The SMMU stage 2 translations remove the need for the hypervisor to manage shadow translation tables, which simplifies hypervisor and improves performance. With stage 2 address translation (This Figure), the SMMU enables a guest operating system to directly configure the DMA capable devices in the system.
The SMMU can also be configured to ensure that devices operating on behalf of one guest operating system are prevented from corrupting memory of another guest operating system.
Providing hardware separation between the two stages of address translation allows a clear definition of the ownership of the two different stages between the guest operating system (stage 1) and the hypervisor (stage 2). Translation faults are routed to the appropriate level of software. Management functions (TLB management, MMU enabling, register configurations) are handled at the appropriate stage of the translation process, improving performance by reducing the number of entries in the VM.
Stage 1 translations are supported for both secure and non-secure translation contexts. Stage 2 translations are only supported for non-secure translation contexts. For non-secure operations, the typical usage model for two-stage address translation is as follows.
•The non-secure operating system defines the stage 1 address translations for application and operating system level operations. The operating system does this as though it is defining mapping from VA to PA, but it is actually defining the mapping from VAs to IPA.
•The hypervisor defines the stage 2 address translation that maps the IPA to PA. It does this as part of its virtualization of one or more non-secure guest operating systems.