Re:Fuchsia Workstation
by zozbot234 on Monday March 28, 2022 @04:26AM
(#30828417)
Microkernels are also not very useful on hardware without IOMMU's or separate buses isolating external components (like most SoC hardware), because a rouge-acting driver can take over your system anyway, so it has to be part of your trusted base. You can make such drivers into separate kernel-side threads or tasks, as a matter of pure convenience, but implementing them in userspace adds no security value.
[ Parent
| on HN ]
While it's true that the attack vector you describes exist, assuming you can trust both the driver and hardware, it is hard to exploit as most software cannot talk directly to the driver. Even if it does, manipulating it the way you describe is challenging. By comparison, it's not only easy to talk with most drivers in a monolithic kernel, there is also many more ways to manipulate it which will result in the entire system being owned. Security isn't all or nothing if designed robustly. I hope the case for IOMMUs becomes stronger due to increased popularity of Operating Systems with userspace drivers. The BOM cost is simply worth it.
Customers of QNX, vxWorks and INTEGRITY OS beg to differ.
QNX works on real-time microcontrollers, where you just don't have the kind of hardware that can subvert an entire system by doing rouge DMA transfers. General-purpose systems are very different.
QNX works in whatever CPU one puts it on, plenty of choice, including plain Intel ones.