iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

KVM: selftests: Extend x86's sync_regs_test to check for event vector races

Browse Source 
Attempt to modify the to-be-injected exception vector to an illegal value
_after_ the sanity checks performed by KVM_CAP_SYNC_REGS's
arch/x86/kvm/x86.c:kvm_vcpu_ioctl_x86_set_vcpu_events().  Buggy KVM
versions will eventually yells loudly about attempting to inject a bogus
vector, e.g.

  WARNING: CPU: 0 PID: 1107 at arch/x86/kvm/x86.c:547 kvm_check_and_inject_events+0x4a0/0x500 [kvm]

  arch/x86/kvm/x86.c:exception_type():
  WARN_ON(vector > 31 || vector == NMI_VECTOR)

Signed-off-by: Michal Luczaj <mhal@rbox.co>
Link: https://lore.kernel.org/r/20230728001606.2275586-3-mhal@rbox.co
[sean: split to separate patch]
Signed-off-by: Sean Christopherson <seanjc@google.com>
This commit is contained in:
Michal Luczaj 2023-07-28 02:12:58 +02:00 committed by Sean Christopherson
parent ae895cbe61
commit 60c4063b47
1 changed files with 22 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
tools/testing/selftests/kvm/x86_64/sync_regs_test.c
View File

@ -81,6 +81,27 @@ static void compare_vcpu_events(struct kvm_vcpu_events *left,
#define TEST_SYNC_FIELDS (KVM_SYNC_X86_REGS|KVM_SYNC_X86_SREGS|KVM_SYNC_X86_EVENTS)
#define INVALID_SYNC_FIELD 0x80000000
/*
* Set an invalid exception vector while KVM is processing events. KVM is
* supposed to reject any vector >= 32, as well as NMIs (vector 2).
*/
static void *race_events_exc(void *arg)
{
struct kvm_run *run = (struct kvm_run *)arg;
struct kvm_vcpu_events *events = &run->s.regs.events;
for (;;) {
WRITE_ONCE(run->kvm_dirty_regs, KVM_SYNC_X86_EVENTS);
WRITE_ONCE(events->flags, 0);
WRITE_ONCE(events->exception.pending, 1);
WRITE_ONCE(events->exception.nr, 255);
pthread_testcancel();
}
return NULL;
}
/*
* Toggle CR4.PAE while KVM is processing SREGS, EFER.LME=1 with CR4.PAE=0 is
* illegal, and KVM's MMU heavily relies on vCPU state being valid.
@ -289,6 +310,7 @@ int main(int argc, char *argv[])
kvm_vm_free(vm);
race_sync_regs(race_sregs_cr4);
race_sync_regs(race_events_exc);
return 0;
}