From 8a13db9f899d149c3aab24abcb668121cfda5a4f Mon Sep 17 00:00:00 2001 From: Richard Cheng Date: Wed, 24 Jun 2026 22:41:47 +0800 Subject: [PATCH 01/35] cxl/mbox: Clamp mailbox output allocation to the payload size CXL_MEM_SEND_COMMAND bounds the user's in.size to the mailbox payload size but leaves out.size unbounded, then cxl_mbox_cmd_ctor() calls kvzalloc(out.size). A large out.size drives a huge allocation, above INT_MAX it WARNs and taints, and with panic_on_warn=1 it panics. The transport __cxl_pci_mbox_send_cmd() already clamps the response copy to min(out.size, payload_size, device len), so the output buffer is never written beyond payload_size. Clamp the allocation to payload_size too, matching the RAW path. Fixes: 583fa5e71cae ("cxl/mem: Add basic IOCTL interface") Reviewed-by: Kai-Heng Feng Reviewed-by: Koba Ko Reviewed-by: Dave Jiang Reviewed-by: Davidlohr Bueso Signed-off-by: Richard Cheng Link: https://patch.msgid.link/20260624144147.53997-1-icheng@nvidia.com Signed-off-by: Dave Jiang --- drivers/cxl/core/mbox.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/drivers/cxl/core/mbox.c b/drivers/cxl/core/mbox.c index 7c6c5b7450a5..d9cb02c9f72c 100644 --- a/drivers/cxl/core/mbox.c +++ b/drivers/cxl/core/mbox.c @@ -380,11 +380,7 @@ static int cxl_mbox_cmd_ctor(struct cxl_mbox_cmd *mbox_cmd, } } - /* Prepare to handle a full payload for variable sized output */ - if (out_size == CXL_VARIABLE_PAYLOAD) - mbox_cmd->size_out = cxl_mbox->payload_size; - else - mbox_cmd->size_out = out_size; + mbox_cmd->size_out = min_t(size_t, out_size, cxl_mbox->payload_size); if (mbox_cmd->size_out) { mbox_cmd->payload_out = kvzalloc(mbox_cmd->size_out, GFP_KERNEL); From fe7883d0e99a5558050c43bbfe29e2b44977f97f Mon Sep 17 00:00:00 2001 From: Yousef Alhouseen Date: Wed, 24 Jun 2026 14:28:35 +0200 Subject: [PATCH 02/35] cxl: fix mailbox return code description typo Fix a typo in the CXL mailbox command return code description for the interrupted-command case. Signed-off-by: Yousef Alhouseen Reviewed-by: Richard Cheng Reviewed-by: Ira Weiny Link: https://patch.msgid.link/20260624122835.5656-1-alhouseenyousef@gmail.com Signed-off-by: Dave Jiang --- drivers/cxl/cxlmem.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/cxl/cxlmem.h b/drivers/cxl/cxlmem.h index ed419d0c59f2..503ae2864591 100644 --- a/drivers/cxl/cxlmem.h +++ b/drivers/cxl/cxlmem.h @@ -183,7 +183,7 @@ static inline struct cxl_ep *cxl_ep_load(struct cxl_port *port, C(MBUNSUPPORTED, -ENXIO, "unsupported on the mailbox it was issued on"),\ C(PAYLOADLEN, -ENXIO, "invalid payload length"), \ C(LOG, -ENXIO, "invalid or unsupported log page"), \ - C(INTERRUPTED, -ENXIO, "asynchronous event occured"), \ + C(INTERRUPTED, -ENXIO, "asynchronous event occurred"), \ C(FEATUREVERSION, -ENXIO, "unsupported feature version"), \ C(FEATURESELVALUE, -ENXIO, "unsupported feature selection value"), \ C(FEATURETRANSFERIP, -ENXIO, "feature transfer in progress"), \ From a667f1eb71a77859af6cedaadfab528256a99ca7 Mon Sep 17 00:00:00 2001 From: Zenghui Yu Date: Mon, 15 Jun 2026 00:14:58 +0800 Subject: [PATCH 03/35] cxl: docs/linux/dax-driver - fix typos Fix two obvious typos in the "kmem conversion" section. Signed-off-by: Zenghui Yu Reviewed-by: Alison Schofield Reviewed-by: Dongliang Mu Acked-by: Randy Dunlap Link: https://patch.msgid.link/20260614161458.88942-1-zenghui.yu@linux.dev Signed-off-by: Dave Jiang --- Documentation/driver-api/cxl/linux/dax-driver.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Documentation/driver-api/cxl/linux/dax-driver.rst b/Documentation/driver-api/cxl/linux/dax-driver.rst index 10d953a2167b..72c85a0f8606 100644 --- a/Documentation/driver-api/cxl/linux/dax-driver.rst +++ b/Documentation/driver-api/cxl/linux/dax-driver.rst @@ -35,9 +35,9 @@ will be exposed to the kernel page allocator in the user-selected memory zone. The :code:`memmap_on_memory` setting (both global and DAX device local) -dictates where the kernell will allocate the :code:`struct folio` descriptors +dictates where the kernel will allocate the :code:`struct folio` descriptors for this memory will come from. If :code:`memmap_on_memory` is set, memory hotplug will set aside a portion of the memory block capacity to allocate folios. If unset, the memory is allocated via a normal :code:`GFP_KERNEL` -allocation - and as a result will most likely land on the local NUM node of the +allocation - and as a result will most likely land on the local NUMA node of the CPU executing the hotplug operation. From d79b81893d0cc93737e811a465b9ef9a00156fd5 Mon Sep 17 00:00:00 2001 From: Wei Hou Date: Sun, 28 Jun 2026 23:58:57 +0800 Subject: [PATCH 04/35] cxl/pci: Remove incorrect mbox.valid check in cxl_pci_type3_init_mailbox() The driver's design intent is that missing or malformed component registers should not prevent mailbox initialization. cxl_pci_probe() already reflects this: the CXL_REGLOC_RBI_COMPONENT setup path only emits a dev_warn() and continues when component registers are absent, rather than returning an error. The check 'if (!cxlds->reg_map.device_map.mbox.valid)' violates this intent and is also technically incorrect for two reasons: 1. Wrong struct: the MEMDEV register block is enumerated into a local variable 'map', not into 'cxlds->reg_map'. The device_map.mbox.valid field inside cxlds->reg_map is never written by the MEMDEV probe and will always read as zero regardless of actual hardware capability. 2. Already validated: cxl_pci_setup_regs(CXL_REGLOC_RBI_MEMDEV) calls cxl_probe_regs() which explicitly checks mbox.valid and returns -ENXIO if the mailbox is absent. If that check passes, the mailbox is guaranteed to be present by the time cxl_pci_type3_init_mailbox() is called. The value that the check actually reads is component_map.ras.valid, which aliases device_map.mbox.valid in the union. This is populated by the COMPONENT probe, not the MEMDEV probe. On devices where the component register BAR does not implement a CXL Component Capability Array (e.g. certain DCD devices), cxl_probe_component_regs() returns early leaving ras.valid=false. Through the union, this makes mbox.valid read as false, causing cxl_pci_type3_init_mailbox() to return -ENODEV (-19) even though the mailbox hardware is fully functional. Remove the check. Mailbox presence has already been validated by cxl_pci_setup_regs(CXL_REGLOC_RBI_MEMDEV). The presence or absence of component registers is irrelevant to mailbox initialization. Fixes: 8d8081cecfb9 ("cxl: Move mailbox related bits to the same context") Reviewed-by: Richard Cheng Signed-off-by: Wei Hou Reviewed-by: Li Ming Link: https://patch.msgid.link/20260628155857.239866-1-wei.hou@scaleflux.com Signed-off-by: Dave Jiang --- drivers/cxl/pci.c | 6 ------ 1 file changed, 6 deletions(-) diff --git a/drivers/cxl/pci.c b/drivers/cxl/pci.c index 267c679b0b3c..0c9d7f8ec9e4 100644 --- a/drivers/cxl/pci.c +++ b/drivers/cxl/pci.c @@ -691,12 +691,6 @@ static int cxl_pci_type3_init_mailbox(struct cxl_dev_state *cxlds) { int rc; - /* - * Fail the init if there's no mailbox. For a type3 this is out of spec. - */ - if (!cxlds->reg_map.device_map.mbox.valid) - return -ENODEV; - rc = cxl_mailbox_init(&cxlds->cxl_mbox, cxlds->dev); if (rc) return rc; From 775d0f4558f4cec0ee0c8966595d1add1791f36e Mon Sep 17 00:00:00 2001 From: Dave Jiang Date: Tue, 16 Jun 2026 15:49:11 -0700 Subject: [PATCH 05/35] cxl/mce: Make the MCE notifier per-region Flavien Solt reported lifetime issues with the CXL MCE notifier, which can lead to NULL dereferences and use-after-free in the MCE handler. The notifier was registered per memory device and stored in 'struct cxl_memdev_state', even though it only needs the region state (the region's SPA range and its extended linear cache size). Instead of keeping the memory device and endpoint alive, the correct fix is to move the notifier into 'struct cxl_region' and register it from cxl_region_probe() as it should be a per-region notifier. Setup the registration to only happen for regions that have an extended linear cache as that is the only current usage. Remove cxl_port_get_spa_cache_alias() as it is now dead code. [ dj: Update dev_warn() when notifier fails due to kconfig. (Ben) ] Reported-by: Flavien Solt Suggested-by: Dan Williams Fixes: 516e5bd0b6bf ("cxl: Add mce notifier to emit aliased address for extended linear cache") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Alison Schofield Reviewed-by: Ben Cheatham Link: https://patch.msgid.link/20260616224912.2567474-1-dave.jiang@intel.com Signed-off-by: Dave Jiang --- drivers/cxl/core/mbox.c | 8 -------- drivers/cxl/core/mce.c | 27 ++++++++++++------------ drivers/cxl/core/region.c | 43 ++++++++++++++------------------------- drivers/cxl/cxl.h | 8 ++------ drivers/cxl/cxlmem.h | 2 -- 5 files changed, 30 insertions(+), 58 deletions(-) diff --git a/drivers/cxl/core/mbox.c b/drivers/cxl/core/mbox.c index d9cb02c9f72c..94b1f7167588 100644 --- a/drivers/cxl/core/mbox.c +++ b/drivers/cxl/core/mbox.c @@ -11,7 +11,6 @@ #include "core.h" #include "trace.h" -#include "mce.h" static bool cxl_raw_allow_all; @@ -1522,7 +1521,6 @@ struct cxl_memdev_state *cxl_memdev_state_create(struct device *dev, u64 serial, u16 dvsec) { struct cxl_memdev_state *mds; - int rc; mds = devm_cxl_dev_state_create(dev, CXL_DEVTYPE_CLASSMEM, serial, dvsec, struct cxl_memdev_state, cxlds, @@ -1534,12 +1532,6 @@ struct cxl_memdev_state *cxl_memdev_state_create(struct device *dev, u64 serial, mutex_init(&mds->event.log_lock); - rc = devm_cxl_register_mce_notifier(dev, &mds->mce_notifier); - if (rc == -EOPNOTSUPP) - dev_warn(dev, "CXL MCE unsupported\n"); - else if (rc) - return ERR_PTR(rc); - return mds; } EXPORT_SYMBOL_NS_GPL(cxl_memdev_state_create, "CXL"); diff --git a/drivers/cxl/core/mce.c b/drivers/cxl/core/mce.c index ff8d078c6ca1..65fed913b221 100644 --- a/drivers/cxl/core/mce.c +++ b/drivers/cxl/core/mce.c @@ -4,16 +4,16 @@ #include #include #include -#include +#include +#include "core.h" #include "mce.h" static int cxl_handle_mce(struct notifier_block *nb, unsigned long val, void *data) { - struct cxl_memdev_state *mds = container_of(nb, struct cxl_memdev_state, - mce_notifier); - struct cxl_memdev *cxlmd = mds->cxlds.cxlmd; - struct cxl_port *endpoint = cxlmd->endpoint; + struct cxl_region *cxlr = container_of(nb, struct cxl_region, + mce_notifier); + struct cxl_region_params *p = &cxlr->params; struct mce *mce = data; u64 spa, spa_alias; unsigned long pfn; @@ -21,26 +21,25 @@ static int cxl_handle_mce(struct notifier_block *nb, unsigned long val, if (!mce || !mce_usable_address(mce)) return NOTIFY_DONE; - if (!endpoint) - return NOTIFY_DONE; - spa = mce->addr & MCI_ADDR_PHYSADDR; - pfn = spa >> PAGE_SHIFT; - if (!pfn_valid(pfn)) + if (!cxl_resource_contains_addr(p->res, spa)) return NOTIFY_DONE; - spa_alias = cxl_port_get_spa_cache_alias(endpoint, spa); - if (spa_alias == ~0ULL) - return NOTIFY_DONE; + if (spa >= p->res->start + p->cache_size) + spa_alias = spa - p->cache_size; + else + spa_alias = spa + p->cache_size; pfn = spa_alias >> PAGE_SHIFT; + if (!pfn_valid(pfn)) + return NOTIFY_DONE; /* * Take down the aliased memory page. The original memory page flagged * by the MCE will be taken cared of by the standard MCE handler. */ - dev_emerg(mds->cxlds.dev, "Offlining aliased SPA address0: %#llx\n", + dev_emerg(&cxlr->dev, "Offlining aliased SPA address0: %#llx\n", spa_alias); if (!memory_failure(pfn, 0)) set_mce_nospec(pfn); diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c index 1e211542b6b6..578622240401 100644 --- a/drivers/cxl/core/region.c +++ b/drivers/cxl/core/region.c @@ -15,6 +15,7 @@ #include #include #include "core.h" +#include "mce.h" /** * DOC: cxl core region @@ -3859,34 +3860,6 @@ int cxl_add_to_region(struct cxl_endpoint_decoder *cxled) } EXPORT_SYMBOL_NS_GPL(cxl_add_to_region, "CXL"); -u64 cxl_port_get_spa_cache_alias(struct cxl_port *endpoint, u64 spa) -{ - struct cxl_region_ref *iter; - unsigned long index; - - if (!endpoint) - return ~0ULL; - - guard(rwsem_write)(&cxl_rwsem.region); - - xa_for_each(&endpoint->regions, index, iter) { - struct cxl_region_params *p = &iter->region->params; - - if (cxl_resource_contains_addr(p->res, spa)) { - if (!p->cache_size) - return ~0ULL; - - if (spa >= p->res->start + p->cache_size) - return spa - p->cache_size; - - return spa + p->cache_size; - } - } - - return ~0ULL; -} -EXPORT_SYMBOL_NS_GPL(cxl_port_get_spa_cache_alias, "CXL"); - static int is_system_ram(struct resource *res, void *arg) { struct cxl_region *cxlr = arg; @@ -4217,6 +4190,20 @@ static int cxl_region_probe(struct device *dev) if (rc) return rc; + /* + * Regions fronted by an extended linear cache need the MCE notifier to + * offline the aliased page on a memory error. + */ + if (p->cache_size) { + rc = devm_cxl_register_mce_notifier(&cxlr->dev, + &cxlr->mce_notifier); + if (rc == -EOPNOTSUPP) + dev_warn(&cxlr->dev, + "CONFIG_CXL_MCE disabled, MCE notifier not registered\n"); + else if (rc) + return rc; + } + rc = cxl_region_setup_poison(cxlr); if (rc) return rc; diff --git a/drivers/cxl/cxl.h b/drivers/cxl/cxl.h index c0e5308e4d1b..bdd0132c999d 100644 --- a/drivers/cxl/cxl.h +++ b/drivers/cxl/cxl.h @@ -478,6 +478,7 @@ struct cxl_region_params { * @coord: QoS access coordinates for the region * @node_notifier: notifier for setting the access coordinates to node * @adist_notifier: notifier for calculating the abstract distance of node + * @mce_notifier: notifier for MCE */ struct cxl_region { struct device dev; @@ -493,6 +494,7 @@ struct cxl_region { struct access_coordinate coord[ACCESS_COORDINATE_MAX]; struct notifier_block node_notifier; struct notifier_block adist_notifier; + struct notifier_block mce_notifier; }; struct cxl_nvdimm_bridge { @@ -870,7 +872,6 @@ bool is_cxl_pmem_region(struct device *dev); struct cxl_pmem_region *to_cxl_pmem_region(struct device *dev); int cxl_add_to_region(struct cxl_endpoint_decoder *cxled); struct cxl_dax_region *to_cxl_dax_region(struct device *dev); -u64 cxl_port_get_spa_cache_alias(struct cxl_port *endpoint, u64 spa); bool cxl_region_contains_resource(const struct resource *res); #else static inline bool is_cxl_pmem_region(struct device *dev) @@ -889,11 +890,6 @@ static inline struct cxl_dax_region *to_cxl_dax_region(struct device *dev) { return NULL; } -static inline u64 cxl_port_get_spa_cache_alias(struct cxl_port *endpoint, - u64 spa) -{ - return 0; -} static inline bool cxl_region_contains_resource(const struct resource *res) { return false; diff --git a/drivers/cxl/cxlmem.h b/drivers/cxl/cxlmem.h index 503ae2864591..c401e3a1af06 100644 --- a/drivers/cxl/cxlmem.h +++ b/drivers/cxl/cxlmem.h @@ -431,7 +431,6 @@ static inline struct cxl_dev_state *mbox_to_cxlds(struct cxl_mailbox *cxl_mbox) * @poison: poison driver state info * @security: security driver state info * @fw: firmware upload / activation state - * @mce_notifier: MCE notifier * * See CXL 3.0 8.2.9.8.2 Capacity Configuration and Label Storage for * details on capacity parameters. @@ -451,7 +450,6 @@ struct cxl_memdev_state { struct cxl_poison_state poison; struct cxl_security_state security; struct cxl_fw_state fw; - struct notifier_block mce_notifier; }; static inline struct cxl_memdev_state * From afae0fa7c6b163339a5d357942b89956a0820e45 Mon Sep 17 00:00:00 2001 From: Dave Jiang Date: Mon, 29 Jun 2026 15:10:58 -0700 Subject: [PATCH 06/35] cxl/test: Add test for module parameters Add a test for module paraters during module init to make sure that only one is activated. [dj: Dropped counting fail_autoassemble modparm. (Alison) ] Suggested-by: Alison Schofield Tested-by: Alison Schofield Reviewed-by: Alison Schofield Link: https://patch.msgid.link/20260629221104.3891733-2-dave.jiang@intel.com Signed-off-by: Dave Jiang --- tools/testing/cxl/test/cxl.c | 18 ++++++++++++++++++ tools/testing/cxl/test/hmem_test.c | 3 ++- tools/testing/cxl/test/mock.h | 2 ++ 3 files changed, 22 insertions(+), 1 deletion(-) diff --git a/tools/testing/cxl/test/cxl.c b/tools/testing/cxl/test/cxl.c index ef92dd35e030..057724f27c6b 100644 --- a/tools/testing/cxl/test/cxl.c +++ b/tools/testing/cxl/test/cxl.c @@ -1827,11 +1827,29 @@ static struct attribute *cxl_acpi_attrs[] = { }; ATTRIBUTE_GROUPS(cxl_acpi); +static bool __init have_multiple_modparms(void) +{ + int count = 0; + + if (interleave_arithmetic) + count++; + if (extended_linear_cache) + count++; + if (hmem_test) + count++; + + return count > 1; +} + static __init int cxl_test_init(void) { int rc, i; struct range mappable; + /* Enforce a single module param active at a time */ + if (have_multiple_modparms()) + return -EINVAL; + if (!IS_ALIGNED(mock_auto_region_size, PMD_SIZE)) { pr_err_once("mock_auto_region_size %d must be PMD-aligned\n", mock_auto_region_size); diff --git a/tools/testing/cxl/test/hmem_test.c b/tools/testing/cxl/test/hmem_test.c index 3a1a089e1721..0fa00f7e16db 100644 --- a/tools/testing/cxl/test/hmem_test.c +++ b/tools/testing/cxl/test/hmem_test.c @@ -3,8 +3,9 @@ #include #include #include "../../../drivers/dax/bus.h" +#include "mock.h" -static bool hmem_test; +bool hmem_test; static void hmem_test_work(struct work_struct *work) { diff --git a/tools/testing/cxl/test/mock.h b/tools/testing/cxl/test/mock.h index 4f57dc80ae7d..846d7c5d6eaa 100644 --- a/tools/testing/cxl/test/mock.h +++ b/tools/testing/cxl/test/mock.h @@ -5,6 +5,8 @@ #include #include +extern bool hmem_test; + struct cxl_mock_ops { struct list_head list; bool (*is_mock_adev)(struct acpi_device *dev); From fc8fc576d909b0336a6f8053d68989c2811aeec0 Mon Sep 17 00:00:00 2001 From: Dave Jiang Date: Mon, 29 Jun 2026 15:10:59 -0700 Subject: [PATCH 07/35] cxl/test: Add type2 support for mock CFMWS0 Add a module parameter 'type2_test' for triggering type2 test support in cxl_test. Setup the CFMWS0 configuration to be type2 when 'type2_test' is set. Tested-by: Alison Schofield Reviewed-by: Alison Schofield Link: https://patch.msgid.link/20260629221104.3891733-3-dave.jiang@intel.com Signed-off-by: Dave Jiang --- tools/testing/cxl/test/cxl.c | 29 ++++++++++++++++++++++++++++- 1 file changed, 28 insertions(+), 1 deletion(-) diff --git a/tools/testing/cxl/test/cxl.c b/tools/testing/cxl/test/cxl.c index 057724f27c6b..3eb9998360f5 100644 --- a/tools/testing/cxl/test/cxl.c +++ b/tools/testing/cxl/test/cxl.c @@ -17,6 +17,7 @@ static int interleave_arithmetic; static bool extended_linear_cache; static bool fail_autoassemble; +static bool type2_test; #define FAKE_QTG_ID 42 @@ -384,6 +385,19 @@ static struct { }, }; +static struct acpi_cedt_cfmws type2_cfmws0 = { + .header = { + .type = ACPI_CEDT_TYPE_CFMWS, + .length = sizeof(mock_cedt.cfmws0), + }, + .interleave_ways = 0, + .granularity = 4, + .restrictions = ACPI_CEDT_CFMWS_RESTRICT_DEVMEM | + ACPI_CEDT_CFMWS_RESTRICT_VOLATILE, + .qtg_id = FAKE_QTG_ID, + .window_size = SZ_256M * 4, +}; + struct acpi_cedt_cfmws *mock_cfmws[] = { [0] = &mock_cedt.cfmws0.cfmws, [1] = &mock_cedt.cfmws1.cfmws, @@ -476,6 +490,11 @@ static void cfmws_elc_update(struct acpi_cedt_cfmws *window, int index) window->window_size = mock_auto_region_size * 2; } +static void update_type2_cfmws(void) +{ + memcpy(&mock_cedt.cfmws0.cfmws, &type2_cfmws0, sizeof(type2_cfmws0)); +} + static int populate_cedt(void) { struct cxl_mock_res *res; @@ -497,11 +516,15 @@ static int populate_cedt(void) chbs->length = size; } + if (type2_test) + update_type2_cfmws(); + for (i = cfmws_start; i <= cfmws_end; i++) { struct acpi_cedt_cfmws *window = mock_cfmws[i]; int align = SZ_256M; - cfmws_elc_update(window, i); + if (i == 0 && !type2_test) + cfmws_elc_update(window, i); if (window->restrictions & ACPI_CEDT_CFMWS_RESTRICT_VOLATILE) align = max_t(int, SZ_256M, PMD_SIZE); res = alloc_mock_res(window->window_size, align); @@ -1837,6 +1860,8 @@ static bool __init have_multiple_modparms(void) count++; if (hmem_test) count++; + if (type2_test) + count++; return count > 1; } @@ -2067,6 +2092,8 @@ module_param(extended_linear_cache, bool, 0444); MODULE_PARM_DESC(extended_linear_cache, "Enable extended linear cache support"); module_param(fail_autoassemble, bool, 0444); MODULE_PARM_DESC(fail_autoassemble, "Simulate missing member of an auto-region"); +module_param(type2_test, bool, 0444); +MODULE_PARM_DESC(type2_test, "Enable type 2 support testing"); module_init(cxl_test_init); module_exit(cxl_test_exit); MODULE_LICENSE("GPL v2"); From a6d37152d284a49249a545861d1094cb678b5d32 Mon Sep 17 00:00:00 2001 From: Dave Jiang Date: Mon, 29 Jun 2026 15:11:00 -0700 Subject: [PATCH 08/35] cxl/test: Refactor platform device enumerations Split all the host bridges, rootports, upstream and downstream ports enumerations to separate helper functions. This should make adding type2 hierarchy easier later on. Tested-by: Alison Schofield Reviewed-by: Alison Schofield Link: https://patch.msgid.link/20260629221104.3891733-4-dave.jiang@intel.com Signed-off-by: Dave Jiang --- tools/testing/cxl/test/cxl.c | 312 ++++++++++++++++++++++++----------- 1 file changed, 214 insertions(+), 98 deletions(-) diff --git a/tools/testing/cxl/test/cxl.c b/tools/testing/cxl/test/cxl.c index 3eb9998360f5..504c737be146 100644 --- a/tools/testing/cxl/test/cxl.c +++ b/tools/testing/cxl/test/cxl.c @@ -1866,10 +1866,204 @@ static bool __init have_multiple_modparms(void) return count > 1; } +static void host_bridges_remove(void) +{ + int i; + + for (i = ARRAY_SIZE(cxl_host_bridge) - 1; i >= 0; i--) { + struct platform_device *pdev = cxl_host_bridge[i]; + + if (!pdev) + continue; + + sysfs_remove_link(&pdev->dev.kobj, "physical_node"); + platform_device_unregister(cxl_host_bridge[i]); + } +} + +static int host_bridges_populate(void) +{ + int rc = 0; + + for (int i = 0; i < ARRAY_SIZE(cxl_host_bridge); i++) { + struct acpi_device *adev = &host_bridge[i]; + struct platform_device *pdev; + + pdev = platform_device_alloc("cxl_host_bridge", i); + if (!pdev) { + rc = -ENOMEM; + goto err_bridge; + } + + mock_companion(adev, &pdev->dev); + rc = cxl_mock_platform_device_add(pdev, &cxl_host_bridge[i]); + if (rc) + goto err_bridge; + + mock_pci_bus[i].bridge = &pdev->dev; + rc = sysfs_create_link(&pdev->dev.kobj, &pdev->dev.kobj, + "physical_node"); + if (rc) + goto err_bridge; + } + + return 0; + +err_bridge: + host_bridges_remove(); + return rc; +} + +static void cxl_rootports_remove(void) +{ + for (int i = ARRAY_SIZE(cxl_root_port) - 1; i >= 0; i--) { + struct platform_device *pdev = cxl_root_port[i]; + + if (!pdev) + continue; + + platform_device_unregister(pdev); + } +} + +static int cxl_rootports_populate(void) +{ + int rc = 0; + + for (int i = 0; i < ARRAY_SIZE(cxl_root_port); i++) { + struct platform_device *bridge = + cxl_host_bridge[i % ARRAY_SIZE(cxl_host_bridge)]; + struct platform_device *pdev; + + pdev = platform_device_alloc("cxl_root_port", i); + if (!pdev) { + rc = -ENOMEM; + goto err_port; + } + + pdev->dev.parent = &bridge->dev; + + rc = cxl_mock_platform_device_add(pdev, &cxl_root_port[i]); + if (rc) + goto err_port; + } + + return 0; + +err_port: + cxl_rootports_remove(); + return rc; +} + +static void cxl_usps_remove(void) +{ + for (int i = ARRAY_SIZE(cxl_switch_uport) - 1; i >= 0; i--) { + struct platform_device *pdev = cxl_switch_uport[i]; + + if (!pdev) + continue; + + platform_device_unregister(cxl_switch_uport[i]); + } +} + +static int cxl_usps_populate(void) +{ + int rc = 0; + + for (int i = 0; i < ARRAY_SIZE(cxl_switch_uport); i++) { + struct platform_device *root_port = cxl_root_port[i]; + struct platform_device *pdev; + + pdev = platform_device_alloc("cxl_switch_uport", i); + if (!pdev) { + rc = -ENOMEM; + goto err_uport; + } + + pdev->dev.parent = &root_port->dev; + + rc = cxl_mock_platform_device_add(pdev, &cxl_switch_uport[i]); + if (rc) + goto err_uport; + } + + return 0; + +err_uport: + cxl_usps_remove(); + return rc; +} + +static void cxl_dsps_remove(void) +{ + for (int i = ARRAY_SIZE(cxl_switch_dport) - 1; i >= 0; i--) { + struct platform_device *pdev = cxl_switch_dport[i]; + + if (!pdev) + continue; + + platform_device_unregister(cxl_switch_dport[i]); + } +} + + +static int cxl_dsps_populate(void) +{ + int rc = 0; + + for (int i = 0; i < ARRAY_SIZE(cxl_switch_dport); i++) { + struct platform_device *uport = + cxl_switch_uport[i % ARRAY_SIZE(cxl_switch_uport)]; + struct platform_device *pdev; + + pdev = platform_device_alloc("cxl_switch_dport", i); + if (!pdev) { + rc = -ENOMEM; + goto err_dport; + } + pdev->dev.parent = &uport->dev; + + rc = cxl_mock_platform_device_add(pdev, &cxl_switch_dport[i]); + if (rc) + goto err_dport; + } + + return 0; + +err_dport: + cxl_dsps_remove(); + return rc; +} + +static void cxl_switches_remove(void) +{ + cxl_dsps_remove(); + cxl_usps_remove(); +} + +static int cxl_switches_populate(void) +{ + int rc; + + BUILD_BUG_ON(ARRAY_SIZE(cxl_switch_uport) != ARRAY_SIZE(cxl_root_port)); + rc = cxl_usps_populate(); + if (rc) + return rc; + + rc = cxl_dsps_populate(); + if (rc) { + cxl_usps_remove(); + return rc; + } + + return 0; +} + static __init int cxl_test_init(void) { - int rc, i; struct range mappable; + int rc; /* Enforce a single module param active at a time */ if (have_multiple_modparms()) @@ -1915,74 +2109,21 @@ static __init int cxl_test_init(void) if (rc) goto err_populate; - for (i = 0; i < ARRAY_SIZE(cxl_host_bridge); i++) { - struct acpi_device *adev = &host_bridge[i]; - struct platform_device *pdev; + rc = host_bridges_populate(); + if (rc) + goto err_populate; - pdev = platform_device_alloc("cxl_host_bridge", i); - if (!pdev) - goto err_bridge; + rc = cxl_rootports_populate(); + if (rc) + goto err_host_bridges; - mock_companion(adev, &pdev->dev); - rc = cxl_mock_platform_device_add(pdev, &cxl_host_bridge[i]); - if (rc) - goto err_bridge; - - mock_pci_bus[i].bridge = &pdev->dev; - rc = sysfs_create_link(&pdev->dev.kobj, &pdev->dev.kobj, - "physical_node"); - if (rc) - goto err_bridge; - } - - for (i = 0; i < ARRAY_SIZE(cxl_root_port); i++) { - struct platform_device *bridge = - cxl_host_bridge[i % ARRAY_SIZE(cxl_host_bridge)]; - struct platform_device *pdev; - - pdev = platform_device_alloc("cxl_root_port", i); - if (!pdev) - goto err_port; - pdev->dev.parent = &bridge->dev; - - rc = cxl_mock_platform_device_add(pdev, &cxl_root_port[i]); - if (rc) - goto err_port; - } - - BUILD_BUG_ON(ARRAY_SIZE(cxl_switch_uport) != ARRAY_SIZE(cxl_root_port)); - for (i = 0; i < ARRAY_SIZE(cxl_switch_uport); i++) { - struct platform_device *root_port = cxl_root_port[i]; - struct platform_device *pdev; - - pdev = platform_device_alloc("cxl_switch_uport", i); - if (!pdev) - goto err_uport; - pdev->dev.parent = &root_port->dev; - - rc = cxl_mock_platform_device_add(pdev, &cxl_switch_uport[i]); - if (rc) - goto err_uport; - } - - for (i = 0; i < ARRAY_SIZE(cxl_switch_dport); i++) { - struct platform_device *uport = - cxl_switch_uport[i % ARRAY_SIZE(cxl_switch_uport)]; - struct platform_device *pdev; - - pdev = platform_device_alloc("cxl_switch_dport", i); - if (!pdev) - goto err_dport; - pdev->dev.parent = &uport->dev; - - rc = cxl_mock_platform_device_add(pdev, &cxl_switch_dport[i]); - if (rc) - goto err_dport; - } + rc = cxl_switches_populate(); + if (rc) + goto err_root_ports; rc = cxl_single_topo_init(); if (rc) - goto err_dport; + goto err_switches; rc = cxl_rch_topo_init(); if (rc) @@ -2018,24 +2159,12 @@ static __init int cxl_test_init(void) cxl_rch_topo_exit(); err_single: cxl_single_topo_exit(); -err_dport: - for (i = ARRAY_SIZE(cxl_switch_dport) - 1; i >= 0; i--) - platform_device_unregister(cxl_switch_dport[i]); -err_uport: - for (i = ARRAY_SIZE(cxl_switch_uport) - 1; i >= 0; i--) - platform_device_unregister(cxl_switch_uport[i]); -err_port: - for (i = ARRAY_SIZE(cxl_root_port) - 1; i >= 0; i--) - platform_device_unregister(cxl_root_port[i]); -err_bridge: - for (i = ARRAY_SIZE(cxl_host_bridge) - 1; i >= 0; i--) { - struct platform_device *pdev = cxl_host_bridge[i]; - - if (!pdev) - continue; - sysfs_remove_link(&pdev->dev.kobj, "physical_node"); - platform_device_unregister(cxl_host_bridge[i]); - } +err_switches: + cxl_switches_remove(); +err_root_ports: + cxl_rootports_remove(); +err_host_bridges: + host_bridges_remove(); err_populate: depopulate_all_mock_resources(); err_gen_pool_add: @@ -2058,27 +2187,14 @@ static void free_decoder_registry(void) static __exit void cxl_test_exit(void) { - int i; - hmem_test_exit(); cxl_mem_exit(); platform_device_unregister(cxl_acpi); cxl_rch_topo_exit(); cxl_single_topo_exit(); - for (i = ARRAY_SIZE(cxl_switch_dport) - 1; i >= 0; i--) - platform_device_unregister(cxl_switch_dport[i]); - for (i = ARRAY_SIZE(cxl_switch_uport) - 1; i >= 0; i--) - platform_device_unregister(cxl_switch_uport[i]); - for (i = ARRAY_SIZE(cxl_root_port) - 1; i >= 0; i--) - platform_device_unregister(cxl_root_port[i]); - for (i = ARRAY_SIZE(cxl_host_bridge) - 1; i >= 