Why Intel VT-d ?

[Michał Janowski]

Hello Joanna,

I have read, that to use Qubes I have to have a processor with Intel
VT-d. I have alsow read some time before (at tomshardware I think) the
interview with you. You have alsow mentioned only about Intel VT. What
about competition implementations? Is there any specific reason that
AMD V is not supported? It is about lack of some instructions or
because of security reason?

Alsow can I use Qubes on AMD processor and (if yes) how will that affect Qubes?

Best Regards,
Michał Janowski

[Joanna Rutkowska]

On 04/10/2010 08:20 PM, Michał Janowski wrote:
> Hello Joanna,
>
> I have read, that to use Qubes I have to have a processor with Intel
> VT-d. I have alsow read some time before (at tomshardware I think) the
> interview with you. You have alsow mentioned only about Intel VT. What
> about competition implementations? Is there any specific reason that
> AMD V is not supported? It is about lack of some instructions or
> because of security reason?

AMD-v seems to be functionally identical to VT-x (or perhaps even better
in some aspects, e.g. due to tagged TLB, that VT-x still doesn't have).

Also, AMD has its own implemention of IOMMU, that is just called...
IOMMU, that should be functionally identical to VT-d (or perhaps even
better because they might have interrupt remapping support).

The only issue with AMD-v/IOMMU is... that it is so difficult to buy a
laptop with AMD processor, and AFAIK, most of them would not have AMD
IOMMU, which apparently is only used on servers platforms (Opterns,
something else?). So, because Qubes targets desktop market, and this
market is dominated by laptops running Intel processors (and chipsets),
we focus on VT-x/VT-d technologies.

>
> Alsow can I use Qubes on AMD processor and (if yes) how will that affect Qubes?
>

Yes. Please note that Xen doesn't require AMD-v/VT-x for running PV VMs,
and Qubes AppVMs are nothing else than Xen PV domains. So, you can run
Qubes on any IA32 64-bit processor, regardless of whether it has any
virtualization extensions or not (AMD-v, VT-x).

But, you need VT-d to run netvm (actually you can also run it without
VT-d, but than there is DMA protection, so it doesn't make any sense). I
think that Xen also has support for AMD IOMMU, but I've never got such a
system to test, so I don't know for sure.

Perhaps AMD would be willing to donate some hardware for testing? :)

joanna.

[fkp...@gmail.com]

Apu a10 support vt-d as far as i know. Athlon x4 aslo. You just need to enable it in bios.

[fkp...@gmail.com]

[Vladimir Shipovalov]

On Friday, December 25, 2015 at 4:03:34 AM UTC+3, fkp...@gmail.com wrote:

Apu a10 support vt-d as far as i know. Athlon x4 aslo. You just need to enable it in bios.

Yes, A10 - even mobile A10 - supports IOMMU. But not every BIOS supports its enabling,
maybe because the BIOS writers are lazy when it comes to "additional features support".
You can look through Qubes Hardware Compatibility List for some info:

https://www.qubes-os.org/hcl/

[piitb...@gmail.com]

Am Samstag, 10. April 2010 21:49:49 UTC+2 schrieb joanna:

[...] 

you need VT-d to run netvm (actually you can also run it without
VT-d, but than there is DMA protection, so it doesn't make any sense).

The Lenovo X200 is only running Qubes OS 3.1 when VT-d is disabled.

I've read several times that not having VT-d is a bad thing, because the NetVM can't be secured against "DMA-attacks".

From the FAQ:

URL: https://www.qubes-os.org/doc/user-faq/#can-i-install-qubes-on-a-system-without-vt-d

Can I install Qubes on a system without VT-d?

Yes. You can even run a NetVM, but you will not benefit from DMA protection for driver domains. On a system without VT-d, everything should work in the same way, except there will be no real security benefit to having a separate NetVM, as an attacker could always use a simple DMA attack to go from the NetVM to Dom0. Nonetheless, all of Qubes’ other security mechanisms, such as AppVM separation, work without VT-d. Therefore, a system running Qubes will still be significantly more secure than one running Windows, Mac, or Linux, even if it lacks VT-d.

