kvm.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH v2 00/15] KVM: x86: Conditional Hyper-V emulation enablement
@ 2021-01-26 13:48 Vitaly Kuznetsov
  2021-01-26 13:48 ` [PATCH v2 01/15] selftests: kvm: Move kvm_get_supported_hv_cpuid() to common code Vitaly Kuznetsov
                   ` (15 more replies)
  0 siblings, 16 replies; 25+ messages in thread
From: Vitaly Kuznetsov @ 2021-01-26 13:48 UTC (permalink / raw)
  To: kvm, Paolo Bonzini; +Cc: Sean Christopherson, Wanpeng Li, Jim Mattson

Changes since v1 [Sean]:
- Add a few cleanup patches ("Rename vcpu_to_hv_vcpu() to to_hv_vcpu()",
  "Rename vcpu_to_synic()/synic_to_vcpu()", ...)
- Drop unused kvm_hv_vapic_assist_page_enabled()
- Stop shadowing global 'current_vcpu' variable in kvm_hv_flush_tlb()/
  kvm_hv_send_ipi()

Original description:

Hyper-V emulation is enabled in KVM unconditionally even for Linux guests.
This is bad at least from security standpoint as it is an extra attack
surface. Ideally, there should be a per-VM capability explicitly enabled by
VMM but currently it is not the case and we can't mandate one without
breaking backwards compatibility. We can, however, check guest visible CPUIDs
and only enable Hyper-V emulation when "Hv#1" interface was exposed in
HYPERV_CPUID_INTERFACE.

Also (and while on it) per-vcpu Hyper-V context ('struct kvm_vcpu_hv') is
currently part of 'struct kvm_vcpu_arch' and thus allocated unconditionally
for each vCPU. The context, however, quite big and accounts for more than
1/4 of 'struct kvm_vcpu_arch' (e.g. 2912/9512 bytes). Switch to allocating
it dynamically. This may come handy if we ever decide to raise KVM_MAX_VCPUS
(and rumor has it some downstream distributions already have more than '288')

Vitaly Kuznetsov (15):
  selftests: kvm: Move kvm_get_supported_hv_cpuid() to common code
  selftests: kvm: Properly set Hyper-V CPUIDs in evmcs_test
  KVM: x86: hyper-v: Drop unused kvm_hv_vapic_assist_page_enabled()
  KVM: x86: hyper-v: Rename vcpu_to_hv_vcpu() to to_hv_vcpu()
  KVM: x86: hyper-v: Rename vcpu_to_synic()/synic_to_vcpu()
  KVM: x86: hyper-v: Rename vcpu_to_stimer()/stimer_to_vcpu()
  KVM: x86: hyper-v: Rename vcpu_to_hv_syndbg() to to_hv_syndbg()
  KVM: x86: hyper-v: Introduce to_kvm_hv() helper
  KVM: x86: hyper-v: Stop shadowing global 'current_vcpu' variable
  KVM: x86: hyper-v: Always use to_hv_vcpu() accessor to get to 'struct
    kvm_vcpu_hv'
  KVM: x86: hyper-v: Prepare to meet unallocated Hyper-V context
  KVM: x86: hyper-v: Allocate 'struct kvm_vcpu_hv' dynamically
  KVM: x86: hyper-v: Make Hyper-V emulation enablement conditional
  KVM: x86: hyper-v: Allocate Hyper-V context lazily
  KVM: x86: hyper-v: Drop hv_vcpu_to_vcpu() helper

 arch/x86/include/asm/kvm_host.h               |   4 +-
 arch/x86/kvm/cpuid.c                          |   2 +
 arch/x86/kvm/hyperv.c                         | 301 +++++++++++-------
 arch/x86/kvm/hyperv.h                         |  54 ++--
 arch/x86/kvm/lapic.c                          |   5 +-
 arch/x86/kvm/lapic.h                          |   7 +-
 arch/x86/kvm/vmx/vmx.c                        |   9 +-
 arch/x86/kvm/x86.c                            |  19 +-
 .../selftests/kvm/include/x86_64/processor.h  |   3 +
 .../selftests/kvm/lib/x86_64/processor.c      |  33 ++
 .../testing/selftests/kvm/x86_64/evmcs_test.c |  39 ++-
 .../selftests/kvm/x86_64/hyperv_cpuid.c       |  31 +-
 12 files changed, 314 insertions(+), 193 deletions(-)

