Re: [PATCH 5/7] ath11k: Use VFIO MSI cache when available

[Jose Ignacio Tornos Martinez <jtornosm@redhat.com>]

> [Severity: Low]
> Does this unconditional linear scan of the extended configuration space risk
> unintended hardware side effects?
>
> Calling qcom_vfio_find_msi_cache() loops over the entire extended
> configuration space reading 4 bytes at a time instead of using the standard
> PCIe capability linked-list traversal.
>
> This could trigger side effects if there are clear-on-read registers present
> in the configuration space.

Not applicable. qcom_vfio_find_msi_cache() is a VM-side function:
config reads go through QEMU's VFIO config space virtualization layer,
not directly to hardware. No URs or read side-effects will occur.

> [Severity: High]
> Will this host physical MSI data be unconditionally overwritten later during
> the probe sequence?
>
> After ath11k_pci_alloc_msi() correctly sets ab->pci.msi.ep_base_data from the
> VFIO cache, the probe sequence in ath11k_pci_probe() continues.
>
> Later, ath11k_pci_probe() calls ath11k_pci_config_msi_data() which does this:
>
> ath11k_pci_config_msi_data() {
>         ...
>         ab_pci->ab->pci.msi.ep_base_data = msi_desc->msg.data;
> }
>
> This appears to overwrite the host MSI data retrieved from the VFIO cache
> with the guest virtual MSI data, which could break interrupt delivery in VMs.

Valid concern. Although ep_base_data is always zero in practice with
interrupt remapping (both host and guest values are zero), the overwrite
is technically incorrect and could be a bug if the data value is ever
non-zero. Fixed in v2 by guarding config_msi_data() to skip the
overwrite when VFIO cached values are already set.

> [Severity: Medium]
> Does returning early here skip ath11k_pci_msi_disable() and leave the device
> in an inconsistent initialization state compared to the bare-metal path?
>
> By bypassing the ath11k_pci_msi_disable(ab_pci) call just below, the device
> is left with MSI enabled prematurely in the PCI configuration space.

Intentional. In the VFIO VM path, MSI is already configured by QEMU
through the host vfio-pci driver. The device MSI state is managed by
the host, so disabling and re-enabling MSI in the guest is not needed
and would interfere with the host setup.

Will send v2 with fix for findings.