ASAravind Sivakumaran
Theme

Theme and appearance

Appearance
Palette

Pick any colour. The displayed accent adjusts for readable contrast in light or dark mode.

← All notes

FIELD NOTES / IOMMU · ONE GUIDE, 26 CHAPTERS

Follow one request. Find every guide.

The bright line is the path a DMA request takes, from device to memory. Each star is a guide or lab, placed at the step it explains. The PCIe link the request crosses first has its own guide and map.

Guide map

  1. Start: 16 bytes
    Follow one DMA request. Watch an address become a memory access. Then break the mapping and test what recovery requires. Device · Guided story · 5 steps
  2. IOMMU foundations
    Follow the request. Test the protection. What an IOMMU does, which structures decide the outcome, and how negative tests separate a working protection path from a misleading success. IOMMU · Guided story · ≈ 22 min
  3. Walk boundaries
    Testing an address-translation walk Page tables, permissions and boundaries in a four-level teaching walk. Memory · Guided story · ≈ 3 min
  4. Translation lab
    IOMMU translation & DMA validation. Trace a device request from its address space to memory, or to a fault. Configurable host levels, GCR3 depth and 4 KiB, 2 MiB and 1 GiB leaves. Page walk · Interactive lab · ≈ 13 min
  5. Linux DMA buffers
    Follow the buffer. Explain the fault. Use a Linux-style bounce buffer, then inspect the bytes and fault records produced by the emulated IOMMU. Software · Interactive lab · ≈ 8 min
  6. Command & event buffers
    Who writes the next entry? Ownership, ordering and completion make a buffer useful. Command lab, event log, PRI lifecycle and a GA entry decoder. IOMMU · Interactive lab · ≈ 10 min
  7. Interrupts & GA log
    Follow the interrupt. Inspect the evidence. Inject a fault, watch the relevant buffer and inspect the guest’s pending interrupt in memory. IOMMU · Interactive lab · ≈ 10 min
  8. IOTLB & cache state
    Which state did the request use? Change a mapping, keep a cached copy, then follow the bytes or interrupt. A request can succeed and still reach the wrong destination. IOMMU · Interactive lab · 9 experiments
  9. IOMMU groups & ACS
    Why can't the VM have just this one device? Requester-ID aliases, peer-to-peer writes that turn around in a switch, and ACS. Build the IOMMU groups the way Linux does and see what VFIO needs. PCIe request · Interactive lab · ≈ 9 min
  10. Shared page tables
    One page table. Separate translation paths. Connect CPU CR3 and a device PASID to the same guest tables. Change a mapping and see which consumer still holds the old translation. Page walk · Interactive lab · ≈ 11 min
  11. Virtual IOMMU
    Who decides where the VM's device can write? Send one write through a guest's table and the host's. Remap, revoke and invalidate, and watch which RAM page changes. Page walk · Interactive lab · ≈ 8 min
  12. Passthrough & isolation
    Who may a device reach, and who may take it? IVRS firmware tables, four ways to give a guest a device, VFIO and iommufd, a Thunderbolt DMA attack, default domains, SR-IOV requester IDs and the RISC-V IOMMU, as eight experiments. Software · Interactive lab · ≈ 12 min
  13. Confidential VMs
    Who can touch a confidential VM's memory? Write a secret, then let the host try: SEV-SNP's Reverse Map Table, page validation and privilege levels, with Intel TDX and Arm CCA beside them. Security · Interactive lab · ≈ 7 min
  14. Secure DMA
    Can a device reach private memory? The emulated IOMMU with SEV-SNP on: RMP checks, RMP_PAGE_FAULT bit by bit, register locks, the completion store and Secure ATS. Security · Interactive lab · ≈ 6 min
  15. Buffer workbook
    Follow 16 bytes through a bounce buffer. Linux's own copies, and what the host can read at each step: receive leaks, failed maps, expired checks and half-done transfers. Security · Interactive lab · ≈ 3 min
  16. Trusted I/O
    When may a device use private memory? SEV-TIO step by step: authenticate, bind, accept, start, grant. Device privilege levels, secure MMIO and the ASID fence. Security · Interactive lab · ≈ 5 min
  17. Attestation
    Who should receive the secret? A verifier's checks in order: signature, measurement, policy, TCB, a fresh challenge and the session. Real hashes and AES-GCM. Security · Interactive lab · ≈ 4 min
  18. What SNP does not cover
    What does SNP not cover? Supported, enabled, selected, verified: evidence at every layer, SNP extensions, and what stays the guest's job. Security · Interactive lab · ≈ 4 min
  19. Request identity
    What did the client actually send? Separate client intent from observed DMA, translation faults and interrupt delivery. 112 test recipes across AMD IOMMU, Arm SMMUv3 and PCIe. PCIe request · Interactive lab · ≈ 60 min
  20. Faults & recovery
    Break the assumption. Test the recovery. Presence, permissions, invalid encodings, lost notifications and stopped engines. Failure paths deserve the same care as a successful translation. Page walk · Interactive lab · ≈ 6 min
  21. Raw-records workbench
    From raw bits to a checked path. Decode the evidence. Change the state. Check what the device was actually allowed to do. Memory · Interactive lab · ≈ 6 min
  22. AMD reference
    AMD IOMMU: the engineering reference Alignment, lookup structures, command completion and GA records, connected to the working lab. Reference · ≈ 11 min
  23. Arm SMMUv3 notes
    Arm SMMUv3: what changes Compare device identity, translation, alignment, queues and recovery before reusing an AMD IOMMU model. Reference · ≈ 13 min
  24. RISC-V IOMMU
    Which identity and tables decided where the bytes went? Device and process contexts, a nested walk, a fault with no payload write, cache maintenance, ATS and PRI, and the separate MSI path, on a RISC-V IOMMU. Reference · Interactive lab · 8 experiments
  25. Model limits & C++
    What this mock can demonstrate A small executable model with explicit boundaries, and how to reuse its C++. Reference · ≈ 5 min
  26. Glossary
    Key terms in the guide Plain meanings, full names, and the chapters that use each term. Reference · ≈ 10 min

