I tried to get that disabled in Linux. There's a register in the FireWire interface which sets the range of addresses into which external memory access requests can be made. By default, it was at 4GB, even on 64 bit systems. Setting it to zero would break some external kernel debugger, though, so it was left open.

(Firewire isn't DMA. PCI-E is DMA. Firewire is a network cable, over which software sends packets. LAN over FireWire was sometimes done. But there's an optional feature which recognizes special packets for doing word-size loads and stores. This is usually used to talk to dumb slave devices, where you write "registers" to make things happen. It's not needed on a computer, and it's far too slow for bulk transfers. FireWire isn't inherently more vulnerable than a LAN port.)

IIRC Apple's "fix" was to just disable recognition of new FireWire devices when the computer was locked. So a nasty device could still compromise you, but it would be one that you plugged in yourself.

It looks like your recollection is indeed correct. See the entry for CVE-2011-3215 here: https://support.apple.com/en-us/HT202348

Firewire in most setups allows DMA access to the host, but only to the first 32 bits of RAM. There's tools for unlocking, reading out keys from memory while asleep, all sorts of nasties.

In Linux, that's a constant in the Linux driver.

I'd be curious to see a list of devices which ship with this enabled. I imagine it's shorter than the article makes it sound.

I imagine DMA was a trade-off for speed. Security is about such trade-offs.

It's a common feature for very high speed writes in hardware, DMA in firewire and thunderbolt is no mistake.

The fun thing is that it is probably a very useful feature for those who know how to use it. You can debug your BIOS this way for example.

Sure, but you should disable it before shipping the final version. It's the same with programming microcontrollers - you have full read write and debug available. But you should really flip the right fuses to disallow changes in the shipped product.