linux-kernel - Re: Queries regarding consolidated picture of virtualization and SPT/EPT/IOMMU/DMAR/PT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAHP4M8WMELcT8G1p7o5khEn5B9X+0UBkEMiScu9eD89qdpUbrw@mail.gmail.com>
Date: Wed, 20 Nov 2024 21:50:18 +0530
From: Ajay Garg <ajaygargnsit@...il.com>
To: Linux Kernel Mailing List <linux-kernel@...r.kernel.org>, iommu@...ts.linux-foundation.org, 
	kvm@...r.kernel.org, Linux Memory Management List <linux-mm@...ck.org>
Subject: Re: Queries regarding consolidated picture of virtualization and SPT/EPT/IOMMU/DMAR/PT

Hi everyone.

Will be grateful for some insight if I am on the right path :)

On Mon, Nov 18, 2024 at 11:30 PM Ajay Garg <ajaygargnsit@...il.com> wrote:
>
> Hi everyone.
>
> I understand in a para-virtualization environment, VMM maintains a
> shadow-page-table (SPT) per process per guest, for GVA => HPA
> translation. The hardware/MMU is passed a single pointer to this
> shadow-page-table. The guest is aware that it is running in a
> virtualization environment, and communicates with VMM to help maintain
> the shadow-page-table.
>
> In full-virtualization/HVM virtualization, the guest is unaware that
> it is running in a virtualized environment, and all GVA => GPA are
> private. The VMM is obviously aware of all HVA => HPA mappings; plus
> GPA => HVA is trivial as it's only an offset difference (Extended Page
> Table, EPT). The hardware/MMU is passed three things :
>
>         * Pointer to guest page-table, for GVA => GPA.
>         * Offset, for GPA => HVA.
>         * Pointer to host page-table, for HVA => HPA.
>
> In both the above cases, DMA is a challenge (without IOMMU), as
> device-addresses would need to be physically-contiguous. This would in
> turn mean that all of  GPA needs to be physically-contiguous, which in
> turn means that the host would need to spawn guest-process with all of
> memory (HVA) which is physically-contiguous - very hard to meet
> generally.
>
> *_Kindly correct me if I have made a mistake so far at conceptual level._*
>
>
> Now, enters IOMMU, providing the ability to DMA with non-contiguous
> device-addresses.
> Now, my queries are simple :
>
> *
> Is IOMMU DMA-Remapping mode (DMAR) analogous to a para-virtualization
> environment (as per previous brief context)?
>
> *
> Is IOMMU Pass-through (PT) mode analogous to a HVM environment (as per
> previous brief context)?
>
>
> Many thanks in advance for your time; hopefully I have not been a
> complete idiot ..
>
>
> Thanks and Regards,
> Ajay