\HeadingLevelC{DMA Transfer Filtering}
\label{sec:dma_master}

Sanctum whitelists a DMA-safe DRAM region instead of following SGX's blacklist
approach. Specifically, Sanctum adds two registers (a base, \texttt{dmarbase}
and an AND mask, \texttt{dmarmask}) to the DMA arbiter (memory controller). The
range check circuit shown in Figure~\ref{fig:page_walker_input} compares
each DMA transfer's start and end addresses against the allowed DRAM range, and
the DMA arbiter drops transfers that fail the check.
