confidential-containers / td-shim

Confidential Containers Shim Firmware
Other
97 stars 53 forks source link

td-payload: add shadow pages for shared memory #661

Closed gaojiaqi7 closed 8 months ago

gaojiaqi7 commented 8 months ago

Data in shared memory provided by VMM is untrusted so from a security perspective the data shall be consumed after being copied into private memory.

Private shadow for SharedMemory is provided to add a more easy and functional safe mechanism to use the untrusted data. It is 1:1 allocated for a shared memory request, and users can use the data with copy_to_private_shadow directly to get a private copy with additional memory allocation/free operations.