Operating systems and hypervisors use a processor’s MMUs to isolate processes and VMs alike. An often overlooked issue is DMA memory security; where a DMA capable device can be programmed to access memory in the system without being subject to MMU restrictions. This typically results in device drivers being used without security, or forcing them to reside in the kernel, hypervisor or a trusted VM.

System MMUs provide the ability to extend the memory protection controls of the OS or hypervisor to these DMA devices. Placed between the memory bus and one or more devices, a system MMU provides the ability to restrict the memory accesses of the device, as well as optionally remap IO memory space entirely.

NXP (Freescale’s) layerscape ARM processors offer great performance for networked devices and fortunately include SMMUs. We’ve recently been integrated support for these System MMUs (SMMU) in the LS1021a processor to demonstrate the ease of isolating DMA capable devices using the OKL4 Microvisor. We’ve been able to show that it is easy to securely partition control of DMA devices between multiple VMs including transparently remapping entire Linux VMs to run non 1:1 with physical memory. This technology enables the development of highly robust (by stopping bad DMA transfers) and secure platforms using the QorIQ processor range.

Cog Systems licenses and maintains the OKL4 Microvisor – a high performance and highly flexible secure hypervisor and separation kernel. Combined with the recent ARM 64-bit AARCH64 support developed by Cog, we can support the entire range of NXP ARM chipsets.

Contact us for further information on how to enable advanced secure partitioning and fault tolerant systems on NXP QorIQ ARM devices.