| Message ID | 20221209015307.1781352-8-oliver.upton@linux.dev (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | KVM: selftests: Fixes for ucall pool + page_fault_test | expand |
On Fri, Dec 09, 2022, Oliver Upton wrote: > Guest assertions depend on successfully allocating a ucall structure. As > such, the use of guest assertions when ucall_alloc() fails simply leads > to an infinite loop in guest code. > > Use GUEST_UCALL_NONE() to indicate failure instead. Though not > technically necessary, use a goto to have a single callsite and an > associated comment about why assertions don't work here. It isn't > perfect, at least the poor developer gets some signal out of the > guest... > > Fixes: 426729b2cf2e ("KVM: selftests: Add ucall pool based implementation") > Signed-off-by: Oliver Upton <oliver.upton@linux.dev> > --- > tools/testing/selftests/kvm/lib/ucall_common.c | 12 ++++++++++-- > 1 file changed, 10 insertions(+), 2 deletions(-) > > diff --git a/tools/testing/selftests/kvm/lib/ucall_common.c b/tools/testing/selftests/kvm/lib/ucall_common.c > index 0cc0971ce60e..e8370da3de24 100644 > --- a/tools/testing/selftests/kvm/lib/ucall_common.c > +++ b/tools/testing/selftests/kvm/lib/ucall_common.c > @@ -41,7 +41,8 @@ static struct ucall *ucall_alloc(void) > struct ucall *uc; > int i; > > - GUEST_ASSERT(ucall_pool); > + if (!ucall_pool) > + goto out; > > for (i = 0; i < KVM_MAX_VCPUS; ++i) { > if (!test_and_set_bit(i, ucall_pool->in_use)) { > @@ -51,7 +52,14 @@ static struct ucall *ucall_alloc(void) > } > } > > - GUEST_ASSERT(0); > +out: > + /* > + * If the guest cannot grab a ucall structure from the pool then the > + * only option to get out to userspace is a bare ucall. This is probably > + * a good time to mention that guest assertions depend on ucalls with > + * arguments too. > + */ > + GUEST_UCALL_NONE(); UCALL_NONE isn't much better than infinite stack recursion, e.g. a test might end up passing by dumb luck, or go in the wrong direction because it sometimes handles UCALL_NONE. How about this? From: Sean Christopherson <seanjc@google.com> Date: Fri, 9 Dec 2022 12:55:44 -0800 Subject: [PATCH] KVM: selftests: Use magic value to signal ucall_alloc() failure Use a magic value to signal a ucall_alloc() failure instead of simply doing GUEST_ASSERT(). GUEST_ASSERT() relies on ucall_alloc() and so a failure puts the guest into an infinite loop. Use -1 as the magic value, as a real ucall struct should never wrap. Reported-by: Oliver Upton <oliver.upton@linux.dev> Signed-off-by: Sean Christopherson <seanjc@google.com> --- tools/testing/selftests/kvm/lib/ucall_common.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/tools/testing/selftests/kvm/lib/ucall_common.c b/tools/testing/selftests/kvm/lib/ucall_common.c index 0cc0971ce60e..2f0e2ea941cc 100644 --- a/tools/testing/selftests/kvm/lib/ucall_common.c +++ b/tools/testing/selftests/kvm/lib/ucall_common.c @@ -4,6 +4,8 @@ #include "linux/bitmap.h" #include "linux/atomic.h" +#define GUEST_UCALL_FAILED -1 + struct ucall_header { DECLARE_BITMAP(in_use, KVM_MAX_VCPUS); struct ucall ucalls[KVM_MAX_VCPUS]; @@ -41,7 +43,8 @@ static struct ucall *ucall_alloc(void) struct ucall *uc; int i; - GUEST_ASSERT(ucall_pool); + if (!ucall_pool) + goto ucall_failed; for (i = 0; i < KVM_MAX_VCPUS; ++i) { if (!test_and_set_bit(i, ucall_pool->in_use)) { @@ -51,7 +54,13 @@ static struct ucall *ucall_alloc(void) } } - GUEST_ASSERT(0); +ucall_failed: + /* + * If the vCPU cannot grab a ucall structure, make a bare ucall with a + * magic value to signal to get_ucall() that things went sideways. + * GUEST_ASSERT() depends on ucall_alloc() and so cannot be used here. + */ + ucall_arch_do_ucall(GUEST_UCALL_FAILED); return NULL; } @@ -93,6 +102,9 @@ uint64_t get_ucall(struct kvm_vcpu *vcpu, struct ucall *uc) addr = ucall_arch_get_ucall(vcpu); if (addr) { + TEST_ASSERT(addr != (void *)GUEST_UCALL_FAILED, + "Guest failed to allocate ucall struct"); + memcpy(uc, addr, sizeof(*uc)); vcpu_run_complete_io(vcpu); } else { base-commit: dc2efbe4813e0dc4368779bc36c5f0e636cb8eb2 --
