On Wed, Oct 07, 2026 at 08:29:34PM +0000, [email protected] wrote: > Thank you for your contribution! Sashiko AI review found 1 potential issue(s) > to consider: > - [High] cxl: cxl_configure_dcd() falsely fails overlap check and > double-counts total DPA capacity
False Positive > -- > > commit e491a6175f0241ed507a397807a28860fd54aadf > Author: Ira Weiny <[email protected]> > > cxl/mem: Read dynamic capacity configuration from the device > > This commit implements Dynamic Capacity (DC) mailbox commands to read and > store DCD configuration information. It validates the first dynamic capacity > partition and configures it as dynamic ram, disabling DCD if the > configuration is invalid. > > > diff --git a/drivers/cxl/core/memdev.c b/drivers/cxl/core/memdev.c > > index b3419df586b9c..def26c490dfe4 100644 > > --- a/drivers/cxl/core/memdev.c > > +++ b/drivers/cxl/core/memdev.c > [ ... ] > > @@ -643,6 +643,53 @@ int cxl_mem_dpa_fetch(struct cxl_memdev_state *mds, > > struct cxl_dpa_info *info) > > } > > EXPORT_SYMBOL_NS_GPL(cxl_mem_dpa_fetch, "CXL"); > > > > +int cxl_configure_dcd(struct cxl_memdev_state *mds, struct cxl_dpa_info > > *info) > > +{ > [ ... ] > > + if (dc_info.start < info->size) { > > + dev_err(dev, > > + "DC partition 0 base %#llx overlaps static capacity > > ending at %#llx\n", > > + dc_info.start, info->size); > > + return -EINVAL; > > + } > > [Severity: High] > Will this overlap check unconditionally fail for any valid DCD configuration? > > Earlier in the execution flow, cxl_mem_dpa_fetch() initializes info->size to > the total DPA capacity (including both static and dynamic capacity): > info->size does not include dynamic capacity. > info->size = mds->total_bytes; > > Since the DC partition is placed within this total space, dc_info.start will > always be strictly less than the total info->size. This appears to cause a > regression where cxl_pci_probe() silently disables DCD support. > > [ ... ] > > + if (check_add_overflow(info->size, dc_info.size, &total)) { > > + dev_err(dev, > > + "DC partition 0 size %#llx overflows DPA space ending > > at %#llx\n", > > + dc_info.size, info->size); > > + return -EINVAL; > > + } > > + > > + info->size = total; > > [Severity: High] > If the above overlap check were bypassed, would this assignment double-count > the dynamic capacity size? > > Since info->size already includes the dynamic capacity initialized from info->size does not include dynamic capacity. > cxl_mem_dpa_fetch(), adding dc_info.size again to the total could cause > cxl_dpa_setup() to allocate a dpa_res root resource larger than the physical > device limit. > > -- > Sashiko AI review ยท > https://sashiko.dev/#/patchset/[email protected]?part=2
