The developers of the XCP-NG project announced Recently, they are working on a new project which has the name «PV-IOMMU» and that allows guest systems to access limited functions of the IOMMU implemented through paravirtualization in the Xen environment.
Basically, PV-IOMMU promises to enable Dom0 to use a paravirtualized IOMMU, which offers several advantages such as DMA protection for Dom0 and support for Linux VFIO.
What is IOMMU?
IOMMU known by different names depending on the manufacturer (VT-d in Intel, AMD-Vi in AMD, SMMU in ARM, among others), It is a special device implemented whose main function is translate or filter DMA requests (Direct Memory Access) from devices to the physical memory of the machine. In virtualization, it is used to allow guest systems to directly access peripheral devices such as Ethernet adapters, graphics cards, and storage controllers.
What benefits are obtained with IOMMU paravirualization?
Previously, the Xen hypervisor used IOMMU to redirect access of PCI devices and control the access of these devices to memory. However, For stability and security reasons, guests could not directly access the IOMMU block provided by the hardware.
We present a new paravirtualized IOMMU simply called PV-IOMMU. It basically implements the features that the guest expects from an IOMMU, abstracting all the internal details of the hardware. In Xen, we added a new hypercall for such operations (which is HYPERVISOR_iommu_op) that provides various IOMMU operations that the guest can use (if allowed).
Despite this, it has been possible to offer an interface to the guest to allow you to access IOMMU, using a simplified Xen paravirtualized infrastructure, while hiding low-level hardware details. This interface, called PV-IOMMU, abstracts all the internal details of the hardware and provides a set of IOMMU operations that the guest can access, if allowed. The operations in PV-IOMMU are exposed as sub-operations in the HYPERVISOR_iommu_op hypercall, and are designed in a way that is convenient for the guest.
One of the main features that the host expects from an IOMMU is the ability to create and modify "IOMMU Domains" which is a set of translations that make memory context and that can be applied to a device (or multiple devices). These domains are called “IOMMU Contexts” in Xen to avoid confusion with Xen domains which are virtual machines.
Among the different benefits that stand out from IOMMU paravirtualization, the following are mentioned:
- DMA protection for Dom0: IOMMU paravirtualization enables direct memory access (DMA) protection for the management domain (Dom0) in virtualization environments. This helps improve system security and stability by preventing devices from directly accessing system memory, which could compromise the integrity of Dom0.
- Linux VFIO support: IOMMU paravirtualization facilitates support for virtualized flexible I/O infrastructure for user devices (VFIO) in virtualization environments, allowing user applications and virtual machines to directly access hardware devices.
- Makes it easy to implement SPDK with Xen: IOMMU paravirtualization is also part of an ongoing effort to support SPDK with Xen. This opens the door to a new fast data path for virtual machine storage, which can potentially boost storage performance in virtualized environments.
In addition to that, also one of Xen's problems is planned to be addressed with IOMMU, since currentlyor allows the existence of multiple IOMMU contexts in a single Xen domain. However, a redesign of the Xen IOMMU subsystem is being considered to account for multiple IOMMU contexts and modify existing features to make use of them. Although a functional PoC that implements the first approach has been implemented, with certain limitations and incomplete support, it is mentioned that a complete redesign of the subsystem is being worked on for the future.
Finally, it should be mentioned that In the current phase of development, PV-IOMMU only supports Intel VT-d, but support for AMD-Vi and SMMUv3 is planned to be added soon. If you are interested in learning more about it, you can consult the details in the following link