hesela.devIOMMU group
An IOMMU group is the set of devices Linux treats as the minimum DMA-isolation ownership unit for safe userspace device access.
Separate PCIe function addresses need not provide independent isolation. Transactions within an enclosure or across a bridge without suitable Access Control Services may avoid the IOMMU. VFIO therefore bases ownership on the group, not just the requested function [1].
Linux v6.12's VFIO device-cdev interface retains this constraint. Opening /dev/vfio/devices/vfioX is not sufficient for device access: VFIO_DEVICE_BIND_IOMMUFD must succeed. Devices in one group cannot have different iommufd-context owners, or mix that ownership with a native kernel driver [1].
An I/O address space (IOAS) is different from a group. IOMMUFD manages mappings from I/O virtual addresses to userspace-backed memory and can represent the associated hardware page tables. Binding establishes ownership; attaching the device to an IOAS or hardware page table is a further operation in the DMA setup [2].
Device DMA addresses must be distinguished from CPU virtual and CPU physical addresses. IOMMUs and host bridges may translate between them, so an application's contiguous buffer is not evidence of contiguous device-visible addresses [3].
Memory-access isolation does not establish SSD service-time isolation. In MQSim's FAST 2018 paper, section 3.1 measures interference between two separate-queue read flows on four SSDs released in 2016-2017. Section 6.1 instead uses simulation to isolate write-cache, mapping-cache and back-end contention. Neither experiment measures an IOMMU group's security boundary [4].
Relations
- related
- PCIe storage attachment, NVMe submission queue, NVMe Physical Region Page, Storage virtualization
Limitations
- A group describes the platform's DMA ownership boundary, not an SSD latency or throughput guarantee. [1, 4]
Citations
- Linux v6.12 VFIO: Groups, Devices, and IOMMUs; VFIO Device cdev
- Linux v6.12 IOMMUFD: User Visible Objects and Kernel API
- Linux v6.12 Dynamic DMA mapping guide: CPU and DMA addresses
- Tavakkol, Gomez-Luna, Sadrosadati, Ghose and Mutlu: MQSim, FAST 2018, sections 3.1 and 6.1
Sources & caveats
- Source review of pinned Linux v6.12 documentation and the original FAST 2018 paper; not a claim about the newest API revision or a Hesela hardware experiment.