If an attacker can go from NetVM to Dom0 with a "simple" DMA attack, this doesn't very secure.

DMA attack from Wikipedia:

URL: https://en.wikipedia.org/wiki/DMA_attack

A DMA attack is a type of side channel attack in computer security, in which an attacker can penetrate a computer or other device, by exploiting the presence of high-speed expansion ports that permit Direct Memory Access ("DMA"). 

[...] 

Mitigations: 

DMA attacks can be prevented by physical security against potentially malicious devices.

This sounds to me that someone needs to have physical access to a machine to use a DMA attack against.

Is this correct?

If so I would think that I am secure enough running a Laptop without having VT-d enabled.

If someone needs and gets physical access to my Laptop to get to access my data, I suppose that he can also use other techniques to get the passphrase out of me...

I think the FAQ should include a few sentences about how risky it is to run Qubes OS on an non-VT-d machine and what are the attacks that can be used against such a device.

- Piit

 

[David Hobach]

> This sounds to me that someone needs to have physical access to a machine
> to use a DMA attack against.
> Is this correct?

Your netvm has access to the network card. An attacker who owned the
netvm likewise. So the attacker might be able to modify the NIC firmware
by some software-based update mechanism in a way so that it does the DMA
he likes, i.e. own dom0.

Maybe someone knows better though...

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Exactly. In some (most?) cases it doesn't even need modifying its
firmware - you can simply as a NIC (or any other DMA capable device) to
write result to an arbitrary memory address. Without IOMMU (VT-d) it
will happily do that.

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJW8ybdAAoJENuP0xzK19cssPcH/i6/+fgYC/PJ+oeNRnV97rnV
AwWxx6B7+FtxP1qb28iHWq2MY2YtASy/AbgdXAE51kcOwktrCDEPCBXmtYoBH5sY
d2vABoc0BHOO5/BGeF7E0PrKNGR9wMB4leoQgZAEMXDDq/mKZ8V3LimZb5uA0vOP
I3b9oUBgRczvWDrLTZ7rv2Ui3FuXFJSN1WE0RU3EClSTShQTowj+YfKAImaUFMfX
TYYJNFB2hbvXVHxk19/Id/WAUTzcQ+x0f+YHxjghDJKi8eGBD9R6Xmc9TcC4ByEX
FeOjZcGhUFBYwBIIZnfvpiTVMdozsZIVA9/pya4LNQ/yFJJOwWkRWmt5I1xJkBs=
=LjYR
-----END PGP SIGNATURE-----

[piit berlin]

Ok, but the most important question to understand the risk of a DMA attack:

This all can only be done, when having physical access to the machine, correct?

- Piit

--
You received this message because you are subscribed to a topic in the Google Groups "qubes-devel" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/qubes-devel/2UL9ZcIPT6Y/unsubscribe.
To unsubscribe from this group and all its topics, send an email to qubes-devel...@googlegroups.com.
To post to this group, send email to qubes...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-devel/20160323232933.GG1726%40mail-itl.

For more options, visit https://groups.google.com/d/optout.

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On Fri, Mar 25, 2016 at 11:42:34AM +0100, piit berlin wrote:
> Ok, but the most important question to understand the risk of a DMA attack:
> This all can only be done, when having physical access to the machine,
> correct?

No, physical access it not needed. Anyone running some code in NetVM (or
any VM with some PCI device) could perform such attach. Unless you have
VT-d.