0; i--) { - struct platform_device *pdev = cxl_host_bridge[i]; - - if (!pdev) - continue; - sysfs_remove_link(&pdev->dev.kobj, "physical_node"); - platform_device_unregister(cxl_host_bridge[i]); - } + cxl_switches_remove(); + cxl_rootports_remove(); + host_bridges_remove(); depopulate_all_mock_resources(); gen_pool_destroy(cxl_mock_pool); unregister_cxl_mock_ops(&cxl_mock_ops); From 6b2e585142e68b4af821a1eca4d1e8d54bd49bb8 Mon Sep 17 00:00:00 2001 From: Dave Jiang Date: Mon, 29 Jun 2026 15:11:01 -0700 Subject: [PATCH 09/35] cxl/test: Add hierarchy enumeration support for type2 device Add enumeration of type2 device hierarchy in cxl-test. The type2 device is setup to be directly attached to a root port instead of rp -> switch -> device that type3 hierarchy is setup.. Tested-by: Alison Schofield Reviewed-by: Alison Schofield Link: https://patch.msgid.link/20260629221104.3891733-5-dave.jiang@intel.com Signed-off-by: Dave Jiang --- tools/testing/cxl/test/cxl.c | 232 ++++++++++++++++++++++++++++------- 1 file changed, 189 insertions(+), 43 deletions(-) diff --git a/tools/testing/cxl/test/cxl.c b/tools/testing/cxl/test/cxl.c index 504c737be146..ab84551b1136 100644 --- a/tools/testing/cxl/test/cxl.c +++ b/tools/testing/cxl/test/cxl.c @@ -28,6 +28,7 @@ static bool type2_test; #define NR_CXL_SWITCH_PORTS 2 #define NR_CXL_PORT_DECODERS 8 #define NR_BRIDGES (NR_CXL_HOST_BRIDGES + NR_CXL_SINGLE_HOST + NR_CXL_RCH) +#define NR_CXL_TYPE2_ACCEL 1 #define MOCK_AUTO_REGION_SIZE_DEFAULT SZ_512M static int mock_auto_region_size = MOCK_AUTO_REGION_SIZE_DEFAULT; @@ -1747,19 +1748,93 @@ static void cxl_single_topo_exit(void) } } -static void cxl_mem_exit(void) +static void cxl_type3_mem_exit(void) { + struct platform_device *pdev; int i; - for (i = ARRAY_SIZE(cxl_rcd) - 1; i >= 0; i--) + for (i = ARRAY_SIZE(cxl_rcd) - 1; i >= 0; i--) { + pdev = cxl_rcd[i]; + if (!pdev) + continue; platform_device_unregister(cxl_rcd[i]); - for (i = ARRAY_SIZE(cxl_mem_single) - 1; i >= 0; i--) + } + + for (i = ARRAY_SIZE(cxl_mem_single) - 1; i >= 0; i--) { + pdev = cxl_mem_single[i]; + if (!pdev) + continue; platform_device_unregister(cxl_mem_single[i]); - for (i = ARRAY_SIZE(cxl_mem) - 1; i >= 0; i--) - platform_device_unregister(cxl_mem[i]); + } + + for (i = ARRAY_SIZE(cxl_mem) - 1; i >= 0; i--) { + pdev = cxl_mem[i]; + if (!pdev) + continue; + platform_device_unregister(pdev); + } } -static int cxl_mem_init(void) +static void cxl_type2_mem_exit(void) +{ + for (int i = NR_CXL_TYPE2_ACCEL - 1; i >= 0; i--) { + struct platform_device *pdev = cxl_mem[i]; + + if (!pdev) + continue; + platform_device_unregister(pdev); + } +} + +static void cxl_mem_exit(void) +{ + if (type2_test) { + cxl_type2_mem_exit(); + return; + } + + cxl_type3_mem_exit(); +} + +static int cxl_type2_mem_init(void) +{ + int i, rc; + + for (i = 0; i < NR_CXL_TYPE2_ACCEL; i++) { + struct platform_device *dport = cxl_root_port[i]; + struct platform_device *pdev; + + pdev = platform_device_alloc("cxl_type2_accel", i); + if (!pdev) { + rc = -ENOMEM; + goto err_mem; + } + pdev->dev.parent = &dport->dev; + set_dev_node(&pdev->dev, i % 2); + + rc = platform_device_add(pdev); + if (rc) { + rc = -ENOMEM; + platform_device_put(pdev); + goto err_mem; + } + cxl_mem[i] = pdev; + } + + return 0; + +err_mem: + for (i = NR_CXL_TYPE2_ACCEL - 1; i >= 0; i--) { + struct platform_device *pdev = cxl_mem[i]; + + if (!pdev) + continue; + platform_device_unregister(pdev); + } + return rc; +} + +static int cxl_type3_mem_init(void) { int i, rc; @@ -1768,8 +1843,10 @@ static int cxl_mem_init(void) struct platform_device *pdev; pdev = platform_device_alloc("cxl_mem", i); - if (!pdev) + if (!pdev) { + rc = -ENOMEM; goto err_mem; + } pdev->dev.parent = &dport->dev; set_dev_node(&pdev->dev, i % 2); @@ -1783,8 +1860,10 @@ static int cxl_mem_init(void) struct platform_device *pdev; pdev = platform_device_alloc("cxl_mem", NR_MEM_MULTI + i); - if (!pdev) + if (!pdev) { + rc = -ENOMEM; goto err_single; + } pdev->dev.parent = &dport->dev; set_dev_node(&pdev->dev, i % 2); @@ -1799,8 +1878,10 @@ static int cxl_mem_init(void) struct platform_device *pdev; pdev = platform_device_alloc("cxl_rcd", idx); - if (!pdev) + if (!pdev) { + rc = -ENOMEM; goto err_rcd; + } pdev->dev.parent = &rch->dev; set_dev_node(&pdev->dev, i % 2); @@ -1823,6 +1904,13 @@ static int cxl_mem_init(void) return rc; } +static int cxl_mem_init(void) +{ + if (type2_test) + return cxl_type2_mem_init(); + return cxl_type3_mem_init(); +} + static ssize_t decoder_reset_preserve_registry_show(struct device *dev, struct device_attribute *attr, char *buf) @@ -2060,6 +2148,92 @@ static int cxl_switches_populate(void) return 0; } +static void cxl_type2_topo_exit(void) +{ + cxl_rootports_remove(); + host_bridges_remove(); +} + +static int cxl_type2_topo_init(void) +{ + int rc; + + rc = host_bridges_populate(); + if (rc) + return rc; + + rc = cxl_rootports_populate(); + if (rc) { + host_bridges_remove(); + return rc; + } + + return 0; +} + +static void cxl_type3_topo_exit(void) +{ + cxl_rch_topo_exit(); + cxl_single_topo_exit(); + cxl_switches_remove(); + cxl_rootports_remove(); + host_bridges_remove(); +} + +static int cxl_type3_topo_init(void) +{ + int rc; + + rc = host_bridges_populate(); + if (rc) + return rc; + + rc = cxl_rootports_populate(); + if (rc) + goto err_host_bridges; + + rc = cxl_switches_populate(); + if (rc) + goto err_root_ports; + + rc = cxl_single_topo_init(); + if (rc) + goto err_switches; + + rc = cxl_rch_topo_init(); + if (rc) + goto err_single; + + return 0; + +err_single: + cxl_single_topo_exit(); +err_switches: + cxl_switches_remove(); +err_root_ports: + cxl_rootports_remove(); +err_host_bridges: + host_bridges_remove(); + return rc; +} + +static void cxl_topo_exit(void) +{ + if (type2_test) { + cxl_type2_topo_exit(); + return; + } + + cxl_type3_topo_exit(); +} + +static int cxl_topo_init(void) +{ + if (type2_test) + return cxl_type2_topo_init(); + return cxl_type3_topo_init(); +} + static __init int cxl_test_init(void) { struct range mappable; @@ -2109,29 +2283,13 @@ static __init int cxl_test_init(void) if (rc) goto err_populate; - rc = host_bridges_populate(); + rc = cxl_topo_init(); if (rc) goto err_populate; - rc = cxl_rootports_populate(); - if (rc) - goto err_host_bridges; - - rc = cxl_switches_populate(); - if (rc) - goto err_root_ports; - - rc = cxl_single_topo_init(); - if (rc) - goto err_switches; - - rc = cxl_rch_topo_init(); - if (rc) - goto err_single; - cxl_acpi = platform_device_alloc("cxl_acpi", 0); if (!cxl_acpi) - goto err_rch; + goto err_topo; mock_companion(&acpi0017_mock, &cxl_acpi->dev); acpi0017_mock.dev.bus = &platform_bus_type; @@ -2139,7 +2297,7 @@ static __init int cxl_test_init(void) rc = cxl_mock_platform_device_add(cxl_acpi, NULL); if (rc) - goto err_rch; + goto err_topo; rc = cxl_mem_init(); if (rc) @@ -2155,16 +2313,8 @@ static __init int cxl_test_init(void) cxl_mem_exit(); err_root: platform_device_unregister(cxl_acpi); -err_rch: - cxl_rch_topo_exit(); -err_single: - cxl_single_topo_exit(); -err_switches: - cxl_switches_remove(); -err_root_ports: - cxl_rootports_remove(); -err_host_bridges: - host_bridges_remove(); +err_topo: + cxl_topo_exit(); err_populate: depopulate_all_mock_resources(); err_gen_pool_add: @@ -2190,11 +2340,7 @@ static __exit void cxl_test_exit(void) hmem_test_exit(); cxl_mem_exit(); platform_device_unregister(cxl_acpi); - cxl_rch_topo_exit(); - cxl_single_topo_exit(); - cxl_switches_remove(); - cxl_rootports_remove(); - host_bridges_remove(); + cxl_topo_exit(); depopulate_all_mock_resources(); gen_pool_destroy(cxl_mock_pool); unregister_cxl_mock_ops(&cxl_mock_ops); From 98ba41c3236b9a3bad206dbd9cf18c98ced75726 Mon Sep 17 00:00:00 2001 From: Dave Jiang Date: Mon, 29 Jun 2026 15:11:02 -0700 Subject: [PATCH 10/35] cxl/test: Propagate -ENOMEM on platform_device_alloc() failures Set rc = -ENOMEM at every platform_device_alloc() failure site in cxl_rch_topo_init(), cxl_single_topo_init() and cxl_test_init() so the failure is propagated and the module load aborts cleanly. The cxl_acpi allocation site originates in the commit below, while the host-bridge/root-port/uport/dport allocation sites fixed here were added later in the single-host and RCH topology configs. Fixes: 67dcdd4d3b83 ("tools/testing/cxl: Introduce a mocked-up CXL port hierarchy") Fixes: e41c8452b9b2 ("tools/testing/cxl: Add a single-port host-bridge regression config") Fixes: c9435dbee119 ("tools/testing/cxl: Add an RCH topology") Assisted-by: Claude:claude-opus-4-8 Tested-by: Alison Schofield Reviewed-by: Alison Schofield Link: https://patch.msgid.link/20260629221104.3891733-6-dave.jiang@intel.com Signed-off-by: Dave Jiang --- tools/testing/cxl/test/cxl.c | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-) diff --git a/tools/testing/cxl/test/cxl.c b/tools/testing/cxl/test/cxl.c index ab84551b1136..5d766b8cdd40 100644 --- a/tools/testing/cxl/test/cxl.c +++ b/tools/testing/cxl/test/cxl.c @@ -1587,8 +1587,10 @@ static __init int cxl_rch_topo_init(void) struct platform_device *pdev; pdev = platform_device_alloc("cxl_host_bridge", idx); - if (!pdev) + if (!pdev) { + rc = -ENOMEM; goto err_bridge; + } mock_companion(adev, &pdev->dev); rc = cxl_mock_platform_device_add(pdev, &cxl_rch[i]); @@ -1642,8 +1644,10 @@ static __init int cxl_single_topo_init(void) pdev = platform_device_alloc("cxl_host_bridge", NR_CXL_HOST_BRIDGES + i); - if (!pdev) + if (!pdev) { + rc = -ENOMEM; goto err_bridge; + } mock_companion(adev, &pdev->dev); rc = cxl_mock_platform_device_add(pdev, &cxl_hb_single[i]); @@ -1664,8 +1668,10 @@ static __init int cxl_single_topo_init(void) pdev = platform_device_alloc("cxl_root_port", NR_MULTI_ROOT + i); - if (!pdev) + if (!pdev) { + rc = -ENOMEM; goto err_port; + } pdev->dev.parent = &bridge->dev; rc = cxl_mock_platform_device_add(pdev, &cxl_root_single[i]); @@ -1679,8 +1685,10 @@ static __init int cxl_single_topo_init(void) pdev = platform_device_alloc("cxl_switch_uport", NR_MULTI_ROOT + i); - if (!pdev) + if (!pdev) { + rc = -ENOMEM; goto err_uport; + } pdev->dev.parent = &root_port->dev; rc = cxl_mock_platform_device_add(pdev, &cxl_swu_single[i]); @@ -1695,8 +1703,10 @@ static __init int cxl_single_topo_init(void) pdev = platform_device_alloc("cxl_switch_dport", i + NR_MEM_MULTI); - if (!pdev) + if (!pdev) { + rc = -ENOMEM; goto err_dport; + } pdev->dev.parent = &uport->dev; rc = cxl_mock_platform_device_add(pdev, &cxl_swd_single[i]); @@ -2288,8 +2298,10 @@ static __init int cxl_test_init(void) goto err_populate; cxl_acpi = platform_device_alloc("cxl_acpi", 0); - if (!cxl_acpi) + if (!cxl_acpi) { + rc = -ENOMEM; goto err_topo; + } mock_companion(&acpi0017_mock, &cxl_acpi->dev); acpi0017_mock.dev.bus = &platform_bus_type; From b3df5a5a38c32e1d161f92234ab70c39d640ea41 Mon Sep 17 00:00:00 2001 From: Dave Jiang Date: Mon, 29 Jun 2026 15:11:03 -0700 Subject: [PATCH 11/35] cxl/test: Fixup hdm init for auto region to support type2 Add support to setup initialization of decoders in order to support type2 auto region. Reviewed-by: Alison Schofield Tested-by: Alison Schofield Link: https://patch.msgid.link/20260629221104.3891733-7-dave.jiang@intel.com Signed-off-by: Dave Jiang --- tools/testing/cxl/test/cxl.c | 263 ++++++++++++++++++++++++++--------- 1 file changed, 194 insertions(+), 69 deletions(-) diff --git a/tools/testing/cxl/test/cxl.c b/tools/testing/cxl/test/cxl.c index 5d766b8cdd40..8ab2ce1262f3 100644 --- a/tools/testing/cxl/test/cxl.c +++ b/tools/testing/cxl/test/cxl.c @@ -1084,74 +1084,26 @@ static int first_decoder(struct device *dev, const void *data) return 0; } -/* - * Initialize a decoder during HDM enumeration. - * - * If a saved registry entry exists: - * - enabled decoders are restored from the saved programming - * - disabled decoders are initialized in a clean disabled state - * - * If no registry entry exists the decoder follows the normal mock - * initialization path, including the special auto-region setup for - * the first endpoints under host-bridge0. - * - * Returns true if decoder state was restored from the registry. In - * that case the saved decode configuration (including target mapping) - * has already been applied and the map_targets() is skipped. - */ -static bool mock_init_hdm_decoder(struct cxl_decoder *cxld) +enum cxld_init_type { + MOCK_DECODER_INIT_DEFAULT, + MOCK_DECODER_INIT_SAVED, + MOCK_DECODER_INIT_TYPE3_AUTO, + MOCK_DECODER_INIT_TYPE2_AUTO, +}; + +static enum cxld_init_type get_decoder_init_type(struct cxl_decoder *cxld, + struct platform_device *pdev, + bool hb0, + struct cxl_test_decoder **td) { - struct acpi_cedt_cfmws *window = mock_cfmws[0]; - struct platform_device *pdev = NULL; - struct cxl_endpoint_decoder *cxled; - struct cxl_switch_decoder *cxlsd; - struct cxl_port *port, *iter; - struct cxl_test_decoder *td; - struct cxl_memdev *cxlmd; - struct cxl_dport *dport; - struct device *dev; - bool hb0 = false; - u64 base; - int i; + struct cxl_test_decoder *found_td = cxld_registry_find(cxld); - if (is_endpoint_decoder(&cxld->dev)) { - cxled = to_cxl_endpoint_decoder(&cxld->dev); - cxlmd = cxled_to_memdev(cxled); - WARN_ON(!dev_is_platform(cxlmd->dev.parent)); - pdev = to_platform_device(cxlmd->dev.parent); - - /* check is endpoint is attach to host-bridge0 */ - port = cxled_to_port(cxled); - do { - if (port->uport_dev == &cxl_host_bridge[0]->dev) { - hb0 = true; - break; - } - if (is_cxl_port(port->dev.parent)) - port = to_cxl_port(port->dev.parent); - else - port = NULL; - } while (port); - port = cxled_to_port(cxled); - } else { - port = to_cxl_port(cxld->dev.parent); + if (found_td) { + *td = found_td; + return MOCK_DECODER_INIT_SAVED; } - td = cxld_registry_find(cxld); - if (td) { - bool enabled; - - if (is_switch_decoder(&cxld->dev)) - enabled = td->cxlsd.cxld.flags & CXL_DECODER_F_ENABLE; - else - enabled = td->cxled.cxld.flags & CXL_DECODER_F_ENABLE; - - if (enabled) - return !cxld_registry_restore(cxld, td); - - init_disabled_mock_decoder(cxld); - return false; - } + *td = NULL; /* * The first decoder on the first 2 devices on the first switch @@ -1162,15 +1114,119 @@ static bool mock_init_hdm_decoder(struct cxl_decoder *cxld) * See 'cxl list -BMPu -m cxl_mem.0,cxl_mem.4' */ if (!is_endpoint_decoder(&cxld->dev) || !hb0 || pdev->id % 4 || - pdev->id > 4 || cxld->id > 0) { - default_mock_decoder(cxld); - return false; - } + pdev->id > 4 || cxld->id > 0) + return