Four addresses, who supplies each, who translates it
The path a request takes depends on how the device is set up. The table names the usual supplier, and the paths below it say what changes.
| Address | Supplied by | Translated by, into |
|---|---|---|
| CPU virtual (a guest process's is a GVA) | The program | The CPU's MMU, through page tables, into a physical address (in a VM, a guest physical address) |
| Guest physical (GPA) | The guest OS, after its own translation | The host's nested page table, into a system physical address |
| IOVA (a device address) | The driver, through the Linux DMA API, which hands it the address to program; the device puts it on the bus | The IOMMU, through the device's table entry and page tables, into a system physical address |
| System physical (SPA) | The final translation | Nothing: it is the system physical target. In this guide's examples it is RAM; peer-to-peer DMA can target another device's memory instead |
- Host DMA: device IOVA → SPA, one IOMMU stage.
- Direct passthrough to a guest: the guest programs a guest physical address, so the device's input is a GPA → SPA.
- Guest IOVA (a virtual IOMMU, or nested translation): guest IOVA → GPA → SPA. See Virtual IOMMU.
These are alternatives, not four steps every request takes, and the CPU's page walk is a separate walk from the IOMMU's.
One worked example, from Start: 16 bytes: the card writes to device address 0x800ABC (IOVA) and the IOMMU sends it to 0x12000ABC (SPA). The page offset 0xABC is kept; only the page number changes. Other pages link here rather than redefine these four.
- ACS Access Control Services
- PCIe controls on how requests are routed between devices; not device attestation. Used in: Request identity, IOMMU groups & ACS.
- AMD-SP, ASP, PSP AMD Secure Processor (Platform Security Processor)
- The security processor and firmware that run SNP_INIT, launch and attest confidential VMs, and bind trusted devices. Used in: Confidential VMs, Trusted I/O, Attestation.
- ARK, ASK
- AMD's root key and the intermediate signing key above a VCEK, in the chain a verifier checks. Used in: Attestation.
- ASID Address Space Identifier
- Two meanings. AMD SEV: the number that names a guest and selects its memory-encryption key (not the key itself). Arm: the tag on stage-1 (process) translations; VMID tags stage 2. Used in: Confidential VMs, Trusted I/O, IOMMU foundations, Arm SMMUv3 notes, Shared page tables.
- ASID fence
- A block on a guest's trusted I/O after a fault. 48882 §2.5.9.1 logs requests from a fenced guest and refers to SEV-TIO 58271 for the details; the recovery shown here follows the author's study notes. Used in: Trusted I/O.
- ATC Address Translation Cache
- A device's own cache of translations it got through ATS. AMD calls it a remote IOTLB. Used in: IOTLB & cache state, Virtual IOMMU, Secure DMA.
- ATS Address Translation Services
- PCIe: a device asks the IOMMU for a translation, keeps it, and later sends already translated requests. Used in: IOTLB & cache state, Secure DMA.
- Attestation report
- Evidence the AMD-SP signs about a guest: launch measurement, policy, TCB versions and 64 bytes of REPORT_DATA. Used in: Attestation.
- Bounce buffer
- A buffer the device can reach; software copies data between it and the real buffer. Linux calls the mechanism SWIOTLB. Used in: Linux DMA buffers, Buffer workbook, Secure DMA.
- C-bit
- A bit in the guest's own page table: 1 for a private (encrypted) access, 0 for a shared one. Used in: Confidential VMs.
- CCA, RME, Realm, RMM Arm Confidential Compute Architecture
- Arm's confidential VMs (realms), managed by the Realm Management Monitor. Used in: Confidential VMs, What SNP does not cover.
- COMPLETION_WAIT
- An IOMMU command that stores a value, or interrupts, when every earlier command has finished. Used in: Command & event buffers, Virtual IOMMU, Secure DMA.
- DC, DDT Device context; Device Directory Table
- RISC-V IOMMU: the directory, one to three levels deep and indexed by device_id, whose leaf is a 32- or 64-byte device context holding the page-table roots and controls for one device. Used in: RISC-V IOMMU.
