Re: [PATCH v2 7/7] ath12k: Use VFIO MSI cache when available

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] pci: unsafe linear scan of extended config space on baremetal
--

commit 7935697effd72af8780a5758936f11256bc2c6d5
Author: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>

ath12k: Use VFIO MSI cache when available

This commit modifies the ath12k driver to search for a VFIO MSI cache in the
PCIe extended config space. It uses these cached host MSI physical addresses
for firmware configuration instead of guest IOVA addresses, resolving issues
when the device is passed through to a VM via VFIO.

> diff --git a/drivers/net/wireless/ath/ath12k/pci.c b/drivers/net/wireless/ath/ath12k/pci.c
> index f7879fb48d32e..8e92213fd3fce 100644
> --- a/drivers/net/wireless/ath/ath12k/pci.c
> +++ b/drivers/net/wireless/ath/ath12k/pci.c
[ ... ]
> @@ -811,6 +815,39 @@ static int ath12k_pci_msi_alloc(struct ath12k_pci *ab_pci)
>  
>  	ath12k_info(ab, "MSI vectors: %d\n", num_vectors);
>  
> +	/*
> +	 * Try to get host MSI address from VFIO cache.
> +	 * When running on a VM, the ath12k firmware requires physical host
> +	 * MSI addresses and cannot handle guest IOVA addresses.
> +	 * qcom-vfio-pci writes host MSI values to extended config space with
> +	 * a magic signature "QMSI" for discovery. Search for it.
> +	 */
> +	msi_offset = qcom_vfio_find_msi_cache(ab_pci->pdev);

[Severity: Medium]
Is it safe to unconditionally call qcom_vfio_find_msi_cache() on all setups,
including baremetal hardware?

This function performs a linear scan of the extended config space:

include/linux/qcom_vfio.h:qcom_vfio_find_msi_cache() {
    ...
    for (offset = PCI_CFG_SPACE_SIZE;
         offset <= PCI_CFG_SPACE_EXP_SIZE - QCOM_VFIO_MSI_SPACE_SIZE;
         offset += 4) {
        if (pci_read_config_dword(pdev, offset, &magic))
            continue;
    ...
}

Reading arbitrary PCIe configuration registers on baremetal hardware can
trigger read-to-clear side effects, unsupported request (UR) errors, or
Advanced Error Reporting (AER) faults.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261011074514.515894-1-jtornosm@redhat.com?part=7