On Wed, Sep 30, 2015 at 09:15:56PM +0300, Vlad Zolotarov wrote:
>
>
> On 09/30/15 18:26, Michael S. Tsirkin wrote:
> >On Wed, Sep 30, 2015 at 03:50:09PM +0300, Vlad Zolotarov wrote:
> >>How not virtualizing iommu forces "all or nothing" approach?
> >Looks like you can't limit an assigned device to only access part of
> >guest memory that belongs to a given process. Either let it access all
> >of guest memory ("all") or don't assign the device ("nothing").
>
> Ok. A question then: can u limit the assigned device to only access part of
> the guest memory even if iommu was virtualized?
That's exactly what an iommu does - limit the device io access to memory.
> How would iommu
> virtualization change anything?
Kernel can use an iommu to limit device access to memory of
the controlling application.
> And why do we care about an assigned device
> to be able to access all Guest memory?
Because we want to be reasonably sure a kernel memory corruption
is not a result of a bug in a userspace application.
--
MST
