2 ms·
Virtualisation's rise in popularity has caused IOMMUs to start showing up even in some consumer chipsets. Do you think an IOMMU and a driver that supplies it ap
by pmjordan 15y ago
Virtualisation's rise in popularity has caused IOMMUs to start showing up even in some consumer chipsets. Do you think an IOMMU and a driver that supplies it appropriately restrictive page tables for the GPU will be enough or do we realistically need GPUs with some kind of native memory protection support that can somehow be intertwined with the CPU's process model?
- daeken 15y agoYes and no. So, it really depends on what you're defending against: if your concern is solely about an attacker using the GPU to compromise the CPU, then IOMMUs get you a lot in terms of restricting what's possible -- sure, an attacker could find some buffer somewhere in the accessible address space that they can use to attack the CPU, but it's another barrier. But if you think about what's on the GPU itself -- all your UI elements (in many cases), your webpages, etc -- it suddenly makes that data seem very important; if I can get you to go to a page that will let me grab all of your running windows, then suddenly I may very well have things like your passwords, credit card info, etc (all depending on when I grab the data and how often that data gets flushed out). I think that proper protections should be put in from the hardware on up through the drivers, but it's going to take a lot of work and a lot of research to get it right.