IOMMU Translation Data Prefetch for DMA Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In computer systems, especially virtual machine environments, input/output (I/O) devices use physical addresses to access memory, which reduces system security and complicates memory management, as rogue devices can access memory unimpeded, and existing memory management units do not provide adequate translation and protection for I/O devices.
Innovation Solution
An I/O memory management unit (IOMMU) is implemented with caches and a table walk unit to translate virtual addresses in DMA requests from I/O devices to physical addresses using I/O translation tables, enabling memory protection and security by separating I/O device memory access paths from processor memory access paths.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If I/O devices use physical addresses to access memory, then memory access speed is improved, but system security deteriorates
Solution Approach 1:
The patent introduces an I/O memory management unit (IOMMU) as an intermediary between I/O devices and system memory. The IOMMU translates physical addresses generated by I/O devices into actual memory addresses using translation tables, thereby maintaining fast direct memory access while implementing security controls. This mediator prevents rogue devices from accessing unauthorized memory regions by validating addresses through the translation mechanism.
2Ease of operation
If I/O devices use physical addresses to access memory, then device operation simplicity is improved, but memory management complexity deteriorates
Solution Approach 1:
The patent segments the memory management functionality by separating the address translation responsibility from the I/O devices themselves and placing it in the IOMMU. The translation tables are organized in a hierarchical structure with different levels, allowing complex memory management policies to be implemented without increasing the operational complexity for individual I/O devices. Each device continues to use simple physical addresses while the IOMMU handles the complex translation logic.
3Reliability
If address translation is implemented for I/O devices, then system security is improved, but address translation overhead increases
Solution Approach 1:
The patent implements preliminary action by pre-establishing translation tables that map I/O device physical addresses to actual memory addresses before DMA operations occur. The IOMMU loads translation data into internal caches or buffers in advance, so that during actual DMA transfers, the translation can be performed rapidly using the pre-computed mappings. This reduces the time penalty of address translation while maintaining security.
Solution Approach 2:
The patent changes the parameter of address translation by implementing a hierarchical translation table structure with different levels of abstraction. The translation process uses multiple levels of tables (e.g., domain tables, device tables, page tables) that can be configured to provide different granularities of translation. This allows the system to optimize translation speed by using coarser-grained tables for common cases while maintaining fine-grained security controls when needed.
Data Source
AI summary
In an embodiment, a system memory stores a set of input/output (I/O) translation tables. One or more I/O devices initiate direct memory access (DMA) requests including virtual addresses. An I/O memory management unit (IOMMU) is coupled to the I/O devices and the system memory, wherein the IOMMU is configured to translate the virtual addresses in the DMA requests to physical addresses to access the system memory according to an I/O translation mechanism implemented by the IOMMU. The IOMMU comprises one or more caches, and is configured to read translation data from the I/O translation tables responsive to a prefetch command that specifies a first virtual address. The reads are responsive to the first virtual address and the I/O translation mechanism, and the IOMMU is configured to store data in the caches responsive to the read translation data.