The latest release of BlueRock's NOVA Microhypervisor introduces a key enhancement: DMA remapping support for AMD platforms with IOMMU hardware virtualization. This feature, enabled by default, improves hardware-level isolation across virtual machines, devices, and memory, which is essential for optimal performance in shared execution environments.
Combining the functions of a microkernel and hypervisor, NOVA operates with a minimal trusted computing base and employs a capability-based authorization model. This architecture allows multiple unmodified guest operating systems to run concurrently on hardware that supports virtualization features. Most of the codebase is developed in C++, with only a small portion in assembly, ensuring an efficient code structure.
Enhanced Security Through DMA Remapping
A standout feature of this release is the integration of the AMD IOMMU, which plays a critical role in enforcing security. By preventing hardware devices assigned to one virtual machine from accessing the memory of other workloads, NOVA can enforce granular memory access controls. It also has the capability to abort unauthorized memory transactions and record any DMA remapping faults for further diagnostics.
Harold Byun, CEO of BlueRock, highlighted the importance of these protections: “While many security bugs are exploited from the CPU, there is an equally large attack surface on the chipset side that can be exploited from a faulty device driver.” Without stable IOMMU protections, vulnerable device drivers could pose significant risks to system integrity and confidentiality.
Scalability and Performance for AI Workloads
NOVA is built to support demanding AI workloads, allowing virtual machines to utilize up to 256TB of physical memory and an impressive 128 petabytes of virtual address space per workload. Byun noted the challenges of maintaining such large address spaces, which require advanced data structures like deep 5-level radix trees for page tables. Importantly, NOVA manages these page tables in a completely lockless manner, enabling scalable concurrent updates without the overhead of locking mechanisms.
To ensure execution predictability across AI workloads, NOVA implements Protection Domains that isolate specific core sets, allowing for customizable resource allocations. This feature, along with the ability to partition CPU caches for different quality of service classes, further optimizes performance.
Advanced Features for x86 Platforms
On x86 platforms, NOVA can be enhanced with optional Control-Flow Enforcement Technology features, including Indirect Branch Tracking and Supervisor Shadow Stacks. However, the default build excludes these protections due to the additional overhead on CPU requirements and runtime performance. On TXT-enabled platforms, NOVA can perform a measured launch to establish a Dynamic Root of Trust for Measurement, provided a matching SINIT Authenticated Code Module is present in the TXT memory.
The advancements in NOVA Microhypervisor reflect a growing demand for secure and efficient infrastructure in the AI sector, where workload requirements are on the rise. With its strong isolation capabilities and scalability, NOVA is positioned as a key component for developing safe, high-performance AI applications.
As AI workloads continue to evolve, the impact of this enhanced infrastructure will grow, making NOVA an indispensable tool for developers navigating the complexities of shared computing environments.
The stories that move AI & crypto markets — before the market reacts.
Free. 7am ET. Five stories. 62,400 readers.
