Re: [RESEND PATCH v13 6/8] cxl/mem: Configure dynamic capacity interrupts

[Anisa Su <anisa.su887@gmail.com>]

On Tue, Sep 08, 2026 at 10:43:27AM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> 
> Pre-existing issues:
> - [High] If a CXL device is surprise-removed or a fatal PCIe error occurs, `cxl_event_thread` enters an infinite loop, pegging the CPU at 100% and deadlocking device removal.
> --
Surpise removal is unsupported. Jonathan mentioned the same on a similar
thread: 
https://lore.kernel.org/linux-cxl/aqLZP3ORYzCLfSgR@acer-nitro-anv15-41/T/#m8e12567a42b07fae8aa307406e6e017fe24ad832
> 
> commit f11145933c61ad9c3ba90b62e3f38dc571f856c5
> Author: Ira Weiny <iweiny@kernel.org>
> 
> cxl/mem: Configure dynamic capacity interrupts
> 
> This commit configures Dynamic Capacity Device (DCD) event log interrupts
> on devices supporting dynamic capacity. It disables DCD if interrupts are
> not supported, and carefully preserves firmware-first interrupt policies
> if selected by the BIOS.
> 
> > diff --git a/drivers/cxl/pci.c b/drivers/cxl/pci.c
> > index 7b754af2168d0..1ea505b1f40e8 100644
> > --- a/drivers/cxl/pci.c
> > +++ b/drivers/cxl/pci.c
> [ ... ]
> > @@ -523,8 +535,8 @@ static irqreturn_t cxl_event_thread(int irq, void *id)
> >  		 * ignore the reserved upper 32 bits
> >  		 */
> >  		status = readl(cxlds->regs.status + CXLDEV_DEV_EVENT_STATUS_OFFSET);
> > -		/* Ignore logs unknown to the driver */
> > -		status &= CXLDEV_EVENT_STATUS_ALL;
> > +		/* Ignore logs unknown to the driver or owned by BIOS */
> > +		status &= mask;
> >  		if (!status)
> >  			break;
> >  		cxl_mem_get_event_records(mds, status);
> >  		cond_resched();
> >  	} while (status);
> 
> [Severity: High]
> This is a pre-existing issue, but does this loop lack a check for PCIe
> surprise removal where MMIO reads return all 1s (~0)?
> 
> If a CXL device is surprise-removed or a fatal PCIe error occurs, readl()
> will return 0xFFFFFFFF. When this is bitwise ANDed with mask, it leaves a
> non-zero value, causing the loop to continue. 
> 
> Since cxl_mem_get_event_records() will also read ~0 (e.g., when checking
> cxl_doorbell_busy()) and return immediately without changing hardware
> state, won't this loop spin indefinitely, pegging the CPU at 100% and
> deadlocking device removal when free_irq() waits for this thread to exit?
> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/20260908102124.2231730-2-anisa.su@samsung.com?part=6