[MODERATED] Re: ***UNCHECKED*** NX, nested virtualization and arch caps

[Joerg Roedel <jroedel@suse.de>]

Hi Paolo,

On Tue, Oct 15, 2019 at 11:45:14AM +0200, speck for Paolo Bonzini wrote:
> Right now, the NX patches are not advertising the
> ARCH_CAP_PSCHANGE_MC_NO bit to its guests (especially nested
> hypervisors).  This is despite KVM's shadow paging will ensure that the
> nested hypervisor's EPT pages are 4K in size.
> 
> This is because nx_huge_pages is writable.  Therefore, the value of the
> parameter could change from Y to N while a guest runs, and then the
> nested hypervisor would become vulnerable to the nested guest's bad
> behavior.
> 
> On the other hand, if the ITLB_MULTIHIT mitigation is disabled, then any
> guest is anyway vulnerable to other guests' shenanigans.  Therefore the
> nested hypervisor can just ignore ITLB_MULTIHIT altogether, even if it
> would then be vulnerable to L2's bad behavior.  And this means we can
> unconditionally advertise to nested hypervisors that the processor is
> not vulnerable.
> 
> Are there any issues with this reasoning?

I also think that any nested hypervisor can ignore the ITLB_MULTIHIT
bug, but for a different reason: The host also builds the nested EPT
table as a shadow of the guests EPT table, so it does the mitigation on
behalf of the nested hypervisor.

Regards,

	Joerg