Constellations

Four ways through the guides, each drawn as the shape it makes on the map. Follow one, or draw your own.

The guide, in order

Read it as one book: six parts, each chapter a star above. Every page shows its chapter number and links to the chapters before and after it.

  1. Part 1: Foundations

    1. Start: 16 bytes 5 steps
    2. IOMMU foundations ≈ 22 min
    3. Walk boundaries ≈ 3 min
    4. Translation lab ≈ 13 min

  2. Part 2: Linux and IOMMU state

    1. Linux DMA buffers ≈ 8 min
    2. Command & event buffers ≈ 10 min
    3. Interrupts & GA log ≈ 10 min
    4. IOTLB & cache state 9 experiments

  3. Part 3: Virtualization

    1. IOMMU groups & ACS ≈ 9 min
    2. Shared page tables ≈ 11 min
    3. Virtual IOMMU ≈ 8 min
    4. Passthrough & isolation ≈ 12 min

  4. Part 4: Security

    1. Confidential VMs ≈ 7 min
    2. Secure DMA ≈ 6 min
    3. Buffer workbook ≈ 3 min
    4. Trusted I/O ≈ 5 min
    5. Attestation ≈ 4 min
    6. What SNP does not cover ≈ 4 min

  5. Part 5: Faults and evidence

    1. Request identity ≈ 60 min
    2. Faults & recovery ≈ 6 min
    3. Raw-records workbench ≈ 6 min

  6. Part 6: Reference

    1. AMD reference ≈ 11 min
    2. Arm SMMUv3 notes ≈ 13 min
    3. RISC-V IOMMU 8 experiments
    4. Model limits & C++ ≈ 5 min
    5. Glossary ≈ 10 min

Nearby: power management and resume correctness.