Re: [PATCH v15 2/8] cxl/mem: Read dynamic capacity configuration from the device

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] cxl: cxl_configure_dcd() falsely fails overlap check and double-counts total DPA capacity
--

commit e491a6175f0241ed507a397807a28860fd54aadf
Author: Ira Weiny <iweiny@kernel.org>

cxl/mem: Read dynamic capacity configuration from the device

This commit implements Dynamic Capacity (DC) mailbox commands to read and
store DCD configuration information. It validates the first dynamic capacity
partition and configures it as dynamic ram, disabling DCD if the
configuration is invalid.

> diff --git a/drivers/cxl/core/memdev.c b/drivers/cxl/core/memdev.c
> index b3419df586b9c..def26c490dfe4 100644
> --- a/drivers/cxl/core/memdev.c
> +++ b/drivers/cxl/core/memdev.c
[ ... ]
> @@ -643,6 +643,53 @@ int cxl_mem_dpa_fetch(struct cxl_memdev_state *mds, struct cxl_dpa_info *info)
>  }
>  EXPORT_SYMBOL_NS_GPL(cxl_mem_dpa_fetch, "CXL");
>  
> +int cxl_configure_dcd(struct cxl_memdev_state *mds, struct cxl_dpa_info *info)
> +{
[ ... ]
> +	if (dc_info.start < info->size) {
> +		dev_err(dev,
> +			"DC partition 0 base %#llx overlaps static capacity ending at %#llx\n",
> +			dc_info.start, info->size);
> +		return -EINVAL;
> +	}

[Severity: High]
Will this overlap check unconditionally fail for any valid DCD configuration?

Earlier in the execution flow, cxl_mem_dpa_fetch() initializes info->size to
the total DPA capacity (including both static and dynamic capacity):

    info->size = mds->total_bytes;

Since the DC partition is placed within this total space, dc_info.start will
always be strictly less than the total info->size. This appears to cause a
regression where cxl_pci_probe() silently disables DCD support.

[ ... ]
> +	if (check_add_overflow(info->size, dc_info.size, &total)) {
> +		dev_err(dev,
> +			"DC partition 0 size %#llx overflows DPA space ending at %#llx\n",
> +			dc_info.size, info->size);
> +		return -EINVAL;
> +	}
> +
> +	info->size = total;

[Severity: High]
If the above overlap check were bypassed, would this assignment double-count
the dynamic capacity size?

Since info->size already includes the dynamic capacity initialized from
cxl_mem_dpa_fetch(), adding dc_info.size again to the total could cause
cxl_dpa_setup() to allocate a dpa_res root resource larger than the physical
device limit.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261007201828.952-1-anisa.su@samsung.com?part=2