From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-in5.apple.com (mail-out5.apple.com [17.151.62.27]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 9AA258220F for ; Fri, 3 Mar 2017 09:06:54 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; d=apple.com; s=mailout2048s; c=relaxed/simple; q=dns/txt; i=@apple.com; t=1488560814; h=From:Sender:Reply-To:Subject:Date:Message-id:To:Cc:MIME-version:Content-type: Content-transfer-encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-reply-to:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=Leyg+tcbXIYm7tACTFKLz1UtVWi2GTuuY4f+hG+MZvc=; b=MESvqbJ5l4s92QhSkYdCohkkongs3pBGr1cFO4F6Naa6SbaJZ2SqEj4czZ0BwksN x+iofLhuBMcPRyPS9qHYnZ6WadYaJ+m+JVoLa8hP+xsSIQhzRYq1tmKr7NafhtwI g5YE1aMgslMd3D5AfMwFX2t9P+fj9sfJrTRU0YXUYt/8JLgvQyAHb1JNHL4Etdvu X76EtQBYu719ukFTKcu76495AXiWCTrk6lwR/ssXbpwjgphNnGOcmjFc9Yuex10d rmtfvZHRAoeILtIyIm/itFAvROh6JnR3fKm7weiZePH67h7/sFyIAdA6qjp6uVEj iTfi3VWaAxZDQ3MMSoTH4g==; Received: from relay4.apple.com (relay4.apple.com [17.128.113.87]) by mail-in5.apple.com (Apple Secure Mail Relay) with SMTP id 79.9D.22688.EA2A9B85; Fri, 3 Mar 2017 09:06:54 -0800 (PST) X-AuditID: 11973e13-51c269a0000058a0-32-58b9a2ae5d44 Received: from nwk-mmpp-sz13.apple.com (nwk-mmpp-sz13.apple.com [17.128.115.216]) by relay4.apple.com (Apple SCV relay) with SMTP id 65.E0.06053.EA2A9B85; Fri, 3 Mar 2017 09:06:54 -0800 (PST) MIME-version: 1.0 Received: from [17.153.42.182] (unknown [17.153.42.182]) by nwk-mmpp-sz13.apple.com (Oracle Communications Messaging Server 8.0.1.2.20170210 64bit (built Feb 10 2017)) with ESMTPSA id <0OM9002UQ0VGCO10@nwk-mmpp-sz13.apple.com>; Fri, 03 Mar 2017 09:06:53 -0800 (PST) Sender: afish@apple.com From: Andrew Fish In-reply-to: <08cbd2c5-5d7e-bdc7-cf74-e5c48edf86c0@solarflare.com> Date: Fri, 03 Mar 2017 09:06:52 -0800 Cc: "edk2-devel@lists.01.org" Message-id: <8239214C-DAB8-4CED-A683-90DB1AA0DE47@apple.com> References: <08cbd2c5-5d7e-bdc7-cf74-e5c48edf86c0@solarflare.com> To: "Tomas Pilar (tpilar)" X-Mailer: Apple Mail (2.3226) X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFtrBLMWRmVeSWpSXmKPExsUi2FAYrrtu0c4Ig3PtwhZ7Dh1ltui83cXm wOTRPfsfi8fqJz/YApiiuGxSUnMyy1KL9O0SuDIWLZrNWHBNoKJv9U7WBsZtvF2MnBwSAiYS a9rOMnUxcnEICexllPjwsp8NJtHz4BILROIQo8SXlmPsIAleAUGJH5PvASU4OJgF5CUOnpcF CTMLaEl8f9QKVT+RSWLlqodgg4QFxCXendnEDFIvLOAosfyzI0iYTUBZYsX8D2AjOQWcJK73 /AWzWQRUJR4+bWGBmGkuMePCFyaQVl4BG4lNc6RBwkJAU748+s0MYosIGEncXPALbLqEgKzE 7F9eIBdICKxgk/hx5An7BEbhWUiOnoVw9CwkRy9gZF7FKJSbmJmjm5lnqpdYUJCTqpecn7uJ ERTU0+2EdzCeXmV1iFGAg1GJh5dh8s4IIdbEsuLK3EOM0hwsSuK8/RU7IoQE0hNLUrNTUwtS i+KLSnNSiw8xMnFwSjUwLjkfXcLekX9DclLyvXvxdsvWbl2Wt1pQv0pD2HR/mOjvkNKbMpN+ erM4XmdwD3qWkLGcZ9uvO333erhOMXwM1lj1cOu19Z9M95qf3m8owLtlnaDOqTXtuls3ONZO eGvGXjil6Os0tqSeD/UbvM9fzFtwOa18tUZFdsyOedLtujOMspiC/5bnK7EUZyQaajEXFScC AEzc0StLAgAA X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFupikeLIzCtJLcpLzFFi42IRbCi+obtu0c4IgwttXBZ7Dh1ltui83cXm