Re: [RFC 11/12] PCI: Initialize and release SIOV capability

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Calculation of maximum SIOV bus consumption silently wraps around due to 16-bit truncation, underreporting the maximum bus number and breaking IOMMU isolation.
--

commit 72b51539a88b3ec026656cdb5f408780a8f58cd2
Author: Dimitri Daskalakis <daskald@meta.com>

PCI: Initialize and release SIOV capability

This commit modifies pci_init_capabilities() to discover the SIOV extended
capability and allocate a struct pci_siov. It computes the worst-case bus
consumption from total_SDIs and mirrors SR-IOV initialization patterns.

> diff --git a/drivers/pci/siov.c b/drivers/pci/siov.c
> new file mode 100644
> index 0000000000000..7372ce95714b2
> --- /dev/null
> +++ b/drivers/pci/siov.c

[ ... ]

> +static int pci_siov_sdi_bus(struct pci_dev *dev, int sdi_id)
> +{
> +	if (!dev->siov)
> +		return -EINVAL;
> +	return pci_virtfn_routing_id(dev, dev->siov->offset,
> +				  dev->siov->stride, sdi_id) >> 8;
> +}
> +
> +static int compute_max_sdi_buses(struct pci_dev *dev)
> +{
> +	struct pci_siov *siov = dev->siov;
> +
> +	if (!siov->offset || (siov->total_SDIs > 1 && !siov->stride))
> +		return -EIO;
> +
> +	siov->max_SDI_buses = pci_siov_sdi_bus(dev, siov->total_SDIs - 1);

[Severity: High]
Does this calculation properly handle 16-bit truncation wrap-around?

If a PCIe endpoint advertises a total_SDIs and stride combination that exceeds
the 16-bit routing ID space (i.e. requesting a bus > 255), the result from
pci_virtfn_routing_id() will mathematically wrap around modulo 65536 since it
returns a u16:

drivers/pci/pci.h:pci_virtfn_routing_id() {
	return (pf->bus->number << 8) + pf->devfn + offset + stride * id;
}

Because this only evaluates the final SDI index (siov->total_SDIs - 1),
siov->max_SDI_buses could be set to a lower, wrapped value.

Later when reserving buses, this could cause an insufficient number of buses to
be reserved, potentially assigning legitimate SDI bus numbers to other
downstream devices and breaking IOMMU isolation.

> +	return 0;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260604150153.3619662-1-dimitri.daskalakis1@gmail.com?part=11