Intel IOMMU DMAR技术详解：虚拟化与 Directed I/O 架构规格

需积分: 32 47 浏览量更新于2024-07-21 收藏 1.57MB PDF 举报

Intel IOMMU (Input/Output Memory Management Unit) 和 DMAR (Device Model Access Routing) 是Intel处理器虚拟化技术中的关键组成部分，旨在增强系统的安全性、稳定性和性能。这些技术在虚拟化环境中发挥着至关重要的作用，尤其是在处理高吞吐量、低延迟的I/O操作时。 Intel Virtualization Technology for Directed I/O Architecture (VT-d) 是一种高级I/O虚拟化技术，它允许虚拟机（VMs）访问物理硬件资源，如网络接口卡、存储控制器等，而无需通过主机操作系统进行间接访问。这种直接I/O访问能力对于提高虚拟机性能和效率至关重要，尤其是在处理对延迟敏感的应用，如云计算、数据库和大数据分析中。 DMAR (Device Model Access Routing) 是一个管理框架，用于在硬件和虚拟化层之间建立映射关系，确保设备驱动程序能够正确地路由I/O请求到正确的虚拟或物理设备。它有助于消除虚拟机间的I/O争抢，提高了系统的整体一致性。DMAR规范定义了如何将物理设备的地址范围分配给不同的虚拟机，并管理设备模型在不同层级（IOMMU、BIOS和操作系统）之间的通信。在使用这些技术时，需要注意以下几点： 1. **许可和责任声明**：Intel提供的文档（如D51397-007 Rev.2.3）并不是为了授予任何知识产权许可，而是为了提供与Intel产品相关的信息。用户在购买和使用Intel产品时应接受其销售条款，包括可能存在的有限保修，但不包括针对特定用途的适配性、商业可用性或侵犯专利、版权等第三方权利的保证。 2. **使命关键应用**：对于可能导致人身伤害或死亡的“使命关键”应用（如医疗设备、航空航天系统等），用户需要特别注意，因为这些应用的失败可能会带来严重后果。在这种情况下，用户需承担法律责任并保护Intel及其子公司免受潜在的损害索赔。 Intel IOMMU和DMAR技术是虚拟化环境中不可或缺的组件，它们通过优化I/O路径和设备管理，显著提升了虚拟化环境的性能和安全性。在实际应用中，了解并正确配置这些技术是确保系统稳定运行和避免潜在问题的关键。

Intel

Virtualization Technology for Directed I/O—Overview

Intel

Virtualization Technology for Directed I/O

Architecture Specification, Rev. 2.3 October 2014

2-1 Order Number: D51397-007

2Overview

This chapter provides a brief overview of Intel

VT, the virtualization software ecosystem it enables,

and hardware support offered for processor and I/O virtualization.

2.1 Intel

Virtualization Technology Overview

Intel

VT consists of technology components that support virtualization of platforms based on Intel

processors, thereby enabling the running of multiple operating systems and applications in

independent partitions. Each partition behaves like a virtual machine (VM) and provides isolation and

protection across partitions. This hardware-based virtualization solution, along with virtualization

software, enables multiple usages such as server consolidation, activity partitioning, workload

isolation, embedded management, legacy software migration, and disaster recovery.

2.2 VMM and Virtual Machines

Intel

VT supports virtual machine architectures comprised of two principal classes of software:

• Virtual-Machine Monitor (VMM): A VMM acts as a host and has full control of the processor(s)

and other platform hardware. VMM presents guest software (see below) with an abstraction of a

virtual processor and allows it to execute directly on a logical processor. A VMM is able to retain

selective control of processor resources, physical memory, interrupt management, and I/O.

• Guest Software: Each virtual machine is a guest software environment that supports a stack

consisting of an operating system (OS) and application software. Each operates independently of

other virtual machines and uses the same interface to processor(s), memory, storage, graphics,

and I/O provided by a physical platform. The software stack acts as if it were running on a

platform with no VMM. Software executing in a virtual machine must operate with reduced

privilege so that the VMM can retain control of platform resources.

The VMM is a key component of the platform infrastructure in virtualization usages. Intel

VT can

improve the reliability and supportability of virtualization infrastructure software with programming

interfaces to virtualize processor hardware. It also provides a foundation for additional virtualization

support for other hardware components in the platform.

2.3 Hardware Support for Processor Virtualization

Hardware support for processor virtualization enables simple, robust and reliable VMM software. VMM

software relies on hardware support on operational details for the handling of events, exceptions, and

resources allocated to virtual machines.

Intel

VT provides hardware support for processor virtualization. For Intel

64 processors, this

support consists of a set of virtual-machine extensions (VMX) that support virtualization of processor

hardware for multiple software environments by using virtual machines.

