Re: [PATCH V17 12/12] drm/xe: Add fault-inject based VRAM page offline injection

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Missing SR-IOV VF check exposes physical VRAM offlining and restricted MMIO access to guest VMs.
--

--- Patch [12]: [PATCH V17 12/12] drm/xe: Add fault-inject based VRAM page offline injection ---
commit 7bef89dbe3ddc0e065bfce2e6d297191374f2aa4
Author: Tejas Upadhyay <[email protected]>

drm/xe: Add fault-inject based VRAM page offline injection

This commit adds a fault-inject based debugfs interface for testing VRAM
page offlining. It exposes standard fault-inject knobs and a custom
trigger file on Crescent Island platforms to simulate VRAM page faults.

> diff --git a/drivers/gpu/drm/xe/xe_debugfs.c b/drivers/gpu/drm/xe/xe_debugfs.c
> index 28135f84e2869..95d4dc067b4b8 100644
> --- a/drivers/gpu/drm/xe/xe_debugfs.c
> +++ b/drivers/gpu/drm/xe/xe_debugfs.c

[ ... ]

> @@ -44,12 +45,18 @@
>  DECLARE_FAULT_ATTR(gt_reset_failure);
>  DECLARE_FAULT_ATTR(inject_csc_hw_error);
>  DECLARE_FAULT_ATTR(wedge_cold_reset);
> +DECLARE_FAULT_ATTR(inject_mempage_offline);
>  
>  static bool csc_hw_error_available(struct xe_device *xe)
>  {
>  	return !IS_SRIOV_VF(xe) && xe->info.platform == XE_BATTLEMAGE;
>  }
>  
> +static bool is_crescent_island(struct xe_device *xe)
> +{
> +	return xe->info.platform == XE_CRESCENTISLAND;

[Severity: High]
Are we unintentionally exposing the VRAM offlining debugfs trigger to SR-IOV
Virtual Functions (VFs)?

The csc_hw_error_available() check right above explicitly restricts its
debugfs entry to the Physical Function (PF) using !IS_SRIOV_VF(xe).

If a guest VM writes to the exposed inject_mempage_offline_trigger file, it
invokes xe_ttm_vram_handle_addr_fault() and xe_ttm_vram_addr_to_region(),
which directly reads the GSMBASE MMIO register.

Could this access of PF-restricted MMIO from a VF cause unsupported requests
or timeouts, and violate the virtualization boundary by allowing a VF to
offline physical VRAM pages?

> +}
> +

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=12