Re: [PATCH v6 05/18] KVM: selftests: Add an irqfd send+receive (and later IRQ bypass) test

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The pseudo-random number generator (`kvm_rng`) is queried before it is initialized, causing the test to deterministically use the same minimum values for GSI and vector.
--

commit ac6e0b75a6ada77cf5a450f7c4989256698f5cae
Author: David Matlack <dmatlack@google.com>

KVM: selftests: Add an irqfd send+receive (and later IRQ bypass) test

This commit adds a new simple test, irq_test, to verify that KVM correctly
delivers interrupts to a running vCPU when triggered via an eventfd bound to
a KVM GSI.

Link: https://lore.kernel.org/kvm/20250404193923.1413163-68-seanjc@google.com

> diff --git a/tools/testing/selftests/kvm/irq_test.c b/tools/testing/selftests/kvm/irq_test.c
> new file mode 100644
> index 0000000000000..9f8895b898214
> --- /dev/null
> +++ b/tools/testing/selftests/kvm/irq_test.c

[ ... ]

> +int main(int argc, char **argv)
> +{
> +	/*
> +	 * Pick a random vector and a random GSI to use for device IRQ.
> +	 *
> +	 * Pick an IRQ vector in range [32, UINT8_MAX]. Min value is 32 because
> +	 * Linux/x86 reserves vectors 0-31 for exceptions and architecture
> +	 * defined NMIs and interrupts.
> +	 *
> +	 * Pick a GSI in range [24, KVM_MAX_IRQ_ROUTES - 1]. The min value is 24
> +	 * because KVM reserves GSIs 0-15 for legacy ISA IRQs and 16-23 only go
> +	 * to the IOAPIC. The max is KVM_MAX_IRQ_ROUTES - 1, because
> +	 * KVM_MAX_IRQ_ROUTES is exclusive.
> +	 */
> +	u32 gsi = kvm_random_u64_in_range(&kvm_rng, 24, KVM_MAX_IRQ_ROUTES - 1);
> +	u8 vector = kvm_random_u64_in_range(&kvm_rng, 32, UINT8_MAX);

[Severity: Medium]
Is kvm_rng initialized before it is used here?

It appears that kvm_random_u64_in_range() is being called before
vm_create_with_vcpus() executes later in this function, which is where
kvm_rng normally gets initialized.

Because kvm_rng is a global variable and zero-initialized, the RNG algorithm
will consistently yield 0. This causes the variables to always evaluate to
their minimum bounds (24 for gsi and 32 for vector).

Does this defeat the intended randomization for this test?

> +
> +	struct kvm_vcpu *vcpus[KVM_MAX_VCPUS];

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260610005338.2967132-1-seanjc@google.com?part=5