Re: [PATCH v5 8/8] drm/xe: convert PCI barrier mmap to use xe_mmio_gem

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The conversion to generic `xe_mmio_gem_mmap` drops the read access restrictions for the PCI barrier, allowing unprivileged userspace to map the write-only PCIe doorbell with `PROT_READ`.
--

commit ef90a93714d00fe81619728388f0697e023978dd
Author: Matthew Auld <matthew.auld@intel.com>

drm/xe: convert PCI barrier mmap to use xe_mmio_gem

This commit converts the PCI barrier mmap to use xe_mmio_gem, which
replaces the hard-coded fake offset design and removes duplicate code.
Userspace still queries the fake offset as before, but it is now managed
by the generic component.

> diff --git a/drivers/gpu/drm/xe/xe_bo.c b/drivers/gpu/drm/xe/xe_bo.c
> --- a/drivers/gpu/drm/xe/xe_bo.c
> +++ b/drivers/gpu/drm/xe/xe_bo.c
[ ... ]
> @@ -3664,6 +3665,39 @@ int xe_gem_create_ioctl(struct drm_device *dev, void *data,
>  	return err;
>  }
>  
> +static int xe_gem_pci_barrier_mmap_offset(struct xe_device *xe, struct drm_file *file,
> +					  struct drm_xe_gem_mmap_offset *args)
> +{
[ ... ]
> +		if (!*barrier) {
> +			phys_addr_t phys_addr;
> +
> +#define LAST_DB_PAGE_OFFSET 0x7ff000
> +			phys_addr = pci_resource_start(to_pci_dev(xe->drm.dev), 0) +
> +				LAST_DB_PAGE_OFFSET;
> +			*barrier = xe_mmio_gem_create(xe, file, phys_addr, SZ_4K);

[Severity: High]
Does the conversion to the generic xe_mmio_gem framework drop the read
access restrictions for the PCI barrier?

The original xe_pci_barrier_mmap handler explicitly checked and rejected
read access before it was removed in this patch:

xe_pci_barrier_mmap() {
        ...
        if (vma->vm_flags & (VM_READ | VM_EXEC))
                return -EINVAL;

        vm_flags_clear(vma, VM_MAYREAD | VM_MAYEXEC);
        ...
}

Without this protection, unprivileged userspace might be able to map the
write-only PCIe doorbell with PROT_READ. If userspace issues a memory read
to this write-only hardware register, the PCIe endpoint typically returns
an Unsupported Request (UR) completion.

Could this trigger Advanced Error Reporting (AER) faults, Machine Check
Exceptions (MCE), or system hangs, leading to a local denial of service?

> +			if (IS_ERR(*barrier)) {
> +				int err = PTR_ERR(*barrier);
[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260908165046.1393557-10-matthew.auld@intel.com?part=8