- DMA Direct Memory Access
- A device reading or writing memory itself, not through the CPU. Used in: Start: 16 bytes, IOMMU foundations, Linux DMA buffers.
- DMA API
- Linux's interface for drivers: map a buffer, sync it, unmap it; it hides bounce buffers and the IOMMU. Used in: Linux DMA buffers, Buffer workbook.
- DMA alias
- A requester ID a device's requests can carry besides its own, such as the one a PCIe-to-PCI bridge puts on requests it forwards. The IOMMU cannot tell such devices apart, so Linux puts them in one group. Used in: IOMMU groups & ACS.
- DomainID
- The number the IOMMU tags cached translations with. Devices with different tables must use different DomainIDs; devices sharing tables may share one (not with GIoV=1). Used in: IOTLB & cache state, Virtual IOMMU.
- DTE Device Table Entry
- The 256-bit entry that says how the IOMMU treats one device: tables, permissions, interrupts, ATS. Used in: IOMMU foundations, Translation lab, Secure DMA.
- Event log
- The ring where the IOMMU writes 16-byte fault and error records for software to read, when that event is enabled and the log has room. Used in: Command & event buffers, Faults & recovery, Raw-records workbench.
- Exclusion range
- An address range the IOMMU does not translate; gone once SNP is on. Used in: Secure DMA.
- GA log, guest virtual APIC
- AMD interrupt virtualization: the IOMMU marks a device interrupt pending in the guest's virtual APIC page and, if the guest is not running and the entry's GALogIntr is set and the GA log is enabled and has room, writes an 8-byte GA log entry for the hypervisor. Used in: Command & event buffers, Interrupts & GA log, AMD reference.
- GCR3
- The guest's table of page-table roots, indexed by PASID. Used in: Translation lab, Shared page tables.
- GHCB Guest-Hypervisor Communication Block
- A page a guest shares to pass chosen values to the host. Used in: Confidential VMs.
- GPA, GVA, SPA Guest physical, guest virtual, system physical address
- The VM's idea of RAM, a guest process's address, and a system physical address (RAM in the usual case, a peer device's memory on a peer-to-peer path). AMD also calls the input to host-only translation a GPA; Linux calls it an IOVA. Used in: Translation lab, Virtual IOMMU, Confidential VMs.
- IDE Integrity and Data Encryption
- Protection of PCIe traffic on the link; says nothing about which page a request may use. Used in: Trusted I/O.
- IMSIC, MRIF Incoming MSI controller; memory-resident interrupt file
- RISC-V AIA: the interrupt-controller block that receives MSIs as writes to a per-hart page, and the 512-byte copy of its pending and enable bits that a RISC-V IOMMU can keep in memory instead, sending a notice MSI after each update. Used in: RISC-V IOMMU.
- IO_PAGE_FAULT, ILLEGAL_DEV_TABLE_ENTRY
- IOMMU event records: a request failed translation, permission or interrupt-remapping checks, or its DeviceID is beyond the table; a device table entry the IOMMU must not use. Used in: Faults & recovery, Secure DMA.
- IOATC IOMMU address-translation cache
- RISC-V IOMMU: the IOMMU's own cache of translations. It may not see a table edit until software runs an IOTINVAL command, and only a completed IOFENCE.C shows the command is done. Used in: RISC-V IOMMU.
- IOMMU I/O Memory Management Unit
- Translates and checks the addresses devices use when their traffic is routed through it (not bypassed), and remaps their interrupts. Used in: Start: 16 bytes, IOMMU foundations.
- IOMMU group
- A set of devices Linux treats as one ownership unit; VFIO hands over whole groups. Devices that share a requester ID, or sit behind a bridge without ACS on their path, are normally grouped together. Group numbers alone do not prove isolation: a switch without ACS can pass a peer write past the IOMMU even when Linux shows separate groups. Used in: IOMMU groups & ACS, Virtual IOMMU.
- IOTLB, IOMMU TLB
- The IOMMU's cache of translations. An entry can stay until software invalidates it, but hardware may also evict it. Linux and Intel call it the IOTLB; AMD 48882 calls it the IOMMU TLB and uses "IOTLB" for the device's cache (the ATC). Used in: IOTLB & cache state, Virtual IOMMU.
