3 ms·

IOMMUs are designed to prevent peripherals accessing all of memory, so you don't need to disable DMA. If a device did manage to escape the confines of the IOMM

IOMMUs are designed to prevent peripherals accessing all of memory, so you don't need to disable DMA. If a device did manage to escape the confines of the IOMMU somehow, then it would likely just get the encrypted pages, which would be garbage without the keys to decrypt them.

the8472 9y ago
Linux and macos use the IOMMU for protection by default. Windows needs a lot of configuration to achieve that otherwise it only uses it for virtualization.
- 4ad 9y ago
  How exactly can you configure Widows to use the IOMMU.
  - jnky 9y ago
    https://docs.microsoft.com/en-us/windows/device-security/device-guard/deploy-device-guard-enable-virtualization-based-security https://docs.microsoft.com/en-us/windows/device-security/dev...