KVM: selftests: Extend x86's sync_regs_test to check for exception races

Attempt to set the to-be-queued exception to be both pending and injected
_after_ KVM_CAP_SYNC_REGS's kvm_vcpu_ioctl_x86_set_vcpu_events() squashes
the pending exception (if there's also an injected exception).  Buggy KVM
versions will eventually yell loudly about having impossible state when
processing queued excpetions, e.g.

  WARNING: CPU: 0 PID: 1115 at arch/x86/kvm/x86.c:10095 kvm_check_and_inject_events+0x220/0x500 [kvm]

  arch/x86/kvm/x86.c:kvm_check_and_inject_events():
  WARN_ON_ONCE(vcpu->arch.exception.injected &&
	       vcpu->arch.exception.pending);
Signed-off-by: Michal Luczaj <mhal@rbox.co>
Link: https://lore.kernel.org/r/20230728001606.2275586-3-mhal@rbox.co
[sean: split to separate patch, massage changelog and comment]
Signed-off-by: Sean Christopherson <seanjc@google.com>

tools/testing/selftests/kvm/x86_64/sync_regs_test.c

@@ -81,6 +81,28 @@ static void compare_vcpu_events(struct kvm_vcpu_events *left,
 #define TEST_SYNC_FIELDS   (KVM_SYNC_X86_REGS|KVM_SYNC_X86_SREGS|KVM_SYNC_X86_EVENTS)
 #define INVALID_SYNC_FIELD 0x80000000
 
+/*
+ * Set an exception as pending *and* injected while KVM is processing events.
+ * KVM is supposed to ignore/drop pending exceptions if userspace is also
+ * requesting that an exception be injected.
+ */
+static void *race_events_inj_pen(void *arg)
+{
+	struct kvm_run *run = (struct kvm_run *)arg;
+	struct kvm_vcpu_events *events = &run->s.regs.events;
+
+	for (;;) {
+		WRITE_ONCE(run->kvm_dirty_regs, KVM_SYNC_X86_EVENTS);
+		WRITE_ONCE(events->flags, 0);
+		WRITE_ONCE(events->exception.injected, 1);
+		WRITE_ONCE(events->exception.pending, 1);
+
+		pthread_testcancel();
+	}
+
+	return NULL;
+}
+
 /*
  * Set an invalid exception vector while KVM is processing events.  KVM is
  * supposed to reject any vector >= 32, as well as NMIs (vector 2).
@@ -311,6 +333,7 @@ int main(int argc, char *argv[])
 
 	race_sync_regs(race_sregs_cr4);
 	race_sync_regs(race_events_exc);
+	race_sync_regs(race_events_inj_pen);
 
 	return 0;
 }