Re: [coreboot] DMA protection? [AMD-Vi]

[Kyösti Mälkki]

On Mon, Nov 21, 2016 at 1:36 AM, ron minnich  wrote:
> The way coreboot has always enforced DMA protections is to not set bus
> master enabling on IO devices. I trust that particular setting a lot more
> than I trust trying to configure an IOMMU, given that such configuration
> seems to require trying to parse ACPI DMAR tables. If you will now tell me
> that some bad IO device might ignore BME, then I would want to know how to
> disable PCI bus mastering in the root complex, but certainly not via the
> IOMMU.

And just grepping for PCI_COMMAND_MASTER would suggest such enforcing has
completely been forgotten for some years. Like for the UART of
intel/skylake in bootblock already.

Kyösti
> coreboot has always attempted to do absolutely minimal platform
> configuration, just enough so a payload can run. This includes enabling as
> little of the hardware as possible, including IO devices. Every time you
> add in new capabilities such as IOMMU you take the risk of getting it wrong
> and making the system less secure.
>
> Off the type of my head, messing about with the IOMMU in coreboot seems a
> very bad idea.