Messages in this thread | | | Date | Wed, 18 May 2022 15:18:22 +0300 | From | "Kirill A. Shutemov" <> | Subject | Re: [PATCH] x86/tdx: Handle load_unaligned_zeropad() page-cross to a shared page |
| |
On Wed, May 18, 2022 at 08:39:45AM +0000, David Laight wrote: > From: Kirill A. Shutemov > > Sent: 17 May 2022 16:30 > > > > load_unaligned_zeropad() can lead to unwanted loads across page boundaries. > > The unwanted loads are typically harmless. But, they might be made to > > totally unrelated or even unmapped memory. load_unaligned_zeropad() > > relies on exception fixup (#PF, #GP and now #VE) to recover from these > > unwanted loads. > > > > In TDX guest the second page can be shared page and VMM may configure it > > to trigger #VE. > > > > Kernel assumes that #VE on a shared page is MMIO access and tries to > > decode instruction to handle it. In case of load_unaligned_zeropad() it > > may result in confusion as it is not MMIO access. > > > > Check fixup table before trying to handle MMIO. > > Is it best to avoid that all happening by avoiding mapping > 'normal memory' below anything that isn't normal memory. > > Even on a normal system it is potentially possibly that the > second page might be MMIO and reference a target that doesn't > want to see non-word sized reads. > (Or the first location might be a fifo and the read consumes > some data.) > > In that case the cpu won't fault the access, but the hardware > access might have rather unexpected side effects. > > Now the way MMIO pages are allocated probably makes that > impossible - but load_unaligned_zeropad() relies on > it not happening or not breaking anything.
Normally MMIO mappings comes from ioremap() and it does not land next to normal pages in virtual memory. So I don't think there's high risk of MMIO being a problem on normal machines.
What makes TDX (and other confidential computing platforms) different is security model: host and VMM considered hostile and we need protect against it. In TDX case, VMM can make any shared memory (such as DMA buffers) to trigger #VE that kernel interprets as MMIO access. We need to make sure host cannot exploit it.
-- Kirill A. Shutemov
| |