Re: Remaining passthrough/VT-d tasks list

[Avi Kivity <avi@redhat.com>]

Tian, Kevin wrote:
>>
>> If the guest fails to disable interrupts on a device that shares an
>> interrupt line with the host, the host will experience an interrupt
>> flood.  Eventually the host will disable the host device as well.
>>
>>     
>
> This issue also exists on host side, that one misbehaved driver
> can hurt all other drivers sharing same irq line. 

There is no issue on the host, since all drivers operate on the same
trust level. A misbehaving driver on the host will take down the entire
system even without shared interrupts, by corrupting memory, not
releasing a lock, etc.

But if you move a driver to the guest, you expect it will be isolated
from the rest of the system, and if there are shared interrupts, it isn't.

> But it seems no
> good way to avoid it. Since not all devices support MSI, we still
> need support irq sharing possibly with above caveats given.
>
> Existing approach at least works with a sane guest driver, with
> some performance penality there.
>
>   

How can we recommend it to users? We tell them, your guests are isolated
and secure as long as they don't misbehave?

> Or do you have better alternative?
>   

No. Maybe the Neocleus polarity trick (which also reduces performance).

-- 
I have a truly marvellous patch that fixes the bug which this
signature is too narrow to contain.