MOCK_DECODER_INIT_DEFAULT; + + return type2_test ? MOCK_DECODER_INIT_TYPE2_AUTO : + MOCK_DECODER_INIT_TYPE3_AUTO; +} + +static bool mock_decoder_handle_saved(struct cxl_decoder *cxld, struct cxl_test_decoder *td) +{ + bool enabled; + + if (is_switch_decoder(&cxld->dev)) + enabled = td->cxlsd.cxld.flags & CXL_DECODER_F_ENABLE; + else + enabled = td->cxled.cxld.flags & CXL_DECODER_F_ENABLE; + + if (enabled) + return !cxld_registry_restore(cxld, td); + + init_disabled_mock_decoder(cxld); + return false; +} + +static void mock_init_hdm_type2_cxled(struct cxl_endpoint_decoder *cxled, + struct cxl_port *port) +{ + struct acpi_cedt_cfmws *window = mock_cfmws[0]; + struct cxl_decoder *cxld = &cxled->cxld; + struct cxl_switch_decoder *cxlsd; + struct cxl_dport *dport; + struct cxl_port *root_port; + struct device *dev; + u64 base; + + base = window->base_hpa; + cxld->hpa_range = (struct range) { + .start = base, + .end = base + mock_auto_region_size - 1, + }; + + cxld->interleave_ways = 1; + eig_to_granularity(window->granularity, &cxld->interleave_granularity); + cxld->target_type = CXL_DECODER_DEVMEM; + cxld->flags = CXL_DECODER_F_ENABLE; + cxled->state = CXL_DECODER_STATE_AUTO; + port->commit_end = cxld->id; + devm_cxl_dpa_reserve(cxled, 0, + mock_auto_region_size / cxld->interleave_ways, 0); + cxld->commit = mock_decoder_commit; + cxld->reset = mock_decoder_reset; + + WARN_ON_ONCE(!cxld_registry_new(cxld)); + /* + * Now that endpoint decoder is set up, walk up the hierarchy + * and setup the root port decoder targeting @cxlmd. + */ + dport = port->parent_dport; + root_port = dport->port; + dev = device_find_child(&root_port->dev, NULL, first_decoder); + /* + * Ancestor ports are guaranteed to be enumerated before + * @port, and all ports have at least one decoder. + */ + if (WARN_ON(!dev)) + return; + + cxlsd = to_cxl_switch_decoder(dev); + cxld = &cxlsd->cxld; + cxld->target_type = CXL_DECODER_DEVMEM; + cxld->flags = CXL_DECODER_F_ENABLE; + root_port->commit_end = 0; + cxld->interleave_ways = 1; + cxld->interleave_granularity = 4096; + cxld->target_map[0] = dport->port_id; + cxld->hpa_range = (struct range) { + .start = base, + .end = base + mock_auto_region_size - 1, + }; + cxld->commit = mock_decoder_commit; + cxld->reset = mock_decoder_reset; + + /* + * Only target_map[] is programmed above, mimicking + * firmware. On real hardware target[] is populated as + * dports enumerate, via update_decoder_targets(). The + * mock's dports are already bound by now, so fire that + * resolution explicitly here rather than stamping + * target[] directly. + */ + cxl_port_update_decoder_targets(root_port, dport); + + cxld_registry_update(cxld); + put_device(dev); +} + +static void mock_init_hdm_type3_cxled(struct cxl_endpoint_decoder *cxled, + struct cxl_port *port, + struct platform_device *pdev, + bool hb0) +{ + struct acpi_cedt_cfmws *window = mock_cfmws[0]; + struct cxl_decoder *cxld = &cxled->cxld; + struct cxl_switch_decoder *cxlsd; + struct cxl_dport *dport; + struct cxl_port *iter; + struct device *dev; + u64 base; + int i; /* Simulate missing cxl_mem.4 configuration */ if (hb0 && pdev->id == 4 && cxld->id == 0 && fail_autoassemble) { default_mock_decoder(cxld); - return false; + return; } base = window->base_hpa; @@ -1252,7 +1308,76 @@ static bool mock_init_hdm_decoder(struct cxl_decoder *cxld) cxld_registry_update(cxld); put_device(dev); } +} +/* + * Initialize a decoder during HDM enumeration. + * + * If a saved registry entry exists: + * - enabled decoders are restored from the saved programming + * - disabled decoders are initialized in a clean disabled state + * + * If no registry entry exists the decoder follows the normal mock + * initialization path, including the special auto-region setup for + * the first endpoints under host-bridge0. + * + * Returns true if decoder state was restored from the registry. In + * that case the saved decode configuration (including target mapping) + * has already been applied and the map_targets() is skipped. + */ +static bool mock_init_hdm_decoder(struct cxl_decoder *cxld) +{ + struct cxl_endpoint_decoder *cxled = NULL; + struct platform_device *pdev = NULL; + struct cxl_test_decoder *td; + struct cxl_memdev *cxlmd; + struct cxl_port *port; + bool hb0 = false; + + if (is_endpoint_decoder(&cxld->dev)) { + cxled = to_cxl_endpoint_decoder(&cxld->dev); + cxlmd = cxled_to_memdev(cxled); + WARN_ON(!dev_is_platform(cxlmd->dev.parent)); + pdev = to_platform_device(cxlmd->dev.parent); + + /* check is endpoint is attach to host-bridge0 */ + port = cxled_to_port(cxled); + do { + if (port->uport_dev == &cxl_host_bridge[0]->dev) { + hb0 = true; + break; + } + if (is_cxl_port(port->dev.parent)) + port = to_cxl_port(port->dev.parent); + else + port = NULL; + } while (port); + port = cxled_to_port(cxled); + } else { + port = to_cxl_port(cxld->dev.parent); + } + + switch (get_decoder_init_type(cxld, pdev, hb0, &td)) { + case MOCK_DECODER_INIT_SAVED: + if (WARN_ON(!td)) + return false; + return mock_decoder_handle_saved(cxld, td); + case MOCK_DECODER_INIT_DEFAULT: + /* + * The default path picks up all the decoders that are not + * endpoint. + */ + default_mock_decoder(cxld); + return false; + case MOCK_DECODER_INIT_TYPE3_AUTO: + mock_init_hdm_type3_cxled(cxled, port, pdev, hb0); + return false; + case MOCK_DECODER_INIT_TYPE2_AUTO: + mock_init_hdm_type2_cxled(cxled, port); + return false; + default: + return false; + } return false; } From 1c6b4ceafc3b994871c29340e0c1ddb0af5800e7 Mon Sep 17 00:00:00 2001 From: Dave Jiang Date: Mon, 29 Jun 2026 15:11:04 -0700 Subject: [PATCH 12/35] cxl/test: Add cxl_test accelerator driver Add a type2 accelerator mock driver for the platform device that simulates a CXL type2 device. The driver exercises the same minimal API calls that a real CXL type2 driver would utilize. Tested-by: Alison Schofield Reviewed-by: Alison Schofield Link: https://patch.msgid.link/20260629221104.3891733-8-dave.jiang@intel.com Signed-off-by: Dave Jiang --- tools/testing/cxl/test/Kbuild | 2 ++ tools/testing/cxl/test/accel.c | 66 ++++++++++++++++++++++++++++++++++ 2 files changed, 68 insertions(+) create mode 100644 tools/testing/cxl/test/accel.c diff --git a/tools/testing/cxl/test/Kbuild b/tools/testing/cxl/test/Kbuild index c168e3c998a7..9a24ddc28488 100644 --- a/tools/testing/cxl/test/Kbuild +++ b/tools/testing/cxl/test/Kbuild @@ -5,10 +5,12 @@ obj-m += cxl_test.o obj-m += cxl_mock.o obj-m += cxl_mock_mem.o obj-m += cxl_translate.o +obj-m += cxl_mock_accel.o cxl_test-y := cxl.o cxl_test-y += hmem_test.o cxl_mock-y := mock.o cxl_mock_mem-y := mem.o +cxl_mock_accel-y := accel.o KBUILD_CFLAGS := $(filter-out -Wmissing-prototypes -Wmissing-declarations, $(KBUILD_CFLAGS)) diff --git a/tools/testing/cxl/test/accel.c b/tools/testing/cxl/test/accel.c new file mode 100644 index 000000000000..8e6f4687ca02 --- /dev/null +++ b/tools/testing/cxl/test/accel.c @@ -0,0 +1,66 @@ +// SPDX-License-Identifier: GPL-2.0-only +// Copyright(c) 2026 Intel Corporation. All rights reserved. + +#include +#include +#include +#include +#include +#include + +struct mock_cxl_accel { + struct cxl_dev_state cxlds; + struct cxl_memdev *cxlmd; +}; + +static int cxl_mock_accel_probe(struct platform_device *pdev) +{ + struct mock_cxl_accel *cxl_accel; + struct device *dev = &pdev->dev; + struct cxl_dev_state *cxlds; + struct cxl_memdev *cxlmd; + struct range mock_range; + int rc; + + cxl_accel = devm_cxl_dev_state_create(&pdev->dev, CXL_DEVTYPE_DEVMEM, + pdev->id + 1, 0, + struct mock_cxl_accel, cxlds, + false); + if (!cxl_accel) + return -ENOMEM; + + cxlds = &cxl_accel->cxlds; + cxlds->media_ready = true; + rc = cxl_set_capacity(cxlds, SZ_512M); + if (rc) + return rc; + + cxlmd = devm_cxl_probe_mem(cxlds, &mock_range); + if (IS_ERR(cxlmd)) + return PTR_ERR(cxlmd); + cxl_accel->cxlmd = cxlmd; + + dev_dbg(dev, "Probed mock accelerator with range %pra\n", &mock_range); + + return 0; +} + +static const struct platform_device_id cxl_mock_accel_ids[] = { + { .name = "cxl_type2_accel" }, + { } +}; +MODULE_DEVICE_TABLE(platform, cxl_mock_accel_ids); + +static struct platform_driver cxl_mock_accel_driver = { + .probe = cxl_mock_accel_probe, + .id_table = cxl_mock_accel_ids, + .driver = { + .name = KBUILD_MODNAME, + .probe_type = PROBE_PREFER_ASYNCHRONOUS, + }, +}; + +module_platform_driver(cxl_mock_accel_driver); +MODULE_LICENSE("GPL"); +MODULE_DESCRIPTION("cxl_test: accelerator device mock module"); +MODULE_IMPORT_NS("CXL"); From f687394af983df5660b6afae7e0d06969f3af206 Mon Sep 17 00:00:00 2001 From: Zhenhao Wan Date: Sat, 20 Jun 2026 12:33:15 +0800 Subject: [PATCH 13/35] cxl/features: bound fwctl command payload to the input buffer fwctl_cmd_rpc() copies cmd->in_len bytes into inbuf = kvzalloc(cmd->in_len) and passes inbuf and in_len to ->fw_rpc(). The CXL callback cxlctl_fw_rpc() ignores in_len and never checks the user-controlled op_size against it. cxlctl_set_feature() bounds op_size only from below (op_size <= sizeof(feat_in->hdr)) and then reads op_size - sizeof(hdr) bytes from feat_in->feat_data via cxl_set_feature(). With a small in_len and a large op_size the first memcpy() already reads past the kvzalloc(in_len) buffer; the out-of-bounds bytes are placed in the mailbox payload and sent to the device, and a large enough op_size can walk into unmapped memory and oops the kernel. The Get paths pin op_size to a fixed size but likewise read the input struct without checking in_len. Reject, at the single dispatch point, any request whose fixed header plus op_size does not fit in the copied-in buffer. The lower-bound test guards the subtraction and ensures op_size was copied in before it is read. Fixes: eb5dfcb9e36d ("cxl: Add support to handle user feature commands for set feature") Reported-by: Yuhao Jiang Signed-off-by: Zhenhao Wan Cc: stable@vger.kernel.org Reviewed-by: Jason Gunthorpe Link: https://patch.msgid.link/20260620-cxl-fwctl-oob-v1-1-5758e34d784a@gmail.com Signed-off-by: Dave Jiang --- drivers/cxl/core/features.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/cxl/core/features.c b/drivers/cxl/core/features.c index 85185af46b72..738a89863ee8 100644 --- a/drivers/cxl/core/features.c +++ b/drivers/cxl/core/features.c @@ -649,7 +649,13 @@ static void *cxlctl_fw_rpc(struct fwctl_uctx *uctx, enum fwctl_rpc_scope scope, struct cxl_memdev *cxlmd = fwctl_to_memdev(fwctl_dev); struct cxl_features_state *cxlfs = to_cxlfs(cxlmd->cxlds); const struct fwctl_rpc_cxl *rpc_in = in; - u16 opcode = rpc_in->opcode; + u16 opcode; + + if (in_len < sizeof(rpc_in->hdr) || + rpc_in->op_size > in_len - sizeof(rpc_in->hdr)) + return ERR_PTR(-EINVAL); + + opcode = rpc_in->opcode; if (!cxlctl_validate_hw_command(cxlfs, rpc_in, scope, opcode)) return ERR_PTR(-EINVAL); From 9515af581da976911aea820175afb05be803ae8c Mon Sep 17 00:00:00 2001 From: Li Ming Date: Mon, 13 Jul 2026 14:15:31 +0800 Subject: [PATCH 14/35] cxl/test: Rework cxl_type2_mem_init() to use cxl_mock_platform_device_add() cxl_type2_mem_init() is used to set up mock CXL type2 memory device for cxl testing, it introduces a known bug fixed by the following commit: commit d90f236f8b9e ("cxl/test: Update mock dev array before calling platform_device_add()") Mock CXL devices require updating the mock device array prior to platform_device_add(), otherwise, the CXL subsystem could fail to recognize the newly added mock device. Switch to cxl_mock_platform_device_add() helper to resolve this ordering issue. Besides, this patch also includes two minor changes. 1. Preserve the original error code returned by cxl_mock_platform_device_add(), rather than unconditionally overriding it with -ENOMEM. 2. Drop redundant NULL check before platform_device_unregister(), as the function internally handles NULL pointer. Fixes: 6b2e585142e6 ("cxl/test: Add hierarchy enumeration support for type2 device") Signed-off-by: Li Ming Reviewed-by: Dave Jiang Link: https://patch.msgid.link/20260713061531.56322-1-ming.li@zohomail.com Signed-off-by: Dave Jiang --- tools/testing/cxl/test/cxl.c | 17 ++++------------- 1 file changed, 4 insertions(+), 13 deletions(-) diff --git a/tools/testing/cxl/test/cxl.c b/tools/testing/cxl/test/cxl.c index 8ab2ce1262f3..62bd92b3be45 100644 --- a/tools/testing/cxl/test/cxl.c +++ b/tools/testing/cxl/test/cxl.c @@ -1947,25 +1947,16 @@ static int cxl_type2_mem_init(void) pdev->dev.parent = &dport->dev; set_dev_node(&pdev->dev, i % 2); - rc = platform_device_add(pdev); - if (rc) { - rc = -ENOMEM; - platform_device_put(pdev); + rc = cxl_mock_platform_device_add(pdev, &cxl_mem[i]); + if (rc) goto err_mem; - } - cxl_mem[i] = pdev; } return 0; err_mem: - for (i = NR_CXL_TYPE2_ACCEL - 1; i >= 0; i--) { - struct platform_device *pdev = cxl_mem[i]; - - if (!pdev) - continue; - platform_device_unregister(pdev); - } + for (i = NR_CXL_TYPE2_ACCEL - 1; i >= 0; i--) + platform_device_unregister(cxl_mem[i]); return rc; } From af5035e1b3e400067bb003975936e5407377e7a3 Mon Sep 17 00:00:00 2001 From: Guzebing Date: Mon, 13 Jul 2026 19:27:44 +0800 Subject: [PATCH 15/35] cxl/memdev: Fix firmware upload exact-fit handling cxl_fw_prepare() classifies a firmware image as a one-shot transfer only when its Transfer FW input payload is smaller than the mailbox payload size. An image that exactly fills the payload is therefore treated as a multi-part transfer. The firmware loader invokes cxl_fw_write() only once for that image. Since both offset == 0 and remaining == 0, the multi-part action selection sends INITIATE, never sends END, and then attempts to activate the target slot. Include equality in the one-shot classification so exact-fit images use the FULL action. Fixes: 9521875bbe00 ("cxl: add a firmware update mechanism using the sysfs firmware loader") Signed-off-by: Guzebing Reviewed-by: Dave Jiang Link: https://patch.msgid.link/20260713112744.2543829-1-guzebing1612@gmail.com Signed-off-by: Dave Jiang --- drivers/cxl/core/memdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/cxl/core/memdev.c b/drivers/cxl/core/memdev.c index 33a3d2e7b13a..45e7d2be17e0 100644 --- a/drivers/cxl/core/memdev.c +++ b/drivers/cxl/core/memdev.c @@ -921,7 +921,7 @@ static enum fw_upload_err cxl_fw_prepare(struct fw_upload *fwl, const u8 *data, if (!size) return FW_UPLOAD_ERR_INVALID_SIZE; - mds->fw.oneshot = struct_size(transfer, data, size) < + mds->fw.oneshot = struct_size(transfer, data, size) <= cxl_mbox->payload_size; if (cxl_mem_get_fw_info(mds)) From 8b301c4afbce4bc3f94528441d8d5ce1366504ad Mon Sep 17 00:00:00 2001 From: Dave Jiang Date: Thu, 9 Jul 2026 08:57:14 -0700 Subject: [PATCH 16/35] cxl/mbox: Break poison list loop on an empty payload A device that returns count == 0 with CXL_POISON_FLAG_MORE set on every iteration never advances nr_records, so the max_errors guard never trips and the do/while loops forever while holding poison.mutex. That hangs the sysfs-triggered scan thread and blocks all subsequent poison operations on the device. The existing "Protect against an uncleared _FLAG_MORE" guard was intended to bound a misbehaving device but does not cover the count == 0 case. Stop the loop on an empty payload so a malfunctioning or malicious device cannot wedge the poison scan. Link: https://sashiko.dev/#/patchset/20260702090849.47501-1-icheng@nvidia.com?part=3 Fixes: ed83f7ca398b ("cxl/mbox: Add GET_POISON_LIST mailbox command") Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Alison Schofield Link: https://patch.msgid.link/20260709155714.1893280-1-dave.jiang@intel.com Signed-off-by: Dave Jiang --- drivers/cxl/core/mbox.