Introduce Hardware-Level Device Isolation to Zephyr
summary
Zephyr gains a new hardware isolation subsystem that wires IOMMU/SMMU into device drivers and device tree entries to constrain DMA. Implementation demonstrates SMMUv3 support on an Arm FVP, maps stream IDs from PCI to SMMU page tables, and enforces DMA regions for a PCI AHCI device. The team builds a proof of concept, exercises allocation and transfer, and shows the controller can only touch allowed buffers so the isolation mechanism works while offering hooks for future low‑power or alternative IOMMU backends.
AI-written summary · about
chapters (4)
related talks
35mZephyr OS Memory Protection
28mConfidential Devices (TEE I/O): A series of modest proposals
41mUserspace in Zephyr: Overview and Practicality- 35mZephyr OS Memory Protection
39miommufd discussion
20mLimitations and Opportunities of Modern Hardware Isolation Mechanisms
41mUserspace in Zephyr: Overview and Practicality
33mZephyr‑Based VIRTIO Backend on Xen: Toward Open Source Functional Safety