Hyper-V emulation is enabled in KVM unconditionally even for Linux guests.
This is bad at least from security standpoint as it is an extra attack
surface. Ideally, there should be a per-VM capability explicitly enabled by
VMM but currently it is not the case and we can't mandate one without
breaking backwards compatibility. We can, however, check guest visible CPUIDs
and only enable Hyper-V emulation when "Hv#1" interface was exposed in
HYPERV_CPUID_INTERFACE.
Also (and while on it) per-vcpu Hyper-V context ('struct kvm_vcpu_hv') is
currently part of 'struct kvm_vcpu_arch' and thus allocated unconditionally
for each vCPU. The context, however, quite big and accounts for more than
1/4 of 'struct kvm_vcpu_arch' (e.g. 2912/9512 bytes). Switch to allocating
it dynamically. This may come handy if we ever decide to raise KVM_MAX_VCPUS
(and rumor has it some downstream distributions already have more than '288')
Vitaly Kuznetsov (7):
selftests: kvm: Move kvm_get_supported_hv_cpuid() to common code
selftests: kvm: Properly set Hyper-V CPUIDs in evmcs_test
KVM: x86: hyper-v: Always use vcpu_to_hv_vcpu() accessor to get to
'struct kvm_vcpu_hv'
KVM: x86: hyper-v: Prepare to meet unallocated Hyper-V context
KVM: x86: hyper-v: Allocate 'struct kvm_vcpu_hv' dynamically
KVM: x86: hyper-v: Make Hyper-V emulation enablement conditional
KVM: x86: hyper-v: Allocate Hyper-V context lazily
arch/x86/include/asm/kvm_host.h | 4 +-
arch/x86/kvm/cpuid.c | 2 +
arch/x86/kvm/hyperv.c | 104 +++++++++++++-----
arch/x86/kvm/hyperv.h | 30 +++--
arch/x86/kvm/lapic.c | 6 +-
arch/x86/kvm/lapic.h | 6 +-
arch/x86/kvm/vmx/vmx.c | 7 +-
arch/x86/kvm/x86.c | 17 +--
.../selftests/kvm/include/x86_64/processor.h | 3 +
.../selftests/kvm/lib/x86_64/processor.c | 33 ++++++
.../testing/selftests/kvm/x86_64/evmcs_test.c | 39 ++++++-
.../selftests/kvm/x86_64/hyperv_cpuid.c | 31 +-----
12 files changed, 203 insertions(+), 79 deletions(-)
--
2.29.2