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/cxl/core/mbox.c b/drivers/cxl/core/mbox.c index 94b1f7167588..241526bb9e80 100644 --- a/drivers/cxl/core/mbox.c +++ b/drivers/cxl/core/mbox.c @@ -1450,6 +1450,11 @@ int cxl_mem_get_poison(struct cxl_memdev *cxlmd, u64 offset, u64 len, if (rc) break; + if (!le16_to_cpu(po->count)) { + dev_dbg(&cxlmd->dev, "Poison empty payload!\n"); + break; + } + for (int i = 0; i < le16_to_cpu(po->count); i++) trace_cxl_poison(cxlmd, cxlr, &po->record[i], po->flags, po->overflow_ts, From 430c502c80e542e77bcf97db13ec0e8cdf9addb0 Mon Sep 17 00:00:00 2001 From: Dave Jiang Date: Mon, 6 Jul 2026 15:43:22 -0700 Subject: [PATCH 17/35] cxl/pci: Honor -EPROBE_DEFER from component register setup cxl_pci_setup_regs() for CXL_REGLOC_RBI_COMPONENT can return -EPROBE_DEFER on a Restricted CXL Host (RCD) when the upstream port has not yet been enumerated and the Component Registers must be extracted from the RCRB. cxl_pci_probe() treats every non-zero return from that call as the benign "component registers not found" case, logs a warning, and continues. The rc is then immediately overwritten by the subsequent cxl_pci_type3_init_mailbox() call, so the deferral is silently swallowed. Return -EPROBE_DEFER instead of continuing so the probe is retried once the upstream port is available. Fixes: 733b57f262b0 ("cxl/pci: Early setup RCH dport component registers from RCRB") Reported-by: sashiko-bot@kernel.org Closes: https://lore.kernel.org/linux-cxl/ajzhsubot_PSYtHQ@MWDK4CY14F/T/#m063bbf76b1c9c293ade52ab311018ae6bba11a44 Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Alison Schofield Link: https://lore.kernel.org/linux-cxl/ajzhsubot_PSYtHQ@MWDK4CY14F/T/#m063bbf76b1c9c293ade52ab311018ae6bba11a44 Link: https://patch.msgid.link/20260706224322.714934-1-dave.jiang@intel.com Signed-off-by: Dave Jiang --- drivers/cxl/pci.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/cxl/pci.c b/drivers/cxl/pci.c index 0c9d7f8ec9e4..9d9952e391ac 100644 --- a/drivers/cxl/pci.c +++ b/drivers/cxl/pci.c @@ -823,10 +823,13 @@ static int cxl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) */ rc = cxl_pci_setup_regs(pdev, CXL_REGLOC_RBI_COMPONENT, &cxlds->reg_map); - if (rc) + if (rc) { + if (rc == -EPROBE_DEFER) + return rc; dev_warn(&pdev->dev, "No component registers (%d)\n", rc); - else if (!cxlds->reg_map.component_map.ras.valid) + } else if (!cxlds->reg_map.component_map.ras.valid) { dev_dbg(&pdev->dev, "RAS registers not found\n"); + } rc = cxl_pci_type3_init_mailbox(cxlds); if (rc) From 77b814c1832fde018c30357b4ec3fcdaa91a1c10 Mon Sep 17 00:00:00 2001 From: Dave Jiang Date: Thu, 9 Jul 2026 08:58:41 -0700 Subject: [PATCH 18/35] cxl/features: Serialize multi-part Get/Set Feature transfers A Get or Set Feature payload larger than the mailbox payload size is split into several mailbox commands. mbox_mutex only serializes individual mailbox commands and is dropped between iterations of these loops. Nothing serializes the multi-part transfer as a whole. cxl_get_feature() and cxl_set_feature() are reachable concurrently from fwctl (per-fd RPCs run under a read-held registration lock) and from the EDAC scrub/ECS/repair paths, so two transfers to the same mailbox can interleave their parts and corrupt the device's transfer context. Add a per-mailbox feat_mutex and hold it across the whole transfer in both functions. It nests outside mbox_mutex (which is taken inside cxl_internal_send_cmd()), and is taken nowhere else, so no lock-ordering inversion is introduced. Link: https://sashiko.dev/#/patchset/20260702090849.47501-1-icheng@nvidia.com?part=1 Fixes: 5e5ac21f629d ("cxl/mbox: Add GET_FEATURE mailbox command") Fixes: 14d502cc2718 ("cxl/mbox: Add SET_FEATURE mailbox command") Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Richard Cheng Link: https://patch.msgid.link/20260709155841.1895915-1-dave.jiang@intel.com Signed-off-by: Dave Jiang --- drivers/cxl/core/features.c | 3 +++ drivers/cxl/core/mbox.c | 1 + include/cxl/mailbox.h | 2 ++ 3 files changed, 6 insertions(+) diff --git a/drivers/cxl/core/features.c b/drivers/cxl/core/features.c index 738a89863ee8..8731b95dd0b5 100644 --- a/drivers/cxl/core/features.c +++ b/drivers/cxl/core/features.c @@ -240,6 +240,8 @@ size_t cxl_get_feature(struct cxl_mailbox *cxl_mbox, const uuid_t *feat_uuid, size_out = min(feat_out_size, cxl_mbox->payload_size); uuid_copy(&pi.uuid, feat_uuid); pi.selection = selection; + + guard(mutex)(&cxl_mbox->feat_mutex); do { data_to_rd_size = min(feat_out_size - data_rcvd_size, cxl_mbox->payload_size); @@ -314,6 +316,7 @@ int cxl_set_feature(struct cxl_mailbox *cxl_mbox, data_in_size = cxl_mbox->payload_size - hdr_size; } + guard(mutex)(&cxl_mbox->feat_mutex); do { int rc; diff --git a/drivers/cxl/core/mbox.c b/drivers/cxl/core/mbox.c index 241526bb9e80..cc479f4322e7 100644 --- a/drivers/cxl/core/mbox.c +++ b/drivers/cxl/core/mbox.c @@ -1516,6 +1516,7 @@ int cxl_mailbox_init(struct cxl_mailbox *cxl_mbox, struct device *host) cxl_mbox->host = host; mutex_init(&cxl_mbox->mbox_mutex); + mutex_init(&cxl_mbox->feat_mutex); rcuwait_init(&cxl_mbox->mbox_wait); return 0; diff --git a/include/cxl/mailbox.h b/include/cxl/mailbox.h index c4e99e2e3a9d..d008b9db07aa 100644 --- a/include/cxl/mailbox.h +++ b/include/cxl/mailbox.h @@ -50,6 +50,7 @@ struct cxl_mbox_cmd { * @payload_size: Size of space for payload * (CXL 3.1 8.2.8.4.3 Mailbox Capabilities Register) * @mbox_mutex: mutex protects device mailbox and firmware + * @feat_mutex: serializes multi-part Get/Set Feature transfers * @mbox_wait: rcuwait for mailbox * @mbox_send: @dev specific transport for transmitting mailbox commands * @feat_cap: Features capability @@ -60,6 +61,7 @@ struct cxl_mailbox { DECLARE_BITMAP(exclusive_cmds, CXL_MEM_COMMAND_ID_MAX); size_t payload_size; struct mutex mbox_mutex; /* lock to protect mailbox context */ + struct mutex feat_mutex; struct rcuwait mbox_wait; int (*mbox_send)(struct cxl_mailbox *cxl_mbox, struct cxl_mbox_cmd *cmd); enum cxl_features_capability feat_cap; From a623128bc2a1c257cbad97d0582f355fbe7be927 Mon Sep 17 00:00:00 2001 From: Alison Schofield Date: Mon, 13 Jul 2026 19:04:35 -0700 Subject: [PATCH 19/35] cxl/port: Restart port enumeration when a sibling adds the dport first Endpoint probes can race while enumerating a shared switch. If a sibling probe adds the dport first, the losing probe finds the dport already present, gets -EBUSY, and fails to enumerate the endpoint. Treat this race the same as the existing port-created case by restarting the port walk, allowing it to find the existing dport and continue enumeration. This race was discovered while testing a cxl_test mixed-granularity topology, where twelve endpoints behind shared switches are probed in parallel during module load. Fixes: 4f06d81e7c6a ("cxl: Defer dport allocation for switch ports") Signed-off-by: Alison Schofield Tested-by: Li Ming Reviewed-by: Li Ming Link: https://patch.msgid.link/20260714020438.1822669-1-alison.schofield@intel.com Signed-off-by: Dave Jiang --- drivers/cxl/core/port.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/cxl/core/port.c b/drivers/cxl/core/port.c index 1215ee4f4035..65f2d2f1eb00 100644 --- a/drivers/cxl/core/port.c +++ b/drivers/cxl/core/port.c @@ -1749,8 +1749,8 @@ static int add_port_attach_ep(struct cxl_memdev *cxlmd, parent_dport, uport_dev, dport_dev); if (IS_ERR(dport)) { - /* Port already exists, restart iteration */ - if (PTR_ERR(dport) == -EAGAIN) + /* Port or dport already exists, restart iteration */ + if (PTR_ERR(dport) == -EAGAIN || PTR_ERR(dport) == -EBUSY) return 0; return PTR_ERR(dport); } From 4bf6bac375076ced2fa4b3fef8739bd985f93456 Mon Sep 17 00:00:00 2001 From: Richard Cheng Date: Fri, 26 Jun 2026 18:41:00 +0800 Subject: [PATCH 20/35] cxl/features: Reject Get Feature count larger than the output buffer cxlctl_get_feature() sizes its output buffer from the user's fwctl_rpc.out_len, but the device is told to write cxl_mbox_get_feat_in.count bytes into rpc_out->payload, which is a separate user-controlled value. Nothing bounds count against out_len, so a small out_len with a large count overflows the kvzalloc()'d buffer. A heap OOB write reachable from FWCTL_RPC. Reject requests where count exceeds the available payload room, before allocating. Fixes: 5908f3ed6dc2 ("cxl: Add support to handle user feature commands for get feature") Reviewed-by: Kai-Heng Feng Reviewed-by: Koba Ko Reviewed-by: Dave Jiang Signed-off-by: Richard Cheng Reviewed-by: Alison Schofield Link: https://patch.msgid.link/20260626104102.53892-2-icheng@nvidia.com Signed-off-by: Dave Jiang --- drivers/cxl/core/features.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/cxl/core/features.c b/drivers/cxl/core/features.c index 8731b95dd0b5..d50e6b58d8fd 100644 --- a/drivers/cxl/core/features.c +++ b/drivers/cxl/core/features.c @@ -474,6 +474,10 @@ static void *cxlctl_get_feature(struct cxl_features_state *cxlfs, if (!count) return ERR_PTR(-EINVAL); + if (out_size < offsetof(struct fwctl_rpc_cxl_out, payload) || + count > out_size - offsetof(struct fwctl_rpc_cxl_out, payload)) + return ERR_PTR(-EINVAL); + struct fwctl_rpc_cxl_out *rpc_out __free(kvfree) = kvzalloc(out_size, GFP_KERNEL); if (!rpc_out) From cde18d6c1d913a67ab0afd3d9475ece4be79da50 Mon Sep 17 00:00:00 2001 From: Richard Cheng Date: Fri, 26 Jun 2026 18:41:01 +0800 Subject: [PATCH 21/35] cxl/features: Reject Set Features output buffer smaller than the header cxlctl_set_feature() sizes its output buffer from the user's fwctl_rpc.out_len but never checks it is large enough to hold even the fwctl_rpc_cxl_out header. With out_len == 0 , kvzalloc() returns ZERO_SIZE_PTR, which passes the !rpc_out check, the subsequent rpc_out->size = 0 then writes through the poison pointer. Reject requests whose output buffer can't hold the response header, before allocating. The Set Feature reply carries no payload, so the header is all that is required. Fixes: eb5dfcb9e36d ("cxl: Add support to handle user feature commands for set feature") Signed-off-by: Richard Cheng Reviewed-by: Dave Jiang Reviewed-by: Alison Schofield Link: https://patch.msgid.link/20260626104102.53892-3-icheng@nvidia.com Signed-off-by: Dave Jiang --- drivers/cxl/core/features.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/cxl/core/features.c b/drivers/cxl/core/features.c index d50e6b58d8fd..2eedabb5f702 100644 --- a/drivers/cxl/core/features.c +++ b/drivers/cxl/core/features.c @@ -523,6 +523,9 @@ static void *cxlctl_set_feature(struct cxl_features_state *cxlfs, flags = le32_to_cpu(feat_in->flags); out_size = *out_len; + if (out_size < offsetof(struct fwctl_rpc_cxl_out, payload)) + return ERR_PTR(-EINVAL); + struct fwctl_rpc_cxl_out *rpc_out __free(kvfree) = kvzalloc(out_size, GFP_KERNEL); if (!rpc_out) From 2aeb21fe557ef154f0cdf4f9745ebd8d5b31ca83 Mon Sep 17 00:00:00 2001 From: Richard Cheng Date: Fri, 26 Jun 2026 18:41:02 +0800 Subject: [PATCH 22/35] cxl/features: Clamp Get Feature output size to the remaining buffer cxl_get_feature() reads a feature in a loop but passes a fixed size_out as the output capacity every iteration. On the last partial iteration the buffer has less room left, so a device that returns more than asked can overflow feat_out. Use the per-iter size data_to_rd_size, which already tracks the remaining room, as the output capacity. Fixes: 5e5ac21f629d ("cxl/mbox: Add GET_FEATURE mailbox command") Signed-off-by: Richard Cheng Reviewed-by: Dave Jiang Reviewed-by: Alison Schofield Link: https://patch.msgid.link/20260626104102.53892-4-icheng@nvidia.com Signed-off-by: Dave Jiang --- drivers/cxl/core/features.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/cxl/core/features.c b/drivers/cxl/core/features.c index 2eedabb5f702..ba6d2a5acb74 100644 --- a/drivers/cxl/core/features.c +++ b/drivers/cxl/core/features.c @@ -225,7 +225,7 @@ size_t cxl_get_feature(struct cxl_mailbox *cxl_mbox, const uuid_t *feat_uuid, void *feat_out, size_t feat_out_size, u16 offset, u16 *return_code) { - size_t data_to_rd_size, size_out; + size_t data_to_rd_size; struct cxl_mbox_get_feat_in pi; struct cxl_mbox_cmd mbox_cmd; size_t data_rcvd_size = 0; @@ -237,7 +237,6 @@ size_t cxl_get_feature(struct cxl_mailbox *cxl_mbox, const uuid_t *feat_uuid, if (!feat_out || !feat_out_size) return 0; - size_out = min(feat_out_size, cxl_mbox->payload_size); uuid_copy(&pi.uuid, feat_uuid); pi.selection = selection; @@ -252,7 +251,7 @@ size_t cxl_get_feature(struct cxl_mailbox *cxl_mbox, const uuid_t *feat_uuid, .opcode = CXL_MBOX_OP_GET_FEATURE, .size_in = sizeof(pi), .payload_in = &pi, - .size_out = size_out, + .size_out = data_to_rd_size, .payload_out = feat_out + data_rcvd_size, .min_out = data_to_rd_size, }; From fac9275820a32748144fe08f8b92493bb85b63e0 Mon Sep 17 00:00:00 2001 From: Dave Jiang Date: Wed, 15 Jul 2026 08:51:26 -0700 Subject: [PATCH 23/35] cxl: Deny Features commands on the RAW mailbox path The RAW mailbox command path allows user to issue arbitrary opcodes to the device. The FWCTL interface was introduced to support the CXL Features commands where access control is provided depends on what the CEL indicates. Add the Features commands to cxl_disabled_raw_commands[] to ensure that all Features commands are only accessible through the FWCTL interface. The cxl_raw_allow_all debugfs override knob bypasses the disabled list if the user is aware of the risks and wants to use the RAW path for Features commands. Reviewed-by: Alison Schofield Link: https://patch.msgid.link/20260715155126.1629178-1-dave.jiang@intel.com Signed-off-by: Dave Jiang --- drivers/cxl/core/mbox.