IOMMU
|
|
An IOMMU (Input Output Memory Management Unit) implements a form of Virtual Memory through Paging, for I/O devices. This means that their DMA transactions can be access-controlled, and remapped, instead of directly accessing physical memory.
Uses
IOMMUs have more than one use. The most obvious deployment is using a Hypervisor. Guest OSes in virtual machines can then access virtualized hardware that is passed-through to the guest VM, but the IOMMU will remap Guest Physical Addresses to the real memory backing it, and prevent DMA accesses beyond the bounds of the VM.
However, the same principles may also be applied to application software running in an unprivileged context, too. Some IOMMUs use the same paging format at the CPU, and nested translation too. This means they can translate Virtual Addresses, to Guest Physical Address, to Physical Addresses. Using this, it is possible to allow Ring 3 software to communicate directly with the hardware, and program DMA, without breaking security. Some modern graphics cards support this for performance reasons, for instance.