Linux 7.4 To Enable Intel Instruction Timeout For Fending Off TDX VM DoS Attacks

Linux 7.4 is enabling support for a new Intel CPU feature for providing safety against possible denial of service attacks using Trust Domain Extensions "TDX" VMs. The new feature is Intel Instruction Timeout and previously in-development known as Notify VM Exit. The Intel Instruction Timeout / Notify VM Exit is a security feature for mitigating possible denial of service attacks by rogue actors with access to TDX-protected virtual machines. This could happen where a malicious guest VM could cause problems for the Linux server by blocking interrupt/event handling to starve host resources or locking up a CPU core. This feature was developed as Notify VM Exit while Intel is reportedly renaming it to "Instruction Timeout" in their next documentation update. Linux 7.4 is set to land this mitigation with the KVM TDX code. The new KVM TDX code for Linux 7.4 is also adding Bus Lock VM Exit support for forcing a VM to exit to user-space whenever a guest CPU executes a bus lock instruction. This too is for preventing denial of service attacks and other performance concerns by malicious VMs. These features were sent out today for queuing in the KVM tree as part of today's KVM+TDX changes pull request targeting Linux 7.4.