Method and apparatus for detecting ATS-based DMA attack
Embodiments are directed to providing a secure address translation service. An embodiment of a system includes a computer-readable memory for storage of data, the computer-readable memory comprising a first memory buffer and a second memory buffer, an attack discovery unit device comprising processing circuitry to perform operations, comprising, receiving a direct memory access (DMA) request from a remote device via a Peripheral Component Interconnect Express (PCIe) link, the direct memory access (DMA) request comprising a host physical address and a header indicating that the target memory address has previously been translated to a host physical address (HPA), and blocking a direct memory access in response to a determination of at least one of that the remote device has not obtained a valid address translation from a translation agent, or that the remote device has not obtained a valid translation for the target memory address from the translation agent.
1. An apparatus comprising:
a computer-readable memory for storage of data, the computer-readable memory comprising a first memory buffer and a second memory buffer;
an attack discovery unit device comprising processing circuitry to perform operations, comprising:
receiving a direct memory access (DMA) request from a remote device via a Peripheral Component Interconnect Express (PCIe) link, the direct memory access (DMA) request comprising a host physical address and a header indicating that the target memory address has previously been translated to a host physical address (HPA);
searching a first memory table for an address translation verified bus device (ATVBDE) entry that matches a bus device pair associated with the PCIe link and a second memory table for an entry that matches a bus concatenation of a requester ID (RID) and a translated address included in an Address Translation Services (ATS) completion message; and
blocking a direct memory access in response to a determination of at least one of: that the remote device has not obtained a valid address translation from a translation agent; or that the remote device has not obtained a valid translation for the target memory address from the translation agent.
2. The apparatus of claim 1 , wherein the attack discovery unit device comprises processing circuitry to perform operations, comprising:
receiving, from the translation agent, a translation response; and
storing, in the first memory buffer, at least a portion of a completion request from the translation agent.
3. The apparatus of claim 2 , wherein the portion of the completion request from the translation agent comprises a bus device pair identifier associated with the remote device.
4. The apparatus of claim 3 , further comprising searching the first memory buffer in response to a direct memory access request to determine that the remote device has not obtained a valid address translation from the translation agent.
5. The apparatus of claim 1 , wherein the attack discovery unit device comprises processing circuitry to perform operations, comprising:
receiving, from the translation agent, a translation response; and
storing, in the second memory buffer, at least a portion of the translation response the translation agent.
6. The apparatus of claim 5 , wherein the portion of the completion request from the translation agent comprises the requester ID, the translated address, and an untranslated address.
7. The apparatus of claim 6 , further comprising searching the second memory buffer in response to a direct memory access request to determine that the remote device has not obtained a valid address translation for the target memory address from the translation agent.
8. A computer-implemented method, comprising:
receiving, in an attack discovery unit device, a direct memory access (DMA) request from a remote device via a Peripheral Component Interconnect Express (PCIe) link, the direct memory access (DMA) request comprising a host physical address and a header indicating that the target memory address has previously been translated to a host physical address (HPA);
searching a first memory table for an address translation verified bus device (ATVBDE) entry that matches a bus device pair associated with the PCIe link and a second memory table for an entry that matches a bus concatenation of a requester ID (RID) and a translated address included in an Address Translation Services (ATS) completion message; and
blocking a direct memory access in response to a determination of at least one of: that the remote device has not obtained a valid address translation from a translation agent; or that the remote device has not obtained a valid translation for the target memory address from the translation agent.
9. The method of claim 8 , further comprising:
receiving, from the translation agent, a translation response; and
storing, in a first memory buffer, at least a portion of a completion request from the translation agent.
10. The method of claim 9 , wherein the portion of the completion request from the translation agent comprises a bus device pair identifier associated with the remote device.
11. The method of claim 10 , further comprising searching the first memory buffer in response to a direct memory access request to determine that the remote device has not obtained a valid address translation from the translation agent.
12. The method of claim 8 , further comprising:
receiving, from the translation agent, a translation response; and
storing, in the second memory buffer, at least a portion of the translation response the translation agent.
13. The method of claim 12 , wherein the portion of the completion request from the translation agent comprises the requester ID, the translated address, and an untranslated address.
14. The method of claim 8 , further comprising searching the second memory buffer in response to a direct memory access request to determine that the remote device has not obtained a valid address translation for the target memory address from the translation agent.
15. A non-transitory computer readable medium comprising instructions which, when executed by a processor, configure the processor to perform operations comprising:
receiving, in an attack discovery unit device, a direct memory access (DMA) request from a remote device via a Peripheral Component Interconnect Express (PCIe) link, the direct memory access (DMA) request comprising a host physical address and a header indicating that the target memory address has previously been translated to a host physical address (HPA);
searching a first memory table for an address translation verified bus device (ATVBDE) entry that matches a bus device pair associated with the PCIe link and a second memory table for an entry that matches a bus concatenation of a requester ID (RID) and a translated address included in an Address Translation Services (ATS) completion message; and blocking a direct memory access in response to a determination of at least one of: that the remote device has not obtained a valid address translation from a translation agent; or that the remote device has not obtained a valid translation for the target memory address from the translation agent.
16. The non-transitory computer readable medium of claim 15 , further comprising instructions which, when executed by the processor, configure the processor to perform operations comprising:
receiving, from the translation agent, a translation response; and
storing, in a first memory buffer, at least a portion of a completion request from the translation agent.
17. The non-transitory computer readable medium of claim 16 , wherein the portion of the completion request from the translation agent comprises a bus device pair identifier associated with the remote device.
18. The non-transitory computer readable medium of claim 17 , further comprising instructions which, when executed by the processor, configure the processor to perform operations comprising:
searching the first memory buffer in response to a direct memory access request to determine that the remote device has not obtained a valid address translation from the translation agent.
19. The non-transitory computer readable medium of claim 15 , further comprising instructions which, when executed by the processor, configure the processor to perform operations comprising
receiving, from the translation agent, a translation response; and
storing, in the second memory buffer, at least a portion of the translation response the translation agent.
20. The non-transitory computer readable medium of claim 19 , wherein the portion of the completion request from the translation agent comprises the requester ID, the translated address, and an untranslated address.
21. The non-transitory computer readable medium of claim 20 , further comprising instructions which, when executed by the processor, configure the processor to perform operations comprising:
searching the second memory buffer in response to a direct memory access request to determine that the remote device has not obtained a valid address translation for the target memory address from the translation agent.