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/cxl/core/mbox.c b/drivers/cxl/core/mbox.c index 7c6c5b7450a5..6dea70a1ff95 100644 --- a/drivers/cxl/core/mbox.c +++ b/drivers/cxl/core/mbox.c @@ -91,6 +91,10 @@ static struct cxl_mem_command cxl_mem_commands[CXL_MEM_COMMAND_ID_MAX] = { * * CXL_MBOX_OP_[GET_,INJECT_,CLEAR_]POISON: These commands require kernel * driver orchestration for safety. + * + * CXL_MBOX_OP_[GET_SUPPORTED_FEATURES,GET_FEATURE,SET_FEATURE]: Features are + * accessed through the fwctl ABI, which applies scope-based access control. + * The RAW path would bypass those checks, so it is not permitted here. */ static u16 cxl_disabled_raw_commands[] = { CXL_MBOX_OP_ACTIVATE_FW, @@ -102,6 +106,9 @@ static u16 cxl_disabled_raw_commands[] = { CXL_MBOX_OP_GET_POISON, CXL_MBOX_OP_INJECT_POISON, CXL_MBOX_OP_CLEAR_POISON, + CXL_MBOX_OP_GET_SUPPORTED_FEATURES, + CXL_MBOX_OP_GET_FEATURE, + CXL_MBOX_OP_SET_FEATURE, }; /* From 15da704b732332cc1e8f121f624e5e6c05124c5d Mon Sep 17 00:00:00 2001 From: Alison Schofield Date: Fri, 24 Jul 2026 15:28:01 -0700 Subject: [PATCH 24/35] cxl/region: Fix use-after-free in find_pos_and_ways() error path The error path releases its reference to a switch decoder before logging an error that includes the decoder name. If the released reference is the last one, the decoder can be freed before the error message accesses its name. Drop the reference after the error is reported. Fixes: d90acdf49e18 ("cxl/region: Add a dev_err() on missing target list entries") Reviewed-by: Li Ming Reviewed-by: Jonathan Cameron Signed-off-by: Alison Schofield Link: https://patch.msgid.link/10deb519b543ef693ce23148b509a03fe1c07d0c.1784931354.git.alison.schofield@intel.com Signed-off-by: Dave Jiang --- drivers/cxl/core/region.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c index 578622240401..8b0005a57d03 100644 --- a/drivers/cxl/core/region.c +++ b/drivers/cxl/core/region.c @@ -1939,14 +1939,13 @@ static int find_pos_and_ways(struct cxl_port *port, struct range *range, break; } } - put_device(dev); - if (rc) dev_err(port->uport_dev, "failed to find %s:%s in target list of %s\n", dev_name(&port->dev), - dev_name(port->parent_dport->dport_dev), - dev_name(&cxlsd->cxld.dev)); + dev_name(port->parent_dport->dport_dev), dev_name(dev)); + + put_device(dev); return rc; } From bad0aa134b64f38e29fb3e61176c15680afe8a04 Mon Sep 17 00:00:00 2001 From: Alison Schofield Date: Fri, 24 Jul 2026 15:28:02 -0700 Subject: [PATCH 25/35] cxl/region: Use __free(put_device) in find_pos_and_ways() Use __free(put_device) for the switch decoder reference returned by device_find_child() instead of releasing it with an open-coded put_device(). This matches the scoped device reference handling used elsewhere in the file. Suggested-by: Li Ming Reviewed-by: Li Ming Signed-off-by: Alison Schofield Link: https://patch.msgid.link/550db1771b3d30277988d3e575f1a6893a26b0ae.1784931354.git.alison.schofield@intel.com Signed-off-by: Dave Jiang --- drivers/cxl/core/region.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c index 8b0005a57d03..d50b1dfbcd33 100644 --- a/drivers/cxl/core/region.c +++ b/drivers/cxl/core/region.c @@ -1914,15 +1914,14 @@ static int find_pos_and_ways(struct cxl_port *port, struct range *range, { struct cxl_switch_decoder *cxlsd; struct cxl_port *parent; - struct device *dev; int rc = -ENXIO; parent = parent_port_of(port); if (!parent) return rc; - dev = device_find_child(&parent->dev, range, - match_switch_decoder_by_range); + struct device *dev __free(put_device) = + device_find_child(&parent->dev, range, match_switch_decoder_by_range); if (!dev) { dev_err(port->uport_dev, "failed to find decoder mapping %#llx-%#llx\n", @@ -1945,8 +1944,6 @@ static int find_pos_and_ways(struct cxl_port *port, struct range *range, dev_name(&port->dev), dev_name(port->parent_dport->dport_dev), dev_name(dev)); - put_device(dev); - return rc; } From 4ee75140669cd954a343443b9ed78665106e3fc1 Mon Sep 17 00:00:00 2001 From: Shaikh Kamaluddin Date: Sun, 2 Aug 2026 16:50:29 +0530 Subject: [PATCH 26/35] cxl: Use %pe to print error pointers Use the %pe printk format specifier to report error pointers directly instead of printing PTR_ERR() as a long value. A failed dport addition then reports -EBUSY rather than -16, which is easier to follow when tracing port and region setup with dynamic debug enabled. Convert the five affected sites in drivers/cxl/core/port.c and drivers/cxl/core/region.c. PTR_ERR() uses in return statements are unaffected and left unchanged. drivers/cxl was scanned in full; these are the only conversion candidates. Found by: make coccicheck MODE=report M=drivers/cxl/ No functional change intended. Signed-off-by: Shaikh Kamaluddin Reviewed-by: Alison Schofield Reviewed-by: Richard Cheng Link: https://patch.msgid.link/20260802112029.28767-1-shaikhkamal2012@gmail.com Signed-off-by: Dave Jiang --- drivers/cxl/core/port.c | 13 ++++++------- drivers/cxl/core/region.c | 8 ++++---- 2 files changed, 10 insertions(+), 11 deletions(-) diff --git a/drivers/cxl/core/port.c b/drivers/cxl/core/port.c index 1215ee4f4035..c9875e6af9f6 100644 --- a/drivers/cxl/core/port.c +++ b/drivers/cxl/core/port.c @@ -932,11 +932,10 @@ struct cxl_port *devm_cxl_add_port(struct device *host, parent_port = parent_dport ? parent_dport->port : NULL; if (IS_ERR(port)) { - dev_dbg(uport_dev, "Failed to add%s%s%s: %ld\n", + dev_dbg(uport_dev, "Failed to add%s%s%s: %pe\n", parent_port ? " port to " : "", parent_port ? dev_name(&parent_port->dev) : "", - parent_port ? "" : " root port", - PTR_ERR(port)); + parent_port ? "" : " root port", port); } else { dev_dbg(uport_dev, "%s added%s%s%s\n", dev_name(&port->dev), @@ -1271,8 +1270,8 @@ struct cxl_dport *devm_cxl_add_dport(struct cxl_port *port, dport = __devm_cxl_add_dport(port, dport_dev, port_id, component_reg_phys, CXL_RESOURCE_NONE); if (IS_ERR(dport)) { - dev_dbg(dport_dev, "failed to add dport to %s: %ld\n", - dev_name(&port->dev), PTR_ERR(dport)); + dev_dbg(dport_dev, "failed to add dport to %s: %pe\n", + dev_name(&port->dev), dport); } else { dev_dbg(dport_dev, "dport added to %s\n", dev_name(&port->dev)); @@ -1305,8 +1304,8 @@ struct cxl_dport *devm_cxl_add_rch_dport(struct cxl_port *port, dport = __devm_cxl_add_dport(port, dport_dev, port_id, CXL_RESOURCE_NONE, rcrb); if (IS_ERR(dport)) { - dev_dbg(dport_dev, "failed to add RCH dport to %s: %ld\n", - dev_name(&port->dev), PTR_ERR(dport)); + dev_dbg(dport_dev, "failed to add RCH dport to %s: %pe\n", + dev_name(&port->dev), dport); } else { dev_dbg(dport_dev, "RCH dport added to %s\n", dev_name(&port->dev)); diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c index 1e211542b6b6..894df68a6074 100644 --- a/drivers/cxl/core/region.c +++ b/drivers/cxl/core/region.c @@ -682,8 +682,8 @@ static int alloc_hpa(struct cxl_region *cxlr, resource_size_t size) dev_name(&cxlr->dev)); if (IS_ERR(res)) { dev_dbg(&cxlr->dev, - "HPA allocation error (%ld) for size:%pap in %s %pr\n", - PTR_ERR(res), &size, cxlrd->res->name, cxlrd->res); + "HPA allocation error (%pe) for size:%pap in %s %pr\n", + res, &size, cxlrd->res->name, cxlrd->res); return PTR_ERR(res); } @@ -3773,9 +3773,9 @@ static struct cxl_region *construct_region(struct cxl_root_decoder *cxlrd, if (IS_ERR(cxlr)) { dev_err(cxlmd->dev.parent, - "%s:%s: %s failed assign region: %ld\n", + "%s:%s: %s failed assign region: %pe\n", dev_name(&cxlmd->dev), dev_name(&cxled->cxld.dev), - __func__, PTR_ERR(cxlr)); + __func__, cxlr); return cxlr; } From 8a80d3d65cd06ee35b913d8517fb2f2319f8e70c Mon Sep 17 00:00:00 2001 From: Alison Schofield Date: Fri, 24 Jul 2026 13:37:17 -0700 Subject: [PATCH 27/35] cxl/pmem: Format the nvdimm serial number as unsigned decimal The CXL NVDIMM security passphrase key description and the nvdimm 'id' sysfs attribute are both derived from the CXL device serial number, but the serial number is not formatted consistently. The key description is formatted in hexadecimal while the 'id' attribute is formatted in decimal. As a result, ndctl stores the key using a decimal description while the kernel later looks it up using a hexadecimal description. For serial numbers of 10 and above, the descriptions no longer match, preventing automatic unlock after reboot. The decimal formatting has a second problem: both the key description and the 'id' attribute use the signed %lld format for a u64 PCIe Device Serial Number. Devices whose vendor OUI sets bit 63, such as Montage CXL devices, appear with negative decimal serial numbers. Format the security key description and 'id' attribute as unsigned decimal, %llu, and document that the 'id' attribute is an unsigned decimal value. The key lookup mismatch was exposed by CXL unit test cxl-security.sh when cxl_test mock serial numbers were extended to 10 and above. A work around is described for ndctl load-key users here: https://github.com/pmem/ndctl/issues/299 Cc: stable@vger.kernel.org Fixes: b5807c80b5bc ("cxl: add dimm_id support for __nvdimm_create()") Acked-by: Dan Williams Signed-off-by: Alison Schofield Link: https://patch.msgid.link/2c673a5ba0a8fa93ad160578e193bd556091fa95.1784924949.git.alison.schofield@intel.com Signed-off-by: Dave Jiang --- Documentation/ABI/testing/sysfs-bus-nvdimm | 3 ++- drivers/cxl/core/pmem.c | 10 ++++++---- drivers/cxl/cxl.h | 3 ++- drivers/cxl/pmem.c | 2 +- 4 files changed, 11 insertions(+), 7 deletions(-) diff --git a/Documentation/ABI/testing/sysfs-bus-nvdimm b/Documentation/ABI/testing/sysfs-bus-nvdimm index 64eb8f4c6a41..46dafd8482b9 100644 --- a/Documentation/ABI/testing/sysfs-bus-nvdimm +++ b/Documentation/ABI/testing/sysfs-bus-nvdimm @@ -48,7 +48,8 @@ What: /sys/bus/nd/devices/nmemX/cxl/id Date: November 2022 KernelVersion: 6.2 Contact: Dave Jiang -Description: (RO) Show the id (serial) of the device. This is CXL specific. +Description: (RO) Show the id (serial) of the device, formatted as an + unsigned 64-bit decimal value. This is CXL specific. What: /sys/bus/nd/devices/nmemX/cxl/provider Date: November 2022 diff --git a/drivers/cxl/core/pmem.c b/drivers/cxl/core/pmem.c index 68462e38a977..5a3bb7e8a1f1 100644 --- a/drivers/cxl/core/pmem.c +++ b/drivers/cxl/core/pmem.c @@ -219,12 +219,14 @@ static struct cxl_nvdimm *cxl_nvdimm_alloc(struct cxl_nvdimm_bridge *cxl_nvb, dev->bus = &cxl_bus_type; dev->type = &cxl_nvdimm_type; /* - * A "%llx" string is 17-bytes vs dimm_id that is max - * NVDIMM_KEY_DESC_LEN + * dev_id is the nvdimm dimm_id used for security key lookup. + * It must match id_show(), which emits the CXL serial as an + * unsigned decimal. A u64 decimal string is at most 20 digits + * plus NUL. */ - BUILD_BUG_ON(sizeof(cxl_nvd->dev_id) < 17 || + BUILD_BUG_ON(sizeof(cxl_nvd->dev_id) < 21 || sizeof(cxl_nvd->dev_id) > NVDIMM_KEY_DESC_LEN); - sprintf(cxl_nvd->dev_id, "%llx", cxlmd->cxlds->serial); + sprintf(cxl_nvd->dev_id, "%llu", cxlmd->cxlds->serial); return cxl_nvd; } diff --git a/drivers/cxl/cxl.h b/drivers/cxl/cxl.h index c0e5308e4d1b..d683ae5e0f7d 100644 --- a/drivers/cxl/cxl.h +++ b/drivers/cxl/cxl.h @@ -503,7 +503,8 @@ struct cxl_nvdimm_bridge { struct nvdimm_bus_descriptor nd_desc; }; -#define CXL_DEV_ID_LEN 19 +/* Holds a u64 serial as a decimal string: up to 20 digits + NUL */ +#define CXL_DEV_ID_LEN 21 enum { CXL_NVD_F_INVALIDATED = 0, diff --git a/drivers/cxl/pmem.c b/drivers/cxl/pmem.c index 261dff7ced9f..a9f50281875d 100644 --- a/drivers/cxl/pmem.c +++ b/drivers/cxl/pmem.c @@ -52,7 +52,7 @@ static ssize_t id_show(struct device *dev, struct device_attribute *attr, char * struct cxl_nvdimm *cxl_nvd = nvdimm_provider_data(nvdimm); struct cxl_dev_state *cxlds = cxl_nvd->cxlmd->cxlds; - return sysfs_emit(buf, "%lld\n", cxlds->serial); + return sysfs_emit(buf, "%llu\n", cxlds->serial); } static DEVICE_ATTR_RO(id); From 95a84b7cb4bbc5bd929adc9b1cd1282fca737662 Mon Sep 17 00:00:00 2001 From: Alison Schofield Date: Fri, 24 Jul 2026 13:37:18 -0700 Subject: [PATCH 28/35] cxl/core: Format the memdev serial number as unsigned in TP_printk The CXL memdev serial number is a u64 PCIe Device Serial Number, but the tracepoints format it with %lld. Devices whose vendor OUI sets bit 63 therefore appear with negative serial numbers in formatted trace output. Note that the trace data itself is already stored correctly as u64. Format the TP_printk serial as unsigned decimal, %llu, to match the underlying value. Signed-off-by: Alison Schofield Link: https://patch.msgid.link/46651395b6c1e552ae2c4fecf3058a062eb0c3f0.1784924949.git.alison.schofield@intel.com Signed-off-by: Dave Jiang --- drivers/cxl/core/trace.h | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/cxl/core/trace.h b/drivers/cxl/core/trace.h index d37876096dd7..c379d60047fc 100644 --- a/drivers/cxl/core/trace.h +++ b/drivers/cxl/core/trace.h @@ -107,7 +107,7 @@ TRACE_EVENT(cxl_aer_uncorrectable_error, memcpy(__entry->header_log, hl, CXL_HEADERLOG_TRACE_SIZE_U32 * sizeof(u32)); ), - TP_printk("memdev=%s host=%s serial=%lld: status: '%s' first_error: '%s'", + TP_printk("memdev=%s host=%s serial=%llu: status: '%s' first_error: '%s'", __get_str(memdev), __get_str(host), __entry->serial, show_uc_errs(__entry->status), show_uc_errs(__entry->first_error) @@ -166,7 +166,7 @@ TRACE_EVENT(cxl_aer_correctable_error, __entry->serial = cxlmd->cxlds->serial; __entry->status = status; ), - TP_printk("memdev=%s host=%s serial=%lld: status: '%s'", + TP_printk("memdev=%s host=%s serial=%llu: status: '%s'", __get_str(memdev), __get_str(host), __entry->serial, show_ce_errs(__entry->status) ) @@ -206,7 +206,7 @@ TRACE_EVENT(cxl_overflow, __entry->last_ts = le64_to_cpu(payload->last_overflow_timestamp); ), - TP_printk("memdev=%s host=%s serial=%lld: log=%s : %u records from %llu to %llu", + TP_printk("memdev=%s host=%s serial=%llu: log=%s : %u records from %llu to %llu", __get_str(memdev), __get_str(host), __entry->serial, cxl_event_log_type_str(__entry->log), __entry->count, __entry->first_ts, __entry->last_ts) @@ -279,7 +279,7 @@ TRACE_EVENT(cxl_overflow, __entry->hdr_head_id = (hdr).head_id #define CXL_EVT_TP_printk(fmt, ...) \ - TP_printk("memdev=%s host=%s serial=%lld log=%s : time=%llu uuid=%pUb " \ + TP_printk("memdev=%s host=%s serial=%llu log=%s : time=%llu uuid=%pUb " \ "len=%d flags='%s' handle=%x related_handle=%x " \ "maint_op_class=%u maint_op_sub_class=%u " \ "ld_id=%x head_id=%x : " fmt, \ @@ -1088,7 +1088,7 @@ TRACE_EVENT(cxl_poison, } ), - TP_printk("memdev=%s host=%s serial=%lld trace_type=%s region=%s " \ + TP_printk("memdev=%s host=%s serial=%llu trace_type=%s region=%s " \ "region_uuid=%pU hpa=0x%llx hpa_alias0=0x%llx dpa=0x%llx " \ "dpa_length=0x%x source=%s flags=%s overflow_time=%llu", __get_str(memdev), From 94d84e3d89594f6ad6dc5ed5bed05956bf146149 Mon Sep 17 00:00:00 2001 From: Alison Schofield Date: Fri, 24 Jul 2026 13:37:19 -0700 Subject: [PATCH 29/35] cxl/test: Assign one mock memdev a full-width serial number Mock memdev serial numbers have historically been derived from pdev->id, leaving them single-digit. As a result they never exercised either the decimal-vs-hex security-key lookup or unsigned formatting of large serial numbers. Give one mock memdev a full-width serial with bit 63 set. This mirrors real hardware (for example, Montage devices) and provides a test device that exposes both the hexadecimal-vs-decimal and signed-vs- unsigned formatting differences. pdev->id 7 is unused by the auto-region topology so the larger serial does not affect existing tests. This enables adding a new test case to cxl-security.sh that verify auto-unlock using a mock device whose serial exposes both formatting differences. Signed-off-by: Alison Schofield Link: https://patch.msgid.link/3e569a748fce4424b8622032fbffc298d92153b9.1784924949.git.alison.schofield@intel.com Signed-off-by: Dave Jiang --- tools/testing/cxl/test/mem.