On Fri, May 20, 2022, Kirill A. Shutemov wrote:
> load_unaligned_zeropad() can lead to unwanted loads across page boundaries.
> The unwanted loads are typically harmless. But, they might be made to
> totally unrelated or even unmapped memory. load_unaligned_zeropad()
> relies on exception fixup (#PF, #GP and now #VE) to recover from these
> unwanted loads.
>
> In TDX guests, the second page can be shared page and VMM may configure
> it to trigger #VE.
>
> Kernel assumes that #VE on a shared page is MMIO access and tries to
> decode instruction to handle it. In case of load_unaligned_zeropad() it
> may result in confusion as it is not MMIO access.
>
> Check fixup table before trying to handle MMIO.
>
> The issue was discovered by analysis. It was not triggered during the
> testing.
>
> Signed-off-by: Kirill A. Shutemov <[email protected]>
> ---
> arch/x86/coco/tdx/tdx.c | 20 ++++++++++++++++++++
> 1 file changed, 20 insertions(+)
>
> diff --git a/arch/x86/coco/tdx/tdx.c b/arch/x86/coco/tdx/tdx.c
> index 010dc229096a..1a1c8a92cfa5 100644
> --- a/arch/x86/coco/tdx/tdx.c
> +++ b/arch/x86/coco/tdx/tdx.c
> @@ -11,6 +11,8 @@
> #include <asm/insn.h>
> #include <asm/insn-eval.h>
> #include <asm/pgtable.h>
> +#include <asm/trapnr.h>
> +#include <asm/extable.h>
>
> /* TDX module Call Leaf IDs */
> #define TDX_GET_INFO 1
> @@ -299,6 +301,24 @@ static int handle_mmio(struct pt_regs *regs, struct ve_info *ve)
> if (WARN_ON_ONCE(user_mode(regs)))
> return -EFAULT;
>
> + /*
> + * load_unaligned_zeropad() relies on exception fixups in case of the
> + * word being a page-crosser and the second page is not accessible.
> + *
> + * In TDX guests, the second page can be shared page and VMM may
> + * configure it to trigger #VE.
> + *
> + * Kernel assumes that #VE on a shared page is MMIO access and tries to
> + * decode instruction to handle it. In case of load_unaligned_zeropad()
> + * it may result in confusion as it is not MMIO access.
The guest kernel can't know that it's not "MMIO", e.g. nothing prevents the host
from manually serving accesses to some chunk of shared memory instead of backing
the shared chunk with host DRAM.
> + *
> + * Check fixup table before trying to handle MMIO.
This ordering is wrong, fixup should be done if and only if the instruction truly
"faults". E.g. if there's an MMIO access lurking in the kernel that is wrapped in
exception fixup, then this will break that usage and provide garbage data on a read
and drop any write.
> + */
> + if (fixup_exception(regs, X86_TRAP_VE, 0, ve->gla)) {
> + /* regs->ip is adjusted by fixup_exception() */
> + return 0;
> + }
> +
> if (copy_from_kernel_nofault(buffer, (void *)regs->ip, MAX_INSN_SIZE))
> return -EFAULT;
>
> --
> 2.35.1
>
On Fri, May 20, 2022 at 05:47:30PM +0000, Sean Christopherson wrote:
> On Fri, May 20, 2022, Kirill A. Shutemov wrote:
> > load_unaligned_zeropad() can lead to unwanted loads across page boundaries.
> > The unwanted loads are typically harmless. But, they might be made to
> > totally unrelated or even unmapped memory. load_unaligned_zeropad()
> > relies on exception fixup (#PF, #GP and now #VE) to recover from these
> > unwanted loads.
> >
> > In TDX guests, the second page can be shared page and VMM may configure
> > it to trigger #VE.
> >
> > Kernel assumes that #VE on a shared page is MMIO access and tries to
> > decode instruction to handle it. In case of load_unaligned_zeropad() it
> > may result in confusion as it is not MMIO access.
> >
> > Check fixup table before trying to handle MMIO.
> >
> > The issue was discovered by analysis. It was not triggered during the
> > testing.
> >
> > Signed-off-by: Kirill A. Shutemov <[email protected]>
> > ---
> > arch/x86/coco/tdx/tdx.c | 20 ++++++++++++++++++++
> > 1 file changed, 20 insertions(+)
> >
> > diff --git a/arch/x86/coco/tdx/tdx.c b/arch/x86/coco/tdx/tdx.c
> > index 010dc229096a..1a1c8a92cfa5 100644
> > --- a/arch/x86/coco/tdx/tdx.c
> > +++ b/arch/x86/coco/tdx/tdx.c
> > @@ -11,6 +11,8 @@
> > #include <asm/insn.h>
> > #include <asm/insn-eval.h>
> > #include <asm/pgtable.h>
> > +#include <asm/trapnr.h>
> > +#include <asm/extable.h>
> >
> > /* TDX module Call Leaf IDs */
> > #define TDX_GET_INFO 1
> > @@ -299,6 +301,24 @@ static int handle_mmio(struct pt_regs *regs, struct ve_info *ve)
> > if (WARN_ON_ONCE(user_mode(regs)))
> > return -EFAULT;
> >
> > + /*
> > + * load_unaligned_zeropad() relies on exception fixups in case of the
> > + * word being a page-crosser and the second page is not accessible.
> > + *
> > + * In TDX guests, the second page can be shared page and VMM may
> > + * configure it to trigger #VE.
> > + *
> > + * Kernel assumes that #VE on a shared page is MMIO access and tries to
> > + * decode instruction to handle it. In case of load_unaligned_zeropad()
> > + * it may result in confusion as it is not MMIO access.
>
> The guest kernel can't know that it's not "MMIO", e.g. nothing prevents the host
> from manually serving accesses to some chunk of shared memory instead of backing
> the shared chunk with host DRAM.
It would require the guest to access shared memory only with instructions
that we can deal with. I don't think we have such guarantee.
> > + *
> > + * Check fixup table before trying to handle MMIO.
>
> This ordering is wrong, fixup should be done if and only if the instruction truly
> "faults". E.g. if there's an MMIO access lurking in the kernel that is wrapped in
> exception fixup, then this will break that usage and provide garbage data on a read
> and drop any write.
When I tried to trigger the bug, the #VE actually succeed, because
load_unaligned_zeropad() uses instruction we can decode. But due
misalignment, the part of that came from non-shared page got overwritten
with data that came from VMM.
I guess we can try to detect misaligned accesses and handle them
correctly. But it gets complicated and easer to screw up.
Do we ever use exception fixups for MMIO accesses to justify the
complication?
--
Kirill A. Shutemov