* kvm smm mode support?
@ 2014-04-25 7:39 Gerd Hoffmann
2014-04-26 9:40 ` Paolo Bonzini
0 siblings, 1 reply; 7+ messages in thread
From: Gerd Hoffmann @ 2014-04-25 7:39 UTC (permalink / raw)
To: kvm-devel; +Cc: kevin, Laszlo Ersek
Hi,
Anyone has plans to add smm support to kvm?
We have two potential use cases meanwhile:
(1) OVMF could use it to implement the LockBox (storage area the
OS can't tamper with, needed to make secure boot actually secure).
(2) SeaBIOS considers using a SMM trampoline to switch into 32bit mode
for device drivers. See
http://www.seabios.org/pipermail/seabios/2014-April/007957.html
cheers,
Gerd
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: kvm smm mode support?
2014-04-25 7:39 kvm smm mode support? Gerd Hoffmann
@ 2014-04-26 9:40 ` Paolo Bonzini
2014-04-26 11:02 ` Paolo Bonzini
2014-04-28 13:40 ` Laszlo Ersek
0 siblings, 2 replies; 7+ messages in thread
From: Paolo Bonzini @ 2014-04-26 9:40 UTC (permalink / raw)
To: Gerd Hoffmann, kvm-devel; +Cc: kevin, Laszlo Ersek
Il 25/04/2014 09:39, Gerd Hoffmann ha scritto:
> Anyone has plans to add smm support to kvm?
No plans, but it should be a Simple Matter Of Programming...
A good start would be to write unit tests for SMM that work with QEMU.
Too bad we're late, it could have been a nice summer of code project.
Paolo
> We have two potential use cases meanwhile:
>
> (1) OVMF could use it to implement the LockBox (storage area the
> OS can't tamper with, needed to make secure boot actually secure).
>
> (2) SeaBIOS considers using a SMM trampoline to switch into 32bit mode
> for device drivers. See
> http://www.seabios.org/pipermail/seabios/2014-April/007957.html
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: kvm smm mode support?
2014-04-26 9:40 ` Paolo Bonzini
@ 2014-04-26 11:02 ` Paolo Bonzini
2014-04-28 13:49 ` Gerd Hoffmann
2014-04-28 13:40 ` Laszlo Ersek
1 sibling, 1 reply; 7+ messages in thread
From: Paolo Bonzini @ 2014-04-26 11:02 UTC (permalink / raw)
To: Gerd Hoffmann, kvm-devel; +Cc: kevin, Laszlo Ersek
Il 26/04/2014 11:40, Paolo Bonzini ha scritto:
> Il 25/04/2014 09:39, Gerd Hoffmann ha scritto:
>> Anyone has plans to add smm support to kvm?
>
> No plans, but it should be a Simple Matter Of Programming...
Well, we need:
- an extra ioctl to inject an SMI (can be modeled after KVM_NMI)
- an extra user exit triggered when SMM is entered or left
- an extra ioctl (or a GET/SET_ONE_REG implementation) to read/write
whether we are in SMM, used to determine whether the #UD produced by RSM
should be forwarded to the guest or trigger emulation.
Paolo
> A good start would be to write unit tests for SMM that work with QEMU.
> Too bad we're late, it could have been a nice summer of code project.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: kvm smm mode support?
2014-04-26 9:40 ` Paolo Bonzini
2014-04-26 11:02 ` Paolo Bonzini
@ 2014-04-28 13:40 ` Laszlo Ersek
1 sibling, 0 replies; 7+ messages in thread
From: Laszlo Ersek @ 2014-04-28 13:40 UTC (permalink / raw)
To: Paolo Bonzini, Gerd Hoffmann, kvm-devel; +Cc: kevin
On 04/26/14 11:40, Paolo Bonzini wrote:
> Il 25/04/2014 09:39, Gerd Hoffmann ha scritto:
>> Anyone has plans to add smm support to kvm?
>
> No plans, but it should be a Simple Matter Of Programming...
>
> A good start would be to write unit tests for SMM that work with QEMU.
Well I don't know what behavior to expect from SMM... :)
Plus, Kevin recently posted some remarks about the SMM implementation in
qemu-tcg -- apparently it's not faithful enough to physical hardware:
http://thread.gmane.org/gmane.comp.bios.coreboot.seabios/7959
http://thread.gmane.org/gmane.comp.emulators.qemu/268909
(But I can see that you've been already discussing the second thread; I
guess I should read up on it first...)
Thanks
Laszlo
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: kvm smm mode support?
2014-04-26 11:02 ` Paolo Bonzini
@ 2014-04-28 13:49 ` Gerd Hoffmann
2014-04-28 14:01 ` Kevin O'Connor
0 siblings, 1 reply; 7+ messages in thread
From: Gerd Hoffmann @ 2014-04-28 13:49 UTC (permalink / raw)
To: Paolo Bonzini; +Cc: kvm-devel, kevin, Laszlo Ersek
On Sa, 2014-04-26 at 13:02 +0200, Paolo Bonzini wrote:
> Il 26/04/2014 11:40, Paolo Bonzini ha scritto:
> > Il 25/04/2014 09:39, Gerd Hoffmann ha scritto:
> >> Anyone has plans to add smm support to kvm?