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/tools/testing/cxl/test/mem.c b/tools/testing/cxl/test/mem.c index a7da279aa3ef..7b756000a1a6 100644 --- a/tools/testing/cxl/test/mem.c +++ b/tools/testing/cxl/test/mem.c @@ -1713,6 +1713,7 @@ static int cxl_mock_mem_probe(struct platform_device *pdev) struct cxl_mockmem_data *mdata; struct cxl_mailbox *cxl_mbox; struct cxl_dpa_info range_info = { 0 }; + u64 serial; int rc; /* Increase async probe race window */ @@ -1739,7 +1740,19 @@ static int cxl_mock_mem_probe(struct platform_device *pdev) if (rc) return rc; - mds = cxl_memdev_state_create(dev, pdev->id + 1, 0); + /* + * Mock serials have historically been derived from pdev->id and stayed + * single-digit, so they never exercised either decimal-vs-hex key + * lookup or unsigned formatting. Give one mock device a full-width + * serial with bit 63 set, matching real hardware such as Montage CXL + * devices. pdev->id 7 is unused by the auto-region topology. + */ + if (pdev->id == 7) + serial = 0x8a34567890abcdef; + else + serial = pdev->id + 1; + + mds = cxl_memdev_state_create(dev, serial, 0); if (IS_ERR(mds)) return PTR_ERR(mds); From 29458e62d0829cbc99435f3e44fd560f9bbf1da7 Mon Sep 17 00:00:00 2001 From: Terry Bowman Date: Mon, 3 Aug 2026 17:17:57 -0500 Subject: [PATCH 30/35] cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read cxl_rch_get_aer_info() copies the RCH Downstream Port AER capability from the RCRB MMIO block using a readl() loop bounded by sizeof(struct aer_capability_regs). This struct is a software layout and its embedded struct pcie_tlp_log is larger than the on-wire AER capability. As a result the loop reads past the mapped AER register block. The over-read also populates the software-only tail fields including header_log.header_len. An out-of-range header_len passed to pcie_print_tlp_log() can then loop past the header log buffer and cause a second out-of-bounds read. The read was correct when introduced, but struct pcie_tlp_log has since grown (Header Log and TLP Prefix Log sizes, header_len and flit fields), so sizeof(struct aer_capability_regs) no longer matches the physical AER capability. Bound the read to the physical AER registers, header through the 16 byte Header Log. Zero the destination first so the software-only fields are deterministic. Fixes: 6ac07883dbb5 ("cxl/pci: Add RCH downstream port error logging") Reported-by: Sashiko Cc: stable@vger.kernel.org Signed-off-by: Terry Bowman Reviewed-by: Alison Schofield Link: https://patch.msgid.link/20260803221810.3685703-2-terry.bowman@amd.com Signed-off-by: Dave Jiang --- drivers/cxl/core/ras_rch.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/drivers/cxl/core/ras_rch.c b/drivers/cxl/core/ras_rch.c index 0a8b3b9b6388..8a3965edaa12 100644 --- a/drivers/cxl/core/ras_rch.c +++ b/drivers/cxl/core/ras_rch.c @@ -58,13 +58,28 @@ void cxl_disable_rch_root_ints(struct cxl_dport *dport) static bool cxl_rch_get_aer_info(void __iomem *aer_base, struct aer_capability_regs *aer_regs) { - int read_cnt = sizeof(struct aer_capability_regs) / sizeof(u32); + /* + * Bound the copy to the physically-defined AER registers (header + * through the 16-byte Header Log). struct aer_capability_regs is a + * software layout whose embedded struct pcie_tlp_log is larger than + * the on-wire AER capability; copying sizeof(*aer_regs) would + * over-read the RCRB-mapped MMIO block. + */ + int read_cnt = (PCI_ERR_HEADER_LOG + 16) / sizeof(u32); u32 *aer_regs_buf = (u32 *)aer_regs; int n; if (!aer_base) return false; + /* + * Zero the destination so the software-only tail fields + * (e.g. header_log.header_len) are deterministic rather than + * left as uninitialized stack, which could drive a bogus loop + * length in pcie_print_tlp_log(). + */ + memset(aer_regs, 0, sizeof(*aer_regs)); + /* Use readl() to guarantee 32-bit accesses */ for (n = 0; n < read_cnt; n++) aer_regs_buf[n] = readl(aer_base + n * sizeof(u32)); From 9d399526128bae184b153deab42b49f5f3eea2ed Mon Sep 17 00:00:00 2001 From: Terry Bowman Date: Mon, 3 Aug 2026 17:17:58 -0500 Subject: [PATCH 31/35] cxl/ras: Fix cxl_rch_get_aer_severity() wrong severity register cxl_rch_get_aer_severity() classifies RCH Downstream Port uncorrectable errors as fatal or non-fatal by ANDing uncorrectable status with PCI_ERR_ROOT_FATAL_RCV. This is wrong because PCI_ERR_ROOT_FATAL_RCV is a Root Error Status register bit (bit 6), not a severity bit. ANDing it against uncorrectable status tests a reserved bit and produces incorrect severity classification. Fix by ANDing the unmasked uncor_status against uncor_severity. Per PCIe Base Spec r6.0 Section 7.8.4.4, each bit in the Uncorrectable Error Severity register indicates whether the corresponding error is fatal (1) or non-fatal (0). Fixes: 6ac07883dbb5 ("cxl/pci: Add RCH downstream port error logging") Cc: stable@vger.kernel.org Signed-off-by: Terry Bowman Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Reviewed-by: Richard Cheng Reviewed-by: Alison Schofield Link: https://patch.msgid.link/20260803221810.3685703-3-terry.bowman@amd.com Signed-off-by: Dave Jiang --- drivers/cxl/core/ras_rch.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/cxl/core/ras_rch.c b/drivers/cxl/core/ras_rch.c index 8a3965edaa12..e0e01aa5eba6 100644 --- a/drivers/cxl/core/ras_rch.c +++ b/drivers/cxl/core/ras_rch.c @@ -94,11 +94,11 @@ static bool cxl_rch_get_aer_info(void __iomem *aer_base, static bool cxl_rch_get_aer_severity(struct aer_capability_regs *aer_regs, int *severity) { - if (aer_regs->uncor_status & ~aer_regs->uncor_mask) { - if (aer_regs->uncor_status & PCI_ERR_ROOT_FATAL_RCV) - *severity = AER_FATAL; - else - *severity = AER_NONFATAL; + u32 uncor_status = aer_regs->uncor_status & ~aer_regs->uncor_mask; + + if (uncor_status) { + *severity = (uncor_status & aer_regs->uncor_severity) ? + AER_FATAL : AER_NONFATAL; return true; } From 6625ca499c3131ef63be3215f8f942d7a097ea3a Mon Sep 17 00:00:00 2001 From: Terry Bowman Date: Mon, 3 Aug 2026 17:17:59 -0500 Subject: [PATCH 32/35] acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locks The CXL CPER work registration and unregistration helpers acquire cxl_cper_work_lock and cxl_cper_prot_err_work_lock with a spinlock guard(), which leaves local interrupts enabled. The corresponding post paths (cxl_cper_post_event(), cxl_cper_post_prot_err()) execute in hard IRQ context (they are called from the GHES error notification path) and acquire the same locks with an irqsave guard(). If a CPU is holding one of these locks via a spinlock guard() when a GHES interrupt arrives on the same CPU, the IRQ handler spins on the held lock waiting for it to release, while the lock holder is preempted by the IRQ. The result is a deadlock. Convert both locks from spinlock_t to raw_spinlock_t and use guard() at all call sites. On PREEMPT_RT kernels spinlock_t is backed by rt_mutex and sleeping from hard IRQ context is not permitted; raw_spinlock_t is safe in both contexts. Add WARN_ONCE to both register functions to surface double-registration bugs at runtime. Restructure both unregister functions to clear the global work pointer under the lock before calling cancel_work_sync(), closing the window where a CPER interrupt could schedule work on a pointer about to be freed. Add kfifo_reset() after cancel_work_sync() so stale entries are not replayed on next module load. Both kfifos are single-consumer: only one work_struct is registered at a time, enforced by the WARN_ONCE guard in the register functions. kfifo_reset() is safe outside the lock because cancel_work_sync() has already quiesced the consumer, and no new consumer can register until the current module exit completes and a fresh module init runs. Remove the redundant cancel_work_sync() call from cxl_ras_exit() and cxl_pci_driver_exit(). The CPER unregister functions now quiesce the work internally. Reported-by: Sashiko Signed-off-by: Terry Bowman Fixes: 5e4a264bf8b5 ("acpi/ghes: Process CXL Component Events") Fixes: 36f257e3b0ba ("acpi/ghes, cxl/pci: Process CXL CPER Protocol Errors") Cc: stable@vger.kernel.org Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Reviewed-by: Tony Luck Link: https://patch.msgid.link/20260803221810.3685703-4-terry.bowman@amd.com Signed-off-by: Dave Jiang --- drivers/acpi/apei/ghes.c | 50 ++++++++++++++++++++++++++-------------- drivers/cxl/core/ras.c | 1 - drivers/cxl/pci.c | 1 - 3 files changed, 33 insertions(+), 19 deletions(-) diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c index 3236a3ce79d6..ca7a138c1ff2 100644 --- a/drivers/acpi/apei/ghes.c +++ b/drivers/acpi/apei/ghes.c @@ -749,7 +749,7 @@ static DEFINE_KFIFO(cxl_cper_prot_err_fifo, struct cxl_cper_prot_err_work_data, CXL_CPER_PROT_ERR_FIFO_DEPTH); /* Synchronize schedule_work() with cxl_cper_prot_err_work changes */ -static DEFINE_SPINLOCK(cxl_cper_prot_err_work_lock); +static DEFINE_RAW_SPINLOCK(cxl_cper_prot_err_work_lock); struct work_struct *cxl_cper_prot_err_work; static void cxl_cper_post_prot_err(struct cxl_cper_sec_prot_err *prot_err, @@ -761,7 +761,7 @@ static void cxl_cper_post_prot_err(struct cxl_cper_sec_prot_err *prot_err, if (cxl_cper_sec_prot_err_valid(prot_err)) return; - guard(spinlock_irqsave)(&cxl_cper_prot_err_work_lock); + guard(raw_spinlock_irqsave)(&cxl_cper_prot_err_work_lock); if (!cxl_cper_prot_err_work) return; @@ -780,10 +780,11 @@ static void cxl_cper_post_prot_err(struct cxl_cper_sec_prot_err *prot_err, int cxl_cper_register_prot_err_work(struct work_struct *work) { - if (cxl_cper_prot_err_work) - return -EINVAL; + guard(raw_spinlock_irqsave)(&cxl_cper_prot_err_work_lock); - guard(spinlock)(&cxl_cper_prot_err_work_lock); + if (WARN_ONCE(cxl_cper_prot_err_work, + "CPER-CXL kfifo consumer already registered\n")) + return -EINVAL; cxl_cper_prot_err_work = work; return 0; } @@ -791,11 +792,18 @@ EXPORT_SYMBOL_NS_GPL(cxl_cper_register_prot_err_work, "CXL"); int cxl_cper_unregister_prot_err_work(struct work_struct *work) { - if (cxl_cper_prot_err_work != work) - return -EINVAL; + scoped_guard(raw_spinlock_irqsave, &cxl_cper_prot_err_work_lock) { + if (WARN_ONCE(cxl_cper_prot_err_work != work, + "CPER-CXL kfifo consumer mismatch on unregister\n")) + return -EINVAL; + cxl_cper_prot_err_work = NULL; + } + + cancel_work_sync(work); + + /* Discard stale entries so they are not replayed on next module load */ + kfifo_reset(&cxl_cper_prot_err_fifo); - guard(spinlock)(&cxl_cper_prot_err_work_lock); - cxl_cper_prot_err_work = NULL; return 0; } EXPORT_SYMBOL_NS_GPL(cxl_cper_unregister_prot_err_work, "CXL"); @@ -811,7 +819,7 @@ EXPORT_SYMBOL_NS_GPL(cxl_cper_prot_err_kfifo_get, "CXL"); DEFINE_KFIFO(cxl_cper_fifo, struct cxl_cper_work_data, CXL_CPER_FIFO_DEPTH); /* Synchronize schedule_work() with cxl_cper_work changes */ -static DEFINE_SPINLOCK(cxl_cper_work_lock); +static DEFINE_RAW_SPINLOCK(cxl_cper_work_lock); struct work_struct *cxl_cper_work; static void cxl_cper_post_event(enum cxl_event_type event_type, @@ -831,7 +839,7 @@ static void cxl_cper_post_event(enum cxl_event_type event_type, return; } - guard(spinlock_irqsave)(&cxl_cper_work_lock); + guard(raw_spinlock_irqsave)(&cxl_cper_work_lock); if (!cxl_cper_work) return; @@ -849,10 +857,11 @@ static void cxl_cper_post_event(enum cxl_event_type event_type, int cxl_cper_register_work(struct work_struct *work) { - if (cxl_cper_work) + guard(raw_spinlock_irqsave)(&cxl_cper_work_lock); + if (WARN_ONCE(cxl_cper_work, + "CXL CPER kfifo consumer already registered\n")) return -EINVAL; - guard(spinlock)(&cxl_cper_work_lock); cxl_cper_work = work; return 0; } @@ -860,11 +869,18 @@ EXPORT_SYMBOL_NS_GPL(cxl_cper_register_work, "CXL"); int cxl_cper_unregister_work(struct work_struct *work) { - if (cxl_cper_work != work) - return -EINVAL; + scoped_guard(raw_spinlock_irqsave, &cxl_cper_work_lock) { + if (WARN_ONCE(cxl_cper_work != work, + "CXL CPER kfifo consumer mismatch on unregister\n")) + return -EINVAL; + cxl_cper_work = NULL; + } + + cancel_work_sync(work); + + /* Discard stale entries so they are not replayed on next module load */ + kfifo_reset(&cxl_cper_fifo); - guard(spinlock)(&cxl_cper_work_lock); - cxl_cper_work = NULL; return 0; } EXPORT_SYMBOL_NS_GPL(cxl_cper_unregister_work, "CXL"); diff --git a/drivers/cxl/core/ras.c b/drivers/cxl/core/ras.c index 99fb00949c2f..bc74d4848132 100644 --- a/drivers/cxl/core/ras.c +++ b/drivers/cxl/core/ras.c @@ -137,7 +137,6 @@ int cxl_ras_init(void) void cxl_ras_exit(void) { cxl_cper_unregister_prot_err_work(&cxl_cper_prot_err_work); - cancel_work_sync(&cxl_cper_prot_err_work); } static void cxl_dport_map_ras(struct cxl_dport *dport) diff --git