• KSII Transactions on Internet and Information Systems
    Monthly Online Journal (eISSN: 1976-7277)

IOMMU Para-Virtualization for Efficient and Secure DMA in Virtual Machines

Vol. 10, No.12, December 31, 2016
10.3837/tiis.2016.12.014, Download Paper (Free):

Abstract

IOMMU is a hardware unit that is indispensable for DMA. Besides address translation and remapping, it also provides I/O virtual address space isolation among devices and memory access control on DMA transactions. However, currently commodity virtualization platforms lack of IOMMU virtualization, so that the virtual machines are vulnerable to DMA security threats. Previous works focus only on DMA security problem of directly assigned devices. Moreover, these solutions either introduce significant overhead or require modifications on the guest OS to optimize performance, and none can achieve high I/O efficiency and good compatibility with the guest OS simultaneously, which are both necessary for production environments. However, for simulated virtual devices the DMA security problem also exists, and previous works cannot solve this problem. The reason behind that is IOMMU circuits on the host do not work for this kind of devices as DMA operations of which are simulated by memory copy of CPU. Motivated by the above observations, we propose an IOMMU para-virtualization solution called PVIOMMU, which provides general functionalities especially DMA security guarantees for both directly assigned devices and simulated devices. The prototype of PVIOMMU is implemented in Qemu/KVM based on the virtio framework and can be dynamically loaded into guest kernel as a module, As a result, modifying and rebuilding guest kernel are not required. In addition, the device model of Qemu is revised to implement DMA access control by separating the device simulator from the address space of the guest virtual machine. Experimental evaluations on three kinds of network devices including Intel I210 (1Gbps), simulated E1000 (1Gbps) and IB ConnectX-3 (40Gbps) show that, PVIOMMU introduces little overhead on DMA transactions, and in general the network I/O performance is close to that in the native KVM implementation without IOMMU virtualization.


Statistics

Show / Hide Statistics

Statistics (Cumulative Counts from December 1st, 2015)
Multiple requests among the same browser session are counted as one view.
If you mouse over a chart, the values of data points will be shown.


Cite this article

[IEEE Style]
Hongwei Tang, Qiang Li, Shengzhong Feng, Xiaofang Zhao and Yan Jin, "IOMMU Para-Virtualization for Efficient and Secure DMA in Virtual Machines," KSII Transactions on Internet and Information Systems, vol. 10, no. 12, pp. 5938-5963, 2016. DOI: 10.3837/tiis.2016.12.014

[ACM Style]
Tang, H., Li, Q., Feng, S., Zhao, X., and Jin, Y. 2016. IOMMU Para-Virtualization for Efficient and Secure DMA in Virtual Machines. KSII Transactions on Internet and Information Systems, 10, 12, (2016), 5938-5963. DOI: 10.3837/tiis.2016.12.014