<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<style type="text/css">
@import url('../css/main.css');
</style>
<title>Notes about DMA and the docking station (X60/T60)</title>
</head>
<body>
<div class="section">
<h1>Notes about DMA and the docking station (X60/T60)</h1>
</div>
<div class="section">
<pre>
Use case:
---------
Usually when people do full disk encryption, it's not really full disk,
instead they still have a /boot in clear.
So an evil maid attack can still be done, in two passes:
1) Clone the hdd, Infect the initramfs or the kernel.
2) Wait for the user to enter its password, recover the password,
luksOpen the hdd image.
I wanted a real full-disk encryption so I've put grub in flash and I
have the following: The HDD has a LUKS rootfs(containing /boot) on an
lvm partition, so no partition is in clear.
So when the computer boots it executes coreboot, then grub as a payload.
Grub then opens the LUKS partition and loads the kernel and initramfs
from there.
To prevent hardware level tempering(like reflashing), I used nail
polish with a lot of gilder, that acts like a seal. Then a high
resolution picture of it is taken, to be able to tell the difference.
The problem:
------------
But then comes the docking port issue: Some LPC pins are exported
there, such as the CLKRUN and LDRQ#.
LDRQ# is "Encoded DMA/Bus Master Request": "Only needed by
peripherals that need DMA or bus mastering. Requires an
individual signal per peripheral. Peripherals may not share
an LDRQ# signal."
So now DMA access is possible trough the dock connector.
So I want to be able to turn that off.
If I got it right, the X60 has 2 superio, one is in the dock, and the
other one is in the laptop, so we have:
________________
_________________ | |
| | | Dock connector:|
|Dock: NSC pc87982|<--LPC--->D_LPC_DREQ0 |
|_________________| |_______^________|
|
|
|
|
___________________|____
| v |
| SuperIO: DLDRQ# |
| NSC pc87382 LDRQ# |
|___________________^____|
|
|
|
|
___________________|___
| v |
| Southbridge: LDRQ0 |
| ICH7 |
|_______________________|
The code:
---------
Now if I look at the existing code, there is some superio drivers, like
pc87382 in src/superio/nsc, the code is very small.
The only interesting part is the pnp_info pnp_dev_info struct.
Now if I look inside src/mainboard/lenovo/x60 there is some more
complete dock driver:
Inside dock.c I see some dock_connect and dock_disconnect functions.
Such functions are called during the initialisation (romstage.c) and
from the X60 SMI handler (smihandler.c).
Questions:
----------
1) Would the following be sufficent to prevent DMA access from the
outside:
> int dock_connect(void)
> {
> int timeout = 1000;
> + int val;
> +
> + if (get_option(&val, "dock") != CB_SUCCESS)
> + val = 1;
> + if (val == 0)
> + return 0;
> [...]
> }
>
> void dock_disconnect(void) {
> + if (dock_present())
> + return;
> [...]
> }
2) Would an nvram option be ok for that? Should a Kconfig option be
added too?
> config DOCK_AUTODETECT
> bool "Autodetect"
> help
> The dock is autodetected. If unsure select this option.
>
> config DOCK_DISABLED
> bool "Disabled"
> help
> The dock is always disabled.
>
> config DOCK_NVRAM_ENABLE
> bool "Nvram"
> help
> The dock autodetection is tried only if it is also enabled
> trough nvram.
</pre>
</div>
<div class="section">
<p>
Copyright © 2014, 2015 Francis Rowe <info@gluglug.org.uk><br/>
This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions.
A copy of the license can be found at <a href="../license.txt">../license.txt</a>.
</p>
<p>
This document is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See <a href="../license.txt">../license.txt</a> for more information.
</p>
</div>
</body>
</html>