3 ms·
> And DMA sees cleartext with (MK)TME. Could you please translate this into non-expert language? Does it mean DMA granted devices can break IOMMU separation?
by posix_me_less 8y ago
> And DMA sees cleartext with (MK)TME.
Could you please translate this into non-expert language? Does it mean DMA granted devices can break IOMMU separation?
- amluto 8y agoNo, I mean that, if the IOMMU is off or if it allows access to an address, then MKTME will treat that access exactly as though it was a normal access from the CPU. So, if the device selects the right key (the key uses some otherwise unused physical address bits), then the device will access the decrypted data.