Messages in this thread | | | Date | Thu, 19 Nov 2020 17:09:40 -0800 | From | Tom Roeder <> | Subject | Re: [PATCH] nvme: Cache DMA descriptors to prevent corruption. |
| |
On Thu, Nov 19, 2020 at 01:09:14PM -0800, Keith Busch wrote: >On Thu, Nov 19, 2020 at 10:59:19AM -0800, Tom Roeder wrote: >> This patch changes the NVMe PCI implementation to cache host_mem_descs >> in non-DMA memory instead of depending on descriptors stored in DMA >> memory. This change is needed under the malicious-hypervisor threat >> model assumed by the AMD SEV and Intel TDX architectures, which encrypt >> guest memory to make it unreadable. Some versions of these architectures >> also make it cryptographically hard to modify guest memory without >> detection. >> >> On these architectures, Linux generally leaves DMA memory unencrypted so >> that devices can still communicate directly with the kernel: DMA memory >> remains readable to and modifiable by devices. This means that this >> memory is also accessible to a hypervisor. >> >> However, this means that a malicious hypervisor could modify the addr or >> size fields of descriptors and cause the NVMe driver to call >> dma_free_attrs on arbitrary addresses or on the right addresses but with >> the wrong size. To prevent this attack, this commit changes the code to >> cache those descriptors in non-DMA memory and to use the cached values >> when freeing the memory they describe. > >If the hypervisor does that, then the device may use the wrong >addresses, too. I guess you can't do anything about that from the >driver, though. I agree; I don't think there's anything the driver can do about that.
> >> + /* Cache the host_mem_descs in non-DMA memory so a malicious hypervisor >> + * can't change them. >> + */ >> + struct nvme_host_mem_buf_desc *host_mem_descs_cache; >> void **host_mem_desc_bufs; > >This is never seen by an nvme device, so no need for an nvme specific >type here. You can use arch native types.
Thanks! I'll change the type to a new struct that has the addr and size fields as native integers and send out a v2 for this patch that makes that change and cleans up a couple of minor style issues in my code.
| |