Xen - x86 IOMMU command timeout detection and handling: MULTI-TENANT ISOLATION: Xen's IOMMU command timeout handling

Impact

MULTI-TENANT ISOLATION: Xen's IOMMU command timeout handling is inappropriate, so IOMMU operations that do not complete in time are mishandled. On a host doing PCI passthrough - which is every GPU cloud - the IOMMU is the component enforcing that an assigned device can only DMA into its owner's memory. Mishandled timeouts mean that enforcement can be left in an indeterminate state while devices keep running.

Who can reach it

Requires a guest able to generate IOMMU load, i.e. a guest with an assigned device doing heavy DMA - normal behaviour for a passed-through GPU or NIC.

What to do

Fixed in Xen (XSA-373). Hypervisor update plus host reboot. Especially relevant on GPU nodes, where passed-through accelerators and RDMA NICs push the IOMMU hard enough to hit timeout paths that idle hosts never reach.

References