Re: [PATCH v28 5/5] sfc: support pio mapping based on cxl

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] Incorrect Address Calculation / Out-of-Bounds Memory Write in CXL PIO Buffer Mapping
--

commit 7aab6942f29d4c0369d1d6d644627cf376efd5b7
Author: Alejandro Lucero <alucerop@amd.com>

sfc: support pio mapping based on cxl

This commit introduces support for mapping PIO buffers via a CXL memory
region to lower transmit latency. It uses the CXL region to map the memory
range when a CXL device is successfully initialized.

> diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
> index 7e04f115bbaaa..73bc064929f63 100644
> --- a/drivers/net/ethernet/sfc/ef10.c
> +++ b/drivers/net/ethernet/sfc/ef10.c
[ ... ]
> @@ -1263,8 +1273,23 @@ static int efx_ef10_dimension_resources(struct efx_nic *efx)
[ ... ]
> -	/* Set up the WC mapping if needed */
> -	if (wc_mem_map_size) {
> +	if (!wc_mem_map_size)
> +		goto skip_pio;
> +
> +	/* Set up the WC mapping */
> +
> +#ifdef CONFIG_SFC_CXL
> +	probe_data = container_of(efx, struct efx_probe_data, efx);
> +	if ((nic_data->datapath_caps3 &
> +	    (1 << MC_CMD_GET_CAPABILITIES_V7_OUT_CXL_CONFIG_ENABLE_LBN)) &&
> +	    probe_data->cxl_pio_initialised) {
> +		/* Using PIO through CXL mapping */
> +		nic_data->pio_write_base = probe_data->cxl->ctpio_cxl;

[Severity: Critical]
Does this assignment miss the VI stride and PIO buffer offsets?

In efx_ef10_dimension_resources(), the raw CXL memory base is assigned 
directly to pio_write_base. In the legacy path below, the base is adjusted
by the VI stride and PIO buffer offset:

nic_data->pio_write_base =
        nic_data->wc_membase +
        (pio_write_vi_base * efx->vi_stride + ER_DZ_TX_PIOBUF -
         uc_mem_map_size);

Without these adjustments in the CXL path, subsequent PIO buffer address
computations seem to resolve to offset 0 of the VI, which corresponds to
the hardware doorbell registers like ER_DZ_TX_DESC_UPD.

Could this cause untrusted network packet payloads to be written directly
into the active RX/TX doorbell registers instead of the PIO buffer area?

> +		nic_data->pio_write_vi_base = pio_write_vi_base;
> +	} else
> +#endif
> +	{
> +		/* Using legacy PIO BAR mapping */
>  		nic_data->wc_membase = ioremap_wc(efx->membase_phys +
>  						  uc_mem_map_size,
>  						  wc_mem_map_size);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260618181806.118745-1-alejandro.lucero-palau@amd.com?part=5