- IOVA I/O virtual address
- The address a device puts on the bus; the IOMMU translates it. Used in: IOMMU foundations, Linux DMA buffers.
- IPA Intermediate Physical Address
- Arm's guest-physical address: stage 1's output, stage 2's input. Used in: Arm SMMUv3 notes, Request identity.
- IRTE Interrupt Remapping Table Entry
- Says where a device's interrupt (an MSI write) goes. Used in: Interrupts & GA log, Virtual IOMMU.
- IVRS, IVHD, IVMD I/O Virtualization Reporting Structure, Hardware Definition, Memory Definition
- AMD's ACPI table where firmware lists each IOMMU and the devices it serves (IVHD) and what memory the devices need (IVMD), which can include a range that must map to itself (a unity map; this chapter uses that case). Intel's equivalent is DMAR. Used in: Passthrough & isolation.
- KDS Key Distribution Service
- AMD's service that hands out VCEK certificates; also expanded "Key Distribution System" and "Key Derivation Service". Used in: Attestation.
- Measurement
- A hash of what a confidential VM was launched with. Used in: Attestation.
- MMIO Memory-mapped I/O
- Registers read and written at physical addresses, not RAM. Used in: Raw-records workbench, Trusted I/O.
- MSI Message Signaled Interrupt
- An interrupt a device raises by writing to a special address. Used in: Interrupts & GA log.
- Nested table, stage 2
- The host's table that maps a guest's GPAs to SPAs. The CPU walks its nested page table; the IOMMU walks the stage-2 table named in the device's DTE; they are separate tables unless the host shares them. Used in: Virtual IOMMU, Confidential VMs.
- #NPF, #PF, #VC
- #PF is the x86 page-fault exception and can occur in host or guest execution; #NPF is AMD's nested page fault; #VC is the guest's VMM Communication exception. Used in: Confidential VMs.
- PASID Process Address Space ID
- A tag on a request that picks which process address space to use; a label, not a permission. Used in: Translation lab, Shared page tables, Secure DMA.
- PC, PDT Process context; Process Directory Table
- RISC-V IOMMU: the directory indexed by process_id (the PASID) whose 16-byte leaf, the process context, holds one process's first-stage root and PSCID. Used in: RISC-V IOMMU.
- Posted, non-posted
- A PCIe Memory Write is posted: no reply comes back. A read is non-posted: data returns in Completion packets, and so do Configuration and I/O writes. Used in: Before DMA: PCIe setup, Secure DMA.
- PPR, PRI Peripheral Page Request, Page Request Interface
- A device asking for a page to be made present; the request, not the transfer. Used in: Command & event buffers, Trusted I/O.
- PSCID, GSCID Process and guest soft-context IDs
- RISC-V IOMMU: software-assigned tags, 20 and 16 bits, that scope cached translations to a first-stage or a guest address space. They come from the configuration, not from the request, and are not PASIDs. Used in: RISC-V IOMMU.
- PTE, PDE Page Table Entry, Page Directory Entry
- Page-table entries describe another table or a mapped page, according to their level and format. An x86 PDE can point to a table or map a large page. Used in: Translation lab, Faults & recovery.
- PVALIDATE
- The instruction a guest (at VMPL0) uses to accept a page the host assigned. Used in: Confidential VMs.
- REPORT_DATA
- 64 bytes a guest puts in its attestation report, typically a hash of the verifier's challenge and the public key of a key pair the guest made. Used in: Attestation.
- RMP Reverse Map Table
- One entry per 4 KiB page of RAM: owner, GPA, validated, VMPL permissions. Checked after the CPU's and the IOMMU's translations. Used in: Confidential VMs, Secure DMA.
- RMP_PAGE_FAULT
- The IOMMU event record for a device access that failed the RMP check. Used in: Secure DMA.
- RMPUPDATE, RMPADJUST
- Instructions: the host assigns or reclaims a page; a guest VMPL passes permissions to a less privileged one. Used in: Confidential VMs.
