On 10/21/26 04:35, Demi Marie Obenour wrote:
On 10/20/26 11:06, Mohamed Mediouni wrote:
On 20. Oct 2026, at 16:20, Alex Bennée <[email protected]> wrote:
Demi Marie Obenour <[email protected]> writes:
On 10/7/26 12:29, Alex Bennée wrote:
(CC trimmed, IOMMU relevant maintainers added)
Hi,
The KVM/QEMU community call is at:
<snip>
Is this also for topics related to KVM but not necessarily QEMU?
If so, and if there will be people who are familiar with device
passthrough, I'd like to discuss whether IOMMU faults and KVM MMU
faults are recoverable. There is a virtio device I am working on
which requires this to avoid either crashing the guest or allowing
the guest to hog host memory.
We didn't get to this at the last community call. Is this something that
can be discussed on list first?
It should be I think.
Hi,
For such a virtio device (and granularly exposing it to user contexts too), is
ATS + PRI
a good choice? Perhaps even using the host page tables directly, with a
per-process
abstraction as the security boundary.> > On physical hardware as intended,
outside of the ATS + PRI case, IOMMU faults
are expected to be something requiring a device/driver reset. On Arm however,
there’s an exception for the stall model, which pre-dates ATS + PRI.
A PRI PPR reply of not present isn’t equivalent to an IOMMU fault and isn’t
expected to
result in a crash resulting in a device reset.
I have two concerns with ATS + PRI:
1. ATS allows a device to bypass the IOMMU, and my project relies on
the IOMMU to isolate a compromised device.
2. I need to support both consumer and enterprise hardware. I suspect
that ATS support is very limited in the consumer space.
For more context, I'm working on a device that allows a backend VM
to provide virtio devices to other (frontend) VMs. The backend VM
will often have an assigned PCIe device, and there are applications
where zero-copy I/O would be very helpful for performance.
curious how you let the frontend memory accessible to backend within
a VM?
However, when the frontend VM exits or unmaps memory, the memory
also needs to be unmapped from the backend. If this is cooperative,
the backend may simply refuse to cooperate, causing a host-side
memory leak. If it is preemptive, the backend will take faults when
it tries to access the memory that has been unmapped from it.
One can avoid both problems by only letting the backend access a small
buffer, but this requires a copy in either the frontend or the device.
This might make the system uncompetitive with host-side vhost-user
devices in high-performance applications.
Is there a way around this tradeoff, or is zero copy incompatible
with protecting both the backend and the host?
