Error handling for I/O memory management units

Posted Aug 21, 2014 5:43 UTC (Thu) by mcpherrinm (guest, #92295)
In reply to: Error handling for I/O memory management units by neilbrown
Parent article: Error handling for I/O memory management units

An IOMMU gives devices virtual memory, basically. This is similar to what we do with process address spaces. We're talking about a device doing something equivalent to a process segfaulting.

For example, a GPU may load a GL shader program with a bug that causes out of bounds reads to happen on the GPU. If executed by a malicious user, that could leak information the system doesn't intend them to have access to.

Error handling for I/O memory management units

Posted Aug 23, 2014 13:25 UTC (Sat) by corsac (subscriber, #49696) [Link] (2 responses)

Or someone could remotely take control of your network card and tries to DMA write from there, compromising the host.

Error handling for I/O memory management units

Posted Aug 23, 2014 22:34 UTC (Sat) by neilbrown (subscriber, #359) [Link] (1 responses)

These are perfectly good answers for why an IOMMU is a valuable thing to have, but don't seem to answer the question: what sort of error can you get from an IOMMU.

If you have a system without an IOMMU, then it is quite possible to program a DMA engine in some device to access an illegal address - maybe some address where there isn't any memory. Presumably an error gets reported .. or maybe it doesn't. Maybe it just silently fails.

If you add an IOMMU, then that greatly increases the range of addresses that are illegal for any given device, but surely the device will just fail in exactly the same way that it did before. I don't see any new sorts of errors. I must be missing something.

So I'm still hoping someone can explain to me what sort of errors one can get from an IOMMU.

Error handling for I/O memory management units

Posted Aug 24, 2014 3:51 UTC (Sun) by dlang (guest, #313) [Link]

I could be wrong, but I think the answer is that without an IOMMU the DMA will either succeed or fail, the only think that knows this is the thing trying to do the DMA

however with an IOMMU, the IOMMU can now report that the device attempted to access memory it's not allowed to.

The question is what should be done when a device misbehaves, and how should it be reported?