- SDTE Secure Device Table Entry
- The part of a trusted device's entry the AMD-SP owns, including the VMPL its accesses use. Used in: Trusted I/O.
- Secure ATS (sATS)
- ATS that hands the device GPAs and translates every translated request again. Used in: Secure DMA.
- SEV-TIO Trusted I/O
- Letting a confidential VM trust one device interface with its private memory. Used in: Trusted I/O.
- SEV, SEV-ES, SEV-SNP Secure Encrypted Virtualization (with Encrypted State, with Secure Nested Paging)
- AMD's confidential VMs: encrypted memory, then protected registers, then integrity through the RMP. Used in: Confidential VMs.
- SME, TSME Secure Memory Encryption (Transparent)
- Memory encrypted with a host key; no protection from the host's own software. Used in: Confidential VMs.
- SMMU, SMMUv3 System Memory Management Unit
- Arm's IOMMU architecture. Used in: Arm SMMUv3 notes, Raw-records workbench, Request identity.
- SNP_INIT
- The command that turns SNP on; afterwards the IOMMU is "SNP-enabled" and parts of it are locked. Used in: Secure DMA.
- SnpPageMode0Sup
- An IOMMU feature bit: whether a device with no host table (Mode=0), or ATS without Secure ATS, is allowed once SNP is on. Used in: Secure DMA.
- SPDM Security Protocol and Data Model
- How a device proves its identity and reports its firmware measurements (DMTF DSP0274; the link encryption and device-assignment parts are PCI-SIG IDE and TDISP, a separate source). Used in: Trusted I/O.
- STE, CD Stream Table Entry, Context Descriptor
- Arm's per-device entry (like the DTE) and per-process entry holding stage-1 table roots and the ASID. Used in: Arm SMMUv3 notes, Request identity, Raw-records workbench.
- StreamID, SubstreamID
- Arm's device identity and process tag; on PCIe usually the Requester ID and the PASID. Used in: Arm SMMUv3 notes, Request identity, Raw-records workbench.
- SVSM Secure VM Service Module
- A guest component at VMPL0 that performs privileged operations for a kernel running below it. Used in: Confidential VMs.
- SWIOTLB
- Linux's bounce-buffer pool. In a confidential VM it is shared with the host. Used in: Linux DMA buffers, Buffer workbook.
- T2GPA Translate to guest-physical address
- RISC-V IOMMU option: an ATS answer returns the guest-physical address instead of the final system-physical one, so the second stage still checks every translated request. Used in: RISC-V IOMMU.
- Target abort, CA Completer Abort
- The IOMMU refuses a request and nothing is read or written. A read or other non-posted request gets an error completion (Completer Abort, CA, on PCIe); a posted write gets no reply, and an event record is written only when event logging is enabled and the fault is one the IOMMU reports. Used in: Faults & recovery, Secure DMA.
- TCB Trusted Computing Base
- What a security claim depends on; in a report, its version numbers per component. Used in: Attestation.
- TDI TEE Device Interface
- The part of a device that can be given to one confidential VM. Used in: Trusted I/O.
- TDISP TEE Device Interface Security Protocol
- PCIe's states for a TDI: CONFIG_UNLOCKED, CONFIG_LOCKED, RUN, ERROR. Used in: Trusted I/O.
- TDX, TD Intel Trust Domain Extensions
- Intel's confidential VMs (trust domains), managed by the TDX module. Used in: Confidential VMs, What SNP does not cover.
- TEE Trusted Execution Environment
- The code and hardware a confidential workload trusts; for SEV-TIO, the confidential VM. Used in: Trusted I/O.
- TLP Transaction Layer Packet
- One PCIe request or completion: a header (type, address, Requester ID, optional PASID prefix) and data. Used in: Before DMA: PCIe setup, Request identity.
- Unity map
- A range where the device address equals the physical address, which firmware can require (an AMD IVMD, an Intel RMRR); it usually blocks handing the device to VFIO. Used in: Passthrough & isolation.
