Re: [PATCH v6 05/13] ACPI: extlog: Avoid populating software AER metadata from raw hardware buffer

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The patch truncates Flit mode TLP logs by strictly copying only 16 bytes of the prefix log and deliberately leaving `flit` and `header_len` as zero.
--

commit a79ba2cb1ba02ad8827d582fce99b0fe70c8796e
Author: Dave Jiang <dave.jiang@intel.com>

ACPI: extlog: Avoid populating software AER metadata from raw hardware buffer

This commit fixes an issue in extlog_print_pcie() where casting the hardware
aer_info buffer directly to struct aer_capability_regs could fill software-only
metadata fields (header_len and flit) with raw firmware bytes. It introduces a
safer local copy mechanism to populate only the hardware-backed fields while
keeping the rest zeroed.

Closes: https://lore.kernel.org/linux-cxl/20260709165457.8BA181F000E9@smtp.kernel.org/

> diff --git a/drivers/acpi/acpi_extlog.c b/drivers/acpi/acpi_extlog.c
> index 2451362e696dc..1b61788abd5a6 100644
> --- a/drivers/acpi/acpi_extlog.c
> +++ b/drivers/acpi/acpi_extlog.c
> @@ -149,7 +149,21 @@ static void extlog_print_pcie(struct cper_sec_pcie *pcie_err,
>  		return;
>  
>  	aer_severity = cper_severity_to_aer(severity);
> -	aer = (struct aer_capability_regs *)pcie_err->aer_info;
> +
> +	/*
> +	 * struct pcie_tlp_log is larger than the hardware layout, so aer_info
> +	 * only maps onto the struct up to the four Header Log DWORDs. Copy that
> +	 * much, then place the TLP Prefix Log from where the hardware keeps it.
> +	 * Everything else stays zero: nothing reads root_command, root_status or
> +	 * the error source IDs, and header_len and flit are software-only.
> +	 */
> +	memcpy(&aer_regs, pcie_err->aer_info,
> +	       offsetof(struct aer_capability_regs, header_log) +
> +	       PCIE_STD_NUM_TLP_HEADERLOG * sizeof(u32));
> +	memcpy(aer_regs.header_log.prefix,
> +	       pcie_err->aer_info + PCI_ERR_PREFIX_LOG,
> +	       sizeof(aer_regs.header_log.prefix));

[Severity: Medium]
Does this strict 16-byte copy truncate the TLP Prefix Log in Flit mode?

By hardcoding sizeof(aer_regs.header_log.prefix) (16 bytes) and deliberately
leaving the software metadata fields 'flit' and 'header_len' as zero, this
appears to drop up to 24 bytes (6 DWORDs) of the Flit mode extended TLP header
from the hardware buffer.

If a PCIe error occurs in Flit mode, the error would be printed as if it were a
non-Flit mode error, leading to incomplete diagnostic information in dmesg.

Should this logic account for Flit mode to ensure the entire extended header
data is accurately copied?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260904172337.1409775-1-dave.jiang@intel.com?part=5