linux-kernel - Re: [RFC PATCH v2 14/17] KVM: x86/ioapic: Disable RTC EOI tracking for protected APIC guests

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ee52786a-b6fc-2258-3816-25140cfb0dcb@amd.com>
Date: Tue, 23 Sep 2025 11:23:22 -0500
From: Tom Lendacky <thomas.lendacky@....com>
To: Neeraj Upadhyay <Neeraj.Upadhyay@....com>, kvm@...r.kernel.org,
 seanjc@...gle.com, pbonzini@...hat.com
Cc: linux-kernel@...r.kernel.org, nikunj@....com, Santosh.Shukla@....com,
 Vasant.Hegde@....com, Suravee.Suthikulpanit@....com, bp@...en8.de,
 David.Kaplan@....com, huibo.wang@....com, naveen.rao@....com,
 tiala@...rosoft.com
Subject: Re: [RFC PATCH v2 14/17] KVM: x86/ioapic: Disable RTC EOI tracking
 for protected APIC guests

On 9/23/25 00:03, Neeraj Upadhyay wrote:
> KVM tracks End-of-Interrupts (EOIs) for the legacy RTC interrupt (GSI 8)
> to detect and report coalesced interrupts to userspace. This mechanism
> fundamentally relies on KVM having visibility into the guest's interrupt
> acknowledgment state.
> 
> This assumption is invalid for guests with a protected APIC (e.g., Secure
> AVIC) for two main reasons:
> 
> a. The guest's true In-Service Register (ISR) is not visible to KVM,
>    making it impossible to know if the previous interrupt is still active.
>    So, lazy pending EOI checks cannot be done.
> 
> b. The RTC interrupt is edge-triggered, and its EOI is accelerated by the
>    hardware without a VM-Exit. KVM never sees the EOI event.
> 
> Since KVM can observe neither the interrupt's service status nor its EOI,
> the tracking logic is invalid. So, disable this feature for all protected
> APIC guests. This change means that userspace will no longer be able to
> detect coalesced RTC interrupts for these specific guest types.
> 
> Signed-off-by: Neeraj Upadhyay <Neeraj.Upadhyay@....com>
> ---
>  arch/x86/kvm/ioapic.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/x86/kvm/ioapic.c b/arch/x86/kvm/ioapic.c
> index 2b5d389bca5f..308778ba4f58 100644
> --- a/arch/x86/kvm/ioapic.c
> +++ b/arch/x86/kvm/ioapic.c
> @@ -113,6 +113,9 @@ static void __rtc_irq_eoi_tracking_restore_one(struct kvm_vcpu *vcpu)
>  	struct dest_map *dest_map = &ioapic->rtc_status.dest_map;
>  	union kvm_ioapic_redirect_entry *e;
>  
> +	if (vcpu->arch.apic->guest_apic_protected)
> +		return;

A comment above this code would be good.

> +
>  	e = &ioapic->redirtbl[RTC_GSI];
>  	if (!kvm_apic_match_dest(vcpu, NULL, APIC_DEST_NOSHORT,
>  				 e->fields.dest_id,
> @@ -476,6 +479,7 @@ static int ioapic_service(struct kvm_ioapic *ioapic, int irq, bool line_status)
>  {
>  	union kvm_ioapic_redirect_entry *entry = &ioapic->redirtbl[irq];
>  	struct kvm_lapic_irq irqe;
> +	struct kvm_vcpu *vcpu;
>  	int ret;
>  
>  	if (entry->fields.mask ||
> @@ -505,7 +509,9 @@ static int ioapic_service(struct kvm_ioapic *ioapic, int irq, bool line_status)
>  		BUG_ON(ioapic->rtc_status.pending_eoi != 0);
>  		ret = kvm_irq_delivery_to_apic(ioapic->kvm, NULL, &irqe,
>  					       &ioapic->rtc_status.dest_map);
> -		ioapic->rtc_status.pending_eoi = (ret < 0 ? 0 : ret);
> +		vcpu = kvm_get_vcpu(ioapic->kvm, 0);
> +		if (!vcpu->arch.apic->guest_apic_protected)
> +			ioapic->rtc_status.pending_eoi = (ret < 0 ? 0 : ret);

And a comment about this, too.

Thanks,
Tom

>  	} else
>  		ret = kvm_irq_delivery_to_apic(ioapic->kvm, NULL, &irqe, NULL);
>