Re: [PATCH v2 2/2] KVM: selftests: Test that KVM_RUN fails for unresolvable host faults

[Sean Christopherson <seanjc@google.com>]

On Tue, Oct 20, 2026, Christian Borntraeger wrote:
> Add a test in which the guest writes to a shmem-backed memslot beyond
> the end of the file.  KVM_RUN must fail with -EFAULT.
> 
> On x86 the guest enables interrupts, and on s390 the test sets up
> pfault, so that KVM could handle the fault with an asynchronous page
> fault.  If KVM mistakes the error for a fault that needs I/O, the vCPU
> retries the access forever, and the test fails after a timeout.
> 
> The test is not built for LoongArch, which handles a failed mapping as
> an MMIO access.
> 
> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
> ---
>  tools/testing/selftests/kvm/Makefile.kvm      |   1 +
>  .../selftests/kvm/faultin_sigbus_test.c       | 169 ++++++++++++++++++

The "sigbus" part of this is confusing, because there is never actually a sigbus.
Kinda silly, but maybe faultin_efault_test?

> +static void arch_enable_async_pf(struct kvm_vm *vm, struct kvm_vcpu *vcpu)
> +{

...

> +}
> +#else
> +/* x86 needs guest interrupts on, see guest_code(); nothing to do elsewhere. */
> +static void arch_enable_async_pf(struct kvm_vm *vm, struct kvm_vcpu *vcpu)

Nit, maybe arch_enable_host_async_pf()?  Because x86 has PV async #PFs, where
instead of scheduling a worker task in the host, KVM (conditionally) reflects
the #PF into the guest so that the guest can schedule in a different task.  A
lot of people, myself included, see "async #PF" and think of the PV version first,
e.g. I initially was looking for the PV side of things here.


> +#endif
> +
> +static void guest_code(u64 gva, u64 size)
> +{
> +#ifdef __x86_64__
> +	/* KVM does async #PF, or its halt fallback, only with IRQs enabled. */
> +	sti_nop();
> +#endif
> +	/* Within EOF: must work, proves that the mapping is set up right. */
> +	WRITE_ONCE(*(u64 *)gva, 1);
> +	GUEST_SYNC(0);
> +
> +	/* Beyond EOF: KVM_RUN must fail with -EFAULT. */
> +	WRITE_ONCE(*(u64 *)(gva + size - sizeof(u64)), 1);
> +	GUEST_FAIL("Store beyond EOF succeeded");
> +}
> +
> +static void sig_alarm(int sig)
> +{
> +}

...

> +	TEST_ASSERT(!sigaction(SIGALRM, &sa, NULL), "sigaction() failed");
> +	alarm(TIMEOUT_SECS);
> +	r = __vcpu_run(vcpu);
> +	alarm(0);
> +
> +	TEST_ASSERT(!(r == -1 && errno == EINTR),
> +		    "KVM_RUN did not return within %d seconds: the fault on the SIGBUS page is retried forever",
> +		    TIMEOUT_SECS);

Rather than assert on EINTR, what if we have sig_alarm() explicitly TEST_FAIL()?
That way readers don't have to piece together that the EINTR is coming from the
alarm, and there's less chance of the test somehow getting a false pass because
KVM manages to morph the signal into EFAULT.  That would also allow using the
single-underscore _vcpu_run(), though I don't know if that's actually a good idea.

E.g.

diff --git a/tools/testing/selftests/kvm/faultin_sigbus_test.c b/tools/testing/selftests/kvm/faultin_sigbus_test.c
index 9394b04efcd6..9d90c32f3c6a 100644
--- a/tools/testing/selftests/kvm/faultin_sigbus_test.c
+++ b/tools/testing/selftests/kvm/faultin_sigbus_test.c
@@ -106,6 +106,7 @@ static void guest_code(u64 gva, u64 size)
 
 static void sig_alarm(int sig)
 {
+	TEST_FAIL("%d second timeout expired before KVM_RUN hit -EFAULT", TIMEOUT_SECS);
 }
 
 int main(void)
@@ -154,12 +155,9 @@ int main(void)
 
 	TEST_ASSERT(!sigaction(SIGALRM, &sa, NULL), "sigaction() failed");
 	alarm(TIMEOUT_SECS);
-	r = __vcpu_run(vcpu);
+	r = _vcpu_run(vcpu);
 	alarm(0);
 
-	TEST_ASSERT(!(r == -1 && errno == EINTR),
-		    "KVM_RUN did not return within %d seconds: the fault on the SIGBUS page is retried forever",
-		    TIMEOUT_SECS);
 	TEST_ASSERT(r == -1 && errno == EFAULT,
 		    "Expected KVM_RUN to fail with EFAULT, got r = %d, errno = %d (%s), exit reason %s",
 		    r, errno, strerror(errno), exit_reason_str(vcpu->run->exit_reason));