[kvm-unit-tests PATCH] s390x: firq: Trigger KVM flic injection bug

[kvm-unit-tests PATCH] s390x: firq: Trigger KVM flic injection bug

[Janosch Frank]

The flic will try to wakeup the last cpu that went to sleep since it
might still be in halt poll and therefore fast to take up work
again. Problem is that there's no check if that vcpu is even enabled
for the specific IRQ that's being injected or any other pending
floating IRQ.

To trigger this bug we setup a third cpu which enables its masks for
external calls and goes into enabled wait AFTER the second cpu went
into enabled wait. This will set KVM's tracking of the last sleeping
cpu to the third cpu. Once the service IRQ is injected KVM will wakeup
cpu #3 which will promptly go back to sleep and the test hangs.

Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
---
 s390x/firq.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/s390x/firq.c b/s390x/firq.c
index 0d65d87f..03638a14 100644
--- a/s390x/firq.c
+++ b/s390x/firq.c
@@ -17,6 +17,12 @@
 #include <smp.h>
 #include <alloc_page.h>
 
+static void wait_for_ext_call(void)
+{
+	ctl_set_bit(0, CTL0_EXTERNAL_CALL);
+	wait_for_interrupt(PSW_MASK_EXT);
+}
+
 static void wait_for_sclp_int(void)
 {
 	/* Enable SCLP interrupts on this CPU only. */
@@ -57,6 +63,16 @@ static void test_wait_state_delivery(void)
 	ret = smp_cpu_setup(1, PSW_WITH_CUR_MASK(wait_for_sclp_int));
 	/* This must not fail because we have at least 3 CPUs */
 	assert(!ret);
+	while(smp_sense_running_status(2));
+
+	/*
+	 * Move CPU #2 into wait so it's the last that entered sleep
+	 * and therefore KVM will try to wake it up first since it
+	 * might still be polling. But since its masks are not open
+	 * for a service IRQ it's not a valid wakeup target.
+	 */
+	ret = smp_cpu_setup(2, PSW_WITH_CUR_MASK(wait_for_ext_call));
+	assert(!ret);
 
 	/*
 	 * We'd have to jump trough some hoops to sense e.g., via SIGP
@@ -90,6 +106,7 @@ static void test_wait_state_delivery(void)
 out_destroy:
 	free_page(h);
 	smp_cpu_destroy(1);
+	smp_cpu_destroy(2);
 out:
 	report_prefix_pop();
 }
-- 
2.53.0