Claude review: drm/xe/xe_vm: Implement xe_vm_get_property_ioctl

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

**TOCTOU race in `xe_vm_get_property_helper`.** The function reads `vm->faults.len` under spinlock, releases it, then checks `args->size > size`. Meanwhile, `fill_faults()` acquires the lock again. Between the two lock acquisitions, new faults could be added, making the list longer than expected. The check `args->size > size` would have passed with the old (smaller) size, but `fill_faults` then iterates the (now longer) list — this is safe because `fill_faults` has its own `count` limit, but the logic is unnecessarily convoluted and fragile.

**`copy_to_user` of potentially uninitialized data.** In `fill_faults()`:
```c
fault_list = kcalloc(count, sizeof(struct xe_vm_fault), GFP_KERNEL);
```
The array is zero-initialized via `kcalloc`, and then partially filled. But the `copy_to_user` copies `args->size` bytes, which is the full requested size. If fewer faults exist than `count`, the remaining entries are zeroed (from kcalloc), which is fine. However, this means userspace has no way to know how many entries were actually filled vs. zero-padded. The ioctl should communicate the actual count back (e.g., updating `args->size` to reflect the actual bytes written).

**`xe_to_user_fault_type` and `xe_to_user_fault_level` are no-ops.** These functions just return their argument unchanged:
```c
static u8 xe_to_user_fault_type(u8 fault_type) { return fault_type; }
static u8 xe_to_user_fault_level(u8 fault_level) { return fault_level; }
```
If the intent is to have a place to insert future mapping logic, a comment explaining this would help. Otherwise, these are dead abstractions.

**Missing `extensions` and `pad` validation.** The ioctl checks `reserved[0..2]` but doesn't validate `args->extensions == 0` or `args->pad == 0`. All MBZ fields should be checked to preserve future extensibility.

**Faults are never cleared.** The fault list accumulates up to 50 entries and is only cleared on VM destruction (`xe_vm_close_and_put`). There's no mechanism for userspace to acknowledge/clear faults after reading them. This means repeated queries return the same stale data, and once 50 faults are recorded, no new faults are ever visible. This is a significant usability limitation that should at least be documented in the uAPI, or better, a clear-on-read or explicit clear mechanism should be added.

---
Generated by Claude Code Patch Reviewer