Re: [PATCH v8 07/10] drm/xe/pf: Align VF GGTT allocations to PAGE_SIZE

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] xe: SR-IOV GGTT alignment allows memory isolation bypass
--

commit b273b43c9c7b2ba3519285921560775aacbe0985
Author: Satyanarayana K V P <satyanarayana.k.v.p@intel.com>

drm/xe/pf: Align VF GGTT allocations to PAGE_SIZE

This commit reduces the PF's alignment for VF GGTT partitions to the host
CPU PAGE_SIZE (4K) to allow finer-grained partitioning.

> diff --git a/drivers/gpu/drm/xe/xe_gt_sriov_pf_config.c b/drivers/gpu/drm/xe/xe_gt_sriov_pf_config.c
> index 6947aeed458ed..91ec8e898e3b5 100644
> --- a/drivers/gpu/drm/xe/xe_gt_sriov_pf_config.c
> +++ b/drivers/gpu/drm/xe/xe_gt_sriov_pf_config.c
> @@ -441,9 +441,7 @@ static int pf_refresh_vf_cfg(struct xe_gt *gt, unsigned int vfid)
>  
>  static u64 pf_get_ggtt_alignment(struct xe_gt *gt)
>  {
> -	struct xe_device *xe = gt_to_xe(gt);
> -
> -	return IS_DGFX(xe) && xe->info.vram_flags & XE_VRAM_FLAGS_NEED64K ? SZ_64K : SZ_4K;
> +	return PAGE_SIZE;

[Severity: Critical]
Does this regression allow a VF to bypass SR-IOV memory isolation?

By unconditionally returning PAGE_SIZE, the PF provisions the VF's GGTT
partition with a base address (ggtt->start) that is only guaranteed to be
4K-aligned.

In the VF, the local drm_mm allocator is initialized with a start offset of 0,
meaning it aligns local offsets but not the absolute global GGTT address:

drivers/gpu/drm/xe/xe_ggtt.c:__xe_ggtt_init_early()
    drm_mm_init(&ggtt->mm, 0, size);

When the VF maps a VRAM object, it requests a 64K-aligned local offset from
drm_mm:

drivers/gpu/drm/xe/xe_ggtt.c:__xe_ggtt_insert_bo_at()
    if (xe_bo_is_vram(bo) && ggtt->flags & XE_GGTT_FLAGS_64K)
        alignment = SZ_64K;

Because the global GGTT virtual address is local_offset + ggtt->start,
a 4K-aligned partition base offset produces a globally misaligned hardware
address.

Since the GPU's TLB masks the lower 16 bits of the virtual address for 64K
pages, will this misaligned absolute address cause the TLB entry to alias with
the preceding 4K-aligned memory range, potentially exposing another VF or PF's
memory?

>  }
>  
>  static u64 pf_get_min_spare_ggtt(struct xe_gt *gt)

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260915071159.51402-12-satyanarayana.k.v.p@intel.com?part=7