RE: [PATCH v5] Add VIRTIO_F_DMB (Device Memory Buffer)

> From: Alexander Graf <[email protected]>
> Sent: 18 August 2026 11:33 AM
> To: [email protected]
> 
> Virtio devices assume R/W access of guest RAM to perform DMA into it to
> access its virt queues and data to operate on. This basic assumption
> leads to multiple problems:
> 
> Confidential Compute - In SEV-SNP or TDX, the host has no direct access
>                        to all of guest RAM. We work around DMA access by
>                        having the guest limit DMA access to a common
>                        shared memory window between guest and host
>                        (swiotlb).
>
In a hypervisor example, where virtio device is composed sw hypervisor and SEV-SNP/TDX is configured,

When the guest VM read/writes to this shared memory, 

Can hypervisor see the plain text content of virtio descriptors and actual buffers?

> Vhost-user - vhost-user backends require access to all guest memory, not
>              only the memory they are actually supposed to access. This
>              is fine for trusted backends, but if you want to limit
>              visibility into guest, you need to do weird stunts like
>              bouncing memory in the vmm [1].
> 
> To restrict DMA visibility, virtio-iommu allows the guest to open specific
> windows into guest memory to the device, but it comes with its own bag
> of problems, such as dynamic allocations and complicated device <->
> iommu connections that need to be represented reliably.
> 
> Instead, introduce a simple mechanism that lets a device communicate
> through its own dedicated shared memory region: Device Memory Buffer.
> A device that offers Device Memory Buffer exposes a shared memory
> region, owned by the device, that holds the virtqueues and the buffers
> they reference.
>
To my understanding this is only suitable only for virtio-devices composed by the SW hypervisor.
In other words, for a real hardware PCI device, guest VM reading used ring, virtio net header, actual TCP packets, over blocking PCI reads seems like a snail device.
What do I miss here?

I don't understand how a basic virtio-block write IO work here.
A data is located in system RAM to be written to the block device.
So its buffer address is placed in the virtio-queue.
But in DMB mode, this buffer should be written to the device memory first, and than put this address into descriptor to complete the IO?

As I start to write above question,
I start to think that I totally misunderstood this DMB when reading " SHM that holds the virtqueues and the buffers"