Received-SPF: pass (google.com: domain of linux-kernel+bounces-186218-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.48.161 as permitted sender) client-ip=147.75.48.161;
Date: Wed, 22 May 2024 09:26:05 -0300
From: Jason Gunthorpe <jgg@nvidia.com>
To: Yan Zhao <yan.y.zhao@intel.com>
Cc: Alex Williamson <alex.williamson@redhat.com>,
	"Tian, Kevin" <kevin.tian@intel.com>,
	"Vetter, Daniel" <daniel.vetter@intel.com>,
	"kvm@vger.kernel.org" <kvm@vger.kernel.org>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
	"x86@kernel.org" <x86@kernel.org>,
	"iommu@lists.linux.dev" <iommu@lists.linux.dev>,
	"pbonzini@redhat.com" <pbonzini@redhat.com>,
	"seanjc@google.com" <seanjc@google.com>,
	"dave.hansen@linux.intel.com" <dave.hansen@linux.intel.com>,
	"luto@kernel.org" <luto@kernel.org>,
	"peterz@infradead.org" <peterz@infradead.org>,
	"tglx@linutronix.de" <tglx@linutronix.de>,
	"mingo@redhat.com" <mingo@redhat.com>,
	"bp@alien8.de" <bp@alien8.de>, "hpa@zytor.com" <hpa@zytor.com>,
	"corbet@lwn.net" <corbet@lwn.net>,
	"joro@8bytes.org" <joro@8bytes.org>,
	"will@kernel.org" <will@kernel.org>,
	"robin.murphy@arm.com" <robin.murphy@arm.com>,
	"baolu.lu@linux.intel.com" <baolu.lu@linux.intel.com>,
	"Liu, Yi L" <yi.l.liu@intel.com>
Subject: Re: [PATCH 4/5] vfio/type1: Flush CPU caches on DMA pages in
 non-coherent domains
Message-ID: <20240522122605.GS20229@nvidia.com>
References: <20240510105728.76d97bbb.alex.williamson@redhat.com>
 <ZkG9IEQwi7HG3YBk@yzhao56-desk.sh.intel.com>
 <BN9PR11MB52766D78684F6206121590B98CED2@BN9PR11MB5276.namprd11.prod.outlook.com>
 <20240516143159.0416d6c7.alex.williamson@redhat.com>
 <20240517171117.GB20229@nvidia.com>
 <BN9PR11MB5276250B2CF376D15D16FF928CE92@BN9PR11MB5276.namprd11.prod.outlook.com>
 <20240521160714.GJ20229@nvidia.com>
 <20240521102123.7baaf85a.alex.williamson@redhat.com>
 <20240521163400.GK20229@nvidia.com>
 <Zk1lZNCPywTmythz@yzhao56-desk.sh.intel.com>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <Zk1lZNCPywTmythz@yzhao56-desk.sh.intel.com>
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0:
	=?us-ascii?Q?Ym6QmUdYN0FN6Xv20P59mW+ySuVArnYi20HqvlVLZB2hYZXsNbkblUunO0Cp?=
 =?us-ascii?Q?vhNAX0/vELI8HnK3aCwh7fomMKAe86cJvz0nSbWymrS8QBAB3fDZv4QeDi6e?=
 =?us-ascii?Q?t8AiBgCZDeMalrAsmQxmusMMfa2NLfGE0wKrBFyYb/eGT3DKQpPDev4MG3ch?=
 =?us-ascii?Q?sS/4Pr4ITqb2z96y7ysPNk7kVsUV6Oi7o6ZnS4RiG/6w+DF/gyS71PHBSCPp?=
 =?us-ascii?Q?WaNScKdQH9Ys3bHF0kvlirXSnEMoNox0YNqZ8njqX/7th0AFka9A3N2yQJlr?=
 =?us-ascii?Q?s18gEI8wNol0LvgGLwnbNdWT6cK3dLKNem7TpL6HBffyzqJDXRgIH+pscCpB?=
 =?us-ascii?Q?av14Uq4SJbVmVkrqwFnelXvXrteHapFi2fnt8jW/DK5ssKwk8alT6VMpfCwo?=
 =?us-ascii?Q?0cSecb46Xcxtbg2mXFaXVcom5DirINBbvzvvvpfOSGkdBNHMAQzONYCNTcNj?=
 =?us-ascii?Q?bVsr+GTZyVwVhqC3z6ohAM2IMP73Qv87TbkWSbaKxUE0H+F3I71tQ8FlGhDD?=
 =?us-ascii?Q?HSL5ShZuW4V1E/Bb976a9Q9GGS/xOJMLCoAUv306bDSVFSsN953K7HoCPAAA?=
 =?us-ascii?Q?s1F306jFPz7KXmAcIWeeZK9BAmNHWWCCnh0UdDOK1ki33u1GDfwOLXctjUlk?=
 =?us-ascii?Q?qHAqvBbKO+OJ1cQGd4qC0zntIpXE+nV7l9+Ys1uYSE8tNzLbQfMBdgWLJCQt?=
 =?us-ascii?Q?0bHPa4hAlLptonCRuAO/46PUjGTud0wwGVBUG3CJkXbmcyI4myGVbPSN/htV?=
 =?us-ascii?Q?J+YKcTLdSifNiq2Qam6CDYgEtbtw91B0LWTHBPwJglUHuyssDNGg1BfTF/8E?=
 =?us-ascii?Q?1lAsV6yKsZ0JnJNoXvpeKth+MHqE/oNUwKQL7EJwTolR/xocR449CsePsKI4?=
 =?us-ascii?Q?5MmnNfWKM1c16qlrQJnUyphj5VKrQNzHz9VCNaXgeprkPEdTyM6hVJLNFK/w?=
 =?us-ascii?Q?5hMBhWfatJNPqhWdBoADMw0OAr3jd6kh7qzbQKQdBPnoM3+L4BsLbqyDdQsX?=
 =?us-ascii?Q?IyzR5/byWDwwdR5izxKlfAc+VlEb8A3eivmG7IdolYGzT43/SN3ibwe7T7fC?=
 =?us-ascii?Q?zfS9VwrW9XVJN4baGqgAEdkafMrSVEBqJtMlvio/xggp5aGDAt681tXptEzD?=
 =?us-ascii?Q?UBqr9x0fx5W6Kw8yGlDo/CN8QzN6kxifgd3woCFf5xM4vyuY227aPIHgSM/S?=
 =?us-ascii?Q?ZYer++5uvvZF4A0S6ygL4Gi/HuKcAE3Cp8otV0qq2WJfI0UfKM2ispu6Awk2?=
 =?us-ascii?Q?U8WmV9NaCNNTRlr+VmVip65iu+w6g/r3Xy7IR6jbB0Q5tRrwuLK7tESb84Vf?=
 =?us-ascii?Q?+fN9l63zrWC8ueK8EzmSuBKsQ8V5xLYm4JS1PDW3/nVXB5gvM5slwAWIALJl?=
 =?us-ascii?Q?WsveCwtv+QPj3ASEV0KMvr+it9CNzfBdrEiM5rr6LuErWEPEgepPKui7zUYS?=
 =?us-ascii?Q?ApxINrMI4wCw6xMIuB90msyLEftl9zkrpEou/VOIjVI0UYZw63WXYGaL8wDp?=
 =?us-ascii?Q?nFW6t7+rHqiwdk/hRoMZ658V96+GAe3iI+1E+8HSaLG9axHiAPH88jDt25wm?=
 =?us-ascii?Q?mjgnoP9pUwtwKjLT29Q=3D?=
X-OriginatorOrg: Nvidia.com
X-MS-Exchange-CrossTenant-Network-Message-Id: f20991d1-6af3-4935-d45c-08dc7a5a5ad8
X-MS-Exchange-CrossTenant-AuthSource: DM6PR12MB3849.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 May 2024 12:26:07.0825
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 939zBfZ+RP37m2v/OeukDvjC5a2nCm2GSbb9rhHKFGaZgCzTh8mQ+3MLPjUum8Eh
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH8PR12MB6915

