diff options
Diffstat (limited to 'docs/04-implementation')
| -rw-r--r-- | docs/04-implementation/01-known-knowns-and-unknowns.md | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/docs/04-implementation/01-known-knowns-and-unknowns.md b/docs/04-implementation/01-known-knowns-and-unknowns.md index 29558b0..1a5967b 100644 --- a/docs/04-implementation/01-known-knowns-and-unknowns.md +++ b/docs/04-implementation/01-known-knowns-and-unknowns.md @@ -129,6 +129,21 @@ running its own validation paths (UVM page-tree init exercises this). **Cost:** days to weeks. +**Reachability resolution note (2026-10-02):** the related IOMMU/DMA +reachability question is closed on the reference host. The physical GPU's +IOMMU group is an identity domain (all-RAM identity) and the mediated device +registers as an emulated-IOMMU VFIO device, so its type-1 container holds +guest DMA mappings privately and no kernel `iommu_domain` exists for it: +`iommu_iova_to_phys` cannot translate guest GPAs. Guest RAM is backed by a +shared file instead, and the module translates GPA->HPA through that file's +page cache. A channel page-table line the GMMU has already walked cannot be +updated at runtime (no TLB-invalidate path exists), so channel page-table +slots for the guest window are pre-built before any engine access. Live proof: +the physical copy engine copied 4 KiB from a real guest page into a module +buffer and back, semaphore released, with the guest process observing the +write and the driver-API smoke green (`ALL OK` 64/64). Wrong-page-table writes +remain the top risk; the division-of-labour question above is unchanged. + ### 2.3 Fault semantics **Unknown:** fault buffer formats and replay/cancel semantics as the *guest* |