lkml.org 
[lkml]   [2021]   [Nov]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [PATCH Part2 v5 00/45] Add AMD Secure Nested Paging (SEV-SNP) Hypervisor Support
    From
    Date
    On 11/22/21 11:06 AM, Brijesh Singh wrote:
    >> 3. Kernel accesses guest private memory via a kernel mapping. This one
    >> is tricky. These probably *do* result in a panic() today, but
    >> ideally shouldn't.
    > KVM has defined some helper functions to maps and unmap the guest pages.
    > Those helper functions do the GPA to PFN lookup before calling the
    > kmap(). Those helpers are enhanced such that it check the RMP table
    > before the kmap() and acquire a lock to prevent a page state change
    > until the kunmap() is called. So, in the current implementation, we
    > should *not* see a panic() unless there is a KVM driver bug that didn't
    > use the helper functions or a bug in the helper function itself.

    I don't think this is really KVM specific.

    Think of a remote process doing ptrace(PTRACE_POKEUSER) or pretty much
    any generic get_user_pages() instance. As long as the memory is mapped
    into the page tables, you're exposed to users that walk the page tables.

    How do we, for example, prevent ptrace() from inducing a panic()?

    \
     
     \ /
      Last update: 2021-11-22 20:14    [W:6.397 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site