Re: [PATCH v3 35/40] KVM: arm64: gic-v5: Add CoreSight MMIO regs to IRS

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Missing MMIO register descriptors for the second 64KB frame of the GICv5 IRS.
--

commit 15bd2f995f6e9330e8aab99ee4212a882b554a17
Author: Sascha Bischoff <Sascha.Bischoff@arm.com>

KVM: arm64: gic-v5: Add CoreSight MMIO regs to IRS
    
This commit exposes the CoreSight identification registers in the emulated
GICv5 IRS MMIO region. It returns the architectural identification values on
reads and ignores writes.

diff --git a/arch/arm64/kvm/vgic/vgic-irs-v5.c b/arch/arm64/kvm/vgic/vgic-irs-v5.c
index 1d63cfe704fda..17be776b4a2b9 100644
--- a/arch/arm64/kvm/vgic/vgic-irs-v5.c
+++ b/arch/arm64/kvm/vgic/vgic-irs-v5.c
@@ -465,6 +465,43 @@ static void vgic_v5_mmio_write_irs_ist(struct kvm_vcpu *vcpu, gpa_t addr,
 	}
 }
 
> +static unsigned long vgic_v5_coresight_read(struct kvm_vcpu *vcpu,
> +					    gpa_t addr, unsigned int len)
> +{
> +	const size_t offset = addr & (SZ_64K - 1);

[Severity: Medium]
The handler masks the address to support both 64KB frames, but is it possible
that accesses to the second frame will never actually reach this function?

The KVM MMIO dispatcher relies on the vgic_v5_irs_registers array below to
find the appropriate handler. If the descriptors for the second frame are
missing from the array, the dispatcher will reject the access and return 0
before ever calling this handler.

[ ... ]

@@ -776,6 +813,47 @@ static const struct vgic_register_region vgic_v5_irs_registers[] = {
 	REGISTER_DESC_WITH_LENGTH(GICV5_IRS_SWERR_SYNDROMER1,
 				  vgic_mmio_read_raz, vgic_mmio_write_wi, 8,
 				  VGIC_ACCESS_64bit),
> +
> +	/* CoreSight identification registers */
> +	REGISTER_DESC_WITH_LENGTH(GICV5_CORESIGHT_DEVARCH,
> +				  vgic_v5_coresight_read, vgic_mmio_write_wi, 4,
> +				  VGIC_ACCESS_32bit),

[Severity: Medium]
Does this array need explicit descriptors for the second 64KB frame?

Since vgic_v5_irs_registers only contains descriptors for the first frame's
CoreSight registers, a guest reading from the second frame 
(e.g., SZ_64K + GICV5_CORESIGHT_DEVARCH) will not match any entry during the
search in vgic_find_mmio_region().

Will this cause the dispatcher to treat the second frame access as unhandled
and return 0, leaving the masking logic in vgic_v5_coresight_read() as dead
code?

> +	REGISTER_DESC_WITH_LENGTH(GICV5_CORESIGHT_PIDR4,
> +				  vgic_v5_coresight_read, vgic_mmio_write_wi, 4,
> +				  VGIC_ACCESS_32bit),

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260703154811.3355680-1-sascha.bischoff@arm.com?part=35