5 ms·
No. But there are limitations. DMA off, only formally verified drivers It's also important to note that se4L multicore kernel is not yet verified.
by nabla9 2y ago
No.
But there are limitations. DMA off, only formally verified drivers
It's also important to note that se4L multicore kernel is not yet verified.
- snvzz 2y agoAn IOMMU can help significantly with the driver problem, preventing a properly initialized driver from misbehaving and compromising the system.
- vacuity 2y agoI want the magical IOMMUs that are maturely secure like MMUs are now. For now, I think various efforts in verifying/restricting/generating drivers are far better, although they fall particularly flat for proprietary drivers.
- snvzz 2y ago>I want the magical IOMMUs that are maturely secure like MMUs are now. There's nothing magical about IOMMUs. They weren't invented last week either. Driver and hardware talk to each other using virtual memory instead of physical memory, preventing the scenario where a bug causes DMA to shit all over somebody else's memory. What holds is that systems that run drivers in supervisor mode have not been able to leverage an iommu to its full extent.
- vacuity 2y agoMy (admittedly limited) understanding is that IOMMUs still have practical roadblocks to being a solidly established part of the security of the computer. Of course they aren't bad in principle. Perhaps it's just that we aren't willing to eat the performance cost of making them more robust, but then performance is a tortured debate.
- surajrmal 2y agoThe primary roadblock is cost and complexity. The technology itself is sound and doesn't have major performance problems.
- FuriouslyAdrift 2y agoI want capability-based addressing like in the Plessy 250... https://en.wikipedia.org/wiki/Plessey_System_250 https://en.wikipedia.org/wiki/Plessey_System_250