> >
> > No plans, but it should be a Simple Matter Of Programming...
>
> Well, we need:
>
> - an extra ioctl to inject an SMI (can be modeled after KVM_NMI)
>
> - an extra user exit triggered when SMM is entered or left
>
> - an extra ioctl (or a GET/SET_ONE_REG implementation) to read/write
> whether we are in SMM, used to determine whether the #UD produced by RSM
> should be forwarded to the guest or trigger emulation.
OVMF probably wants set aside some ram which can't be accessed by the
OS, for secure boot emulation which is actually secure. Guess we'll
just go map/unmap some slot in the smm enter/leave vmexits? Or there
are better ways to do it?
cheers,
Gerd
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: kvm smm mode support?
2014-04-28 13:49 ` Gerd Hoffmann
@ 2014-04-28 14:01 ` Kevin O'Connor
2014-04-28 14:22 ` Paolo Bonzini
0 siblings, 1 reply; 7+ messages in thread
From: Kevin O'Connor @ 2014-04-28 14:01 UTC (permalink / raw)
To: Gerd Hoffmann; +Cc: Paolo Bonzini, kvm-devel, Laszlo Ersek
On Mon, Apr 28, 2014 at 03:49:31PM +0200, Gerd Hoffmann wrote:
> On Sa, 2014-04-26 at 13:02 +0200, Paolo Bonzini wrote:
> > Il 26/04/2014 11:40, Paolo Bonzini ha scritto:
> > > Il 25/04/2014 09:39, Gerd Hoffmann ha scritto:
> > >> Anyone has plans to add smm support to kvm?
> > >
> > > No plans, but it should be a Simple Matter Of Programming...
> >
> > Well, we need:
> >
> > - an extra ioctl to inject an SMI (can be modeled after KVM_NMI)
> >
> > - an extra user exit triggered when SMM is entered or left
> >
> > - an extra ioctl (or a GET/SET_ONE_REG implementation) to read/write
> > whether we are in SMM, used to determine whether the #UD produced by RSM
> > should be forwarded to the guest or trigger emulation.
>
> OVMF probably wants set aside some ram which can't be accessed by the
> OS, for secure boot emulation which is actually secure. Guess we'll
> just go map/unmap some slot in the smm enter/leave vmexits? Or there
> are better ways to do it?
Normally, the memory at 0xa0000-0xc0000 is only mapped when in SMM.
And, as I understand it, in a multi-cpu system only the core handling
the SMI can access that ram. (All other cores would continue to
access IO space at 0xa0000-0xc0000.)
-Kevin
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: kvm smm mode support?
2014-04-28 14:01 ` Kevin O'Connor
@ 2014-04-28 14:22 ` Paolo Bonzini
0 siblings, 0 replies; 7+ messages in thread
From: Paolo Bonzini @ 2014-04-28 14:22 UTC (permalink / raw)
To: Kevin O'Connor, Gerd Hoffmann; +Cc: kvm-devel, Laszlo Ersek
Il 28/04/2014 16:01, Kevin O'Connor ha scritto:
>> > OVMF probably wants set aside some ram which can't be accessed by the
>> > OS, for secure boot emulation which is actually secure. Guess we'll
>> > just go map/unmap some slot in the smm enter/leave vmexits? Or there
>> > are better ways to do it?
> Normally, the memory at 0xa0000-0xc0000 is only mapped when in SMM.
Yes, and there's also a configuration space bit that lets you show/hide
SMRAM at 0xa0000-0xc0000. Another a configuration space bit that lets
you lock the first bit. QEMU doesn't implement the lock, but it should
not be hard.
For OVMF, we would certainly lock SMRAM out. For SeaBIOS, if we can
avoid that it would help writing testcases... SeaBIOS is not doing
anything security-sensitive in SMM anyway.
> And, as I understand it, in a multi-cpu system only the core handling
> the SMI can access that ram. (All other cores would continue to
> access IO space at 0xa0000-0xc0000.)
QEMU just grew per-CPU address spaces, but not KVM.
I don't think we need it. For SeaBIOS's callbacks we can assume single
processor, SeaBIOS is not thread-safe anyway. And the only interaction
would be with legacy VGA VRAM, so no big deal.
Paolo
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2014-04-28 14:22 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2014-04-25 7:39 kvm smm mode support? Gerd Hoffmann
2014-04-26 9:40 ` Paolo Bonzini
2014-04-26 11:02 ` Paolo Bonzini
2014-04-28 13:49 ` Gerd Hoffmann
2014-04-28 14:01 ` Kevin O'Connor
2014-04-28 14:22 ` Paolo Bonzini
2014-04-28 13:40 ` Laszlo Ersek
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.