4 ms·

The motherboard wasn’t broken per se, you just were trying to split an iommu group apart, which is insecure (and thus unavailable by default).

by strstr 5y ago

drbawb 5y ago
>which is insecure Splitting IOMMU groups is not inherently insecure; doing so without ACS is insecure. It is true that's not the motherboard vendors fault - it is because Intel designed it that way. ACS (the part of PCIe which makes sane IOMMU group splitting possible) works great on my Zen products (Ryzen, Threadripper, EPYC, etc.) It also works fine on my Intel Xeon products. Intel client silicon is the odd man out here, and if you ask me that's hardly an accident. It falls neatly in line w/ their other artificial market segmentation. (They do the exact same thing w/ ECC RAM.) I'm mostly just jaded because my use-case (PCIe passthrough for a 'gaming VM') is hardly conducive to enterprise grade hardware (Xeon SKUs w/ low base clocks, headless GPUs designed for compute, etc.) yet vendors like NVidia and Intel choose to make this use-case difficult/impossible to implement on their consumer grade offerings. It gets old after a while. I, for one, am really glad AMD shook things up in this regard in the CPU space.
- strstr 5y ago
  PCI-passthrough support for gaming is pretty niche (I say this having set it up myself), and I can understand vendors not wanting to support it. Those support tickets would be a pain. Gaming VMs are likely going to die anyway, at least for competitive gaming. Virtualization is just too powerful a tool for cheating. Many anti-cheats already ban it.
  - whitexn--g28h 5y ago
    Anti-cheat software, even those that run in ring 0, can always be lied to by another program, even without a VM. Just look at how deep the Sony root kit [1] buried itself into systems and was still easily circumvented by other software. If anything gaming in VMs makes cheating harder and if NVidia, intel and Microsoft worked together they could help publishers ship secure VMs to run games reducing support tickets and cheats. 1. https://en.wikipedia.org/wiki/Extended_Copy_Protection https://en.wikipedia.org/wiki/Extended_Copy_Protection

The motherboard wasn’t broken per se, you just were trying to split an iommu group apart, which is insecure (and thus unavailable by default).

by strstr 5y ago

The motherboard wasn’t broken per se, you just were trying to split an iommu group apart, which is insecure (and thus unavailable by default).

drbawb 5y ago

>which is insecure Splitting IOMMU groups is not inherently insecure; doing so without ACS is insecure. It is true that's not the motherboard vendors fault - it is because Intel designed it that way. ACS (the part of PCIe which makes sane IOMMU group splitting possible) works great on my Zen products (Ryzen, Threadripper, EPYC, etc.) It also works fine on my Intel Xeon products. Intel client silicon is the odd man out here, and if you ask me that's hardly an accident. It falls neatly in line w/ their other artificial market segmentation. (They do the exact same thing w/ ECC RAM.) I'm mostly just jaded because my use-case (PCIe passthrough for a 'gaming VM') is hardly conducive to enterprise grade hardware (Xeon SKUs w/ low base clocks, headless GPUs designed for compute, etc.) yet vendors like NVidia and Intel choose to make this use-case difficult/impossible to implement on their consumer grade offerings. It gets old after a while. I, for one, am really glad AMD shook things up in this regard in the CPU space.

strstr 5y ago
PCI-passthrough support for gaming is pretty niche (I say this having set it up myself), and I can understand vendors not wanting to support it. Those support tickets would be a pain. Gaming VMs are likely going to die anyway, at least for competitive gaming. Virtualization is just too powerful a tool for cheating. Many anti-cheats already ban it.
- whitexn--g28h 5y ago
  Anti-cheat software, even those that run in ring 0, can always be lied to by another program, even without a VM. Just look at how deep the Sony root kit [1] buried itself into systems and was still easily circumvented by other software. If anything gaming in VMs makes cheating harder and if NVidia, intel and Microsoft worked together they could help publishers ship secure VMs to run games reducing support tickets and cheats. 1. https://en.wikipedia.org/wiki/Extended_Copy_Protection https://en.wikipedia.org/wiki/Extended_Copy_Protection