Re: PCI DMA and security

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



> Hi!
>
> On 22:59 Thu 31 Jul     , Thomas Petazzoni wrote:
>> Le Wed, 30 Jul 2008 17:21:31 -0700,
>> Greg KH <greg@xxxxxxxxx> a ??crit :
>>
>> > That's a fault of the hardware, nothing the os can do about that,
>> > sorry.
>>
>> Yes, however some recent chips provide an IOMMU, ??a memory management
>> unit (MMU) that connects a DMA-capable I/O bus to the main memory??. And
>> one of its advantage is:
>>
>> ??
>> Memory protection from malicious or misbehaving devices: a device
>> cannot read or write to memory that hasn't been explicitly allocated
>> (mapped) for it. The memory protection is based on the fact that OS
>> running on the CPU (see figure) exclusively controls both the MMU and
>> the IOMMU. The devices are physically unable to circumvent or corrupt
>> configured memory management tables.
>> ??

But if you consider the Intel's VT-d which adds an IOMMU for DMA
remapping, also mentions Device IOTLBs, which can fetch and cache some
of the translations. The idea is to offload the burden of the DMA
remapping engine. So these translated addresses from the devices
bypass the DMA remapping hardware and this can cause trouble.

for example, if device X fetches a translation (a -> b) and caches it
but somehow it gets corrupted to say (a -> c), then the device can
access the memory location c and the DMA remapping h/w will be of no
use.


Regards,
Sukanto

--
To unsubscribe from this list: send an email with
"unsubscribe kernelnewbies" to ecartis@xxxxxxxxxxxx
Please read the FAQ at http://kernelnewbies.org/FAQ


[Index of Archives]     [Newbies FAQ]     [Linux Kernel Mentors]     [Linux Kernel Development]     [IETF Annouce]     [Git]     [Networking]     [Security]     [Bugtraq]     [Yosemite]     [MIPS Linux]     [ARM Linux]     [Linux RAID]     [Linux SCSI]     [Linux ACPI]
  Powered by Linux