Answer each question out loud before opening it. If you miss more than three in the checkpoint, revisit the lessons linked at the end.
The request carries a security attribute (AXI AxPROT[1]) set by hardware from the requester's true state, carried unchanged and checked in front of memory.
Keep it from the target, answer it with an error, log it and alert secure software.
Without one, a DMA-capable device can access any physical memory; the IOMMU translates and checks each access with per-device tables.
It has no secret; an attacker recomputes it. Use keyed integrity tags, encryption and replay counters.
By volume: filling shared queues and buffers with allowed requests; bound it with per-requester queues, limits and regulators.
Identities for every request, per-tenant IOMMU tables, virtual functions, performance isolation, cache and bandwidth partitioning, and link protection.
Task. An SoC has a CPU cluster with secure and non-secure software, a DMA engine programmed by non-secure software, a PCIe port for an external accelerator, and DRAM with a secure region. Specify how each requester is identified, where checks happen, and how the secure region and the CPU's memory latency are protected.
Identity: the CPU sets AxPROT (privilege, non-secure) from its true state; the DMA engine's port forces non-secure and assigns a fixed master ID, since non-secure software programs it; PCIe requests carry a Requester ID, which an IOMMU uses. Checks: a TrustZone address space controller in front of DRAM refuses non-secure access to the secure region by region, security state and master ID, answering refused requests with errors and logging them; its configuration is writable only by secure software and locked after boot; it checks whole bursts. The DMA engine and the PCIe port go through an IOMMU (SMMU) with per-stream page tables set up by the operating system, so neither can reach memory outside its mappings, with invalidation completed before buffers are freed. Performance: per-requester queues and round-robin or weighted arbitration at the memory controller, outstanding-transaction limits and a bandwidth regulator on the PCIe and DMA ports, and QoS priority for the CPU with limits. If the PCIe link leaves a trusted enclosure, enable IDE.
Privileged, non-secure, instruction.
The fabric port it is attached to (or an IOMMU), not the engine or its software.
A conservative value, normally non-secure.
A burst starting in an allowed region can run into a protected one.
Only secure, privileged software, or nobody after it is locked.
From its requester or stream ID, assigned by the fabric.
The IOMMU must invalidate the device's cached translation and wait for confirmation before the memory is reused.
Encryption, a keyed integrity tag covering the header too, and replay protection.
The attacker's number of queued requests.
Its own virtual function of a shared device, with its own identity.