Re: [PATCH v15 2/8] cxl/mem: Read dynamic capacity configuration from the device

[Anisa Su <anisa.su887@gmail.com>]

On Wed, Oct 07, 2026 at 08:29:34PM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] cxl: cxl_configure_dcd() falsely fails overlap check and double-counts total DPA capacity

False Positive
> --
> 
> commit e491a6175f0241ed507a397807a28860fd54aadf
> Author: Ira Weiny <iweiny@kernel.org>
> 
> cxl/mem: Read dynamic capacity configuration from the device
> 
> This commit implements Dynamic Capacity (DC) mailbox commands to read and
> store DCD configuration information. It validates the first dynamic capacity
> partition and configures it as dynamic ram, disabling DCD if the
> configuration is invalid.
> 
> > diff --git a/drivers/cxl/core/memdev.c b/drivers/cxl/core/memdev.c
> > index b3419df586b9c..def26c490dfe4 100644
> > --- a/drivers/cxl/core/memdev.c
> > +++ b/drivers/cxl/core/memdev.c
> [ ... ]
> > @@ -643,6 +643,53 @@ int cxl_mem_dpa_fetch(struct cxl_memdev_state *mds, struct cxl_dpa_info *info)
> >  }
> >  EXPORT_SYMBOL_NS_GPL(cxl_mem_dpa_fetch, "CXL");
> >  
> > +int cxl_configure_dcd(struct cxl_memdev_state *mds, struct cxl_dpa_info *info)
> > +{
> [ ... ]
> > +	if (dc_info.start < info->size) {
> > +		dev_err(dev,
> > +			"DC partition 0 base %#llx overlaps static capacity ending at %#llx\n",
> > +			dc_info.start, info->size);
> > +		return -EINVAL;
> > +	}
> 
> [Severity: High]
> Will this overlap check unconditionally fail for any valid DCD configuration?
> 
> Earlier in the execution flow, cxl_mem_dpa_fetch() initializes info->size to
> the total DPA capacity (including both static and dynamic capacity):
> 
info->size does not include dynamic capacity.

>     info->size = mds->total_bytes;
> 
> Since the DC partition is placed within this total space, dc_info.start will
> always be strictly less than the total info->size. This appears to cause a
> regression where cxl_pci_probe() silently disables DCD support.
> 
> [ ... ]
> > +	if (check_add_overflow(info->size, dc_info.size, &total)) {
> > +		dev_err(dev,
> > +			"DC partition 0 size %#llx overflows DPA space ending at %#llx\n",
> > +			dc_info.size, info->size);
> > +		return -EINVAL;
> > +	}
> > +
> > +	info->size = total;
> 
> [Severity: High]
> If the above overlap check were bypassed, would this assignment double-count
> the dynamic capacity size?
> 
> Since info->size already includes the dynamic capacity initialized from

info->size does not include dynamic capacity.

> cxl_mem_dpa_fetch(), adding dc_info.size again to the total could cause
> cxl_dpa_setup() to allocate a dpa_res root resource larger than the physical
> device limit.
> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/20261007201828.952-1-anisa.su@samsung.com?part=2