Xen PCI passthrough on Intel VT-d chipsets without interrupt remapping: The founding GPU-passthrough escape. A guest

Impact

The founding GPU-passthrough escape. A guest that owns a passed-through device programs it to DMA into the platform's interrupt-injection registers, synthesising MSIs it was never allowed to raise, and from there takes the hypervisor. The IOMMU alone does not stop this - DMA remapping constrains where a device may write data, but without interrupt remapping the MSI address range is still reachable, and an MSI is just a memory write. Directly applicable to any rented-GPU product: hand a tenant a GPU on a platform without IR (or with IR disabled) and you have handed them the host. This is the concrete instance of the Invisible Things Lab result that IOMMU-without-IR is not an isolation boundary.

Who can reach it

A guest administrator - i.e. the tenant renting the VM - who has been assigned any bus-mastering-capable PCI device. A GPU qualifies.

What to do

Upgrade to Xen 4.1.1 / 4.0.2 or later, which refuses passthrough when interrupt remapping is unavailable, and confirm IR is actually enabled on every host: check the DMAR/IVRS tables and that the hypervisor did not silently fall back after a firmware quirk. The expensive part is not the hypervisor patch but the platform audit - some older boards report IR capability and have it errata-disabled, and the only safe response there is to stop selling passthrough on that SKU and retire it. Requires a host reboot per node with all tenants evacuated.

References