Re: [PATCH RFC v3 81/88] KVM: selftests: Verify guest mapping for VFIO BAR

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] KVM: selftests: guest_mapping() checks stage-1 PTE via
  vm_get_pte()
--

commit 8a5370d54b044c85eadf5eb14da654ead8af47a1
Author: Ackerley Tng <ackerleytng@google.com>

KVM: selftests: Verify guest mapping for VFIO BAR

This commit adds a selftest that configures a VFIO BAR into a KVM memslot
and runs a guest vCPU to verify guest access to the BAR.

> diff --git a/tools/testing/selftests/kvm/x86/guest_memfd_vfio_test.c b/tools/testing/selftests/kvm/x86/guest_memfd_vfio_test.c
> index 79a0001ca1733..0339794fb6dd3 100644
> --- a/tools/testing/selftests/kvm/x86/guest_memfd_vfio_test.c
> +++ b/tools/testing/selftests/kvm/x86/guest_memfd_vfio_test.c

[ ... ]

> @@ -594,4 +595,60 @@ TEST_F(guest_memfd_vfio, host_vma_flags)
>  	ASSERT_EQ(0, munmap(bar0_mmap, bar0_info.size));
>  }
>  
> +static void guest_memslot_cacheability_code(uint64_t bar_gpa)
> +{
> +	uint32_t *reg = (uint32_t *)(bar_gpa + E1000_STATUS);
> +	uint32_t val;
> +
> +	val = READ_ONCE(*reg);
> +	GUEST_ASSERT(val != 0xFFFFFFFF);
> +
> +	GUEST_DONE();
> +}
> +
> +TEST_F(guest_memfd_vfio, guest_mapping)
> +{
> +	struct vfio_region_info bar0_info = {};
> +	uint64_t bar_gpa = 0xc0000000;
> +	struct kvm_vcpu *vcpu;
> +	void *bar0_mmap;
> +	uint64_t *pte;
> +	int ret;
> +
> +	vfio_pci_enable_memory_and_bus_master(_metadata, self->vfio_fd);
> +
> +	bar0_info.argsz = sizeof(bar0_info);
> +	bar0_info.index = VFIO_PCI_BAR0_REGION_INDEX;
> +	ret = ioctl(self->vfio_fd, VFIO_DEVICE_GET_REGION_INFO, &bar0_info);
> +	ASSERT_EQ(0, ret);
> +	ASSERT_TRUE(bar0_info.flags & VFIO_REGION_INFO_FLAG_MMAP);
> +
> +	/* mmap the VFIO BAR directly into host userspace for memslot config */
> +	bar0_mmap = mmap(NULL, bar0_info.size, PROT_READ | PROT_WRITE,
> +			 MAP_SHARED, self->bar_fd, bar0_info.offset);
> +	ASSERT_NE(MAP_FAILED, bar0_mmap);
> +
> +	vcpu = vm_vcpu_add(self->vm, 0, guest_memslot_cacheability_code);
> +	if (variant->use_gmem)
> +		vm_set_user_memory_region2(self->vm, 1, KVM_MEM_GUEST_MEMFD,
> +					   bar_gpa, bar0_info.size, bar0_mmap,
> +					   self->gmem_fd, bar0_info.offset);
> +	else
> +		vm_set_user_memory_region(self->vm, 1, 0, bar_gpa,
> +					  bar0_info.size, bar0_mmap);
> +
> +	virt_map(self->vm, bar_gpa, bar_gpa, bar0_info.size >> self->vm->page_shift);
> +
> +	/* Run guest to fault in the page via stage 2, then verify S2 PTE */
> +	vcpu_args_set(vcpu, 1, bar_gpa);
> +	vcpu_run(vcpu);
> +	ASSERT_EQ(UCALL_DONE, get_ucall(vcpu, NULL));
> +
> +	pte = vm_get_pte(self->vm, bar_gpa);
> +	ASSERT_NE(NULL, pte);
> +	ASSERT_TRUE(is_present_pte(&self->vm->mmu, pte));

[Severity: Low]
Does vm_get_pte() check the guest stage-1 PTE rather than the stage-2 PTE?

vm_get_pte() walks self->vm->mmu (the guest GVA-to-GPA page tables in
guest memory), where virt_map() -> __virt_pg_map() already set
PTE_PRESENT_MASK(&self->vm->mmu) before vcpu_run(), so is_present_pte()
always succeeds without inspecting KVM's stage-2 page tables.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261106-gmem-alternative-providers-v3-0-8484dde66a7e@google.com?part=81