From: Sean Christopherson <seanjc@google.com>
To: Paolo Bonzini <pbonzini@redhat.com>
Cc: kvm@vger.kernel.org, linux-kernel@vger.kernel.org,
Peter Xu <peterx@redhat.com>, Yan Zhao <yan.y.zhao@intel.com>,
Maxim Levitsky <mlevitsk@redhat.com>,
Binbin Wu <binbin.wu@linux.intel.com>,
James Houghton <jthoughton@google.com>,
Sean Christopherson <seanjc@google.com>,
Pankaj Gupta <pankaj.gupta@amd.com>
Subject: [PATCH v3 0/6] KVM: Dirty ring fixes and cleanups
Date: Fri, 16 May 2025 14:35:34 -0700 [thread overview]
Message-ID: <20250516213540.2546077-1-seanjc@google.com> (raw)
Fix issues with dirty ring harvesting where KVM doesn't bound the processing
of entries in any way, which allows userspace to keep KVM in a tight loop
indefinitely.
E.g.
struct kvm_dirty_gfn *dirty_gfns = vcpu_map_dirty_ring(vcpu);
if (fork()) {
int r;
for (;;) {
r = kvm_vm_reset_dirty_ring(vcpu->vm);
if (r)
printf("RESET %d dirty ring entries\n", r);
}
} else {
int i;
for (i = 0; i < test_dirty_ring_count; i++) {
dirty_gfns[i].slot = TEST_MEM_SLOT_INDEX;
dirty_gfns[i].offset = (i * 64) % host_num_pages;
}
for (;;) {
for (i = 0; i < test_dirty_ring_count; i++)
WRITE_ONCE(dirty_gfns[i].flags, KVM_DIRTY_GFN_F_RESET);
}
}
Patches 1-3 address that class of bugs. Patches 4-6 are cleanups.
v3:
- Fix typos (I apparently can't spell opportunistically to save my life).
[Binbin, James]
- Clean up stale comments. [Binbin]
- Collect reviews. [James, Pankaj]
- Add a lockdep assertion on slots_lock, along with a comment. [James]
v2:
- https://lore.kernel.org/all/20250508141012.1411952-1-seanjc@google.com
- Expand on comments in dirty ring harvesting code. [Yan]
v1: https://lore.kernel.org/all/20250111010409.1252942-1-seanjc@google.com
Sean Christopherson (6):
KVM: Bound the number of dirty ring entries in a single reset at
INT_MAX
KVM: Bail from the dirty ring reset flow if a signal is pending
KVM: Conditionally reschedule when resetting the dirty ring
KVM: Check for empty mask of harvested dirty ring entries in caller
KVM: Use mask of harvested dirty ring entries to coalesce dirty ring
resets
KVM: Assert that slots_lock is held when resetting per-vCPU dirty
rings
include/linux/kvm_dirty_ring.h | 18 ++----
virt/kvm/dirty_ring.c | 111 +++++++++++++++++++++++----------
virt/kvm/kvm_main.c | 9 ++-
3 files changed, 89 insertions(+), 49 deletions(-)
base-commit: 7ef51a41466bc846ad794d505e2e34ff97157f7f
--
2.49.0.1112.g889b7c5bd8-goog
next reply other threads:[~2025-05-16 21:35 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-05-16 21:35 Sean Christopherson [this message]
2025-05-16 21:35 ` [PATCH v3 1/6] KVM: Bound the number of dirty ring entries in a single reset at INT_MAX Sean Christopherson
2025-05-20 6:51 ` Binbin Wu
2025-05-16 21:35 ` [PATCH v3 2/6] KVM: Bail from the dirty ring reset flow if a signal is pending Sean Christopherson
2025-05-20 6:53 ` Binbin Wu
2025-05-16 21:35 ` [PATCH v3 3/6] KVM: Conditionally reschedule when resetting the dirty ring Sean Christopherson
2025-05-16 21:35 ` [PATCH v3 4/6] KVM: Check for empty mask of harvested dirty ring entries in caller Sean Christopherson
2025-05-20 6:56 ` Binbin Wu
2025-05-21 9:16 ` Yan Zhao
2025-05-21 14:55 ` Sean Christopherson
2025-05-16 21:35 ` [PATCH v3 5/6] KVM: Use mask of harvested dirty ring entries to coalesce dirty ring resets Sean Christopherson
2025-05-20 6:58 ` Binbin Wu
2025-05-21 9:16 ` Yan Zhao
2025-05-21 14:54 ` Sean Christopherson
2025-05-21 19:45 ` Sean Christopherson
2025-05-22 1:04 ` Yan Zhao
2025-05-16 21:35 ` [PATCH v3 6/6] KVM: Assert that slots_lock is held when resetting per-vCPU dirty rings Sean Christopherson
2025-05-20 7:04 ` Binbin Wu
2025-05-20 19:12 ` [PATCH v3 0/6] KVM: Dirty ring fixes and cleanups Peter Xu
2025-05-20 23:16 ` Sean Christopherson
2025-05-20 23:51 ` Peter Xu
2025-05-21 14:50 ` Sean Christopherson
2025-05-21 15:24 ` Peter Xu
2025-05-21 9:21 ` Yan Zhao
2025-06-24 19:36 ` Sean Christopherson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250516213540.2546077-1-seanjc@google.com \
--to=seanjc@google.com \
--cc=binbin.wu@linux.intel.com \
--cc=jthoughton@google.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mlevitsk@redhat.com \
--cc=pankaj.gupta@amd.com \
--cc=pbonzini@redhat.com \
--cc=peterx@redhat.com \
--cc=yan.y.zhao@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®