Re: [PATCH v5 06/18] drm/xe/vsec: Do not register BMG PMT for VF

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] Removing the `!xe->soc_remapper.set_telem_region` check introduces a NULL pointer dereference during PMT telemetry reads when the device is in boot survivability mode.
--

commit e9ec971f3f576a6d5f7a1224c18c5b1a5428ab39
Author: Michael J. Ruhl <michael.j.ruhl@intel.com>

drm/xe/vsec: Do not register BMG PMT for VF

This commit disables BMG PMT registration for Virtual Function (VF) nodes by
adding SR-IOV checks. It also removes the soc_remapper pointer check in the
telemetry read path.

> diff --git a/drivers/gpu/drm/xe/xe_vsec.c b/drivers/gpu/drm/xe/xe_vsec.c
> index a9baf0bfe572c..71bc359b2ad14 100644
> --- a/drivers/gpu/drm/xe/xe_vsec.c
> +++ b/drivers/gpu/drm/xe/xe_vsec.c
[ ... ]
> @@ -157,9 +160,6 @@ int xe_pmt_telem_read(struct device *dev, u32 guid, u64 *data, loff_t user_offse
>  
>  	guard(mutex)(&xe->pmt.lock);
>  
> -	if (!xe->soc_remapper.set_telem_region)
> -		return -ENODEV;
> -

[Severity: Critical]
Does removing this check introduce a NULL pointer dereference during PMT
telemetry reads when the device is in boot survivability mode?

If the device enters boot survivability mode (e.g., due to pcode failure or
configfs), xe_pci_probe() returns early. This skips xe_device_probe() and
xe_soc_remapper_init(), leaving xe->soc_remapper.set_telem_region as NULL.

However, xe_vsec_init() still registers the PMT capabilities during boot
survivability mode, exposing them via sysfs. Because the PCI core leaves
the device's runtime PM state as RPM_ACTIVE, a userspace read of the PMT
sysfs entry will bypass the xe_pm_runtime_get_if_active() check and
unconditionally dereference the NULL set_telem_region pointer later in this
function:

drivers/gpu/drm/xe/xe_vsec.c:xe_pmt_telem_read() {
	...
	/* Unconditional dereference of set_telem_region */
	xe->soc_remapper.set_telem_region(xe, mem_region);
	...
}

>  	/* indicate that we are not at an appropriate power level */
>  	if (!xe_pm_runtime_get_if_active(xe))
>  		return -ENODATA;
[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260903201002.1064889-20-michael.j.ruhl@intel.com?part=6