On 10/20/26 11:06, Mohamed Mediouni wrote: > >> On 20. Oct 2026, at 16:20, Alex Bennée <[email protected]> wrote: >> >> Demi Marie Obenour <[email protected]> writes: >> >>> On 10/7/26 12:29, Alex Bennée wrote: >> >> (CC trimmed, IOMMU relevant maintainers added) >> >>>> >>>> Hi, >>>> >>>> The KVM/QEMU community call is at: >>>> >> <snip> >>> >>> Is this also for topics related to KVM but not necessarily QEMU? >>> If so, and if there will be people who are familiar with device >>> passthrough, I'd like to discuss whether IOMMU faults and KVM MMU >>> faults are recoverable. There is a virtio device I am working on >>> which requires this to avoid either crashing the guest or allowing >>> the guest to hog host memory. >> >> We didn't get to this at the last community call. Is this something that >> can be discussed on list first? > > It should be I think. > > Hi, > > For such a virtio device (and granularly exposing it to user contexts too), > is ATS + PRI > a good choice? Perhaps even using the host page tables directly, with a > per-process > abstraction as the security boundary.> > On physical hardware as intended, > outside of the ATS + PRI case, IOMMU faults > are expected to be something requiring a device/driver reset. On Arm however, > there’s an exception for the stall model, which pre-dates ATS + PRI. > > A PRI PPR reply of not present isn’t equivalent to an IOMMU fault and isn’t > expected to > result in a crash resulting in a device reset.
I have two concerns with ATS + PRI: 1. ATS allows a device to bypass the IOMMU, and my project relies on the IOMMU to isolate a compromised device. 2. I need to support both consumer and enterprise hardware. I suspect that ATS support is very limited in the consumer space. For more context, I'm working on a device that allows a backend VM to provide virtio devices to other (frontend) VMs. The backend VM will often have an assigned PCIe device, and there are applications where zero-copy I/O would be very helpful for performance. However, when the frontend VM exits or unmaps memory, the memory also needs to be unmapped from the backend. If this is cooperative, the backend may simply refuse to cooperate, causing a host-side memory leak. If it is preemptive, the backend will take faults when it tries to access the memory that has been unmapped from it. One can avoid both problems by only letting the backend access a small buffer, but this requires a copy in either the frontend or the device. This might make the system uncompetitive with host-side vhost-user devices in high-performance applications. Is there a way around this tradeoff, or is zero copy incompatible with protecting both the backend and the host? -- Sincerely, Demi Marie Obenour (she/her/hers)
OpenPGP_signature.asc
Description: OpenPGP digital signature
