linux-kernel - Re: [PATCH 11/15] KVM: x86: Add CONFIG_KVM_IOAPIC to allow disabling in-kernel I/O APIC

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <qus75blxbosrfohbbies4cqlwcmli2ofbmaoqfhcrkuyzeyiek@44rldpbnngeq>
Date: Thu, 19 Jun 2025 15:35:07 +0530
From: Naveen N Rao <naveen@...nel.org>
To: Paolo Bonzini <pbonzini@...hat.com>
Cc: Sean Christopherson <seanjc@...gle.com>, 
	Kai Huang <kai.huang@...el.com>, "kvm@...r.kernel.org" <kvm@...r.kernel.org>, 
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, "vkuznets@...hat.com" <vkuznets@...hat.com>
Subject: Re: [PATCH 11/15] KVM: x86: Add CONFIG_KVM_IOAPIC to allow disabling
 in-kernel I/O APIC

[Sorry for bumping an old thread]

On Wed, Jun 04, 2025 at 06:54:44PM +0200, Paolo Bonzini wrote:
> On 5/30/25 01:08, Sean Christopherson wrote:
> > On Thu, May 29, 2025, Kai Huang wrote:
> > > On Thu, 2025-05-29 at 07:31 -0700, Sean Christopherson wrote:
> > > > On Thu, May 29, 2025, Kai Huang wrote:
> > > > > On Thu, 2025-05-29 at 23:55 +1200, Kai Huang wrote:
> > > > > > Do they only support userspace IRQ chip, or not support any IRQ chip at all?
> > > > 
> > > > The former, only userspace I/O APIC (and associated devices), though some VM
> > > > shapes, e.g. TDX, don't provide an I/O APIC or PIC.
> > > 
> > > Thanks for the info.
> > > 
> > > Just wondering what's the benefit of using userspace IRQCHIP instead of
> > > emulating in the kernel?
> > 
> > Reduced kernel attack surface (this was especially true years ago, before KVM's
> > I/O APIC emulation was well-tested) and more flexibility (e.g. shipping userspace
> > changes is typically easier than shipping new kernels.  I'm pretty sure there's
> > one more big one that I'm blanking on at the moment.
> 
> Feature-wise, the big one is support for IRQ remapping which is not
> implemented in the in-kernel IOAPIC.

Is there a reason to prefer the in-kernel IOAPIC today, seeing as it is 
still the default with Qemu?


Thanks,
Naveen