Technical reports
IOCaps: de/centralized capabilities for I/O protection
202 pages
This technical report is based on a dissertation submitted June 2026 by the author for the degree of Doctor of Philosophy to the University of Cambridge, St. Catharine’s College.
| DOI | https://doi.org/10.48456/tr-1011 |
Abstract
Modern computing systems interact with a minefield of potentially buggy or malicious peripherals such as block storage, network devices, fixed-function video decoders and NPUs, and fully programmable GPUs and FPGAs. These peripherals must be allowed to perform direct memory access (DMA) on host memory, for high-speed bulk memory transfer, but must not be allowed to access memory not meant for them. IOMMUs can thwart DMA attacks via address translation but are limited in spatial security, temporal security, and performance. IOMMUs by definition are limited to page-granularity protection. IOMMUs have to perform slow walks over page tables (stored in slow DRAM) on the critical path, limiting throughput and increasing latency. IOTLBs can cache page table walks but I/O tends to have low locality, constantly accessing new pages and unmapping old ones, making caching ineffective. Invalidating IOTLB entries is so slow that Linux defers invalidation, leading drivers to accidentally access and reuse memory while it may still be exposed, to avoid an otherwise debilitating performance hit.
This thesis proposes IOCaps: a capability-based system inspired by CHERI that replaces slow page table walks with fast cryptographic validation, allows peer-to-peer capability delegation and reduction, and improves protection granularity and invalidation latency. Instead of defining access control policies with a cache backed by DRAM page tables, IOCaps are access tokens that are stored by the peripherals, attached to each access, and validated by the host against a set of keys stored in fast SRAM. A Macaroon-inspired Message Authentication Code (MAC)-chaining system allows IOCaps to be reduced and passed between peripherals, facilitating CHERI-like compartmentalization, while remaining secure. IOCaps, like CHERI capabilities, encode the bounds of accessible regions at sub-page precision, avoiding accidental exposure of sensitive data near exposed regions. While IOCaps do not enable translation they can still be layered on top of IOMMU translation if needed, for example, for virtualization. Using separate systems for protection and translation should allow translation to be made less granular, using high-locality hugepages to be more IOMMU-friendly, without sacrificing protection granularity—the best of both worlds.
After justifying and describing the basic system, this thesis investigates spatial security, temporal security, and performance to show IOCaps are a viable alternative to IOMMU protection. Spatial Security. IOCaps must be compact to avoid bottlenecking DMA throughput, but must still represent a 64-bit address region with high precision and multiple reductions, which I show is viable through a new approach to compression. Temporal Security. Because protection is no longer backed by a persistent page table, IOCap lifetimes are entirely dependent on that of the keys used to validate them, requiring more keys per peripheral than prior art in the same vein. I investigate different MAC functions, fundamental limits on the number of keys per system, and allocation methods that allow IOCaps to scale to underprovisioned systems without loss of security. Performance. I implement an IOCap protection system in practice using QEMU-based emulation and real FPGA hardware, integrate it with existing CheriBSD VirtIO drivers, and demonstrate that the impact on bulk DMA throughput is minimal.
Full text
PDF (2.7 MB)
BibTeX record
@TechReport{UCAM-CL-TR-1011,
author = {Stark, Samuel Winslow},
title = {{IOCaps: de/centralized capabilities for I/O protection}},
url = {https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-1011.pdf},
institution = {University of Cambridge, Computer Laboratory},
doi = {10.48456/tr-1011},
number = {UCAM-CL-TR-1011}
}