a/drivers/cxl/pci.c b/drivers/cxl/pci.c index 267c679b0b3c..7c6faee7f85e 100644 --- a/drivers/cxl/pci.c +++ b/drivers/cxl/pci.c @@ -1083,7 +1083,6 @@ static int __init cxl_pci_driver_init(void) static void __exit cxl_pci_driver_exit(void) { cxl_cper_unregister_work(&cxl_cper_work); - cancel_work_sync(&cxl_cper_work); pci_unregister_driver(&cxl_pci_driver); } From 59a37f9200688916650e1d60774c90f023c79b57 Mon Sep 17 00:00:00 2001 From: Dan Williams Date: Mon, 3 Aug 2026 17:18:00 -0500 Subject: [PATCH 33/35] cxl: Tighten CPER kfifo registration API and symbol visibility Tighten the CPER protocol error kfifo registration API and symbol visibility. Use EXPORT_SYMBOL_FOR_MODULES() instead of EXPORT_SYMBOL_NS_GPL() for the CPER kfifo registration symbols. This names the consuming module explicitly and gives compile-time enforcement. Drop the work_struct argument from the unregister path. Change the WARN_ONCE condition to a NULL check since there is no caller pointer to compare against anymore. Return void from the registration helpers whose result callers ignore. cxl_cper_register_work() keeps its int return as the only one consumed by a caller. Flag double registration with WARN_ONCE() inside the lock instead of returning an error. Change cxl_ras_init() to void because there is one consumer and one producer so the error return was unnecessary. Remove the now-dead error check in cxl_core_init(). Co-developed-by: Terry Bowman Signed-off-by: Terry Bowman Signed-off-by: Dan Williams Reviewed-by: Dave Jiang Reviewed-by: Alison Schofield Link: https://patch.msgid.link/20260803221810.3685703-5-terry.bowman@amd.com Signed-off-by: Dave Jiang --- drivers/acpi/apei/ghes.c | 32 +++++++++++++++----------------- drivers/cxl/core/core.h | 7 ++----- drivers/cxl/core/port.c | 6 +----- drivers/cxl/core/ras.c | 6 +++--- include/cxl/event.h | 21 ++++++--------------- 5 files changed, 27 insertions(+), 45 deletions(-) diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c index ca7a138c1ff2..187f54e31c33 100644 --- a/drivers/acpi/apei/ghes.c +++ b/drivers/acpi/apei/ghes.c @@ -778,41 +778,41 @@ static void cxl_cper_post_prot_err(struct cxl_cper_sec_prot_err *prot_err, #endif } -int cxl_cper_register_prot_err_work(struct work_struct *work) +void cxl_cper_register_prot_err_work(struct work_struct *work) { guard(raw_spinlock_irqsave)(&cxl_cper_prot_err_work_lock); if (WARN_ONCE(cxl_cper_prot_err_work, "CPER-CXL kfifo consumer already registered\n")) - return -EINVAL; + return; cxl_cper_prot_err_work = work; - return 0; } -EXPORT_SYMBOL_NS_GPL(cxl_cper_register_prot_err_work, "CXL"); +EXPORT_SYMBOL_FOR_MODULES(cxl_cper_register_prot_err_work, "cxl_core"); -int cxl_cper_unregister_prot_err_work(struct work_struct *work) +void cxl_cper_unregister_prot_err_work(void) { + struct work_struct *old; + scoped_guard(raw_spinlock_irqsave, &cxl_cper_prot_err_work_lock) { - if (WARN_ONCE(cxl_cper_prot_err_work != work, - "CPER-CXL kfifo consumer mismatch on unregister\n")) - return -EINVAL; + WARN_ONCE(!cxl_cper_prot_err_work, + "CPER-CXL kfifo consumer not registered on unregister\n"); + old = cxl_cper_prot_err_work; cxl_cper_prot_err_work = NULL; } - cancel_work_sync(work); + if (old) + cancel_work_sync(old); /* Discard stale entries so they are not replayed on next module load */ kfifo_reset(&cxl_cper_prot_err_fifo); - - return 0; } -EXPORT_SYMBOL_NS_GPL(cxl_cper_unregister_prot_err_work, "CXL"); +EXPORT_SYMBOL_FOR_MODULES(cxl_cper_unregister_prot_err_work, "cxl_core"); int cxl_cper_prot_err_kfifo_get(struct cxl_cper_prot_err_work_data *wd) { return kfifo_get(&cxl_cper_prot_err_fifo, wd); } -EXPORT_SYMBOL_NS_GPL(cxl_cper_prot_err_kfifo_get, "CXL"); +EXPORT_SYMBOL_FOR_MODULES(cxl_cper_prot_err_kfifo_get, "cxl_core"); /* Room for 8 entries for each of the 4 event log queues */ #define CXL_CPER_FIFO_DEPTH 32 @@ -867,12 +867,12 @@ int cxl_cper_register_work(struct work_struct *work) } EXPORT_SYMBOL_NS_GPL(cxl_cper_register_work, "CXL"); -int cxl_cper_unregister_work(struct work_struct *work) +void cxl_cper_unregister_work(struct work_struct *work) { scoped_guard(raw_spinlock_irqsave, &cxl_cper_work_lock) { if (WARN_ONCE(cxl_cper_work != work, "CXL CPER kfifo consumer mismatch on unregister\n")) - return -EINVAL; + return; cxl_cper_work = NULL; } @@ -880,8 +880,6 @@ int cxl_cper_unregister_work(struct work_struct *work) /* Discard stale entries so they are not replayed on next module load */ kfifo_reset(&cxl_cper_fifo); - - return 0; } EXPORT_SYMBOL_NS_GPL(cxl_cper_unregister_work, "CXL"); diff --git a/drivers/cxl/core/core.h b/drivers/cxl/core/core.h index 07555ae63859..23fe40ddf4c6 100644 --- a/drivers/cxl/core/core.h +++ b/drivers/cxl/core/core.h @@ -183,7 +183,7 @@ static inline struct device *dport_to_host(struct cxl_dport *dport) return &port->dev; } #ifdef CONFIG_CXL_RAS -int cxl_ras_init(void); +void cxl_ras_init(void); void cxl_ras_exit(void); bool cxl_handle_ras(struct device *dev, void __iomem *ras_base); void cxl_handle_cor_ras(struct device *dev, void __iomem *ras_base); @@ -192,10 +192,7 @@ void cxl_disable_rch_root_ints(struct cxl_dport *dport); void cxl_handle_rdport_errors(struct cxl_dev_state *cxlds); void devm_cxl_dport_ras_setup(struct cxl_dport *dport); #else -static inline int cxl_ras_init(void) -{ - return 0; -} +static inline void cxl_ras_init(void) { } static inline void cxl_ras_exit(void) { } static inline bool cxl_handle_ras(struct device *dev, void __iomem *ras_base) { diff --git a/drivers/cxl/core/port.c b/drivers/cxl/core/port.c index 1215ee4f4035..f90f899c31d0 100644 --- a/drivers/cxl/core/port.c +++ b/drivers/cxl/core/port.c @@ -2531,14 +2531,10 @@ static __init int cxl_core_init(void) if (rc) goto err_region; - rc = cxl_ras_init(); - if (rc) - goto err_ras; + cxl_ras_init(); return 0; -err_ras: - cxl_region_exit(); err_region: bus_unregister(&cxl_bus_type); err_bus: diff --git a/drivers/cxl/core/ras.c b/drivers/cxl/core/ras.c index bc74d4848132..e307361bb39e 100644 --- a/drivers/cxl/core/ras.c +++ b/drivers/cxl/core/ras.c @@ -129,14 +129,14 @@ static void cxl_cper_prot_err_work_fn(struct work_struct *work) } static DECLARE_WORK(cxl_cper_prot_err_work, cxl_cper_prot_err_work_fn); -int cxl_ras_init(void) +void cxl_ras_init(void) { - return cxl_cper_register_prot_err_work(&cxl_cper_prot_err_work); + cxl_cper_register_prot_err_work(&cxl_cper_prot_err_work); } void cxl_ras_exit(void) { - cxl_cper_unregister_prot_err_work(&cxl_cper_prot_err_work); + cxl_cper_unregister_prot_err_work(); } static void cxl_dport_map_ras(struct cxl_dport *dport) diff --git a/include/cxl/event.h b/include/cxl/event.h index ff97fea718d2..b5673384d930 100644 --- a/include/cxl/event.h +++ b/include/cxl/event.h @@ -287,10 +287,10 @@ struct cxl_cper_prot_err_work_data { #ifdef CONFIG_ACPI_APEI_GHES int cxl_cper_register_work(struct work_struct *work); -int cxl_cper_unregister_work(struct work_struct *work); +void cxl_cper_unregister_work(struct work_struct *work); int cxl_cper_kfifo_get(struct cxl_cper_work_data *wd); -int cxl_cper_register_prot_err_work(struct work_struct *work); -int cxl_cper_unregister_prot_err_work(struct work_struct *work); +void cxl_cper_register_prot_err_work(struct work_struct *work); +void cxl_cper_unregister_prot_err_work(void); int cxl_cper_prot_err_kfifo_get(struct cxl_cper_prot_err_work_data *wd); #else static inline int cxl_cper_register_work(struct work_struct *work) @@ -298,22 +298,13 @@ static inline int cxl_cper_register_work(struct work_struct *work) return 0; } -static inline int cxl_cper_unregister_work(struct work_struct *work) -{ - return 0; -} +static inline void cxl_cper_unregister_work(struct work_struct *work) { } static inline int cxl_cper_kfifo_get(struct cxl_cper_work_data *wd) { return 0; } -static inline int cxl_cper_register_prot_err_work(struct work_struct *work) -{ - return 0; -} -static inline int cxl_cper_unregister_prot_err_work(struct work_struct *work) -{ - return 0; -} +static inline void cxl_cper_register_prot_err_work(struct work_struct *work) { } +static inline void cxl_cper_unregister_prot_err_work(void) { } static inline int cxl_cper_prot_err_kfifo_get(struct cxl_cper_prot_err_work_data *wd) { return 0; From 658fb50cc8882608dc72dfa6b2e052f87d265ce6 Mon Sep 17 00:00:00 2001 From: Dan Williams Date: Mon, 3 Aug 2026 17:18:01 -0500 Subject: [PATCH 34/35] cxl: Rename find_cxl_port() to find_cxl_port_by_dport() find_cxl_port() and find_cxl_port_by_uport() are internal port lookup functions that search the CXL bus by dport and uport respectively, but their names do not make the lookup method clear. Rename find_cxl_port() to find_cxl_port_by_dport() to make the lookup method explicit and consistent with find_cxl_port_by_uport(). Both functions remain static to port.c; the upcoming patch that adds the first cross-file caller will widen their scope. Make the same naming change to static helper __find_cxl_port_by_dport(). Co-developed-by: Terry Bowman Signed-off-by: Terry Bowman Signed-off-by: Dan Williams Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Reviewed-by: Alison Schofield Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20260803221810.3685703-6-terry.bowman@amd.com Signed-off-by: Dave Jiang --- drivers/cxl/core/port.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/drivers/cxl/core/port.c b/drivers/cxl/core/port.c index f90f899c31d0..cadb51f70f85 100644 --- a/drivers/cxl/core/port.c +++ b/drivers/cxl/core/port.c @@ -1379,7 +1379,7 @@ static int match_port_by_dport(struct device *dev, const void *data) return dport != NULL; } -static struct cxl_port *__find_cxl_port(struct cxl_find_port_ctx *ctx) +static struct cxl_port *__find_cxl_port_by_dport(struct cxl_find_port_ctx *ctx) { struct device *dev; @@ -1392,8 +1392,16 @@ static struct cxl_port *__find_cxl_port(struct cxl_find_port_ctx *ctx) return NULL; } -static struct cxl_port *find_cxl_port(struct device *dport_dev, - struct cxl_dport **dport) +/** + * find_cxl_port_by_dport - find a cxl_port by one of its targets + * @dport_dev: device representing the dport target + * @dport: optional output of the 'struct cxl_dport' companion of the @dport_dev + * + * Return a 'struct cxl_port' with an elevated reference if found. Use + * __free(put_cxl_port) to release. + */ +static struct cxl_port *find_cxl_port_by_dport(struct device *dport_dev, + struct cxl_dport **dport) { struct cxl_find_port_ctx ctx = { .dport_dev = dport_dev, @@ -1401,7 +1409,7 @@ static struct cxl_port *find_cxl_port(struct device *dport_dev, }; struct cxl_port *port; - port = __find_cxl_port(&ctx); + port = __find_cxl_port_by_dport(&ctx); return port; } @@ -1895,14 +1903,14 @@ EXPORT_SYMBOL_NS_GPL(devm_cxl_enumerate_ports, "CXL"); struct cxl_port *cxl_pci_find_port(struct pci_dev *pdev, struct cxl_dport **dport) { - return find_cxl_port(pdev->dev.parent, dport); + return find_cxl_port_by_dport(pdev->dev.parent, dport); } EXPORT_SYMBOL_NS_GPL(cxl_pci_find_port, "CXL"); struct cxl_port *cxl_mem_find_port(struct cxl_memdev *cxlmd, struct cxl_dport **dport) { - return find_cxl_port(grandparent(&cxlmd->dev), dport); + return find_cxl_port_by_dport(grandparent(&cxlmd->dev), dport); } EXPORT_SYMBOL_NS_GPL(cxl_mem_find_port, "CXL"); From d7066cfc418714e536d78a1b7b93da2a7f12d9c9 Mon Sep 17 00:00:00 2001 From: Alison Schofield Date: Tue, 4 Aug 2026 16:20:08 -0700 Subject: [PATCH 35/35] cxl/Documentation: Spell out globbed sysfs attribute names Four entries in sysfs-bus-cxl use braced globs to document groups of attributes. Where the glob factors out a common prefix, as in cap_{pmem,ram,type2,type3}, no individual attribute name appears in the file at all and none can be found by grep or get_abi.py search. In every case the glob also keys get_abi.py validate on the glob string, so duplicates against separately documented attributes go undetected. Replace the globs with consecutive What: lines for each attribute. These lines continue to share the existing metadata and description and follow the format used in sysfs-driver-ufs and sysfs-bus-iio. Also restore one missing blank line between entries. Verify with: python3 tools/docs/get_abi.py -D Documentation/ABI/testing validate python3 tools/docs/get_abi.py search cap_pmem python3 tools/docs/get_abi.py search create_ram_region validate reports no sysfs-bus-cxl warning, and both searches now return the stanza where they returned nothing before. Signed-off-by: Alison Schofield Reviewed-by: Dave Jiang Link: https://patch.msgid.link/20260804232014.2286549-1-alison.schofield@intel.com Signed-off-by: Dave Jiang --- Documentation/ABI/testing/sysfs-bus-cxl | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/Documentation/ABI/testing/sysfs-bus-cxl b/Documentation/ABI/testing/sysfs-bus-cxl index 16a9b3d2e2c0..7352dbd70bc7 100644 --- a/Documentation/ABI/testing/sysfs-bus-cxl +++ b/Documentation/ABI/testing/sysfs-bus-cxl @@ -201,7 +201,8 @@ Description: capability. -What: /sys/bus/cxl/devices/{port,endpoint}X/parent_dport +What: /sys/bus/cxl/devices/portX/parent_dport +What: /sys/bus/cxl/devices/endpointX/parent_dport Date: January, 2023 KernelVersion: v6.3 Contact: linux-cxl@vger.kernel.org @@ -258,7 +259,8 @@ Description: instance id of a given decoder resource. -What: /sys/bus/cxl/devices/decoderX.Y/{start,size} +What: /sys/bus/cxl/devices/decoderX.Y/start +What: /sys/bus/cxl/devices/decoderX.Y/size Date: June, 2021 KernelVersion: v5.14 Contact: linux-cxl@vger.kernel.org @@ -297,7 +299,10 @@ Description: Each entry in the list is a dport id. -What: /sys/bus/cxl/devices/decoderX.Y/cap_{pmem,ram,type2,type3} +What: /sys/bus/cxl/devices/decoderX.Y/cap_pmem +What: /sys/bus/cxl/devices/decoderX.Y/cap_ram +What: /sys/bus/cxl/devices/decoderX.Y/cap_type2 +What: /sys/bus/cxl/devices/decoderX.Y/cap_type3 Date: June, 2021 KernelVersion: v5.14 Contact: linux-cxl@vger.kernel.org @@ -410,7 +415,8 @@ Description: interleave_granularity). -What: /sys/bus/cxl/devices/decoderX.Y/create_{pmem,ram}_region +What: /sys/bus/cxl/devices/decoderX.Y/create_pmem_region +What: /sys/bus/cxl/devices/decoderX.Y/create_ram_region Date: May, 2022, January, 2023 KernelVersion: v6.0 (pmem), v6.3 (ram) Contact: linux-cxl@vger.kernel.org @@ -500,6 +506,7 @@ Description: cache is present, the size indicates extended linear cache size plus the CXL region size. + What: /sys/bus/cxl/devices/regionZ/extended_linear_cache_size Date: October, 2025 KernelVersion: v6.19