?us-ascii?Q?qXkj66H2pVSklP0qMRGvsgGSLWhyZIVZb6Ii9Mp/8ShIX9g8e5E94kfxFanr?=
 =?us-ascii?Q?KmjmzLnQ8hCx87MLBbhaAsoGxurks6IVCwP2GFzEsK42T9M1jAUJLPar0y5W?=
 =?us-ascii?Q?to/9Ci6PbI11l78IC3/eg5ig8cAUYRyXrQstgWe9KrSpVb2tQJu9IJMaucz4?=
 =?us-ascii?Q?vjcdNYFpv8gAXsCV7ZeblshZrMZEzza4cGR9poo2HH4Gua7x51ncm+xHm7mD?=
 =?us-ascii?Q?nwkbYDHoHKEjwQVx1CgaQ6nUFpBpHmBA9V5Y8FWjiP+i55mCpegzDOaBaYS3?=
 =?us-ascii?Q?BlLVfmmVHNwApJMJjc5BiyMJg/UOawNovzsKW5HriZHqmobBN3gAT//ZplW6?=
 =?us-ascii?Q?ldGsT56SLwZqQh4mdE7E5oEtypnER9YtFFYp+d0eaM/bWGYiURhAYVMGWLzp?=
 =?us-ascii?Q?GcBRTfLSClNen9SsdH6f2CUjUWHWY4Mkimi1jfV32MhH1Wd0hUQiA8IGDVRp?=
 =?us-ascii?Q?05XZsrIFE7TD/68nQmty2u1vNCbG0QrNWqrqDTc3RyOP15fFK7Bg1xCCyrZ5?=
 =?us-ascii?Q?Am8xrRNnra8b+CEtIIoYGwdwARON5W60S4WAV0Cn?=
X-MS-Exchange-CrossTenant-Network-Message-Id: 2f709294-a68e-4b53-db7d-08dc433f7361
X-MS-Exchange-CrossTenant-AuthSource: DS7PR11MB5966.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Mar 2024 09:24:57.8696
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: KuLfZAXFtuS5aKV80mFSKkSBfM+IRZNDa6VqFfPZWgYDdUmPREgFgBi7QqKPI0vkfATGubqXiEa0o8YbYuQ4SA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH3PR11MB7914
X-OriginatorOrg: intel.com

> We'll certain fix the security hole on CPUs w/ self-snoop. In this case
> CPU accesses are guaranteed to be coherent and the vulnerability can
> only be exposed via non-coherent DMA which is supposed to be fixed
> by your coming series. 
> 
> But for old CPUs w/o self-snoop the hole can be exploited using either CPU
> or non-coherent DMA once the guest PAT is honored. As long as nobody
> is willing to actually fix the CPU path (is it possible?) I'm kind of convinced
We can cook a patch to check CPU self-snoop and force WB in EPT even for
non-coherent DMA if no self-snoop. Then back porting such a patch together
with the IOMMU side mitigation for non-coherent DMA.

Otherwise, IOMMU side mitigation alone is meaningless for platforms of CPU of
no self-snoop.

> by Sean that sustaining the old behavior is probably the best option...
Yes, as long as we think exposing secuirty hole on those platforms is acceptable.