Re: [PATCH 2/3] PCI: dw-rockchip: Support fixed MSI-X table and PBA on RK3588

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Unmapped epf_bar[bir] access in dw_pcie_ep_raise_msix_irq() causes kernel panic when msix_hw_owned is true
--

commit d51d0db24756ed54917db6dbe19e86f2adfdc77f
Author: Koichiro Den <den@valinux.co.jp>

PCI: dw-rockchip: Support fixed MSI-X table and PBA on RK3588

This commit adds support for fixed MSI-X tables and PBA on the RK3588
controller by marking BAR4 as a reserved region. It introduces the
msix_hw_owned flag to track when a hardware-owned layout is selected. The
RK3588 then overrides the MSI-X raise behavior to use the controller
doorbell when this flag is set.

> diff --git a/drivers/pci/controller/dwc/pcie-designware-ep.c b/drivers/pci/controller/dwc/pcie-designware-ep.c
> index 147b043589f02..bc2b63814dea1 100644
> --- a/drivers/pci/controller/dwc/pcie-designware-ep.c
> +++ b/drivers/pci/controller/dwc/pcie-designware-ep.c
[ ... ]
> @@ -764,6 +784,7 @@ static int dw_pcie_ep_set_msix(struct pci_epc *epc, u8 func_no, u8 vfunc_no,
>  	reg = ep_func->msix_cap + PCI_MSIX_PBA;
>  	val = layout->pba_offset | layout->pba_bar;
>  	dw_pcie_ep_writel_dbi(ep, func_no, reg, val);
> +	ep_func->msix_hw_owned = dw_pcie_ep_msix_layout_is_hw_owned(ep, layout);

[Severity: Medium]
Does introducing the msix_hw_owned state here create a potential NULL pointer
dereference in the generic dw_pcie_ep_raise_msix_irq() handler?

When msix_hw_owned is true, the MSI-X table is backed by a hardware-reserved
BAR, meaning the EPF driver does not map epf_bar[bir].

While the RK3588 controller correctly intercepts this state to avoid calling
the generic dw_pcie_ep_raise_msix_irq(), the generic function itself (which
is exported and serves as the default MSI-X handler for DesignWare) is not
updated.

If any other DW controller adds a hardware-owned layout and falls back to
this default handler, it will unconditionally dereference the NULL
ep_func->epf_bar[bir]:

drivers/pci/controller/dwc/pcie-designware-ep.c:dw_pcie_ep_raise_msix_irq() {
	...
	tbl_offset &= PCI_MSIX_TABLE_OFFSET;

	msix_tbl = ep_func->epf_bar[bir]->addr + tbl_offset;
	...
}

Should dw_pcie_ep_raise_msix_irq() be updated to check msix_hw_owned and
return an error, or otherwise avoid accessing the unmapped array?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260827182012.1984960-1-den@valinux.co.jp?part=2