linux-kernel - Re: [PATCH] KVM: lapic: stop advertising DIRECTED

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 09 Feb 2018 17:32:47 +0100
From:   Vitaly Kuznetsov <vkuznets@...hat.com>
To:     Nikita Leshenko <nikita.leshchenko@...cle.com>
Cc:     kvm <kvm@...r.kernel.org>, linux-kernel@...r.kernel.org,
        x86@...nel.org, Paolo Bonzini <pbonzini@...hat.com>,
        Radim Krčmář <rkrcmar@...hat.com>,
        Peter Xu <peterx@...hat.com>
Subject: Re: [PATCH] KVM: lapic: stop advertising DIRECTED_EOI when in-kernel IOAPIC is in use

Nikita Leshenko <nikita.leshchenko@...cle.com> writes:

> The patch looks correct, however I’m confused about why you consider
> this to be a bug in the guest rather than a bug in KVM.
>
> The spec for x2APIC states:
> "The support for Directed EOI capability can be detected by means of
> bit 24 in the Local APIC Version Register” (Intel’s x2APIC spec, 2.5.1
> Directed EOI)
> It seems to me that Windows did the right thing by testing for the
> presence of directed EOI feature rather than implying it exists by
> testing a version number. KVM did the wrong thing by advertising a
> feature it doesn’t support.
>
> Therefore I think that you should change the comment to something like
> “KVM’s in-kernel IOAPIC doesn’t support Directed EOI register, so don’t
> advertise this capability in the LAPIC Version Register.” instead of
> talking about buggy guests, as it may confuse future readers of this
> code.
>

Before disabling EOI broadcast guests should check if IOAPIC is of
proper version - the fact that you can disable EOI broadcast doesn't
automatically mean that you can later do EOI through IOAPIC... 

Anyway, I got the impression that last time conversation ended up with
'this is a guest bug' conclusion
(https://www.spinics.net/lists/kvm/msg148187.html - see Radim's and
Ladi's comments) but I'm not insisting - if now we conclude this is not a
Windows issue let it be it. But let's just fix it once and for all :-)

-- 
  Vitaly