Re: [POC Seabios PATCH] seabios: use isolated SMM address space for relocation
Igor Mammedov <imammedo@...>
On Fri, 16 Aug 2019 18:43:11 -0400
Boris Ostrovsky <boris.ostrovsky@...> wrote:
On 8/16/19 7:24 AM, Igor Mammedov wrote:^^^ reads using 0x30000 base in non-SMM modefor purpose of demo SMRAM (at 0x30000) is aliased at a0000 in system address space
^^^ reads from SMRAM temporarily aliased at 0xa0000 in non-SMM modesmm_relocate: SMRAM codeentry f000c831eac88c
^^^ reads using 0x30000 base in SMM modehandle_smi cmd=0 smbase=0x00030000
^^^ normal RAM at 0x30000 base hasn't been modified after SMM relocationsmm_relocate: after relocaten
without us taking care of saving/restoring it (2nd patch removes it altogether)
^^^ but SMRAM has changed base to what out handler told it tosmm_relocate: SMRAM codeentry f000c831eac88c
(note we are reading it form non-SMM context only because we
have an alias at a0000 which it there only for demo purposes)
We are aren't reading SMRAM at 0x30000 base directly,
"RAM" marked log lines are non-SMM context reads using as base
and as you see, it isn't showing anything from SMRAM
For mgmt/demo purposes SMRAM (which is at 0x30000 in SMM address space)
is also aliased at
into non-SMM address space to allow us to initialize SMM entry point
(log entries are marked as "SMRAM").
Aliased SMRAM also allows us to check that relocation worked
(i.e. smm_base was relocated from default "handle_smi cmd=0 smbase=0x00030000"
to a new one "smm_relocate: SMRAM cpu.i64.smm_base a0000").
It's similar to what we do with TSEG where QEMU steals RAM from
normal address space and puts MMIO region 'tseg_blackhole' over it
so non-SMM context reads 0xFF from TSEG window, while SMM context
accesses RAM hidden below tseg_blackhole.
These patches show that we can have normal usable RAM at 0x30000
which doesn't overlap with SMRAM at the same address and each can
be made accessible only from its own mode (no-SMM and SMM).
Preventing non-SMM mode from injecting attack on SMRAM via CPU
that hasn't been initialized yet once firmware locked down SMRAM.