WHERE is VT-D implemented..?

[neilh...@gmail.com]

Quick question.

WHERE is VT-D protection against DMA attacks implemented..?

Is it implemented at a particular VM, such as

"sys-net"

or

"sys-firewall"

Or is this just built-in to the entire Qubes system regardless of which VM you are using..?

If I were to run something like

wget google.com

within "sys-net" terminal

Would that be protected by VT-D..?

Thanks

[Zrubi]

On 09/20/2016 02:44 AM, neilh...@gmail.com wrote:

> WHERE is VT-D protection against DMA attacks implemented..?

VT-D is implemented in Xen and it is actually protecting PCI passtrough
feature:
https://wiki.xen.org/wiki/Xen_PCI_Passthrough

Because Qubes using Xen, all the VM's are protected against DMA attacks,
however most of the VM's are not even affected by DMA attacks, only the
ones having PCI device assigned.
(sys-net and sys-usb by default)


--
Zrubi

[J. Eppler]

WHERE is VT-D implemented..?

Intel VT-d is a hardware virtualization feature and it is implemented in hardware.

Xen uses Intel VT-d. Xen does not call it Intel VT-d, instead Xen uses the more general term IOMMU (I/O MMU).

For the rest look at Zrubi's answer.