Re: [PATCH v2] vfio/pci: Verify each MSI vector to avoid invalid MSI vectors

[Jason Gunthorpe]

On Sat, Nov 26, 2022 at 11:15:14AM +0000, Marc Zyngier wrote:

> > Physical hardware doesn't do this, virtual emulation shouldn't either.
> 
> If you want to fix VFIO, be my guest. My rambling about the sorry
> state of this has been in the kernel for 5 years (ed8703a506a8).

We are talking about things. Stuff we want to do doesn't work, or is
completely insane right now.

> > People are taking too many liberties with trapping the PCI MSI
> > registers through VFIO. :(
> 
> Do you really want to leave access to the MSI BAR to userspace? The
> number of ways this can go wrong is mind-boggling. 

Yeah, actually I do. This is basically mandatory to do something like
IMS, SIOV, etc.

> Starting with having to rebuild the interrupt translation tables on
> the host side to follow what the guest does, instead of keeping the
> two independent.

At least on x86 most of the discussion has been about teaching the
interrupt controller to go to the hypervisor to get help when
establishing interrupts. The hypervisor can tell the guest what the
real MSI data is.

This is following the example of hyperv which plugs in a hyper call to
HVCALL_MAP_DEVICE_INTERRUPT in its remapping irq_chip. This allows the
hypervisor to tell the guest a real addr/data pair and the hypervisor
does not have to involve itself in the device programming.

We haven't reached a point of thinking in detail about ARM, but I would
guess the general theme would still apply.

Jason