On Tue, Jul 29, 2025 at 01:58:54PM +0530, Aneesh Kumar K.V wrote: > Jason Gunthorpe <jgg@xxxxxxxx> writes: > > > On Mon, Jul 28, 2025 at 07:21:43PM +0530, Aneesh Kumar K.V (Arm) wrote: > >> Signed-off-by: Aneesh Kumar K.V (Arm) <aneesh.kumar@xxxxxxxxxx> > > > > Why would we need this? > > > > I can sort of understand why Intel would need it due to their issues > > with MCE, but ARM shouldn't care either way, should it? > > > > But also why is it an iommufd option? That doesn't seem right.. > > > > Jason > > This is based on our previous discussion https://lore.kernel.org/all/20250606120919.GH19710@xxxxxxxxxx I suggested a global option, this is a per-device option, and that especially seems wrong for iommufd. If it is per-device that is vfio, if it is global then vfio can pick it up during the early phases of opening the device. > IIUC, we intend to request the resource in exclusive mode for secure > guests—regardless of whether the platform is Intel or ARM. Could you > help clarify the MCE issue observed on Intel platforms in this context? As I understand it Intel MCEs if the non-secure side ever reads from secure'd address space. So there is alot of emphasis there to ensure there are no CPU mappings. Jason
