Re: [RFC v3 03/10] KVM: PPC: selftests: add support for powerpc

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Global exception handlers array leaks state across VMs and causes race conditions in multi-VM tests.
--

commit 4362b48fc35809ad7a74045c726f7ffae0c70ccd
Author: Nicholas Piggin <npiggin@gmail.com>

KVM: PPC: selftests: add support for powerpc

This commit implements KVM selftests support for powerpc (Book3S-64),
including ucalls and virtual memory for the radix MMU.

> diff --git a/tools/testing/selftests/kvm/lib/powerpc/processor.c b/tools/testing/selftests/kvm/lib/powerpc/processor.c
> new file mode 100644
> index 0000000000000..9846ec26a32aa
> --- /dev/null
> +++ b/tools/testing/selftests/kvm/lib/powerpc/processor.c

[ ... ]

> +struct handler {
> +	void (*fn)(struct ex_regs *regs);
> +	int trap;
> +};
> +
> +#define NR_HANDLERS	10
> +static struct handler handlers[NR_HANDLERS];

[Severity: Medium]
Could this static global array cause state leakage across VMs or race
conditions in multi-threaded tests?

Since this is defined as a static global on the host rather than a per-VM
allocation, a new VM will start with a zeroed guest handlers array (from ELF
loading), but the host's handlers array will retain entries from previous VMs.

This appears to limit the total number of unique handlers that can be installed
sequentially across all VMs in the entire test process to 10, which would
eventually result in the "Out of exception handlers" failure below.

Additionally, if multiple threads concurrently create VMs and install exception
handlers, would they race on this shared host array and sync corrupted state to
their respective guests?

> +
> +void route_interrupt(struct ex_regs *regs)
> +{
> +	int i;

[ ... ]

> +void vm_install_exception_handler(struct kvm_vm *vm, int trap,
> +			       void (*fn)(struct ex_regs *))
> +{
> +	int i;
> +
> +	for (i = 0; i < NR_HANDLERS; i++) {
> +		if (!handlers[i].trap || handlers[i].trap == trap) {
> +			if (fn == NULL)
> +				trap = 0; /* Clear handler */
> +			handlers[i].trap = trap;
> +			handlers[i].fn = fn;
> +			sync_global_to_guest(vm, handlers[i]);
> +			return;
> +		}
> +	}
> +
> +	TEST_FAIL("Out of exception handlers");
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1779885589.git.ritesh.list@gmail.com?part=3