IOMMU Two-Level Address Translation for Virtualized I/O Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtualized computer systems, the lack of memory management for input/output (I/O) devices using physical addresses compromises security and system performance, as rogue devices can access memory unimpeded, and existing solutions for address translation are cumbersome and instruction-intensive.
Innovation Solution
The implementation of an I/O Memory Management Unit (IOMMU) with control logic and cache memory that performs two-level guest translations for I/O device requests, using a transaction layer protocol (TLP) packet with a process address space identifier (PASID) prefix to translate guest virtual addresses to system physical addresses, thereby enhancing security and performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If I/O devices use physical addresses to access memory, then device access speed is improved, but system security deteriorates as rogue devices can access memory unimpeded
Solution Approach 1:
The patent introduces an I/O Memory Management Unit (IOMMU) as an intermediary device between I/O devices and system memory. The IOMMU translates I/O virtual addresses (IOVAs) to system physical addresses (SPAs), preventing rogue devices from directly accessing memory using physical addresses. This mediator maintains security by enforcing address translation and access control while preserving fast device access through hardware-based translation.
Solution Approach 2:
The patent segments the address space into multiple levels: I/O virtual address space (IOVA) and system physical address space (SPA). By dividing the address translation function into hierarchical stages (first stage: IOVA to intermediate address; second stage: intermediate address to SPA), the system achieves both security through controlled access and performance through efficient segmented translation.
2Reliability
If a virtual machine manager intercepts and translates addresses for I/O devices, then security is improved, but system performance deteriorates due to cumbersome and instruction-intensive translation
Solution Approach 1:
The patent replaces software-based address translation (virtual machine manager interception) with a hardware-based IOMMU system. The IOMMU performs address translation through dedicated hardware circuits rather than software instructions, eliminating the performance overhead of instruction-intensive translation while maintaining security controls. This substitution of mechanical/software system with hardware system resolves the contradiction between security and performance.
Solution Approach 2:
The IOMMU enables self-service address translation by autonomously translating IOVAs to SPAs without requiring virtual machine manager intervention for each translation operation. The hardware unit maintains its own translation tables and performs translations independently, freeing the system from cumbersome software-based translation while preserving security through enforced address mapping.
3Reliability
If address translation is implemented for I/O devices, then system security is improved, but device access complexity increases
Solution Approach 1:
The IOMMU serves as a specialized intermediary that handles address translation complexity internally through dedicated hardware structures (translation tables, address comparators, and mapping logic). This mediator absorbs the complexity of multi-stage address translation, presenting a simple IOVA interface to I/O devices while managing the complex translation to SPAs behind the scenes, thus improving security without increasing visible device complexity.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An IOMMU for controlling requests by an I/O device to a system memory of a computer system includes control logic and a cache memory. The control logic may translate an address received in a request from the I/O device. If the request includes a transaction layer protocol (TLP) packet with a process address space identifier (PASID) prefix, the control logic may perform a two-level guest translation. Accordingly, the control logic may access a set of guest page tables to translate the address received in the request. A pointer in a last guest page table points to a first table in a set of nested page tables. The control logic may use the pointer in a last guest page table to access the set of nested page tables to obtain a system physical address (SPA) that corresponds to a physical page in the system memory. The cache memory stores completed translations.