On Fri, Dec 09, 2022 at 09:03:45PM +0000, Sean Christopherson wrote: [...] > > - GUEST_ASSERT(0); > > +out: > > + /* > > + * If the guest cannot grab a ucall structure from the pool then the > > + * only option to get out to userspace is a bare ucall. This is probably > > + * a good time to mention that guest assertions depend on ucalls with > > + * arguments too. > > + */ > > + GUEST_UCALL_NONE(); > > UCALL_NONE isn't much better than infinite stack recursion, e.g. a test might end > up passing by dumb luck, or go in the wrong direction because it sometimes handles > UCALL_NONE. Oh, I was just seeking an end to my misery. Yeah, we can use a magic value to signal this instead. > How about this? LGTM. -- Thanks, Oliver > From: Sean Christopherson <seanjc@google.com> > Date: Fri, 9 Dec 2022 12:55:44 -0800 > Subject: [PATCH] KVM: selftests: Use magic value to signal ucall_alloc() > failure > > Use a magic value to signal a ucall_alloc() failure instead of simply > doing GUEST_ASSERT(). GUEST_ASSERT() relies on ucall_alloc() and so a > failure puts the guest into an infinite loop. > > Use -1 as the magic value, as a real ucall struct should never wrap. > > Reported-by: Oliver Upton <oliver.upton@linux.dev> > Signed-off-by: Sean Christopherson <seanjc@google.com> > --- > tools/testing/selftests/kvm/lib/ucall_common.c | 16 ++++++++++++++-- > 1 file changed, 14 insertions(+), 2 deletions(-) > > diff --git a/tools/testing/selftests/kvm/lib/ucall_common.c b/tools/testing/selftests/kvm/lib/ucall_common.c > index 0cc0971ce60e..2f0e2ea941cc 100644 > --- a/tools/testing/selftests/kvm/lib/ucall_common.c > +++ b/tools/testing/selftests/kvm/lib/ucall_common.c > @@ -4,6 +4,8 @@ > #include "linux/bitmap.h" > #include "linux/atomic.h" > > +#define GUEST_UCALL_FAILED -1 > + > struct ucall_header { > DECLARE_BITMAP(in_use, KVM_MAX_VCPUS); > struct ucall ucalls[KVM_MAX_VCPUS]; > @@ -41,7 +43,8 @@ static struct ucall *ucall_alloc(void) > struct ucall *uc; > int i; > > - GUEST_ASSERT(ucall_pool); > + if (!ucall_pool) > + goto ucall_failed; > > for (i = 0; i < KVM_MAX_VCPUS; ++i) { > if (!test_and_set_bit(i, ucall_pool->in_use)) { > @@ -51,7 +54,13 @@ static struct ucall *ucall_alloc(void) > } > } > > - GUEST_ASSERT(0); > +ucall_failed: > + /* > + * If the vCPU cannot grab a ucall structure, make a bare ucall with a > + * magic value to signal to get_ucall() that things went sideways. > + * GUEST_ASSERT() depends on ucall_alloc() and so cannot be used here. > + */ > + ucall_arch_do_ucall(GUEST_UCALL_FAILED); > return NULL; > } > > @@ -93,6 +102,9 @@ uint64_t get_ucall(struct kvm_vcpu *vcpu, struct ucall *uc) > > addr = ucall_arch_get_ucall(vcpu); > if (addr) { > + TEST_ASSERT(addr != (void *)GUEST_UCALL_FAILED, > + "Guest failed to allocate ucall struct"); > + > memcpy(uc, addr, sizeof(*uc)); > vcpu_run_complete_io(vcpu); > } else { > > base-commit: dc2efbe4813e0dc4368779bc36c5f0e636cb8eb2 > -- >
