Hacker News Reader

Comment by poizan42 | Hacker News Reader

Doesn't apple use IOMMUs? Are there actually motherboards out there with TB3 support but without IOMMU?

AFAIK Apple uses a custom motherboard for their machines, so I'm not sure where to look for specs on if the mobos support IOMMU/VT-d, but from what I can find, IOMMU/VT-d is not supported on any of the CPUs used in TB3-capable MBs, and it needs to be supported by both CPU and mobo for it to work.

http://ilostmynotes.blogspot.com/2014/11/thunderbolt-dma-att...

Apple in MacOS is using IOMMU to protect against Firewire/Thunderbolt attacks.

Here's a developer working on xhyve that is explaining how each PCI device has it's own VT-d mapper/domain: https://github.com/mist64/xhyve/issues/108#issuecomment-3592...

Interesting, I've been doing lots of searching and all I can find is forum or blog posts of unverified people, some saying that VT-d is enabled, but most saying it is not supported/enabled. In fact, if you look at the presentation by Russ Sevinsky that is referenced in your first link, it is specifically said that Apple hardware does not support IOMMU [1]. So I really don't know what to think.

1: https://youtu.be/q0HthE3qDMw?t=415

edit: I finally came across the below link from Apple which does seem to imply that IOMMU VT-d is enabled on Macs that are 2012 and newer. On anything before that, though, and DMA attacks could own you. So uh.. don't run macbooks that are 6 years old, I guess.

https://developer.apple.com/library/content/documentation/Ha...

Reply on news.ycombinator.com