- VCEK, VLEK Versioned Chip Endorsement Key; Versioned Loaded Endorsement Key
- Keys that sign attestation reports; they encrypt nothing. Used in: Attestation.
- Verifier, relying party
- Whoever checks an attestation report against its own policy and decides whether to release a secret. Used in: Attestation, What SNP does not cover.
- VFIO Virtual Function I/O
- The Linux framework that gives devices to user space or a VM, one IOMMU group at a time, with the IOMMU confining their DMA to the memory they are given. Used in: IOMMU groups & ACS, Virtual IOMMU.
- vIOMMU Virtual IOMMU
- The IOMMU a VM sees: emulated by the host, or AMD's hardware-assisted one. Used in: Virtual IOMMU.
- VMPCK VM Platform Communication Key
- Protects messages between a guest and the AMD-SP firmware, such as report requests. Used in: Attestation.
- VMPL Virtual Machine Privilege Level
- Privilege levels inside one SNP guest, 0 (most) to 3; not the CPU's rings. Used in: Confidential VMs, Trusted I/O.
- VMSA Virtual Machine Save Area
- A guest's saved registers, protected under SEV-ES. Used in: Confidential VMs.
- VT-d, DMAR Intel Virtualization Technology for Directed I/O; DMA Remapping
- Intel's IOMMU architecture. DMAR is its ACPI table and the prefix of its Linux kernel messages. Used in: Shared page tables, Virtual IOMMU, What SNP does not cover.
AMD, Arm and Intel names for the same idea
The guide teaches with AMD's IOMMU. Arm SMMUv3 and Intel VT-d have the same parts under other names; VT-d is the IOMMU in Intel machines, and Linux logs it as DMAR. Port the idea, not the encoding: entry formats, field positions and opcodes all differ. AMD names link to the chapter that explains them, Arm names to the Arm notes; Intel names give the section of VT-d 5.0.
| Idea | AMD IOMMU (48882) | Arm SMMUv3 (IHI 0070) | Intel VT-d (5.0) |
|---|---|---|---|
| Firmware table | IVRS: one IVHD per IOMMU | IORT: an SMMUv3 node, and ID mappings from Requester ID to StreamID (or a devicetree) | DMAR: one DRHD per remapping unit (§8.3); ATSR lists root ports that support ATS (§8.5), SATC the SoC-integrated devices with an ATC (§8.8) |
| Reserved memory | IVMD in the IVRS | RMR node in the IORT | RMRR (§8.4) |
| Requester identity | DeviceID, plus PASID | StreamID, plus SubstreamID | source-id (§3.4.1), plus PASID; on PCIe each comes from the Requester ID |
| Feature registers | Extended Feature Register (EFR) | SMMU_IDR0 and the other ID registers | Capability and Extended Capability registers (§11.4.2, §11.4.3) |
| Device entry | DTE in the device table | STE in the stream table | Context entry under a root entry (§9.1, §9.3); in scalable mode, a scalable-mode context entry (§9.4) |
| PASID entries | GCR3 table | CD table (Context Descriptors), found through the STE | Scalable mode: PASID directory, then PASID-table entry (§9.5, §9.6). Every request uses one, and it holds the page-table pointers and domain-id, part of a DTE's job |
| Translation stages | Host translation (Linux: v1 table) and guest translation (v2 table) | Stage 2 and stage 1 | Second-stage and first-stage (§3.6 to §3.8); legacy mode has second-stage only |
| Cache tag | DomainID | VMID (stage 2) and ASID (stage 1) | Domain-ID (DID), with PASID for first-stage entries (§6.2.1) |
| Device's cache (ATC) | IOTLB (48882's name; PCIe calls it the ATC) | ATC | Device-TLB (chapter 4) |
| Command channel | Command buffer | Command queue (CMDQ) | Invalidation queue of descriptors (§6.5.2); older register-based invalidation too (§6.5.1) |
