On Fri, 08 Jun 2018 10:58:54 +1000 Benjamin Herrenschmidt <benh@xxxxxxxxxxxxxxxxxxx> wrote: > On Thu, 2018-06-07 at 18:34 -0600, Alex Williamson wrote: > > > We *can* allow individual GPUs to be passed through, either if somebody > > > designs a system without cross links, or if the user is ok with the > > > security risk as the guest driver will not enable them if it doesn't > > > "find" both sides of them. > > > > If GPUs are not isolated and we cannot prevent them from probing each > > other via these links, then I think we have an obligation to configure > > grouping in a way that doesn't rely on a benevolent userspace. Thanks, > > Well, it's a user decision, no ? Like how we used to let the user > decide whether to pass-through things that have LSIs shared out of > their domain. No, users don't get to pinky swear they'll be good. The kernel creates IOMMU groups assuming the worst case isolation and malicious users. Its the kernel's job to protect itself from users and to protect users from each other. Anything else is unsupportable. The only way to bypass the default grouping is to modify the kernel. Thanks, Alex
