Re: [PATCH v31 4/5] sfc: obtain and map cxl range using devm_cxl_probe_mem

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Inverted teardown order unmaps write-combining memory and cleans up devm CXL resources after the PCI device is disabled.
--

commit 8a6ea64dcd83c4ec06b3116375770f0f9dce6ca6
Author: Alejandro Lucero <alucerop@amd.com>
Subject: sfc: obtain and map cxl range using devm_cxl_probe_mem

This commit uses the core CXL API to safely obtain and map the CXL range
linked to an HDM committed by the BIOS. The mapped range is used as the ctpio
buffer.

> diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c
> index 61cbb6cfc3602..3806cd3dd7f48 100644
> --- a/drivers/net/ethernet/sfc/efx.c
> +++ b/drivers/net/ethernet/sfc/efx.c
> @@ -984,6 +984,7 @@ static void efx_pci_remove(struct pci_dev *pci_dev)
>  	efx_fini_io(efx);
>  
>  	probe_data = container_of(efx, struct efx_probe_data, efx);
> +	efx_cxl_exit(probe_data);

[Severity: High]
Does this sequence unmap the Write-Combining memory after the PCI device is
disabled?

In efx_pci_remove(), efx_fini_io() is called first, which calls
pci_disable_device(). Then efx_cxl_exit() calls iounmap() on the ctpio_cxl
mapping.

If a CPU write-combining buffer flush occurs during iounmap() on a disabled
device, could it trigger a fatal PCIe error (Master Abort) and a kernel panic?

Also, since devm_cxl_probe_mem() and devm_cxl_dev_state_create() are used
during initialization, devres will clean up these resources after
efx_pci_remove() returns. Does this mean the devm cleanup also accesses the
device after it has been disabled?

>  
>  	pci_dbg(efx->pci_dev, "shutdown successful\n");
>  

[ ... ]

> @@ -1242,6 +1243,7 @@ static int efx_pci_probe(struct pci_dev *pci_dev,
>  	return 0;
>  
>   fail3:
> +	efx_cxl_exit(probe_data);
>  	efx_fini_io(efx);

[Severity: High]
Does this error path cause devm-managed CXL resources to be cleaned up on a
disabled device?

While efx_cxl_exit() correctly unmaps the region before efx_fini_io()
disables the device here, the devm-managed resources (like the CXL accel
memdev) will be destroyed by devres after efx_pci_probe() returns.

By the time devres runs, efx_fini_io() has already called pci_disable_device(),
so the devm cleanup will happen with the PCI device already disabled.

>   fail2:
>  	efx_fini_struct(efx);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260630151346.31201-1-alejandro.lucero-palau@amd.com?part=4