Intel

Virtualization Technology for Directed I/O

October 2014 Architecture Specification, Rev. 2.3

Order Number: D51397-007 2-2

Overview—Intel

Virtualization Technology for Directed I/O

2.4 I/O Virtualization

A VMM must support virtualization of I/O requests from guest software. I/O virtualization may be

supported by a VMM through any of the following models:

• Emulation: A VMM may expose a virtual device to guest software by emulating an existing

(legacy) I/O device. VMM emulates the functionality of the I/O device in software over whatever

physical devices are available on the physical platform. I/O virtualization through emulation

provides good compatibility (by allowing existing device drivers to run within a guest), but pose

limitations with performance and functionality.

• New Software Interfaces: This model is similar to I/O emulation, but instead of emulating legacy

devices, VMM software exposes a synthetic device interface to guest software. The synthetic

device interface is defined to be virtualization-friendly to enable efficient virtualization compared

to the overhead associated with I/O emulation. This model provides improved performance over

emulation, but has reduced compatibility (due to the need for specialized guest software or

drivers utilizing the new software interfaces).

• Assignment: A VMM may directly assign the physical I/O devices to VMs. In this model, the driver

for an assigned I/O device runs in the VM to which it is assigned and is allowed to interact directly

with the device hardware with minimal or no VMM involvement. Robust I/O assignment requires

additional hardware support to ensure the assigned device accesses are isolated and restricted to

resources owned by the assigned partition. The I/O assignment model may also be used to create

one or more I/O container partitions that support emulation or software interfaces for virtualizing

I/O requests from other guests. The I/O-container-based approach removes the need for running

the physical device drivers as part of VMM privileged software.

• I/O Device Sharing: In this model, which is an extension to the I/O assignment model, an I/O

device supports multiple functional interfaces, each of which may be independently assigned to a

VM. The device hardware itself is capable of accepting multiple I/O requests through any of these

functional interfaces and processing them utilizing the device's hardware resources.

Depending on the usage requirements, a VMM may support any of the above models for I/O

virtualization. For example, I/O emulation may be best suited for virtualizing legacy devices. I/O

assignment may provide the best performance when hosting I/O-intensive workloads in a guest.

Using new software interfaces makes a trade-off between compatibility and performance, and device

I/O sharing provides more virtual devices than the number of physical devices in the platform.

2.5 Intel

Virtualization Technology For Directed I/O

Overview

A general requirement for all of above I/O virtualization models is the ability to isolate and restrict

device accesses to the resources owned by the partition managing the device. Intel

VT for Directed

I/O provides VMM software with the following capabilities:

• I/O device assignment: for flexibly assigning I/O devices to VMs and extending the protection and

isolation properties of VMs for I/O operations.

• DMA remapping: for supporting address translations for Direct Memory Accesses (DMA) from

devices.

• Interrupt remapping: for supporting isolation and routing of interrupts from devices and external

interrupt controllers to appropriate VMs.

• Interrupt posting: for supporting direct delivery of virtual interrupts from devices and external

interrupt controllers to virtual processors.

• Reliability: for recording and reporting of DMA and interrupt errors to system software that may

otherwise corrupt memory or impact VM isolation.

Intel

Virtualization Technology for Directed I/O—Overview

Intel

Virtualization Technology for Directed I/O

Architecture Specification, Rev. 2.3 October 2014

2-3 Order Number: D51397-007

2.5.1 Hardware Support for DMA Remapping

To generalize I/O virtualization and make it applicable to different processor architectures and

operating systems, this document refers to domains as abstract isolated environments in the platform

to which a subset of host physical memory is allocated.

DMA remapping provides hardware support for isolation of device accesses to memory, and enables

each device in the system to be assigned to a specific domain through a distinct set of paging

structures. When the device attempts to access system memory, the DMA-remapping hardware

intercepts the access and utilizes the page tables to determine whether the access can be permitted;

it also determines the actual location to access. Frequently used paging structures can be cached in

hardware. DMA remapping can be configured independently for each device, or collectively across

multiple devices.

2.5.1.1 OS Usages of DMA Remapping

There are several ways in which operating systems can use DMA remapping:

• OS Protection: An OS may define a domain containing its critical code and data structures, and

restrict access to this domain from all I/O devices in the system. This allows the OS to limit

erroneous or unintended corruption of its data and code through incorrect programming of

devices by device drivers, thereby improving OS robustness and reliability.

• Feature Support: An OS may use domains to better manage DMA from legacy devices to high

memory (For example, 32-bit PCI devices accessing memory above 4GB). This is achieved by

programming the I/O page-tables to remap DMA from these devices to high memory. Without

such support, software must resort to data copying through OS “bounce buffers”.

