Re: [PATCH 11/45] KVM: selftests: test hypercall memory fault exits

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] KVM: selftests: missing TSC clocksource check in test_clock_pairing_fault()
--

commit ec6214ca720546d1e406955e679ce191a860ab11
Author: Paolo Bonzini <pbonzini@redhat.com>

KVM: selftests: test hypercall memory fault exits

This commit adds a new x86 KVM selftest to verify that hypercalls invoked
with invalid or read-only GPAs exit to userspace with KVM_EXIT_MEMORY_FAULT
when KVM_CAP_HCALL_FAULT_EXIT is enabled, and updates existing Hyper-V
tests to enable the capability.

Link: https://patch.msgid.link/20260918135030.171564-8-pbonzini@redhat.com

> diff --git a/tools/testing/selftests/kvm/x86/hcall_fault.c b/tools/testing/selftests/kvm/x86/hcall_fault.c
> new file mode 100644
> index 0000000000000..725c59ff750c1
> --- /dev/null
> +++ b/tools/testing/selftests/kvm/x86/hcall_fault.c
> @@ -0,0 +1,246 @@

[ ... ]

> +static void clock_pairing_guest(gpa_t gpa)
> +{
> +	kvm_hypercall(KVM_HC_CLOCK_PAIRING, gpa, KVM_CLOCK_PAIRING_WALLCLOCK, 0, 0);
> +	GUEST_DONE();
> +}

[ ... ]

> +static void test_clock_pairing_fault(bool readonly)
> +{
> +	struct kvm_vcpu *vcpu;
> +	struct kvm_vm *vm;
> +	gpa_t gpa;
> +
> +	/* Unlike create_vm do not enable Hyper-V hypercalls. */
> +	vm = vm_create_with_one_vcpu(&vcpu, clock_pairing_guest);
> +	create_test_regions(vm);
> +	vm_enable_cap(vm, KVM_CAP_HCALL_FAULT_EXIT, 1);
> +	gpa = readonly ? READONLY_GPA : UNMAPPED_OUT_GPA;
> +	vcpu_args_set(vcpu, 1, gpa);
> +
> +	assert_memory_fault(vcpu, gpa, KVM_MEMORY_EXIT_FLAG_WRITE);
> +	kvm_vm_free(vm);
> +}
> +
> +int main(void)
> +{
> +	TEST_REQUIRE(kvm_has_cap(KVM_CAP_HYPERV_CPUID));
> +	TEST_REQUIRE(kvm_has_cap(KVM_CAP_HCALL_FAULT_EXIT));
> +	TEST_REQUIRE(kvm_cpuid_has(kvm_get_supported_hv_cpuid(),
> +				   HV_ENABLE_EXTENDED_HYPERCALLS));
> +
> +	test_unused_gpas();
> +	test_readonly_input();
> +	test_input_fault();
> +	test_output_fault(false, false);
> +	test_output_fault(true, false);
> +	test_output_fault(false, true);
> +	test_clock_pairing_fault(false);
> +	test_clock_pairing_fault(true);

[Severity: Medium]
In arch/x86/kvm/x86.c, kvm_pv_clock_pairing() checks whether the host
clocksource is TSC-based via kvm_get_walltime_and_clockread() before
translating the GPA or checking vcpu->kvm->arch.hcall_fault_exit:

arch/x86/kvm/x86.c:kvm_pv_clock_pairing() {
	...
	*ret = -KVM_EOPNOTSUPP;
	if (clock_type != KVM_CLOCK_PAIRING_WALLCLOCK)
		return 0;
	...
	if (!kvm_get_walltime_and_clockread(&ts, &cycle))
		return 0;
	...
	while (offset < sizeof(clock_pairing)) {
		...
		if (vcpu->kvm->arch.hcall_fault_exit) {
			hva = kvm_vcpu_gfn_to_hva_prot(vcpu, gpa_to_gfn(gpa), &writable);
			if (kvm_is_error_hva(hva) || !writable) {
				kvm_prepare_memory_fault_exit(vcpu, gpa & PAGE_MASK, PAGE_SIZE,
							      true, false, false);
				return -EFAULT;
			}
		}
}

If the host clocksource is not TSC-based (e.g., kvm-clock, hpet, or
acpi_pm), kvm_pv_clock_pairing() returns 0 with *ret = -KVM_EOPNOTSUPP
without preparing a memory fault exit, and clock_pairing_guest() proceeds to
GUEST_DONE(), causing assert_memory_fault() to fail on KVM_EXIT_IO.

Should main() guard the test_clock_pairing_fault() calls with
sys_clocksource_is_based_on_tsc()?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261102174130.8779-1-pbonzini@redhat.com?part=11