Open Source Summit + Embedded Linux Conference Europe 2020

Modern interrupt controllers are very complicated constructs with complex interfaces, only matched by the complexity of the software that emulates them. In a hypervisor, this software often lives at a privileged exception level, exposing an attractive attack surface for malicious actors, and making it difficult to verify the correctness of the hypervisor. This is problematic for many hypervisor deployments, especially when aiming to provide trusted execution environments. To address these concerns, we present a paravirtualized interrupt controller architecture, which is easier to verify, provides the minimum level of service that a VM requires as well as consistent semantics, and which has the potential to be used across CPU architectures. This gives the opportunity to consider trade-offs between performance and complexity, and the applicability to being built or accelerated in hardware.