• DMA Isolation: An OS may manage I/O by creating multiple domains and assigning one or more

I/O devices to each domain. Each device-driver explicitly registers its I/O buffers with the OS, and

the OS assigns these I/O buffers to specific domains, using hardware to enforce DMA domain

protection. See Figure 2-2.

• Shared Virtual Memory: For devices supporting appropriate PCI-Express

capabilities, OS may

use the DMA remapping hardware capabilities to share virtual address space of application

processes with I/O devices. Shared virtual memory along with support for I/O page-faults enable

application programs to freely pass arbitrary data-structures to devices such as graphics

processors or accelerators, without the overheads of pinning and marshalling of data.

1. Refer to Process Address Space ID (PASID) capability in PCI-Express

base specification.

Figure 2-2. Example OS Usage of DMA Remapping

Device A

Driver A

I/O Buffers

System Memory

Device B

Driver B

I/O Buffers

Driver B

I/O Buffers

Driver A

I/O Buffers

DMA-Remapping Hardware

System Memory

Device DMA isolated using DMA remapping hardware

Domain 1 Domain 2

I/O Devices

Device DMA without isolation

OS Code &

Data

I/O BuffersI/O Buffers

Intel

Virtualization Technology for Directed I/O

October 2014 Architecture Specification, Rev. 2.3

Order Number: D51397-007 2-4

Overview—Intel

Virtualization Technology for Directed I/O

2.5.1.2 VMM Usages of DMA Remapping

The limitations of software-only methods for I/O virtualization can be improved through direct

assignment of I/O devices to partitions. With this approach, the driver for an assigned I/O device runs

only in the partition to which it is assigned and is allowed to interact directly with the device hardware

with minimal or no VMM involvement. The hardware support for DMA remapping enables this direct

device assignment without device-specific knowledge in the VMM. See Figure 2-3.

In this model, the VMM restricts itself to enabling direct assignment of devices to their partitions.

Rather than invoking the VMM for all I/O requests from a partition, the VMM is invoked only when

guest software accesses protected resources (such as configuration accesses, interrupt management,

etc.) that impact system functionality and isolation.

To support direct assignment of I/O devices, a VMM must enforce isolation of DMA requests. I/O

devices can be assigned to domains, and the remapping hardware can be used to restrict DMA from

an I/O device to the physical memory presently owned by its domain. For domains that may be

relocated in physical memory, the remapping hardware can be programmed to perform the necessary

translation.

I/O device assignment allows other I/O sharing usages — for example, assigning an I/O device to an

I/O partition that provides I/O services to other user partitions. Remapping hardware enables

virtualization software to choose the right combination of device assignment and software-based

methods for I/O virtualization.

2.5.1.3 DMA Remapping Usages by Guests

A guest OS running in a VM may benefit from the availability of remapping hardware to support the

usages described in Section 2.5.1.1. To support such usages, the VMM may virtualize the remapping

hardware to its guests. For example, the VMM may intercept guest accesses to the virtual remapping

hardware registers, and manage a shadow copy of the guest remapping structures that is provided to

the physical remapping hardware. On updates to the guest I/O page tables, the guest software

performs appropriate virtual invalidation operations. The virtual invalidation requests may be

intercepted by the VMM, to update the respective shadow page tables and perform invalidations of

Figure 2-3. Example Virtualization Usage of DMA Remapping

App App

Virtual Machine Monitor (VMM) or Hosting OS

Physical Host Hardware

Virtual Machine (0)

Guest OS

App App

Device A

Driver

Device B

Driver

Virtual Devices Emulation

Driver for

Virtual Devices

Device B

App App

Virtual Machine (n)

Guest OS

App App

Driver for

Virtual Devices

App App

Virtual Machine Monitor (VMM) or Hosting OS

Virtual Machine (0)

Guest OS

App App

Device A Device B

App App

Virtual Machine (n)

Guest OS

App App

Device A

Driver

Device B

Driver

Example Software-based

I/O Virtualization

Direct Assignment of I/O Devices

DMA-Remapping Hardware

剩余271页未读，继续阅读

xgbing

粉丝: 1282
资源: 57

Intel IOMMU DMAR技术详解：虚拟化与 Directed I/O 架构规格

AMD 的iommu 介绍

intel-iommu.rar_intel mmu_intel_iommu_iommu.驱动框架_iommu驱动

intel-iommu.rar_iommu_limit

intel-iommu.rar_intel

IOMMU TUTORIAL

iommu11111111111111111111111111111111

iommu12222222222222222222222222222222

IOMMU Spec.

iommu-zero-day-labs/riscv-iommu

Linux内核中的IOMMU技术详解

最新资源