What Is an IOMMU?

What Is an IOMMU? Explainer

An input-output memory management unit, or IOMMU, is hardware that controls how devices access system memory. Graphics cards, network adapters, storage controllers, and other peripherals often use direct memory access, or DMA, so they can read or write RAM without asking the CPU to copy every byte. DMA is essential for performance, but unrestricted DMA would let a device reach almost any physical address. The IOMMU sits in that path and translates the device’s I/O virtual address into an approved physical memory address, much as the CPU’s memory management unit translates a program’s virtual addresses for normal loads and stores.

When a driver prepares a DMA transfer, the operating system allocates a buffer and creates an IOMMU mapping for it. The driver gives the device an I/O virtual address rather than exposing the underlying physical address directly. If the device issues a valid request, the IOMMU consults its page tables, applies access permissions, and forwards the transaction to the correct RAM location. If the device tries to use an address that is not mapped, or attempts a disallowed operation, the IOMMU can block the request and report a fault. After the transfer, the operating system can remove the mapping so the device no longer has access to that buffer.

Translation gives the operating system flexibility as well as protection. A device may need a continuous DMA address range even when the backing physical pages are scattered around RAM. The IOMMU can present those pages as one continuous I/O address space. It can also help older devices that understand only a limited address width reach memory located elsewhere. Like CPU address translation, IOMMU translation is accelerated with caches so hardware does not have to walk page tables for every transaction. Drivers and the operating system must invalidate those caches when mappings change, or a device could keep using a stale translation.

Virtualization is one of the most visible uses. A hypervisor can assign a physical device or a virtual function directly to a guest while giving that device mappings only for the guest’s memory. Requests are translated from addresses meaningful to the guest into host physical addresses, and another guest’s memory remains outside the device’s permitted domain. Technologies such as Intel VT-d, AMD-Vi, and Arm SMMU implement this idea with different architecture details. Features such as process address-space identifiers can further distinguish requests from separate processes that share a capable device.

An IOMMU is not a complete defense by itself. Firmware tables, device grouping, driver correctness, interrupt remapping, and invalidation behavior all matter. Some systems use identity mappings for performance, and devices behind the same bridge may not always be isolated as finely as administrators expect. Translation also adds page-table memory use and can introduce latency or cache pressure, though modern hardware is designed to keep that overhead small. The useful way to think about an IOMMU is as a programmable boundary around DMA: it tells each device which memory it may reach, converts the addresses it presents, and creates the foundation for safer high-performance I/O.