-- 
2.29.2


^ permalink raw reply	[flat|nested] 25+ messages in thread

end of thread, other threads:[~2021-02-09 10:36 UTC | newest]

Thread overview: 25+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-01-26 13:48 [PATCH v2 00/15] KVM: x86: Conditional Hyper-V emulation enablement Vitaly Kuznetsov
2021-01-26 13:48 ` [PATCH v2 01/15] selftests: kvm: Move kvm_get_supported_hv_cpuid() to common code Vitaly Kuznetsov
2021-01-26 13:48 ` [PATCH v2 02/15] selftests: kvm: Properly set Hyper-V CPUIDs in evmcs_test Vitaly Kuznetsov
2021-01-26 13:48 ` [PATCH v2 03/15] KVM: x86: hyper-v: Drop unused kvm_hv_vapic_assist_page_enabled() Vitaly Kuznetsov
2021-01-26 13:48 ` [PATCH v2 04/15] KVM: x86: hyper-v: Rename vcpu_to_hv_vcpu() to to_hv_vcpu() Vitaly Kuznetsov
2021-01-26 13:48 ` [PATCH v2 05/15] KVM: x86: hyper-v: Rename vcpu_to_synic()/synic_to_vcpu() Vitaly Kuznetsov
2021-01-26 13:48 ` [PATCH v2 06/15] KVM: x86: hyper-v: Rename vcpu_to_stimer()/stimer_to_vcpu() Vitaly Kuznetsov
2021-01-26 13:48 ` [PATCH v2 07/15] KVM: x86: hyper-v: Rename vcpu_to_hv_syndbg() to to_hv_syndbg() Vitaly Kuznetsov
2021-01-26 13:48 ` [PATCH v2 08/15] KVM: x86: hyper-v: Introduce to_kvm_hv() helper Vitaly Kuznetsov
2021-01-26 13:48 ` [PATCH v2 09/15] KVM: x86: hyper-v: Stop shadowing global 'current_vcpu' variable Vitaly Kuznetsov
2021-01-26 13:48 ` [PATCH v2 10/15] KVM: x86: hyper-v: Always use to_hv_vcpu() accessor to get to 'struct kvm_vcpu_hv' Vitaly Kuznetsov
2021-02-08 23:06   ` Maxim Levitsky
2021-02-09  8:38     ` Vitaly Kuznetsov
2021-02-09 10:31       ` Maxim Levitsky
2021-01-26 13:48 ` [PATCH v2 11/15] KVM: x86: hyper-v: Prepare to meet unallocated Hyper-V context Vitaly Kuznetsov
2021-01-28 14:19   ` Paolo Bonzini
2021-01-28 15:21     ` Vitaly Kuznetsov
2021-01-28 16:58       ` Paolo Bonzini
2021-01-26 13:48 ` [PATCH v2 12/15] KVM: x86: hyper-v: Allocate 'struct kvm_vcpu_hv' dynamically Vitaly Kuznetsov
2021-01-26 13:48 ` [PATCH v2 13/15] KVM: x86: hyper-v: Make Hyper-V emulation enablement conditional Vitaly Kuznetsov
2021-01-26 13:48 ` [PATCH v2 14/15] KVM: x86: hyper-v: Allocate Hyper-V context lazily Vitaly Kuznetsov
2021-01-26 13:48 ` [PATCH v2 15/15] KVM: x86: hyper-v: Drop hv_vcpu_to_vcpu() helper Vitaly Kuznetsov
2021-01-28 14:25 ` [PATCH v2 00/15] KVM: x86: Conditional Hyper-V emulation enablement Paolo Bonzini
2021-02-08 14:18   ` Vitaly Kuznetsov
2021-02-08 15:02     ` Paolo Bonzini

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).