1
\$\begingroup\$

AbsoluteƵERØ showed me that memory can be bypassed at the memory controller. https://security.stackexchange.com/questions/36592/can-linux-be-made-to-detect-foreign-connections-to-the-ram-bus

by showing me this patent: http://www.google.com/patents/US6745308

In the Abstract of the article, it says

If particular memory controller components are idle, a memory client is informed that a bypassing of memory controller components is possible.

Does that mean that there can't be a bypass if the particular memory controller components aren't idle? (More quotes on "idleness" below)

If so, how can a memory controller be kept from an "idle" state?

Idleness Quotes

Only components that are idle or have no other memory requests to process may be bypassed.

The method as in claim 1, wherein the step of providing, to the client, the signal indicating the state of the memory controller includes providing a signal indicating a level of idleness associated with the memory controller pipeline.

The method as in claim 5, wherein determining a level of idleness associated with the memory controller pipeline includes analyzing memory request queues of a first component and a second component are empty.

A system comprising:providing the memory access request to a bypass module when the signal indicates the first component is idle;

Only components that are idle or have no other memory requests to process may be bypassed.

At least one embodiment of the present invention provides for a method of bypassing memory controller components. The method includes receiving a first memory request to read data from memory. In one embodiment, a bus interface unit receives the first memory request. The first memory request may be associated with a cache fetch request. The method includes determining if a first component and a second component of a memory controller are idle. The first component is a Northbridge client interface used to organize received memory requests. The second component is a Northbridge arbiter used to arbitrate, or select, requests from different clients, allowing received requests from all the clients to be processed. The result of determining if the first and second components are idle is provided as a signal to the host bus interface unit. The method also includes providing the first memory request to the first component, when the first component and the second component are busy. The method also includes determining, in the memory controller, if the first memory request is valid for access by bypassing the second component. In one embodiment the second component is used to generate commands to open closed pages of memory. If the memory request needs to access a closed page of memory, the memory request is considered invalid. The method also includes enabling the first memory request to be accessed by the second component, when the first memory request is considered invalid for bypass operations. The method further includes enabling the first memory request to be accessed by bypassing the first and second components, when the first memory request is considered valid.

with many more.

\$\endgroup\$
2
  • \$\begingroup\$ Please work on making your question addressed to a specific component or components of IT Security such as confidentiality, integrity, or availability. I also suggest you read more about memory buses and memory architectures before re-asking. See people.cis.ksu.edu/~schmidt/300s05/Lectures/ArchNotes/arch.html \$\endgroup\$ Commented May 29, 2013 at 6:29
  • \$\begingroup\$ @this.josh was there something particular in that page that you think i should look at? it's very long, and i don't know what i'm looking for. is there another stack where this would be on-topic? if so, can you move it there? ty! \$\endgroup\$ Commented May 29, 2013 at 12:23

2 Answers 2

Reset to default
1
\$\begingroup\$

That patent doesn't do what he thinks it does. The patent is a method for changing the components of a memory controller during design so that you can support a collaborative bypass of the controller within the various components or stages of the memory controller itself. No where do they describe sitting on the external memory bus (to DRAM) and snooping on it. In fact they describe a controller that says "hey guys - I'm idle now, go and do your stuff"

When they say "components" think " functional blocks" not DRAM modules or the like.

\$\endgroup\$
7
  • \$\begingroup\$ does this mean that it's not possible for someone to instantly close the memory's circuit and hijack the system or at the very least read it as its' running? \$\endgroup\$ Commented May 29, 2013 at 23:56
  • 2
    \$\begingroup\$ It's possible to snoop on the DRAM bus, and passively collect data, but you have to be careful to not disturb the signals. Taking over the bus is far less likely without first halting the processor and then getting it to let go of the bus (i.e. stop driving it) I can't comment on the do-ability of that. What is clear is that patent has nothing to do with the subject though. \$\endgroup\$ Commented May 30, 2013 at 0:05
  • \$\begingroup\$ @Sulla I don't think this has a whole lot of relevance to security because the attacker has to have the motherboard laid out on the table. "Extreme" physical access. \$\endgroup\$ Commented May 30, 2013 at 0:06
  • 1
    \$\begingroup\$ @Sulla It might be an issue for someone who wants to create a tamper-proof system that can't be compromised even when it's in the attacker's possession. \$\endgroup\$ Commented May 30, 2013 at 0:07
  • \$\begingroup\$ @rawbrawb ty very much for the knowledge about the processor! would you mind taking a look at this? security.stackexchange.com/questions/36592/… \$\endgroup\$ Commented May 30, 2013 at 0:21
0
\$\begingroup\$

memory can be bypassed at the memory controller.

Technically another memory controler may be substituted, but its substitution would be detectable. Most likely the bus would be off for a period of time while the substitution took place. The inability to communicate with RAM would be detected by the processor and result in OS failure.

Can linux (be made to) detect foreign connections to the ram bus?

Linux is an operating system. It is software. Detection of physical attachment or modification requires hardware components with monitoring capabilities. So, it depends from components the computer is made.

If so, how can a memory controller be kept from an "idle" state?

You may keep a memory controller from idle by ensuring frequent read and write requests to memory locations. THe memory controller waits for a condition to transition into the idle state. The condition may vary by model, but typically it requires that during the last time period (for example 600 ns) it received no read or write requests from the processor.

\$\endgroup\$