Re: [PATCH v7 02/11] cxl: Cache decoder settings on PCI devices

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:

New issues:
- [High] Cached target list is truncated to 8 targets, breaking reset recovery for 16-way interleaving.

Pre-existing issues:
- [High] HDM target list parsing uses an endian-unsafe union, reversing target IDs on big-endian architectures.
- [High] Stack out-of-bounds read occurs when processing decoders with more than 8 interleave ways.
--

commit 1a9ec0491bde62ac73e5c79d561f966396fbb2b8
Author: Srirangan Madhavan <smadhavan@nvidia.com>

cxl: Cache decoder settings on PCI devices

Cache CXL core's HDM decoder settings in pci_dev->hdm as decoders are
enumerated, committed, or reset. PCI reset paths can use this snapshot to
restore HDM programming without walking CXL topology during reset recovery.

> diff --git a/drivers/cxl/core/hdm.c b/drivers/cxl/core/hdm.c
> index fa978c297546f..83cda63f76a5a 100644
> --- a/drivers/cxl/core/hdm.c
> +++ b/drivers/cxl/core/hdm.c
[ ... ]
> @@ -989,6 +1061,7 @@ static int init_hdm_decoder(struct cxl_port *port, struct cxl_decoder *cxld,
>  		lo = readl(hdm + CXL_HDM_DECODER0_TL_LOW(which));
>  		hi = readl(hdm + CXL_HDM_DECODER0_TL_HIGH(which));
>  		target_list.value = (hi << 32) + lo;
> +		cxld->targets = target_list.value;

[Severity: High]
Does this truncate the target list to 8 targets?

Since target_list.value is a u64, if a decoder is configured for 16-way
interleaving, it looks like the extended target list registers are ignored
and the upper 8 targets will be permanently lost during reset recovery.

>  		for (i = 0; i < cxld->interleave_ways; i++)
>  			cxld->target_map[i] = target_list.target_id[i];

[Severity: High]
This isn't a bug introduced by this patch, but doesn't the target_list
union overlay reverse the target list on big-endian architectures?

The target_list union maps an 8-byte array over a u64, which accesses
the value in memory order.

[Severity: High]
This is also a pre-existing issue, but since target_id is strictly bounded
to 8 bytes in the union, does this loop perform a stack out-of-bounds read
into cxld->target_map if cxld->interleave_ways is greater than 8?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260623032453.3404772-1-smadhavan@nvidia.com?part=2