On 12/9/22 22:03, Sean Christopherson wrote: > From: Sean Christopherson<seanjc@google.com> > Date: Fri, 9 Dec 2022 12:55:44 -0800 > Subject: [PATCH] KVM: selftests: Use magic value to signal ucall_alloc() > failure > > Use a magic value to signal a ucall_alloc() failure instead of simply > doing GUEST_ASSERT(). GUEST_ASSERT() relies on ucall_alloc() and so a > failure puts the guest into an infinite loop. > > Use -1 as the magic value, as a real ucall struct should never wrap. > > Reported-by: Oliver Upton<oliver.upton@linux.dev> > Signed-off-by: Sean Christopherson<seanjc@google.com> > --- > tools/testing/selftests/kvm/lib/ucall_common.c | 16 ++++++++++++++-- > 1 file changed, 14 insertions(+), 2 deletions(-) > > diff --git a/tools/testing/selftests/kvm/lib/ucall_common.c b/tools/testing/selftests/kvm/lib/ucall_common.c > index 0cc0971ce60e..2f0e2ea941cc 100644 > --- a/tools/testing/selftests/kvm/lib/ucall_common.c > +++ b/tools/testing/selftests/kvm/lib/ucall_common.c > @@ -4,6 +4,8 @@ > #include "linux/bitmap.h" > #include "linux/atomic.h" > > +#define GUEST_UCALL_FAILED -1 > + > struct ucall_header { > DECLARE_BITMAP(in_use, KVM_MAX_VCPUS); > struct ucall ucalls[KVM_MAX_VCPUS]; > @@ -41,7 +43,8 @@ static struct ucall *ucall_alloc(void) > struct ucall *uc; > int i; > > - GUEST_ASSERT(ucall_pool); > + if (!ucall_pool) > + goto ucall_failed; > > for (i = 0; i < KVM_MAX_VCPUS; ++i) { > if (!test_and_set_bit(i, ucall_pool->in_use)) { > @@ -51,7 +54,13 @@ static struct ucall *ucall_alloc(void) > } > } > > - GUEST_ASSERT(0); > +ucall_failed: > + /* > + * If the vCPU cannot grab a ucall structure, make a bare ucall with a > + * magic value to signal to get_ucall() that things went sideways. > + * GUEST_ASSERT() depends on ucall_alloc() and so cannot be used here. > + */ > + ucall_arch_do_ucall(GUEST_UCALL_FAILED); > return NULL; > } > > @@ -93,6 +102,9 @@ uint64_t get_ucall(struct kvm_vcpu *vcpu, struct ucall *uc) > > addr = ucall_arch_get_ucall(vcpu); > if (addr) { > + TEST_ASSERT(addr != (void *)GUEST_UCALL_FAILED, > + "Guest failed to allocate ucall struct"); > + > memcpy(uc, addr, sizeof(*uc)); > vcpu_run_complete_io(vcpu); > } else { > > base-commit: dc2efbe4813e0dc4368779bc36c5f0e636cb8eb2 > -- Queued, thanks. Paolo
diff --git a/tools/testing/selftests/kvm/lib/ucall_common.c b/tools/testing/selftests/kvm/lib/ucall_common.c index 0cc0971ce60e..e8370da3de24 100644 --- a/tools/testing/selftests/kvm/lib/ucall_common.c +++ b/tools/testing/selftests/kvm/lib/ucall_common.c @@ -41,7 +41,8 @@ static struct ucall *ucall_alloc(void) struct ucall *uc; int i; - GUEST_ASSERT(ucall_pool); + if (!ucall_pool) + goto out; for (i = 0; i < KVM_MAX_VCPUS; ++i) { if (!test_and_set_bit(i, ucall_pool->in_use)) { @@ -51,7 +52,14 @@ static struct ucall *ucall_alloc(void) } } - GUEST_ASSERT(0); +out: + /* + * If the guest cannot grab a ucall structure from the pool then the + * only option to get out to userspace is a bare ucall. This is probably + * a good time to mention that guest assertions depend on ucalls with + * arguments too. + */ + GUEST_UCALL_NONE(); return NULL; }
Guest assertions depend on successfully allocating a ucall structure. As such, the use of guest assertions when ucall_alloc() fails simply leads to an infinite loop in guest code. Use GUEST_UCALL_NONE() to indicate failure instead. Though not technically necessary, use a goto to have a single callsite and an associated comment about why assertions don't work here. It isn't perfect, at least the poor developer gets some signal out of the guest... Fixes: 426729b2cf2e ("KVM: selftests: Add ucall pool based implementation") Signed-off-by: Oliver Upton <oliver.upton@linux.dev> --- tools/testing/selftests/kvm/lib/ucall_common.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)