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJW9RjgAAoJENuP0xzK19csuv8H/jyGioU2y6y0p9KDteaSVymD
rEV2Rx5Z8lAK7j3yvoBsGCc65Qmg+hlVGT59MF8X0ItyB21F0fddKIPMZdpPMOEq
nY11rLNe/5baZ6NP/GcJ6RnUcpHS6SD9/3V2Eqss0Mg7OHCuKM43G/HditbRjePM
I7/N7BxMZmo/F+NKRLAUpKutgP9tO3wzQZsDa/C1ikQuO3KSkDVu3tCKS3IZ2bQl
g0z2XsgzJiXRYAgouRGWU+9sHfQFE5gj//KcrjgIyOLMRcA3ogGfRjas99H7/vc8
Gh8mgOG87vcDpoE1FS7yCnf0HLtiVOFsuS6d/mDTCZpcJ/6dlm2PW+CWe8A+1Nw=
=S/sO
-----END PGP SIGNATURE-----

[Alexis Wattel]

  Message d'origine  
De: Marek Marczykowski-Górecki
Envoyé: vendredi 25 mars 2016 11:54
À: piit berlin
Cc: David Hobach; qubes-devel; janows...@gmail.com
Objet: Re: [qubes-devel] Re: Why Intel VT-d ?

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On Fri, Mar 25, 2016 at 11:42:34AM +0100, piit berlin wrote:
> Ok, but the most important question to understand the risk of a DMA attack:
> This all can only be done, when having physical access to the machine,
> correct?

No, physical access it not needed. Anyone running some code in NetVM (or
any VM with some PCI device) could perform such attach. Unless you have
VT-d.

- --

Of course NetVM can be exploited remotely ! It stil requires physical accesss but in the case of a NIC physical range includes the network it belongs to.

As an exemple, a WiFi network card can be reached over the air.
Now imagine than your Intel WiFi chip is backdoored. Someone can simply root your AP then send the magic packets that trigger a DMA attack. 

For networked devices, physical access goes a long way ! 

[Chris Laprise]

On 03/25/2016 06:54 AM, Marek Marczykowski-Górecki wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> On Fri, Mar 25, 2016 at 11:42:34AM +0100, piit berlin wrote:
>> Ok, but the most important question to understand the risk of a DMA attack:
>> This all can only be done, when having physical access to the machine,
>> correct?
> No, physical access it not needed. Anyone running some code in NetVM (or
> any VM with some PCI device) could perform such attach. Unless you have
> VT-d.
>

Its also worth noting that certain criminal and spy organizations have
focused their energies on compromising routers and similar home/office
LAN devices. They can then remotely tell these devices to launch "local"
attacks on PCs.

Chris

[sloven...@gmail.com]

Hello marmarek,

I am writing a thesis about Qubes OS and one of the assignments is to investigate the security impact of missing VT-d. For the next 2 to 3 weeks I am ready to work full-time to investigate this issue. Do you think it would be too difficult to create a proof-of-concept scenario demonstrating the vulnerability? I have made some research already and isolated some useful sources.

WOJTCZUK, Rafal; RUTKOWSKA, Joanna. Following the White Rabbit: Software attacks against Intel VT-d technology

Comment: Could you please point me to the chapters or other sources relevant to the demonstration or investigation of an attack on a system without VT-d? My laptop is HP ProBook 4730s and it is missing VT-d support.

RUTKOWSKA, Joanna. Remotely Attacking Network Cards (or why we do need VT-d and TXT)
Comment: A blog post commenting on a research article demonstrating a POC of a breach of network card FW vulnerability. I reckon, after breaching network card FW, the DMA enables doors to a full system breach w/o VT-d. I wonder if the research article enables me to demonstrate the POC on my HP ProBook 4730s. 

Intel® Virtualization Technology for Directed I/O (VT-d): Enhancing Intel platforms for efficient virtualization of I/O devices

Comment: An introduction to VT-d. I kinda fancy it, I have even created this vector diagram of VT-d. I wonder if it makes sense.

It seems the exploit would have to be written in some low-level language, assembler or something. I have no exp in asm, but I know C.