On: Struck by a Thunderbolt

[ncmncm]

I have been warned against turning on IOMMU because the code to operate it is so little exercised, and therefore buggy. A crashed kernel is secure only in that it stops running.

[the8472 → ncmncm]

On the other hand IOMMU helps protecting system memory not just against malicious but also faulty devices that could otherwise write anywhere.

And people who use GPU passthrough rely on IOMMUs, so it's not like those code paths are not being exercised.

[bonzini → the8472]

Using IOMMU through the "userspace PCI" vfio driver, as done in pass-through scenarios, is a different path than using it through the DMA API.

[walterbell → bonzini]

IOMMU is also exercised by Xen PCI passthrough (e.g. QubesOS network and USB driver VMs) and SR-IOV (e.g. AWS Nitro networking).

[bonzini → walterbell]

The problem isn't bugs in the IOMMU, it's bugs or performance issues in using the DMA API with an IOMMU.