4 ms·

Doesn't apple use IOMMUs? Are there actually motherboards out there with TB3 support but without IOMMU?

txcwpalpha 9y ago
AFAIK Apple uses a custom motherboard for their machines, so I'm not sure where to look for specs on if the mobos support IOMMU/VT-d, but from what I can find, IOMMU/VT-d is not supported on any of the CPUs used in TB3-capable MBs, and it needs to be supported by both CPU and mobo for it to work.
- X-Istence 9y ago
  http://ilostmynotes.blogspot.com/2014/11/thunderbolt-dma-attacks-on-os-x.html http://ilostmynotes.blogspot.com/2014/11/thunderbolt-dma-att... Apple in MacOS is using IOMMU to protect against Firewire/Thunderbolt attacks. Here's a developer working on xhyve that is explaining how each PCI device has it's own VT-d mapper/domain: https://github.com/mist64/xhyve/issues/108#issuecomment-359266598 https://github.com/mist64/xhyve/issues/108#issuecomment-3592...
  - txcwpalpha 9y ago
    Interesting, I've been doing lots of searching and all I can find is forum or blog posts of unverified people, some saying that VT-d is enabled, but most saying it is not supported/enabled. In fact, if you look at the presentation by Russ Sevinsky that is referenced in your first link, it is specifically said that Apple hardware does not support IOMMU [1]. So I really don't know what to think. 1: https://youtu.be/q0HthE3qDMw?t=415 https://youtu.be/q0HthE3qDMw?t=415 edit: I finally came across the below link from Apple which does seem to imply that IOMMU VT-d is enabled on Macs that are 2012 and newer. On anything before that, though, and DMA attacks could own you. So uh.. don't run macbooks that are 6 years old, I guess. https://developer.apple.com/library/content/documentation/HardwareDrivers/Conceptual/ThunderboltDevGuide/DebuggingThunderboltDrivers/DebuggingThunderboltDrivers.html https://developer.apple.com/library/content/documentation/Ha...

AFAIK Apple uses a custom motherboard for their machines, so I'm not sure where to look for specs on if the mobos support IOMMU/VT-d, but from what I can find, IOMMU/VT-d is not supported on any of the CPUs used in TB3-capable MBs, and it needs to be supported by both CPU and mobo for it to work.

X-Istence 9y ago
http://ilostmynotes.blogspot.com/2014/11/thunderbolt-dma-attacks-on-os-x.html http://ilostmynotes.blogspot.com/2014/11/thunderbolt-dma-att... Apple in MacOS is using IOMMU to protect against Firewire/Thunderbolt attacks. Here's a developer working on xhyve that is explaining how each PCI device has it's own VT-d mapper/domain: https://github.com/mist64/xhyve/issues/108#issuecomment-359266598 https://github.com/mist64/xhyve/issues/108#issuecomment-3592...
- txcwpalpha 9y ago
  Interesting, I've been doing lots of searching and all I can find is forum or blog posts of unverified people, some saying that VT-d is enabled, but most saying it is not supported/enabled. In fact, if you look at the presentation by Russ Sevinsky that is referenced in your first link, it is specifically said that Apple hardware does not support IOMMU [1]. So I really don't know what to think. 1: https://youtu.be/q0HthE3qDMw?t=415 https://youtu.be/q0HthE3qDMw?t=415 edit: I finally came across the below link from Apple which does seem to imply that IOMMU VT-d is enabled on Macs that are 2012 and newer. On anything before that, though, and DMA attacks could own you. So uh.. don't run macbooks that are 6 years old, I guess. https://developer.apple.com/library/content/documentation/HardwareDrivers/Conceptual/ThunderboltDevGuide/DebuggingThunderboltDrivers/DebuggingThunderboltDrivers.html https://developer.apple.com/library/content/documentation/Ha...