On Wed, May 22, 2024 at 11:24:20AM +0800, Yan Zhao wrote:
> On Tue, May 21, 2024 at 01:34:00PM -0300, Jason Gunthorpe wrote:
> > On Tue, May 21, 2024 at 10:21:23AM -0600, Alex Williamson wrote:
> > 
> > > > Intel GPU weirdness should not leak into making other devices
> > > > insecure/slow. If necessary Intel GPU only should get some variant
> > > > override to keep no snoop working.
> > > > 
> > > > It would make alot of good sense if VFIO made the default to disable
> > > > no-snoop via the config space.
> > > 
> > > We can certainly virtualize the config space no-snoop enable bit, but
> > > I'm not sure what it actually accomplishes.  We'd then be relying on
> > > the device to honor the bit and not have any backdoors to twiddle the
> > > bit otherwise (where we know that GPUs often have multiple paths to get
> > > to config space).
> > 
> > I'm OK with this. If devices are insecure then they need quirks in
> > vfio to disclose their problems, we shouldn't punish everyone who
> > followed the spec because of some bad actors.
> Does that mean a malicous device that does not honor the bit could read
> uninitialized host data?

Yes, but a malicious device could also just do DMA with the PF RID and
break everything. VFIO substantially trusts the device already, I'm
not sure trusting it to do no-snoop blocking is a big reach.

Jason