Linux KVM/SVM - AVIC IPI virtualization on Hygon Family 18h: MULTI-TENANT ISOLATION: AVIC inter-processor-interrupt

Impact

MULTI-TENANT ISOLATION: AVIC inter-processor-interrupt virtualization is unsafe on Hygon Family 18h parts, which are derived from AMD Family 17h. With AVIC active, a guest's IPIs can be delivered incorrectly - interrupt delivery reaching the wrong target is a cross-VM correctness failure on the interrupt path, which is the same seam the Heckler-class attacks exploit.

Who can reach it

From inside a guest VM on affected Hygon silicon with AVIC enabled.

What to do

Fixed in the Linux kernel by disabling AVIC IPI virtualization on affected parts. Distro kernel update plus host reboot. Interim mitigation: disable AVIC in the kvm_amd module parameters (avic=0), which costs some interrupt-heavy performance but needs only a module reload with guests drained. Relevant only if you have Hygon parts in the fleet - worth checking, since they show up in some regional supply chains.

References