Intel VT-d

This page or section is a stub. You can help the wiki by accurately contributing to it.

Intel VT-d provides an IOMMU to translate device addresses to host addresses, similar to the MMU on the CPU. It is also able to remap interrupt lines.

The location of the configuration registers can be found in the DMAR ACPI table. Note, DMAR is specific to VT-d.

DMAR

VT-d is found by locating the DMAR ACPI table, much like the MADT.

Offset	0	1	2	3	4	5	6	7
0x0	Signature				Length
0x8	REV	CHK	OEMID
0x10	OEM Table ID
0x18	OEM Revision				Creator ID
0x20	Creator Revision				HAW	FLG	Resevred
0x28	Reserved
0x30	DRHD #1
0x38
0x40
0x48
0x50	DRHD #2
0x58
0x60
0x68	DRHD...
0x70...

Signature: "DMAR".

Translation structures

There are two translation formats: legacy and scalable. The legacy format is simpler but lacks useful features. Importantly, it only supports second-stage page tables which are not compatible with X86 Paging tables.

This section will only discuss the scalable format, which supports first-stage translation and is directly compatible with 64-bit x86 page tables.

Note that the tables are all 4KiB in size and alignment. This can be used as a sanity check when defining structures.

Note: Requests to the 0xFEEx_xxxx region do not go through DMA translation tables. See the Interrupt Remapping section.

Scalable Mode Root Table

The root table consists of 256 Root Entries, with each entry corresponding to a single bus. Each entry points to a single Context Table.

(Lower/Upper) Context Table

The context table is split in two equally sized halves, each half containing 128 entries for a total of 256 entries.

Each entry corresponds to a single device function.

Scalable Mode PASID structures

The PASID tree consists of a directory and tables, similar to page tables. Each directory entry points to a table.

The PASID is either a default value ("request-without-PASID") or included in the TLP ("request-with-PASID").

First-Stage Page Table Structures

These page tables are fully compatible with the CPU page tables. However, some of the otherwise ignored bits may be accessed and interpreted specially by the IOMMU.

Interrupt Remapping

MSI / MSI-X

Any write requests to the 0xFEEx_xxxx region do not go through DMA translation tables.

Emulation

QEMU

To use an emulated VT-d IOMMU with support for scalable mode and first-stage translation structures, add the following argument:

-device intel-iommu,x-scalable-mode=on,x-flts=on

(flts is a historical acronym meaning "First-Layer Translation Structures")

info mtree

The memory regions used by the emulated devices will look like this:

memory-region: vtd-1f.2
  0000000000000000-ffffffffffffffff (prio 0, container): vtd-1f.2
    0000000000000000-ffffffffffffffff (prio 0, i/o): vtd-1f.2-dmar
      00000000fee00000-00000000feefffff (prio 1, i/o): alias vtd-ir @vtd-ir 0000000000000000-00000000000fffff

Note the vtd-ir range with higher priority than the dmar range.

See also

External Links

• Intel® Virtualization Technology for Directed I/O (June 2022 Revision 4.0)