linux-kernel - Re: [PATCH 06/10] KVM: selftests: Add "delete" testcase to set_memory_region

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 14 Apr 2020 18:29:08 +0200
From:   Andrew Jones <drjones@...hat.com>
To:     Sean Christopherson <sean.j.christopherson@...el.com>
Cc:     Paolo Bonzini <pbonzini@...hat.com>,
        Christian Borntraeger <borntraeger@...ibm.com>,
        Janosch Frank <frankja@...ux.ibm.com>,
        David Hildenbrand <david@...hat.com>,
        Cornelia Huck <cohuck@...hat.com>, kvm@...r.kernel.org,
        linux-kernel@...r.kernel.org, Peter Xu <peterx@...hat.com>,
        Wainer dos Santos Moschetta <wainersm@...hat.com>
Subject: Re: [PATCH 06/10] KVM: selftests: Add "delete" testcase to
 set_memory_region_test

On Tue, Apr 14, 2020 at 06:19:00PM +0200, Andrew Jones wrote:
> On Fri, Apr 10, 2020 at 04:17:03PM -0700, Sean Christopherson wrote:
> > Add a testcase for deleting memslots while the guest is running.
> > Like the "move" testcase, this is x86_64-only as it relies on MMIO
> > happening when a non-existent memslot is encountered.
> > 
> > Signed-off-by: Sean Christopherson <sean.j.christopherson@...el.com>
> > ---
> >  .../kvm/x86_64/set_memory_region_test.c       | 91 +++++++++++++++++++
> >  1 file changed, 91 insertions(+)
> > 
> > diff --git a/tools/testing/selftests/kvm/x86_64/set_memory_region_test.c b/tools/testing/selftests/kvm/x86_64/set_memory_region_test.c
> > index 629dd8579b73..b556024af683 100644
> > --- a/tools/testing/selftests/kvm/x86_64/set_memory_region_test.c
> > +++ b/tools/testing/selftests/kvm/x86_64/set_memory_region_test.c
> > @@ -29,6 +29,9 @@
> >  
> >  static const uint64_t MMIO_VAL = 0xbeefull;
> >  
> > +extern const uint64_t final_rip_start;
> > +extern const uint64_t final_rip_end;
> > +
> >  static sem_t vcpu_ready;
> >  
> >  static inline uint64_t guest_spin_on_val(uint64_t spin_val)
> 
> We don't have guest_spin_on_val(), so it looks like this patch applies
> on the older version of this series? But I don't know where
> wait_for_vcpu() called below comes from.

Eh, never mind. I skipped over the patch where these were introduced by
accidentally marking it as read.

I'll look tomorrow.

Thanks,
drew

> 
> Thanks,
> drew
> 
> 
> > @@ -203,6 +206,89 @@ static void test_move_memory_region(void)
> >  	kvm_vm_free(vm);
> >  }
> >  
> > +static void guest_code_delete_memory_region(void)
> > +{
> > +	uint64_t val;
> > +
> > +	GUEST_SYNC(0);
> > +
> > +	/* Spin until the memory region is deleted. */
> > +	val = guest_spin_on_val(0);
> > +	GUEST_ASSERT_1(val == MMIO_VAL, val);
> > +
> > +	/* Spin until the memory region is recreated. */
> > +	val = guest_spin_on_val(MMIO_VAL);
> > +	GUEST_ASSERT_1(val == 0, val);
> > +
> > +	/* Spin until the memory region is deleted. */
> > +	val = guest_spin_on_val(0);
> > +	GUEST_ASSERT_1(val == MMIO_VAL, val);
> > +
> > +	asm("1:\n\t"
> > +	    ".pushsection .rodata\n\t"
> > +	    ".global final_rip_start\n\t"
> > +	    "final_rip_start: .quad 1b\n\t"
> > +	    ".popsection");
> > +
> > +	/* Spin indefinitely (until the code memslot is deleted). */
> > +	guest_spin_on_val(MMIO_VAL);
> > +
> > +	asm("1:\n\t"
> > +	    ".pushsection .rodata\n\t"
> > +	    ".global final_rip_end\n\t"
> > +	    "final_rip_end: .quad 1b\n\t"
> > +	    ".popsection");
> > +
> > +	GUEST_ASSERT_1(0, 0);
> > +}
> > +
> > +static void test_delete_memory_region(void)
> > +{
> > +	pthread_t vcpu_thread;
> > +	struct kvm_regs regs;
> > +	struct kvm_run *run;
> > +	struct kvm_vm *vm;
> > +
> > +	vm = spawn_vm(&vcpu_thread, guest_code_delete_memory_region);
> > +
> > +	/* Delete the memory region, the guest should not die. */
> > +	vm_mem_region_delete(vm, MEM_REGION_SLOT);
> > +	wait_for_vcpu();
> > +
> > +	/* Recreate the memory region.  The guest should see "0". */
> > +	vm_userspace_mem_region_add(vm, VM_MEM_SRC_ANONYMOUS_THP,
> > +				    MEM_REGION_GPA, MEM_REGION_SLOT,
> > +				    MEM_REGION_SIZE / getpagesize(), 0);
> > +	wait_for_vcpu();
> > +
> > +	/* Delete the region again so that there's only one memslot left. */
> > +	vm_mem_region_delete(vm, MEM_REGION_SLOT);
> > +	wait_for_vcpu();
> > +
> > +	/*
> > +	 * Delete the primary memslot.  This should cause an emulation error or
> > +	 * shutdown due to the page tables getting nuked.
> > +	 */
> > +	vm_mem_region_delete(vm, 0);
> > +
> > +	pthread_join(vcpu_thread, NULL);
> > +
> > +	run = vcpu_state(vm, VCPU_ID);
> > +
> > +	TEST_ASSERT(run->exit_reason == KVM_EXIT_SHUTDOWN ||
> > +		    run->exit_reason == KVM_EXIT_INTERNAL_ERROR,
> > +		    "Unexpected exit reason = %d", run->exit_reason);
> > +
> > +	vcpu_regs_get(vm, VCPU_ID, &regs);
> > +
> > +	TEST_ASSERT(regs.rip >= final_rip_start &&
> > +		    regs.rip < final_rip_end,
> > +		    "Bad rip, expected 0x%lx - 0x%lx, got 0x%llx\n",
> > +		    final_rip_start, final_rip_end, regs.rip);
> > +
> > +	kvm_vm_free(vm);
> > +}
> > +
> >  int main(int argc, char *argv[])
> >  {
> >  	int i, loops;
> > @@ -215,8 +301,13 @@ int main(int argc, char *argv[])
> >  	else
> >  		loops = 10;
> >  
> > +	pr_info("Testing MOVE of in-use region, %d loops\n", loops);
> >  	for (i = 0; i < loops; i++)
> >  		test_move_memory_region();
> >  
> > +	pr_info("Testing DELETE of in-use region, %d loops\n", loops);
> > +	for (i = 0; i < loops; i++)
> > +		test_delete_memory_region();
> > +
> >  	return 0;
> >  }
> > -- 
> > 2.26.0
> > 
>