From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:39140) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZpWnZ-0005M7-SK for qemu-devel@nongnu.org; Fri, 23 Oct 2015 03:30:07 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZpWnV-0000KI-TB for qemu-devel@nongnu.org; Fri, 23 Oct 2015 03:30:01 -0400 Received: from mail-wi0-x22e.google.com ([2a00:1450:400c:c05::22e]:38879) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZpWnV-0000Jv-N7 for qemu-devel@nongnu.org; Fri, 23 Oct 2015 03:29:57 -0400 Received: by wicll6 with SMTP id ll6so19080363wic.1 for ; Fri, 23 Oct 2015 00:29:56 -0700 (PDT) Sender: Paolo Bonzini References: <20151023062700.30810.47746@jljusten-ivb> <1445583386.13733.134.camel@redhat.com> From: Paolo Bonzini Message-ID: <5629E1F2.5020005@redhat.com> Date: Fri, 23 Oct 2015 09:29:54 +0200 MIME-Version: 1.0 In-Reply-To: <1445583386.13733.134.camel@redhat.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] fw_cfg DMA security List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Gerd Hoffmann , Jordan Justen Cc: markmb@redhat.com, qemu-devel@nongnu.org On 23/10/2015 08:56, Gerd Hoffmann wrote: >> > >> > So, for example, since Red Hat is working on SMM. Would a DMA to SMRAM >> > be protected? >> > >> > I haven't watched the fw_cfg DMA discussion too closely, but has this >> > been thought about? > Yes. That problem isn't new and it isn't specific to fw_cfg. You also > don't want grant dma access to smram/tseg to your ide/sata/scsi > controller or NIC. > > > One idea I had was that near the end of the firmware boot, the > > firmware could trigger fw_cfg in QEMU to stop supporting DMA until a > > reset. > > Should not be needed. We have address spaces in qemu, and the > smram/tseg regions are explicitly excluded (when enabled) from dma-able > memory. Exactly. SMRAM/TSEG is only added to CPU address spaces: for TCG, it's enabled specifically when the processor enters SMM and disabled upon RSM; for KVM, it's added to hypervisor address space 1, which is only looked up for processors that are in SMM. Paolo