From mboxrd@z Thu Jan  1 00:00:00 1970
From: Claude Code Review Bot <claude-review@example.com>
To: dri-devel-reviews@example.com
Subject: Claude review: drm/xe/xe_pagefault: Disallow writes to read-only VMAs
Date: Mon, 09 Mar 2026 08:42:06 +1000
Message-ID: <review-patch1-20260306155556.67500-7-jonathan.cavitt@intel.com>
In-Reply-To: <20260306155556.67500-7-jonathan.cavitt@intel.com>
References: <20260306155556.67500-6-jonathan.cavitt@intel.com> <20260306155556.67500-7-jonathan.cavitt@intel.com>
X-Mailer: Claude Code Patch Reviewer
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0

Patch Review

This is a straightforward bug fix. The check is correct:

```c
if (xe_vma_read_only(vma) &&
    pf->consumer.access_type != XE_PAGEFAULT_ACCESS_TYPE_READ) {
    err = -EPERM;
    goto unlock_vm;
}
```

**Issue:** The `access_type` field has `XE_PAGEFAULT_ACCESS_PREFETCH` packed in bit 7 (defined as `BIT(7)`). If a prefetch fault arrives with `access_type = XE_PAGEFAULT_ACCESS_PREFETCH | XE_PAGEFAULT_ACCESS_TYPE_READ` (value 0x80), the comparison `!= XE_PAGEFAULT_ACCESS_TYPE_READ` (value 0) would be true, incorrectly returning `-EPERM` for what is a read-prefetch. The check should mask out the prefetch bit first:

```c
(pf->consumer.access_type & XE_PAGEFAULT_ACCESS_TYPE_MASK) != XE_PAGEFAULT_ACCESS_TYPE_READ
```

Otherwise the fix is good and the placement after the VMA lookup is correct.

---
Generated by Claude Code Patch Reviewer