Re: [PATCH 16/16] KVM: arm64: gic-v5: Document ITS userspace ABI

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] kvm: arm64: gic-v5: userspace writes to READ_EVENT_DATAR are silently ignored causing state loss
--

commit 3a4606444ec9f90ae2360e066a229c789d9eca15
Author: Sascha Bischoff <sascha.bischoff@arm.com>

KVM: arm64: gic-v5: Document ITS userspace ABI

Document the GICv5 ITS device and its userspace ABI, including the
MMIO address, reset control, register attributes, and MSI requirements.

> diff --git a/Documentation/virt/kvm/devices/arm-vgic-v5-its.rst b/Documentation/virt/kvm/devices/arm-vgic-v5-its.rst
> new file mode 100644
> index 0000000000000..250057e4445d7
> --- /dev/null
> +++ b/Documentation/virt/kvm/devices/arm-vgic-v5-its.rst

[ ... ]

> +KVM_DEV_ARM_VGIC_GRP_ITS_REGS
> +-----------------------------
> +
> +  Attributes:
> +    The attr field of kvm_device_attr contains the ITS register offset from
> +    the control frame base address. kvm_device_attr.addr points to a __u64,
> +    regardless of whether the register is 32 or 64 bits wide. A 64-bit
> +    register must be addressed at its base offset; userspace cannot access
> +    its upper or lower half separately. Guest MMIO may use aligned 32-bit
> +    accesses to DT_BASER, DIDR, READ_EVENT_DATAR, and GEN_EVENT_DIDR.
> +
> +    The ITS base address must be configured before this group can be used.
> +    Writes to read-only registers are ignored. Writes to DT_CFGR and DT_BASER

[Severity: Medium]
Does this design violate the rule that read-only attributes must return an
error on set?

A device attribute documented as read-only whose set path does not return an
error can lead to silent migration state loss. For example, READ_EVENT_DATAR
is a stateful register that holds the result of the READ_EVENTR command. If
userspace restores this state during migration, but the write path returns 0
while ignoring the value, the restored state is silently dropped, corrupting
the guest's view of the command result upon resume.

Looking at the implementation, READ_EVENT_DATAR is defined without a uaccess
write override in vgic_v5_its_registers() and uses vgic_v5_mmio_write_its_wi.
The userspace attribute set path in vgic_v5_its_attr_regs_access() defaults
to calling the guest its_write handler, which invokes the Write Ignore stub
and successfully returns 0 instead of returning -EINVAL or -EPERM.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261016155741.979985-1-sascha.bischoff@arm.com?part=16