Re: [PATCH v2] KVM: selftests: Fix 32-bit truncation of vm_get_max_gfn()

[Paolo Bonzini <pbonzini@redhat.com>]

On 21/05/21 19:38, David Matlack wrote:
> vm_get_max_gfn() casts vm->max_gfn from a uint64_t to an unsigned int,
> which causes the upper 32-bits of the max_gfn to get truncated.
> 
> Nobody noticed until now likely because vm_get_max_gfn() is only used
> as a mechanism to create a memslot in an unused region of the guest
> physical address space (the top), and the top of the 32-bit physical
> address space was always good enough.
> 
> This fix reveals a bug in memslot_modification_stress_test which was
> trying to create a dummy memslot past the end of guest physical memory.
> Fix that by moving the dummy memslot lower.
> 
> Fixes: 52200d0d944e ("KVM: selftests: Remove duplicate guest mode handling")
> Reviewed-by: Venkatesh Srinivas <venkateshs@chromium.org>
> Signed-off-by: David Matlack <dmatlack@google.com>
> ---
> 
> v1 -> v2:
>   - Added Venkatesh's R-b line.
>   - Used PRIx64 to print uint64_t instead of %lx.
> 
>   tools/testing/selftests/kvm/include/kvm_util.h |  2 +-
>   tools/testing/selftests/kvm/lib/kvm_util.c     |  2 +-
>   .../testing/selftests/kvm/lib/perf_test_util.c |  4 +++-
>   .../kvm/memslot_modification_stress_test.c     | 18 +++++++++++-------
>   4 files changed, 16 insertions(+), 10 deletions(-)
> 
> diff --git a/tools/testing/selftests/kvm/include/kvm_util.h b/tools/testing/selftests/kvm/include/kvm_util.h
> index 84982eb02b29..5d9b35d09251 100644
> --- a/tools/testing/selftests/kvm/include/kvm_util.h
> +++ b/tools/testing/selftests/kvm/include/kvm_util.h
> @@ -303,7 +303,7 @@ bool vm_is_unrestricted_guest(struct kvm_vm *vm);
>   
>   unsigned int vm_get_page_size(struct kvm_vm *vm);
>   unsigned int vm_get_page_shift(struct kvm_vm *vm);
> -unsigned int vm_get_max_gfn(struct kvm_vm *vm);
> +uint64_t vm_get_max_gfn(struct kvm_vm *vm);
>   int vm_get_fd(struct kvm_vm *vm);
>   
>   unsigned int vm_calc_num_guest_pages(enum vm_guest_mode mode, size_t size);
> diff --git a/tools/testing/selftests/kvm/lib/kvm_util.c b/tools/testing/selftests/kvm/lib/kvm_util.c
> index 1af1009254c4..aeffbb1e7c7d 100644
> --- a/tools/testing/selftests/kvm/lib/kvm_util.c
> +++ b/tools/testing/selftests/kvm/lib/kvm_util.c
> @@ -2058,7 +2058,7 @@ unsigned int vm_get_page_shift(struct kvm_vm *vm)
>   	return vm->page_shift;
>   }
>   
> -unsigned int vm_get_max_gfn(struct kvm_vm *vm)
> +uint64_t vm_get_max_gfn(struct kvm_vm *vm)
>   {
>   	return vm->max_gfn;
>   }
> diff --git a/tools/testing/selftests/kvm/lib/perf_test_util.c b/tools/testing/selftests/kvm/lib/perf_test_util.c
> index 81490b9b4e32..abf381800a59 100644
> --- a/tools/testing/selftests/kvm/lib/perf_test_util.c
> +++ b/tools/testing/selftests/kvm/lib/perf_test_util.c
> @@ -2,6 +2,7 @@
>   /*
>    * Copyright (C) 2020, Google LLC.
>    */
> +#include <inttypes.h>
>   
>   #include "kvm_util.h"
>   #include "perf_test_util.h"
> @@ -80,7 +81,8 @@ struct kvm_vm *perf_test_create_vm(enum vm_guest_mode mode, int vcpus,
>   	 */
>   	TEST_ASSERT(guest_num_pages < vm_get_max_gfn(vm),
>   		    "Requested more guest memory than address space allows.\n"
> -		    "    guest pages: %lx max gfn: %x vcpus: %d wss: %lx]\n",
> +		    "    guest pages: %" PRIx64 " max gfn: %" PRIx64
> +		    " vcpus: %d wss: %" PRIx64 "]\n",
>   		    guest_num_pages, vm_get_max_gfn(vm), vcpus,
>   		    vcpu_memory_bytes);
>   
> diff --git a/tools/testing/selftests/kvm/memslot_modification_stress_test.c b/tools/testing/selftests/kvm/memslot_modification_stress_test.c
> index 6096bf0a5b34..98351ba0933c 100644
> --- a/tools/testing/selftests/kvm/memslot_modification_stress_test.c
> +++ b/tools/testing/selftests/kvm/memslot_modification_stress_test.c
> @@ -71,14 +71,22 @@ struct memslot_antagonist_args {
>   };
>   
>   static void add_remove_memslot(struct kvm_vm *vm, useconds_t delay,
> -			      uint64_t nr_modifications, uint64_t gpa)
> +			       uint64_t nr_modifications)
>   {
> +	const uint64_t pages = 1;
> +	uint64_t gpa;
>   	int i;
>   
> +	/*
> +	 * Add the dummy memslot just below the perf_test_util memslot, which is
> +	 * at the top of the guest physical address space.
> +	 */
> +	gpa = guest_test_phys_mem - pages * vm_get_page_size(vm);
> +
>   	for (i = 0; i < nr_modifications; i++) {
>   		usleep(delay);
>   		vm_userspace_mem_region_add(vm, VM_MEM_SRC_ANONYMOUS, gpa,
> -					    DUMMY_MEMSLOT_INDEX, 1, 0);
> +					    DUMMY_MEMSLOT_INDEX, pages, 0);
>   
>   		vm_mem_region_delete(vm, DUMMY_MEMSLOT_INDEX);
>   	}
> @@ -120,11 +128,7 @@ static void run_test(enum vm_guest_mode mode, void *arg)
>   	pr_info("Started all vCPUs\n");
>   
>   	add_remove_memslot(vm, p->memslot_modification_delay,
> -			   p->nr_memslot_modifications,
> -			   guest_test_phys_mem +
> -			   (guest_percpu_mem_size * nr_vcpus) +
> -			   perf_test_args.host_page_size +
> -			   perf_test_args.guest_page_size);
> +			   p->nr_memslot_modifications);
>   
>   	run_vcpus = false;
>   
> 

Queued, thanks.

Paolo