Re: [RFC PATCH] fpga: region: Add support for FPGA region variants

> > But if the no-verification-in-driver is denied, I think the thing we
> > need to do is to verify the binding between the DT description & image.
> > After we've verified the DTO & the image is a valid pair, they are not
> > arbitrary, whatever the DTO does is necessary to the updated hardware.
> 
> I think we agree on this. Ideally, we should validate the complete
> {config, image} pair. However, I don't see how using DTO at runtime can
> help with this goal.

Validation is not the goal. Re-enumeration is the goal. DTO is what FPGA
is now using for re-enumeration. Validation helps DTO if you want extra
integrity.

> On the contrary, it would put us in a situation
> where neither element of the pair is guaranteed since it enables the
> user to feed arbitrarily forged DTOs.

As you referenced, no OS component (even the kernel) could guarantee the
functionality of the binary for a device, only the device can. So what's
the difference who provides the pair?

The only thing matters here is integrity and authentication, which is
totally a different thing from kernel-user privilege.

I'm also confused you keep on telling that userspace is arbitrary so no
userspace interface, which seems to suggest kenrel should never get any
input from user.