Re: [RFC PATCH v11 12/29] KVM: Add KVM_CREATE_GUEST_MEMFD ioctl() for guest-specific backing memory
From: Vishal Annapurve <hidden>
Date: 2023-08-10 23:57:53
Also in:
kvm, kvm-riscv, kvmarm, linux-arm-kernel, linux-fsdevel, linux-mips, linux-mm, linux-riscv, linux-security-module, lkml
Possibly related (same subject, not in this thread)
- 2023-09-15 · Re: [RFC PATCH v11 12/29] KVM: Add KVM_CREATE_GUEST_MEMFD ioctl() for guest-specific backing memory · Sean Christopherson <seanjc@google.com>
- 2023-09-14 · Re: [RFC PATCH v11 12/29] KVM: Add KVM_CREATE_GUEST_MEMFD ioctl() for guest-specific backing memory · Ackerley Tng <hidden>
- 2023-09-14 · Re: [RFC PATCH v11 12/29] KVM: Add KVM_CREATE_GUEST_MEMFD ioctl() for guest-specific backing memory · Sean Christopherson <seanjc@google.com>
- 2023-09-14 · Re: [RFC PATCH v11 12/29] KVM: Add KVM_CREATE_GUEST_MEMFD ioctl() for guest-specific backing memory · Sean Christopherson <seanjc@google.com>
- 2023-09-01 · Re: [RFC PATCH v11 12/29] KVM: Add KVM_CREATE_GUEST_MEMFD ioctl() for guest-specific backing memory · Ackerley Tng <hidden>
On Tue, Aug 8, 2023 at 2:13 PM Sean Christopherson [off-list ref] wrote:
...
quoted
+ When binding a memslot to the file, if a kvm pointer exists, it must be the same kvm as the one in this binding + When the binding to the last memslot is removed from a file, NULL the kvm pointer.Nullifying the KVM pointer isn't sufficient, because without additional actions userspace could extract data from a VM by deleting its memslots and then binding the guest_memfd to an attacker controlled VM. Or more likely with TDX and SNP, induce badness by coercing KVM into mapping memory into a guest with the wrong ASID/HKID.
TDX/SNP have mechanisms i.e. PAMT/RMP tables to ensure that the same memory is not assigned to two different VMs. Deleting memslots should also clear out the contents of the memory as the EPT tables will be zapped in the process and the host will reclaim the memory. Regards, Vishal