Re: [PATCH 10/11] drm/xe: Require a fully visible VRAM BAR without a primary GT

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [High] drm/xe: NULL deref of tile->primary_gt in tile_vram_size() in
  xe_vram_probe()
--

commit 5c01d4a69cb121bc624de632e7f741dd67a3eabc
Author: Stuart Summers <stuart.summers@intel.com>

drm/xe: Require a fully visible VRAM BAR without a primary GT

This commit rejects device probe in xe_vram_probe() if a tile has no
primary GT and its VRAM BAR is smaller than the tile's usable VRAM size.

> diff --git a/drivers/gpu/drm/xe/xe_vram.c b/drivers/gpu/drm/xe/xe_vram.c
> index 1c02889ba29b2..4d399a83479ef 100644
> --- a/drivers/gpu/drm/xe/xe_vram.c
> +++ b/drivers/gpu/drm/xe/xe_vram.c
[ ... ]
> @@ -346,6 +347,20 @@ int xe_vram_probe(struct xe_device *xe)
>  		if (err)
>  			return err;
>  
> +		/*
> +		 * Without a primary GT there is no copy engine, so VRAM is
> +		 * moved with the CPU through the BAR.  That only works if the
> +		 * BAR covers all of it.
> +		 */
> +		if (!tile->primary_gt &&
> +		    tile->mem.vram->io_size < tile->mem.vram->usable_size) {
> +			xe_tile_err(tile,
> +				    "VRAM is not fully CPU visible (%pa of %pa); a resizable BAR is required without a primary GT\n",
> +				    &tile->mem.vram->io_size,
> +				    &tile->mem.vram->usable_size);
> +			return -ENODEV;
> +		}
> +
>  		if (total_size > lmem_bar.io_size) {
>  			xe_log_info(xe, VRAM,
>  				    "Total size %#llx is larger than resource %#llx\n",

[Severity: High]
Can xe_vram_probe() reach this !tile->primary_gt check when
xe->info.has_flat_ccs is set, or does tile_vram_size() dereference a NULL
tile->primary_gt first?

Earlier in the same loop, xe_vram_probe() calls tile_vram_size(), which
passes tile->primary_gt to get_flat_ccs_offset():

drivers/gpu/drm/xe/xe_vram.c:tile_vram_size() {
	struct xe_device *xe = tile_to_xe(tile);
	struct xe_gt *gt = tile->primary_gt;
...
	if (xe->info.has_flat_ccs) {
		int ret = get_flat_ccs_offset(gt, *tile_size, &offset);
}

When a discrete GPU with Flat-CCS (such as Battlemage) is probed with
gt_types_allowed=media via configfs, xe->info.has_flat_ccs remains set
while tile->primary_gt is NULL, and get_flat_ccs_offset() immediately
dereferences gt via gt_to_xe(gt) and gt_to_fw(gt).

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261110231442.218721-13-stuart.summers@intel.com?part=10