Skip to content

vmm: sanitize GPUs through vfio-ioctls hot reset - #1065

Open
kvinwang wants to merge 4 commits into
nextfrom
fix/gpu-sbr-vfio-ioctls
Open

vmm: sanitize GPUs through vfio-ioctls hot reset#1065
kvinwang wants to merge 4 commits into
nextfrom
fix/gpu-sbr-vfio-ioctls

Conversation

@kvinwang

@kvinwang kvinwang commented Aug 17, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • switch GPU sanitize-on-attach from root-only sysfs writes to VFIO_DEVICE_PCI_HOT_RESET
  • use rust-vmm/vfio abstractions instead of maintaining handwritten VFIO ioctl numbers, ABI structs, and variable-length buffer parsing in dstack
  • validate the kernel-reported reset scope and reject affected devices outside the GPU's IOMMU group
  • keep devices bound to vfio-pci across the reset
  • add dstack-vmm sanitize-gpu <slot>... for standalone validation and operations

Dependency strategy

rust-vmm/vfio already provides the VFIO bindings and container/group/device lifecycle abstractions, but its public API does not yet expose PCI hot reset operations. This PR temporarily pins the following fork commit:

The fork adds pci_hot_reset_info and pci_hot_reset APIs. After validating the complete flow on GPU hardware, we plan to submit those APIs upstream and replace the Git dependency with a released crates.io version.

Motivation

The existing sanitize path writes Bridge Control through sysfs and re-probes devices through /sys/bus/pci/drivers_probe. Both operations require root privileges. The VMM normally runs as a dedicated unprivileged user that already has access to the VFIO group nodes required for GPU passthrough.

The VFIO hot-reset ioctl asks the kernel to perform the bus reset and authorizes it through ownership of every affected VFIO group. This is the same mechanism used by VMM implementations such as QEMU.

Safety

  • retain the dedicated-bridge topology check
  • query the kernel-reported affected-device set before resetting
  • reject any affected device outside the target GPU's IOMMU group
  • pass the owned VFIO group to the reset ioctl as proof of ownership
  • drop all VFIO objects before QEMU starts

Tests

  • cargo check -p dstack-vmm
  • cargo test -p dstack-vmm — 119 passed
  • cargo clippy -p dstack-vmm --all-targets -- -D warnings

The new reset path has not yet been validated on target GPU hardware. The standalone sanitize-gpu command is included to exercise the exact launch-time path during that validation.

Relationship to #1058

This is an alternative implementation of #1058 that addresses the review feedback to use vfio-ioctls. PR #1058 has not been modified.

Leechael and others added 3 commits August 17, 2026 06:03
The sanitize-on-attach path issued the Secondary Bus Reset by writing
Bridge Control in the upstream bridge sysfs config space and re-probed
devices through /sys/bus/pci/drivers_probe. Both files are writable by
root only, so the feature could not be enabled in production where
dstack-vmm runs as an unprivileged user with no sudo.

Switch to the VFIO_DEVICE_PCI_HOT_RESET ioctl, which makes the kernel
perform the same bus reset. The ioctl is authorized by device ownership
rather than privilege: the caller presents fds for every VFIO group
affected by the reset, and the /dev/vfio group nodes are the same ones
QEMU opens to attach the GPU, so the VMM user already has access.

A single group fd suffices because every sanitized GPU sits alone
behind a dedicated PCIe bridge and alone in its IOMMU group. The bridge
topology check is kept as defense, and the kernel-reported set of
affected devices must all belong to the GPU own group or the launch is
aborted. Devices stay bound to vfio-pci across the reset, so the
drivers_probe re-probe logic is no longer needed and is removed.

Not yet validated on GPU hardware; see
plans/2026-08-14-vfio-gpu-hot-reset.md for the pending experiment.
Expose the sanitize path as "dstack-vmm sanitize-gpu <slot>..." so
operators can reset GPUs by hand and the pending hardware experiment
can exercise exactly the code path used at VM launch, running as the
unprivileged VMM user. The subcommand needs no server configuration,
only /dev/vfio access, and is handled before config loading like the
other special modes.
Copilot AI lite review requested due to automatic review settings August 17, 2026 13:09

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@kvinwang
kvinwang force-pushed the fix/gpu-sbr-vfio-ioctls branch from ff467dc to 3d9c161 Compare August 17, 2026 13:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants