lkml.org 
[lkml]   [2021]   [Jun]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [PATCH v2 00/30] KVM: x86: hyper-v: Fine-grained access check to Hyper-V hypercalls and MSRs
    From
    Date
    On 21/05/21 11:51, Vitaly Kuznetsov wrote:
    > Changes since v1:
    > - Rebase to kvm/next.
    >
    > Original description:
    >
    > Currently, all implemented Hyper-V features (MSRs and hypercalls) are
    > available unconditionally to all Hyper-V enabled guests. This is not
    > ideal as KVM userspace may decide to provide only a subset of the
    > currently implemented features to emulate an older Hyper-V version,
    > to reduce attack surface,... Implement checks against guest visible
    > CPUIDs for all currently implemented MSRs and hypercalls.
    >
    > Vitaly Kuznetsov (30):
    > asm-generic/hyperv: add HV_STATUS_ACCESS_DENIED definition
    > KVM: x86: hyper-v: Introduce KVM_CAP_HYPERV_ENFORCE_CPUID
    > KVM: x86: hyper-v: Cache guest CPUID leaves determining features
    > availability
    > KVM: x86: hyper-v: Prepare to check access to Hyper-V MSRs
    > KVM: x86: hyper-v: Honor HV_MSR_HYPERCALL_AVAILABLE privilege bit
    > KVM: x86: hyper-v: Honor HV_MSR_VP_RUNTIME_AVAILABLE privilege bit
    > KVM: x86: hyper-v: Honor HV_MSR_TIME_REF_COUNT_AVAILABLE privilege bit
    > KVM: x86: hyper-v: Honor HV_MSR_VP_INDEX_AVAILABLE privilege bit
    > KVM: x86: hyper-v: Honor HV_MSR_RESET_AVAILABLE privilege bit
    > KVM: x86: hyper-v: Honor HV_MSR_REFERENCE_TSC_AVAILABLE privilege bit
    > KVM: x86: hyper-v: Honor HV_MSR_SYNIC_AVAILABLE privilege bit
    > KVM: x86: hyper-v: Honor HV_MSR_SYNTIMER_AVAILABLE privilege bit
    > KVM: x86: hyper-v: Honor HV_MSR_APIC_ACCESS_AVAILABLE privilege bit
    > KVM: x86: hyper-v: Honor HV_ACCESS_FREQUENCY_MSRS privilege bit
    > KVM: x86: hyper-v: Honor HV_ACCESS_REENLIGHTENMENT privilege bit
    > KVM: x86: hyper-v: Honor HV_FEATURE_GUEST_CRASH_MSR_AVAILABLE
    > privilege bit
    > KVM: x86: hyper-v: Honor HV_FEATURE_DEBUG_MSRS_AVAILABLE privilege bit
    > KVM: x86: hyper-v: Inverse the default in hv_check_msr_access()
    > KVM: x86: hyper-v: Honor HV_STIMER_DIRECT_MODE_AVAILABLE privilege bit
    > KVM: x86: hyper-v: Prepare to check access to Hyper-V hypercalls
    > KVM: x86: hyper-v: Check access to HVCALL_NOTIFY_LONG_SPIN_WAIT
    > hypercall
    > KVM: x86: hyper-v: Honor HV_POST_MESSAGES privilege bit
    > KVM: x86: hyper-v: Honor HV_SIGNAL_EVENTS privilege bit
    > KVM: x86: hyper-v: Honor HV_DEBUGGING privilege bit
    > KVM: x86: hyper-v: Honor HV_X64_REMOTE_TLB_FLUSH_RECOMMENDED bit
    > KVM: x86: hyper-v: Honor HV_X64_CLUSTER_IPI_RECOMMENDED bit
    > KVM: x86: hyper-v: Honor HV_X64_EX_PROCESSOR_MASKS_RECOMMENDED bit
    > KVM: selftests: move Hyper-V MSR definitions to hyperv.h
    > KVM: selftests: Move evmcs.h to x86_64/
    > KVM: selftests: Introduce hyperv_features test
    >
    > Documentation/virt/kvm/api.rst | 11 +
    > arch/x86/include/asm/kvm_host.h | 9 +
    > arch/x86/kvm/hyperv.c | 216 +++++-
    > arch/x86/kvm/hyperv.h | 1 +
    > arch/x86/kvm/x86.c | 4 +
    > include/asm-generic/hyperv-tlfs.h | 1 +
    > include/uapi/linux/kvm.h | 1 +
    > tools/testing/selftests/kvm/.gitignore | 1 +
    > tools/testing/selftests/kvm/Makefile | 1 +
    > .../kvm/include/{ => x86_64}/evmcs.h | 2 +-
    > .../selftests/kvm/include/x86_64/hyperv.h | 185 +++++
    > .../selftests/kvm/x86_64/hyperv_clock.c | 8 +-
    > .../selftests/kvm/x86_64/hyperv_features.c | 649 ++++++++++++++++++
    > 13 files changed, 1071 insertions(+), 18 deletions(-)
    > rename tools/testing/selftests/kvm/include/{ => x86_64}/evmcs.h (99%)
    > create mode 100644 tools/testing/selftests/kvm/include/x86_64/hyperv.h
    > create mode 100644 tools/testing/selftests/kvm/x86_64/hyperv_features.c
    >

    Queued, thanks.

    Paolo

    \
     
     \ /
      Last update: 2021-06-10 17:31    [W:3.597 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site