linux-kernel - Re: [PATCH 11/15] KVM: x86: Add CONFIG_KVM_IOAPIC to allow disabling in-kernel I/O APIC

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aDhvs1tXH6pv8MxN@google.com>
Date: Thu, 29 May 2025 07:31:15 -0700
From: Sean Christopherson <seanjc@...gle.com>
To: Kai Huang <kai.huang@...el.com>
Cc: "pbonzini@...hat.com" <pbonzini@...hat.com>, "vkuznets@...hat.com" <vkuznets@...hat.com>, 
	"kvm@...r.kernel.org" <kvm@...r.kernel.org>, 
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 11/15] KVM: x86: Add CONFIG_KVM_IOAPIC to allow disabling
 in-kernel I/O APIC

On Thu, May 29, 2025, Kai Huang wrote:
> On Thu, 2025-05-29 at 23:55 +1200, Kai Huang wrote:
> > On Mon, 2025-05-19 at 16:28 -0700, Sean Christopherson wrote:
> > > Add a Kconfig to allowing building KVM without support for emulating an
> > 		   ^
> > 		   allow
> > 
> > > I/O APIC, PIC, and PIT, which is desirable for deployments that effectively
> > > don't support a fully in-kernel IRQ chip, i.e. never expect any VMM to
> > > create an in-kernel I/O APIC.  
> > 
> > Do you happen to know what developments don't support a full in-kernel IRQ chip?

Google Cloud, for one.  I suspect/assume many/most CSPs don't utilize an in-kernel
I/O APIC.

> > Do they only support userspace IRQ chip, or not support any IRQ chip at all?

The former, only userspace I/O APIC (and associated devices), though some VM
shapes, e.g. TDX, don't provide an I/O APIC or PIC.

> Forgot to ask:
> 
> Since this new Kconfig option is not only for IOAPIC but also includes PIC and
> PIT, is CONFIG_KVM_IRQCHIP a better name?

I much prefer IOAPIC, because IRQCHIP is far too ambiguous and confusing, e.g.
just look at KVM's internal APIs, where these:

  irqchip_in_kernel()
  irqchip_kernel()

are not equivalent.  In practice, no modern guest kernel is going to utilize the
PIC, and the PIT isn't an IRQ chip, i.e. isn't strictly covered by IRQCHIP either.
So I think/hope the vast majority of users/readers will be able to intuit that
CONFIG_KVM_IOAPIC also covers the PIC and PIT.