It’s no more secure than the security isolation guarantees given by the GPU driver stack to a regular process. No more guarantees are provided than that. I’d c

It’s no more secure than the security isolation guarantees given by the GPU driver stack to a regular process. No more guarantees are provided than that. I’d consider the VMM as even more untrusted than before when VirGL is used, with always assuming that the guest has code exec in the VMM. With all the implications that this entails.