Re: [RFC] vduse config write support

* Jason Wang <[email protected]> [2024-07-26 10:47:59]:

> > 2) For PCI pass-through devices, we are concerned of letting VMM be in charge of
> > emulating the complete configuration space (how can VM defend against invalid
> > attributes presented for passthr devices)?
> 
> Virtio driver has been hardened for this, for example:
> 
> commit 72b5e8958738aaa453db5149e6ca3bcf416023b9
> Author: Jason Wang <[email protected]>
> Date:   Fri Jun 4 13:53:50 2021 +0800
> 
>     virtio-ring: store DMA metadata in desc_extra for split virtqueue
> 
> More hardening work is ongoing.

I think above change is not sufficient for what we are looking for. In
particular for pass-through PCI devices, we are concerned that a untrusted
(compromised?) VMM can return invalid attributes when the confidential VM reads
the configuration space. These are PCI devices that may not support TDISP.
Hypervisor, being a trusted entity and controlling the PCI bus emulation
can ensure that the confidential VM sees valid attributes for all devices
(physical and virtual) that are enumerated on the bus. That's a key reason why
we want hypervisor to emulate access to configuration space of all PCI devices
enumerated by VM. That I think necessitates that hypervisor handle access to
virtio device configuration space as well (even if MSI-X obviates the
performance arguments of hypervisor doing so)!

Thanks
vatsa