Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] Enabling the survivability region causes an infinite loop during erase operations at the 8MB boundary, and bypasses bounds checks via integer underflow on reads and writes. --
--- Patch [2]: [PATCH 2/2] drm/xe/nvm: define survivabilty partition --- commit b38b020b9c762ee5ac9265db46b43fe2139de54d Author: Alexander Usyskin <[email protected]> drm/xe/nvm: define survivabilty partition Define 8M survivability partition for CRI when storage is open for write. > diff --git a/drivers/gpu/drm/xe/xe_nvm.c b/drivers/gpu/drm/xe/xe_nvm.c > index 1ea67eaeae243..54de0dbe1fa4d 100644 > --- a/drivers/gpu/drm/xe/xe_nvm.c > +++ b/drivers/gpu/drm/xe/xe_nvm.c [ ... ] > @@ -67,6 +68,7 @@ static bool xe_nvm_writable_override(struct xe_device *xe) > reg = PCODE_SCRATCH(0); > test_bit = FDO_MODE; > test_val = FDO_MODE; > + s_size = SZ_8M; [Severity: High] Does enabling this survivability region cause an infinite loop during erase operations in the MTD driver? When this patch sets the size to 8MB and survivability is enabled, all accesses are forced to use region 0, which has a hardcoded size of 8MB: drivers/mtd/devices/mtd_intel_dg.c:idg_nvm_get_region() { ... if (nvm->survivability_enabled) return 0; ... } If a user performs an erase operation at or crossing the 8MB boundary, it can trigger an infinite loop in intel_dg_mtd_erase(): drivers/mtd/devices/mtd_intel_dg.c:intel_dg_mtd_erase() { ... if (len > nvm->regions[idx].size - from) len = nvm->regions[idx].size - from; ... } When from reaches 8MB (the size of region 0), size - from evaluates to 0. This sets len to 0. This can cause the operation to return 0 immediately without decreasing total_len, leading to an infinite while (total_len > 0) loop. Additionally, read and write operations starting beyond 8MB might cause size - from to underflow to a massive positive number, bypassing bounds checks. > break; > case XE_BATTLEMAGE: > reg = HECI_FWSTS2(DG2_GSC_HECI2_BASE); -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=2
