From mboxrd@z Thu Jan  1 00:00:00 1970
Return-path: <ak@linux.intel.com>
Received: from mga18.intel.com ([134.134.136.126])
	by Galois.linutronix.de with esmtps (TLS1.2:DHE_RSA_AES_256_CBC_SHA256:256)
	(Exim 4.80)
	(envelope-from <ak@linux.intel.com>)
	id 1fDtMf-0004Zw-CK
	for speck@linutronix.de; Wed, 02 May 2018 17:08:18 +0200
Date: Wed, 2 May 2018 08:07:39 -0700
From: Andi Kleen <ak@linux.intel.com>
Subject: [MODERATED] Re: Updated L1TF native OS patch
Message-ID: <20180502150739.GS75137@tassilo.jf.intel.com>
References: <20180501234247.GA41910@tassilo.jf.intel.com>
 <alpine.LFD.2.21.999.1805011659300.17283@i7.lan>
 <20180502000512.GO75137@tassilo.jf.intel.com>
 <20180502012112.GQ75137@tassilo.jf.intel.com>
 <20180502121420.GB31258@dhcp22.suse.cz>
MIME-Version: 1.0
In-Reply-To: <20180502121420.GB31258@dhcp22.suse.cz>
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
To: speck@linutronix.de
List-ID: <speck.linutronix.de>

> I have to confess that I do not understand the thread model for
> PROT_NONE patch though. The mitigation _has_ to be done on the
> VM layer otherwise we are screwed. So why should we even bother
> and make the code even more kludgy?

It has to be done in both layers. One is between guests/hosts,
and the other is inside the guest.

Here's an example:

You have physical pages 1 2. They get mapped into a guest as 
GPA 1 -> PA 2
GPA 2 -> PA 1
through EPT. 

The L1TF speculation ignores the EPT remapping.

Now the guest kernel maps GPA 1 to process A and GPA 2 to process B,
and they belong to different users and should be isolated.

If A sets the GPA 1 PA 2 page to PROT_NONE to bypass the EPT remapping
and gets read access to the underlying physical page. Which
in this case points to PA 2, so it can read process B's data,
if it happened to be in L1.

So we broke isolation inside the guest. 

There's nothing the hypervisor can do about this. This
mitigation has to be done in the guest.

> Patch 3 seems reasonable but I do not feel confident enough to give my
> ack because I simply have no idea whether some obscure HW depends on the
> zero page.

Can you expand? How should hardware depend on it?

It certainly cannot write to it, and even reading would be dubious because
the contents are undefined.

-Andi