wOTRPfsfi8fqJz/YApiiuGxSUnMyy1KL9O0SuDIWLZrNWHBNoKJv9U7WBsZtvF2MnBwSAiYS PQ8usXQxcnEICRxilPjScowdJMErICjxY/I9oAQHB7OAvMTB87IgYWYBLYnvj1qh6icySaxc 9ZANJCEsIC7x7swmZpB6YQFHieWfHUHCbALKEivmfwAbySngJHG95y+YzSKgKvHwaQsLxExz iRkXvjCBtPIK2EhsmiMNEhYCmvLl0W9mEFtEwEji5oJfYNMlBGQlZv/ymsAoMAvJnbMQ7pyF 5M4FjMyrGAWKUnMSK030EgsKclL1kvNzNzGCg7AwfAfjv2VWhxgFOBiVeHgZJu+MEGJNLCuu zAUGBAezkgiv9kSgEG9KYmVValF+fFFpTmrxIcYqoOsnMkuJJucDIySvJN7QxMTAxNjYzNjY 3MScKsJK4ryOG7ZHCAmkJ5akZqemFqQWwSxn4uCUamBs3j/f7Hzvq8Z9nheY/qyo2WKkqBnx s9dEgm/hNG5ZqVc5nueSvoXo9jwvlnnF+cKEN1wg+MKlbblLvs8/3CA1fdHiqfuZNyeGHlfv ePAu9ZHhjilaBjNZHJcpGL5wLs38ejIsReqYut1GxYWLxb/c436zUDLZg/FaJP9h5aBJEpnL mnbvipRUYinOSDTUYi4qTgQAXNjagZ0CAAA= Subject: Re: Hiding physical memory from OS and VT-d/IOMMU X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Mar 2017 17:06:54 -0000 Content-transfer-encoding: 7BIT Content-type: text/plain; CHARSET=US-ASCII > On Mar 3, 2017, at 8:32 AM, Tomas Pilar (tpilar) wrote: > > Hi, > > > I am trying to implement a message-box communication protocol between > PCIe devices in the same host without the assistance of the OS. For > irreducible reasons, I can't use PCIe endpoint-to-endpoint communication > so I thought I could create a DMA based message-box protocol where in > UEFI driver probe (during DXE) I blot out some physical memory (by > leaking a page of memory allocated as EfiRuntimeServicesData) that the > devices will then use to communicate even when the OS loads. > > > This runs into a problem when VT-d/IOMMU is involved because it still > stops the device from DMA into that page, even though the OS shouldn't > touch the page as it's been allocated using EfiRuntimeServicesData. > > > So my query is: Can I achieve this by allocating the box as a different > memory type (such as EfiUnusableMemory or EfiReservedMemoryType) and if > not, what would be a better way of doing this? > No VT-d is designed to stop attacks like yours. By default VT-d blocks all DMA, and only allows DMA when it is properly requested by an OS driver that is trusted. You need an OS driver to map the DMA region for use by the PCI devices prior to using it on a system with VT-d enabled. If there was a way around this that would be a security bug in the IOMMU that an attacker could exploit. Thanks, Andrew Fish > > Cheers, > > Tom > > The information contained in this message is confidential and is intended for the addressee(s) only. If you have received this message in error, please notify the sender immediately and delete the message. Unless you are an addressee (or authorized to receive for an addressee), you may not use, copy or disclose to anyone this message or any information contained in this message. The unauthorized use, disclosure, copying or alteration of this message is strictly prohibited. > _______________________________________________ > edk2-devel mailing list > edk2-devel@lists.01.org > https://lists.01.org/mailman/listinfo/edk2-devel