[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20250508141012.1411952-1-seanjc@google.com>
Date: Thu, 8 May 2025 07:10:07 -0700
From: Sean Christopherson <seanjc@...gle.com>
To: Paolo Bonzini <pbonzini@...hat.com>
Cc: kvm@...r.kernel.org, linux-kernel@...r.kernel.org,
Peter Xu <peterx@...hat.com>, Yan Zhao <yan.y.zhao@...el.com>,
Maxim Levitsky <mlevitsk@...hat.com>, Sean Christopherson <seanjc@...gle.com>
Subject: [PATCH v2 0/5] KVM: Dirty ring fixes and cleanups
Fix issues with dirty ring harvesting where KVM doesn't bound the processing
of entries in any way, which allows userspace to keep KVM in a tight loop
indefinitely.
E.g.
struct kvm_dirty_gfn *dirty_gfns = vcpu_map_dirty_ring(vcpu);
if (fork()) {
int r;
for (;;) {
r = kvm_vm_reset_dirty_ring(vcpu->vm);
if (r)
printf("RESET %d dirty ring entries\n", r);
}
} else {
int i;
for (i = 0; i < test_dirty_ring_count; i++) {
dirty_gfns[i].slot = TEST_MEM_SLOT_INDEX;
dirty_gfns[i].offset = (i * 64) % host_num_pages;
}
for (;;) {
for (i = 0; i < test_dirty_ring_count; i++)
WRITE_ONCE(dirty_gfns[i].flags, KVM_DIRTY_GFN_F_RESET);
}
}
Patches 1-3 address that class of bugs. Patches 4 and 5 are cleanups.
v2: Expand on comments in dirty ring harvesting code. [Yan]
v1: https://lore.kernel.org/all/20250111010409.1252942-1-seanjc@google.com
Sean Christopherson (5):
KVM: Bound the number of dirty ring entries in a single reset at
INT_MAX
KVM: Bail from the dirty ring reset flow if a signal is pending
KVM: Conditionally reschedule when resetting the dirty ring
KVM: Check for empty mask of harvested dirty ring entries in caller
KVM: Use mask of harvested dirty ring entries to coalesce dirty ring
resets
include/linux/kvm_dirty_ring.h | 8 ++-
virt/kvm/dirty_ring.c | 103 ++++++++++++++++++++++-----------
virt/kvm/kvm_main.c | 9 ++-
3 files changed, 81 insertions(+), 39 deletions(-)
base-commit: d1b88431c59e94799aff0e31ce1467af2a86b0cf
--
2.49.0.1015.ga840276032-goog
Powered by blists - more mailing lists