IOMMU

IOMMU stands for Input-Output Memory Management Unit. It is a hardware component that provides memory management and protection for I/O devices that perform direct memory access (DMA). By translating device-visible addresses used in DMA to physical system memory addresses and enforcing access permissions, the IOMMU isolates devices from each other and from the CPU, preventing unauthorized memory access and improving system security in environments that share hardware resources.

Typically, an IOMMU translates I/O virtual addresses issued by a device into host physical addresses using dedicated page tables. It can enforce permissions such as read or write access and execute protection, trap invalid translations, and report faults to the CPU. Many implementations also support interrupt remapping to securely route device interrupts and prevent a compromised device from interrupting or exploiting the guest or host.

Prominent IOMMU implementations include Intel VT-d, AMD IOMMU (Vi), and ARM's SMMU. In virtualization, IOMMUs enable safe direct device assignment (PCI passthrough) to virtual machines and provide isolation between VMs sharing devices. They also support I/O virtualization features such as SR-IOV, which allows a single device to appear as multiple independent functions.

Beyond virtualization, IOMMUs are used to improve system security and reliability by preventing devices from DMA-ing into memory regions outside their assigned domains, enabling safe device hot-plug, and supporting secure DMA-based I/O in servers, workstations, and embedded systems.