Re: [PATCH v5 1/4] cxl/hdm: Reject switch decoder interleave ways that overflow targets

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Incorrect parsing of the target list register on Big-Endian architectures.
--

--- Patch [1]: [PATCH v5 1/4] cxl/hdm: Reject switch decoder interleave ways that overflow targets ---
commit f23bc6bdfaf477309897aefc0c8b1cee5f060c37
Author: Alison Schofield <alison.schofield@intel.com>

cxl/hdm: Reject switch decoder interleave ways that overflow targets

Switch decoder enumeration validates that the interleave ways encoding
is legal, but not that the resulting number of ways fits the available
targets. This can overrun the target array (target_list.target_id[])
during enumeration of 12 or 16 way interleaves.

Link: https://sashiko.dev/#/patchset/20260711180755.1779002-1-alison.schofield@intel.com?part=1

> diff --git a/drivers/cxl/core/hdm.c b/drivers/cxl/core/hdm.c
> index 0c80b76a5f9b4..c394b3d54d362 100644
> --- a/drivers/cxl/core/hdm.c
> +++ b/drivers/cxl/core/hdm.c

[ ... ]

> @@ -1084,6 +1086,16 @@ static int init_hdm_decoder(struct cxl_port *port, struct cxl_decoder *cxld,
>  		cxld->interleave_ways, cxld->interleave_granularity);
>  
>  	if (!cxled) {
> +		struct cxl_switch_decoder *cxlsd = to_cxl_switch_decoder(&cxld->dev);
> +
> +		if (cxld->interleave_ways > cxlsd->nr_targets) {
> +			dev_err(&port->dev,
> +				"decoder%d.%d: interleave ways: %d exceeds targets: %d\n",
> +				port->id, cxld->id, cxld->interleave_ways,
> +				cxlsd->nr_targets);
> +			return -ENXIO;
> +		}
> +
>  		lo = readl(hdm + CXL_HDM_DECODER0_TL_LOW(which));
>  		hi = readl(hdm + CXL_HDM_DECODER0_TL_HIGH(which));
>  		target_list.value = (hi << 32) + lo;

[Severity: High]
This isn't a bug introduced by this patch, but does this logic in
init_hdm_decoder() parse the target list register incorrectly on Big-Endian
architectures?

Because hi and lo are in CPU endianness, on a Big-Endian system the shift
operation places the most significant bytes of hi at the lowest addresses of
the target_list.target_id array, effectively reversing the hardware target
IDs.

When the 64-bit target list is read out sequentially as an array of bytes,
could this result in physical memory addresses being routed to the wrong
target ports on Big-Endian systems?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1786143520.git.alison.schofield@intel.com?part=1