SecureROM in the iPhone 6 didn't properly configure the MMU before initialising the NAND, so it turned out to be possible to interpose between the NVME controll

SecureROM in the iPhone 6 didn't properly configure the MMU before initialising the NAND, so it turned out to be possible to interpose between the NVME controller and main CPU (which had just started using PCI-e fabric for I/O, IIUC), take advantage of a bunch of software pieces that happened to be sitting in all the right places, and have fun with DMA bus mastering :3 http://ramtin-amin.fr/#nvmepcie http://ramtin-amin.fr/#nvmepcie http://ramtin-amin.fr/#nvmedma http://ramtin-amin.fr/#nvmedma Remains one of my favourite hacks, mostly because I can say I can (barely) actually understand it :D I mention this because, if Apple can't get PCI-e right on the first go, ...