Acronym · Safety & Security
IOMMU (Input-Output Memory Management Unit)
A translation and protection unit between DMA-capable devices and system memory that maps device addresses and blocks accesses outside a permitted set, containing malicious or faulty peripherals and enabling safe device passthrough to virtual machines.
- Also known as
- SMMU, VT-d, AMD-Vi, System MMU
- Type
- Acronym
- Domain
- Safety & Security, Security architecture
- Also relevant to
- Embedded Software & Tools
Notes
The standard defence against DMA attacks over Thunderbolt, PCIe or any other bus-mastering interface.
Overview
An IOMMU, or input-output memory management unit, is a hardware unit that sits between devices capable of direct memory access (DMA) and main memory, translating the addresses those devices use and blocking accesses they are not allowed to make. It does for peripherals what a processor's MMU does for programs. Operating systems and hypervisors rely on it to keep a faulty or malicious device from reading or overwriting arbitrary memory, and to hand devices directly to virtual machines.
How it works
When a network card, GPU or storage controller issues a DMA request, the request carries a device identifier and an I/O virtual address. The IOMMU uses the identifier to find that device's context, walks an I/O page table set up by the operating system, and either produces a physical address or rejects the access and reports a fault. Recent translations are cached so that most requests avoid a full table walk.
For virtualisation, the IOMMU can translate in two stages: a first stage, controlled by the guest operating system, maps the device's addresses to guest physical addresses, and a second stage, controlled by the hypervisor, maps those to host physical addresses. Linux exposes this nesting through its IOMMUFD interface. Some IOMMUs also remap interrupts, so a device cannot inject interrupts it does not own. PCIe Address Translation Services let a capable device cache translations itself.
Isolation is only as fine as the hardware topology allows. Linux groups devices that cannot be separated from each other, for example behind a bridge without Access Control Services, and assigns a whole group at once. Translation adds latency and uses memory for page tables, and strict policies cost performance, which is why some systems have shipped with protection relaxed or turned off.
Examples
- Intel VT-d, AMD-Vi and the Arm SMMUv3, IOMMU architectures supported by the Linux kernel and found in x86 and Arm servers.
- A cloud server using Linux VFIO to assign a GPU directly to a virtual machine, with the IOMMU confining its DMA to that guest's memory.
- The Thunderclap research platform, an FPGA posing as a network card, used to show that operating systems often left IOMMU protection weak or switched off.
- An automotive SoC that places camera and accelerator DMA behind an SMMU so a faulty driver cannot corrupt safety-critical memory.
Why it matters
Without an IOMMU, any device with DMA can read encryption keys or inject code, and devices plugged in through external ports make that a practical attack. Cloud providers depend on it to pass accelerators and network cards safely to tenants. SoC and interconnect architects size and place it, hardware security architects rely on it for isolation, and kernel and hypervisor engineers program it.
Related terms
Part of the Safety & Security glossary, with every term in the topic and the lifecycles, tools and standards that use them.
Where it appears on the Hub
Used on 4 pages of the Hub. In each group, the pages that mention it most come first.
Suggest an improvement
Suggest an improvement to this entry
A clearer definition, an example, a correction or a source an editor can check. Editors review every suggestion before the entry changes.
Last reviewed . Written by The Semiconductor Hub editorial team. The full glossary