diff options
| author | Michal Luczaj <mhal@rbox.co> | 2023-07-28 02:12:58 +0200 |
|---|---|---|
| committer | Sean Christopherson <seanjc@google.com> | 2023-08-02 13:33:20 -0700 |
| commit | 60c4063b475215321fc63ab253c9a840bb664f35 (patch) | |
| tree | 7296e3c7824133952460147df9b8a596921e66a3 | |
| parent | ae895cbe613a5b193f3953c90c075306bfa4d30b (diff) | |
KVM: selftests: Extend x86's sync_regs_test to check for event vector races
Attempt to modify the to-be-injected exception vector to an illegal value
_after_ the sanity checks performed by KVM_CAP_SYNC_REGS's
arch/x86/kvm/x86.c:kvm_vcpu_ioctl_x86_set_vcpu_events(). Buggy KVM
versions will eventually yells loudly about attempting to inject a bogus
vector, e.g.
WARNING: CPU: 0 PID: 1107 at arch/x86/kvm/x86.c:547 kvm_check_and_inject_events+0x4a0/0x500 [kvm]
arch/x86/kvm/x86.c:exception_type():
WARN_ON(vector > 31 || vector == NMI_VECTOR)
Signed-off-by: Michal Luczaj <mhal@rbox.co>
Link: https://lore.kernel.org/r/20230728001606.2275586-3-mhal@rbox.co
[sean: split to separate patch]
Signed-off-by: Sean Christopherson <seanjc@google.com>
| -rw-r--r-- | tools/testing/selftests/kvm/x86_64/sync_regs_test.c | 22 |
1 files changed, 22 insertions, 0 deletions
diff --git a/tools/testing/selftests/kvm/x86_64/sync_regs_test.c b/tools/testing/selftests/kvm/x86_64/sync_regs_test.c index 13ac3ae8e704..e4ff2eaad7cd 100644 --- a/tools/testing/selftests/kvm/x86_64/sync_regs_test.c +++ b/tools/testing/selftests/kvm/x86_64/sync_regs_test.c @@ -82,6 +82,27 @@ static void compare_vcpu_events(struct kvm_vcpu_events *left, #define INVALID_SYNC_FIELD 0x80000000 /* + * Set an invalid exception vector while KVM is processing events. KVM is + * supposed to reject any vector >= 32, as well as NMIs (vector 2). + */ +static void *race_events_exc(void *arg) +{ + struct kvm_run *run = (struct kvm_run *)arg; + struct kvm_vcpu_events *events = &run->s.regs.events; + + for (;;) { + WRITE_ONCE(run->kvm_dirty_regs, KVM_SYNC_X86_EVENTS); + WRITE_ONCE(events->flags, 0); + WRITE_ONCE(events->exception.pending, 1); + WRITE_ONCE(events->exception.nr, 255); + + pthread_testcancel(); + } + + return NULL; +} + +/* * Toggle CR4.PAE while KVM is processing SREGS, EFER.LME=1 with CR4.PAE=0 is * illegal, and KVM's MMU heavily relies on vCPU state being valid. */ @@ -289,6 +310,7 @@ int main(int argc, char *argv[]) kvm_vm_free(vm); race_sync_regs(race_sregs_cr4); + race_sync_regs(race_events_exc); return 0; } |