lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date:   Wed, 25 Oct 2023 17:23:52 +0200
From:   Vitaly Kuznetsov <vkuznets@...hat.com>
To:     kvm@...r.kernel.org, Paolo Bonzini <pbonzini@...hat.com>,
        Sean Christopherson <seanjc@...gle.com>,
        Maxim Levitsky <mlevitsk@...hat.com>
Cc:     linux-kernel@...r.kernel.org
Subject: [PATCH 00/14] KVM: x86: Make Hyper-V emulation optional

RFC:
  https://lore.kernel.org/kvm/20231010160300.1136799-1-vkuznets@redhat.com/

Changes since RFC:
- Enhance Kconfig message [Max, Sean]
- Introduce nested_vmx_is_evmptr12_valid [Max, Sean]
- Collected R-b tags [Max]
- Add a common function to allocate partition assist page [Max]
- Fix KVM selftest to skip gracefully when !CONFIG_KVM_HYPERV
- Other minor tweaks.

KVM supports emulating Microsoft Hyper-V as well as running as a nested
(L1) hypervisor on top of Hyper-V whileusing Hyper-V specific PV features.
Support for the later is only compiled in when CONFIG_HYPERV is set. This
series makes it possible to disable the former with a newly introduced 
CONFIG_KVM_HYPERV option. This helps to reduce sized of KVM modules as well
as the attack surface for some specific deployments when no Windows/Hyper-V
guests are expected. The size gain is significant:

    # CONFIG_KVM_HYPERV is not set
    # CONFIG_HYPERV is not set

    -rw-r--r--. 1 user user 3612632 Oct 10 16:53 arch/x86/kvm/kvm-amd.ko
    -rw-r--r--. 1 user user 5343968 Oct 10 16:53 arch/x86/kvm/kvm-intel.ko

    CONFIG_KVM_HYPERV=y
    # CONFIG_HYPERV is not set

    -rw-r--r--. 1 user user 3925704 Oct 10 16:51 arch/x86/kvm/kvm-amd.ko
    -rw-r--r--. 1 user user 5819192 Oct 10 16:51 arch/x86/kvm/kvm-intel.ko

    # CONFIG_KVM_HYPERV is not set
    CONFIG_HYPERV=m

    -rw-r--r--. 1 user user 3928440 Oct 10 16:40 arch/x86/kvm/kvm-amd.ko
    -rw-r--r--. 1 user user 8156464 Oct 10 16:40 arch/x86/kvm/kvm-intel.ko

    CONFIG_KVM_HYPERV=y
    CONFIG_HYPERV=m

    -rw-r--r--. 1 user user 4245440 Oct 10 16:37 arch/x86/kvm/kvm-amd.ko
    -rw-r--r--. 1 user user 8583872 Oct 10 16:37 arch/x86/kvm/kvm-intel.ko

The series should not supposed to introduce any functional change for the 
"CONFIG_KVM_HYPERV=y && CONFIG_HYPERV=m/y" case. Tested with KVM selftests,
kvm-unit-tests and real Windows guests on VMX and SVM. Note, kvm-unit-tests
have to be updated to not fail miserably when CONFIG_KVM_HYPERV is not set,
I'll send a separate series.

Vitaly Kuznetsov (14):
  KVM: x86: xen: Remove unneeded xen context from struct kvm_arch when
    !CONFIG_KVM_XEN
  KVM: x86: hyper-v: Move Hyper-V partition assist page out of Hyper-V
    emulation context
  KVM: VMX: Split off vmx_onhyperv.{ch} from hyperv.{ch}
  KVM: x86: hyper-v: Introduce kvm_hv_synic_auto_eoi_set()
  KVM: x86: hyper-v: Introduce kvm_hv_synic_has_vector()
  KVM: VMX: Split off hyperv_evmcs.{ch}
  KVM: x86: hyper-v: Introduce kvm_hv_nested_transtion_tlb_flush()
    helper
  KVM: selftests: Make all Hyper-V tests explicitly dependent on Hyper-V
    emulation support in KVM
  KVM: selftests: Fix vmxon_pa == vmcs12_pa == -1ull
    vmx_set_nested_state_test for !eVMCS case
  KVM: x86: Make Hyper-V emulation optional
  KVM: nVMX: hyper-v: Introduce nested_vmx_evmptr12() and
    nested_vmx_is_evmptr12_valid() helpers
  KVM: nVMX: hyper-v: Introduce nested_vmx_evmcs() accessor
  KVM: nVMX: hyper-v: Hide more stuff under CONFIG_KVM_HYPERV
  KVM: nSVM: hyper-v: Hide more stuff under
    CONFIG_KVM_HYPERV/CONFIG_HYPERV

 arch/x86/include/asm/kvm_host.h               |  11 +-
 arch/x86/kvm/Kconfig                          |  14 +
 arch/x86/kvm/Makefile                         |  19 +-
 arch/x86/kvm/cpuid.c                          |   6 +
 arch/x86/kvm/hyperv.h                         |  52 +-
 arch/x86/kvm/irq.c                            |   2 +
 arch/x86/kvm/irq_comm.c                       |   9 +-
 arch/x86/kvm/kvm_onhyperv.h                   |  20 +
 arch/x86/kvm/lapic.c                          |   5 +-
 arch/x86/kvm/svm/hyperv.h                     |   7 +
 arch/x86/kvm/svm/nested.c                     |  30 +-
 arch/x86/kvm/svm/svm.h                        |   2 +
 arch/x86/kvm/svm/svm_onhyperv.c               |  10 +-
 arch/x86/kvm/vmx/hyperv.c                     | 447 ------------------
 arch/x86/kvm/vmx/hyperv.h                     | 196 ++------
 arch/x86/kvm/vmx/hyperv_evmcs.c               | 315 ++++++++++++
 arch/x86/kvm/vmx/hyperv_evmcs.h               | 166 +++++++
 arch/x86/kvm/vmx/nested.c                     | 102 ++--
 arch/x86/kvm/vmx/nested.h                     |   3 +-
 arch/x86/kvm/vmx/vmx.c                        |  18 +-
 arch/x86/kvm/vmx/vmx.h                        |   2 +
 arch/x86/kvm/vmx/vmx_onhyperv.c               |  36 ++
 arch/x86/kvm/vmx/vmx_onhyperv.h               | 125 +++++
 arch/x86/kvm/vmx/vmx_ops.h                    |   2 +-
 arch/x86/kvm/x86.c                            |  66 ++-
 .../selftests/kvm/x86_64/hyperv_clock.c       |   2 +
 .../selftests/kvm/x86_64/hyperv_evmcs.c       |   5 +-
 .../kvm/x86_64/hyperv_extended_hypercalls.c   |   2 +
 .../selftests/kvm/x86_64/hyperv_features.c    |   2 +
 .../testing/selftests/kvm/x86_64/hyperv_ipi.c |   2 +
 .../selftests/kvm/x86_64/hyperv_svm_test.c    |   1 +
 .../selftests/kvm/x86_64/hyperv_tlb_flush.c   |   2 +
 .../kvm/x86_64/vmx_set_nested_state_test.c    |  16 +-
 33 files changed, 963 insertions(+), 734 deletions(-)
 create mode 100644 arch/x86/kvm/vmx/hyperv_evmcs.c
 create mode 100644 arch/x86/kvm/vmx/hyperv_evmcs.h
 create mode 100644 arch/x86/kvm/vmx/vmx_onhyperv.c
 create mode 100644 arch/x86/kvm/vmx/vmx_onhyperv.h

-- 
2.41.0

Powered by blists - more mailing lists