How Does an IOMMU Translate DMA and Isolate Devices?

An Input-Output Memory Management Unit (IOMMU) is a hardware component that sits between peripheral devices and main system memory, translating device-visible addresses into physical memory addresses. By intercepting Direct Memory Access (DMA) requests, it ensures that each peripheral can only read from and write to the specific memory regions explicitly assigned to it by the operating system. This hardware-enforced boundary prevents buggy, misconfigured, or malicious devices from corrupting kernel data structures or accessing memory belonging to other processes and virtual machines.

Why Direct Memory Access Needs Protection

In classical computing architectures, high-speed peripherals such as network cards, storage controllers, and GPUs use Direct Memory Access (DMA) to transfer data directly to and from main memory without involving the CPU for every byte. Without an IOMMU, a device issues DMA requests using raw physical memory addresses.

This flat physical addressing model creates two major problems:

  • Lack of isolation: A peripheral with a firmware bug, a driver error, or a hardware fault can accidentally overwrite arbitrary physical memory, crashing the operating system or corrupting user data.
  • Contiguous memory requirements: Many devices expect a single contiguous buffer in their address space, even when the operating system has allocated fragmented physical pages.

An IOMMU solves both issues by introducing a layer of indirection, much like a CPU's Memory Management Unit (MMU) does for user-space processes.

How DMA Address Translation Works

When a device initiates a DMA read or write, it supplies an I/O Virtual Address (IOVA) rather than a physical address. The IOMMU intercepts this memory transaction on the system bus and translates the IOVA into a Host Physical Address (HPA) before forwarding the request to the memory controller.

The translation process relies on a hierarchy of page tables managed by the operating system:

  1. Device Identification: The IOMMU identifies which peripheral issued the request using a hardware-assigned identifier, such as a PCIe Requester ID (Bus, Device, and Function number).
  2. Domain Lookup: Using the Requester ID, the IOMMU looks up a device context entry that points to the root of the I/O page table assigned to that device's protection domain.
  3. Page Table Walk: The IOMMU walks the multi-level page table using the IOVA, similar to how a CPU MMU translates a virtual address.
  4. Permission Check: Each page table entry contains read and write permission bits. If the transaction violates these permissions, the IOMMU blocks it.

For a standard 4 KiB page size (\(2^{12}\) bytes), an IOVA can be split into a page number and a byte offset:

\[\text{HPA} = (\text{Translated Frame Number} \times 4096) + (\text{IOVA} \bmod 4096)\]

To avoid the latency of walking page tables in main memory on every DMA request, the IOMMU caches recent translations in an Input-Output Translation Lookaside Buffer (IOTLB).

Isolating Faulty Peripherals

Isolation is achieved by assigning each device (or group of devices that cannot be separated at the bus level) to its own protection domain with dedicated I/O page tables.

  • Strict Boundary Enforcement: If a peripheral attempts to access an IOVA that is not mapped in its page tables, or attempts a write to a read-only mapping, the IOMMU aborts the transaction before it reaches system RAM.
  • Fault Reporting: When an illegal DMA request is blocked, the IOMMU records the offending Requester ID, the target IOVA, and the access type in a fault log, then raises an interrupt to notify the operating system. The OS can then reset or disable the faulty device without suffering memory corruption.
  • DMA Remapping for Virtualization: In virtualized environments, the hypervisor maps Guest Physical Addresses (GPAs) to Host Physical Addresses (HPAs) in the IOMMU. This allows a guest virtual machine to have direct control over a physical device (device passthrough) while ensuring the device cannot escape the guest's allocated memory.

Interrupt Remapping

Beyond memory reads and writes, peripherals also signal the CPU using Message Signaled Interrupts (MSI), which are implemented as special DMA writes to a dedicated interrupt address range. A faulty or malicious device could forge these writes to trigger arbitrary interrupts. Modern IOMMUs include an interrupt remapping table that validates the Requester ID against allowed interrupt vectors, blocking unauthorized interrupt injections.