Thesis (BA(Hons)(Aboriginal Studies)) - University of Tasmania, 2009.

As mobile computers such as laptops and cellphones are becoming more and more powerful, the options for those who traditionally required a more powerful desktop PC, such as video editors or gamers seem to have grown slightly. One of these new options are external Graphics Processing Units (eGPUs). Where a laptop is used along with an external GPU, connected via Intel’s Thunderbolt 3. This is however a rather untested method. This paper discusses the performance of eGPUs in a variety of operating systems (OS’s). For this research, performance benchmarking was used to investigate the performance of GPU intensive tasks in various operating systems. It was possible to determine that the performance across operating systems does indeed differ greatly in some usecases, such as games. While other use cases such as computational and synthetictests perform very similarly independently of which system (OS) is used. It seems that the main limiting factor is the GPU itself. It also appears to be the case that the interface with which the GPU is connected to a computer does indeed impact performance, in a very similar way between different OS’s. Generally, games seem to loose more performance than synthetic and computational tasks when using an externalGPU rather than an internal one. It was also discovered that there are too many variables for any real conclusions to be drawn from the gathered results. This as theresults were sometimes very inconclusive and conflicting. So while the outcomes can be generalized, more research is needed before any definitive conclusions can be made.

The thesis of this dissertation is that, despite widespread belief in the security community, systems are still vulnerable to attacks from malicious peripherals delivered over the PCI Express (PCIe) protocol. Malicious peripherals can be plugged directly into internal PCIe slots, or connected via an external Thunderbolt connection. To prove this thesis, we designed and built a new PCIe attack platform. We discovered that a simple platform was insufficient to carry out complex attacks, so created the first PCIe attack platform that runs a full, conventional OS. To allows us to conduct attacks against higher-level OS functionality built on PCIe, we made the attack platform emulate in detail the behaviour of an Intel 82574L Network Interface Controller (NIC), by using a device model extracted from the QEMU emulator. We discovered a number of vulnerabilities in the PCIe protocol itself, and with the way that the defence mechanisms it provides are used by modern OSs. The principal defence mechanism provided is the Input/Output Memory Management Unit (IOMMU). The remaps the address space used by peripherals in 4KiB chunks, and can prevent access to areas of address space that a peripheral should not be able to access. We found that, contrary to belief in the security community, the IOMMUs in modern systems were not designed to protect against attacks from malicious peripherals, but to allow virtual machines direct access to real hardware. We discovered that use of the IOMMU is patchy even in modern operating systems. Windows effectively does not use the IOMMU at all; macOS opens windows that are shared by all devices; Linux and FreeBSD map windows into host memory separately for each device, but only if poorly documented boot flags are used. These OSs make no effort to ensure that only data that should be visible to the devices is in the mapped windows. We created novel attacks that subverted control flow and read private data against systems running macOS, Linux and FreeBSD with the highest level of relevant protection enabled. These represent the first use of the relevant exploits in each case. In the final part of this thesis, we evaluate the suitability of a number of proposed general purpose and specific mitigations against DMA attacks, and make a number of recommendations about future directions in IOMMU software and hardware.