| Invalidate a device entry | INVALIDATE_DEVTAB_ENTRY | CMD_CFGI_STE | Context-cache invalidate (§6.5.2.1) |
| Invalidate a PASID entry | INVALIDATE_IOMMU_PAGES with GN=1 for that PASID | CMD_CFGI_CD | PASID-cache invalidate (§6.5.2.2) |
| Invalidate mappings | INVALIDATE_IOMMU_PAGES | CMD_TLBI_*: NH_ for stage 1, S2_IPA and S12_VMALL for stage 2 | IOTLB invalidate (§6.5.2.3); PASID-based IOTLB invalidate, P_IOTLB (§6.5.2.4) |
| Invalidate the device's cache | INVALIDATE_IOTLB_PAGES | CMD_ATC_INV | Device-TLB and PASID-based device-TLB invalidate (§6.5.2.5, §6.5.2.6) |
| Invalidate interrupt entries | INVALIDATE_INTERRUPT_TABLE | — (the SMMU does not remap interrupts) | Interrupt entry cache invalidate (§6.5.2.8) |
| Wait for completion | COMPLETION_WAIT | CMD_SYNC | Invalidation wait descriptor (§6.5.2.9) |
| Fault reports | Event log (a ring in memory) | Event queue (EVTQ) | Fault recording registers (§7.2, §11.4.7.6), not a ring in memory |
| Page requests (PRI) | PPR log; answer with COMPLETE_PPR_REQUEST | PRI queue (PRIQ); answer with CMD_PRI_RESP. A stalled transaction is answered with CMD_RESUME | Page request queue (§7.4.1); answer with a page group response descriptor (§7.6.1) |
| Interrupt remapping | IRTE, in a table the DTE names | — The SMMU treats an MSI as an ordinary write; the GIC's ITS turns DeviceID and EventID into an interrupt (notes) | IRTE in the interrupt remapping table (§5.1.3, §9.9) |
| Guest interrupts | Guest virtual APIC, and, when the vCPU is not running, a GA log entry if the IRTE's GALogIntr is set and the GA log is enabled and has room | — in the SMMU; the GIC does it (GICv4 direct injection of vLPIs) | Interrupt posting: a posted-interrupt IRTE points to a posted interrupt descriptor (§5.2, §9.10, §9.11) |
| Hardware A/D bits | HAD in the DTE for host tables (features HASup, HDSup) | HTTU (SMMU_IDR0.HTTU; CD.HA and CD.HD for stage 1) | First stage as on the CPU (§3.6.2); second stage if ECAP_REG.SSADS, turned on per PASID-table entry by SSADE (§3.7.2) |
| Linux log prefix | AMD-Vi: | arm-smmu-v3 and the SMMU's device name | DMAR:, and DMAR-IR: for interrupt remapping |
| Linux boot options | amd_iommu= (off, pgtbl_v1, pgtbl_v2 …), amd_iommu_intr= | No SMMUv3 switch; the driver has one module parameter, disable_msipolling | intel_iommu= (on, off, sm_on, sm_off …) |
| Boot options for all | iommu.passthrough=1 lets DMA bypass translation by default; iommu.strict=1 invalidates on every unmap, 0 defers it (lazy) | ||
| Guest IOMMU | Emulated (QEMU amd-iommu), or nested through iommufd; AMD's hardware vIOMMU (48882 §2.10) | Emulated, or the vSMMU: iommufd's VIOMMU object, with the guest's CD table nested on stage 2 | QEMU intel-iommu: an assigned device needs caching-mode=on (CM=1, §6.1), so the guest invalidates every change and QEMU can keep the host's mappings in step; or nested through iommufd |
Sources for the names
- Intel VT-d specification, D51397-017 revision 5.0, August 2024: the sections in the table.
- AMD 48882 rev 3.11 and Arm IHI 0070 H.a, as in the chapters.
- Linux at 80a4e3ad: command, field and feature names in amd_iommu_types.h, arm-smmu-v3.h and intel/iommu.h; DMAR, IVRS and IORT structures in actbl1.h and actbl2.h; log prefixes in the drivers; nesting in iommufd.h; boot options in kernel-parameters.txt; GICv4 vLPIs in irq-gic-v4.c.
- QEMU hw/i386/intel_iommu.c (development version): device assignment is refused without
caching-mode=on.