[privatelypublic]

I thought part of vt-d/vt-x made the "virtual tables" actual tables.

Eg- the memory the VM can access is controlled by the MMU of the CPU (below ring0/kernel). Resulting in the only VM escapes being the Shim(s) for talking with the host (network, memory balloon, graphics).

[bonzini]

Yes, there are virtualization-specific page tables that convert guest physical to host physical addresses. KVM still haw to take host userspace's virtual addresses, convert them to host physical addresses, and make sure that the virtualization-specific page tables stay in sync with the kernel's usual page tables (which convery host virtual addresses to host physical)