URL to paper from conference siteThis paper presents SUD, a system for running existing
Linux device drivers as untrusted user-space processes.
Even if the device driver is controlled by a malicious
adversary, it cannot compromise the rest of the system.
One significant challenge of fully isolating a driver is to
confine the actions of its hardware device. SUD relies on
IOMMU hardware, PCI express bridges, and message-signaled
interrupts to confine hardware devices. SUD
runs unmodified Linux device drivers, by emulating a
Linux kernel environment in user-space. A prototype of
SUD runs drivers for Gigabit Ethernet, 802.11 wireless,
sound cards, USB host controllers, and USB devices, and
it is easy to add a new device class. SUD achieves the
same performance as an in-kernel driver on networking
benchmarks, and can saturate a Gigabit Ethernet link.
SUD incurs a CPU overhead comparable to existing runtime
driver isolation techniques, while providing much
stronger isolation guarantees for untrusted drivers. Finally,
SUD requires minimal changes to the kernel—just two
kernel modules comprising 4,000 lines of code—which
may at last allow the adoption of these ideas in practice
