* [PATCH v9 01/11] cxl: Split decoder programming into a reusable helper
2026-07-09 1:02 [PATCH v9 00/11] PCI/CXL: Add CXL reset support for Type 2 devices Srirangan Madhavan
@ 2026-07-09 1:02 ` Srirangan Madhavan
2026-07-09 1:14 ` sashiko-bot
2026-07-15 13:49 ` Alejandro Lucero Palau
2026-07-09 1:02 ` [PATCH v9 02/11] cxl: Cache decoder settings on PCI devices Srirangan Madhavan
` (10 subsequent siblings)
11 siblings, 2 replies; 28+ messages in thread
From: Srirangan Madhavan @ 2026-07-09 1:02 UTC (permalink / raw)
To: Alison Schofield, Bjorn Helgaas, Dan Williams, Dave Jiang,
Davidlohr Bueso, Jonathan Cameron, Vishal Verma, linux-cxl,
linux-pci, linux-kernel
Cc: Alex Williamson, vsethi, alwilliamson, Dan Williams,
Sai Yashwanth Reddy Kancherla, Vishal Aslot, Manish Honap,
Jiandi An, Richard Cheng, linux-tegra, Srirangan Madhavan
Move common HDM decoder settings to include/cxl/cxl.h and route the
register programming sequence through cxl_commit(). This lets reset code
restore cached HDM state without depending on private cxl_core types while
keeping hdm.c in charge of the existing commit policy checks.
Build the low-level HDM helper under CONFIG_CXL_HDM so it is available even
when cxl_core is modular.
Signed-off-by: Srirangan Madhavan <smadhavan@nvidia.com>
---
drivers/cxl/Kconfig | 4 ++
drivers/cxl/core/Makefile | 1 +
drivers/cxl/core/hdm.c | 122 ++++-------------------------------
drivers/cxl/core/region.c | 6 +-
drivers/cxl/core/reset.c | 118 +++++++++++++++++++++++++++++++++
drivers/cxl/cxl.h | 43 ------------
include/cxl/cxl.h | 55 +++++++++++++++-
tools/testing/cxl/test/cxl.c | 10 +--
8 files changed, 197 insertions(+), 162 deletions(-)
create mode 100644 drivers/cxl/core/reset.c
diff --git a/drivers/cxl/Kconfig b/drivers/cxl/Kconfig
index 80aeb0d556bd..87d719ea1e14 100644
--- a/drivers/cxl/Kconfig
+++ b/drivers/cxl/Kconfig
@@ -6,6 +6,7 @@ menuconfig CXL_BUS
select FW_UPLOAD
select PCI_DOE
select FIRMWARE_TABLE
+ select CXL_HDM
select NUMA_KEEP_MEMINFO if NUMA_MEMBLKS
select FWCTL if CXL_FEATURES
help
@@ -243,4 +244,7 @@ config CXL_ATL
depends on CXL_REGION
depends on ACPI_PRMT && AMD_NB
+config CXL_HDM
+ bool
+
endif
diff --git a/drivers/cxl/core/Makefile b/drivers/cxl/core/Makefile
index ce7213818d3c..dc075cee0450 100644
--- a/drivers/cxl/core/Makefile
+++ b/drivers/cxl/core/Makefile
@@ -1,5 +1,6 @@
# SPDX-License-Identifier: GPL-2.0
obj-$(CONFIG_CXL_BUS) += cxl_core.o
+obj-$(CONFIG_CXL_HDM) += reset.o
obj-$(CONFIG_CXL_SUSPEND) += suspend.o
ccflags-y += -I$(srctree)/drivers/cxl
diff --git a/drivers/cxl/core/hdm.c b/drivers/cxl/core/hdm.c
index 0c80b76a5f9b..fa978c297546 100644
--- a/drivers/cxl/core/hdm.c
+++ b/drivers/cxl/core/hdm.c
@@ -16,11 +16,6 @@
* for enumerating these registers and capabilities.
*/
-struct cxl_rwsem cxl_rwsem = {
- .region = __RWSEM_INITIALIZER(cxl_rwsem.region),
- .dpa = __RWSEM_INITIALIZER(cxl_rwsem.dpa),
-};
-
static int add_hdm_decoder(struct cxl_port *port, struct cxl_decoder *cxld)
{
int rc;
@@ -255,11 +250,11 @@ static void __cxl_dpa_release(struct cxl_endpoint_decoder *cxled)
lockdep_assert_held_write(&cxl_rwsem.dpa);
/* save @skip_start, before @res is released */
- skip_start = res->start - cxled->skip;
+ skip_start = res->start - cxled->cxld.skip;
__release_region(&cxlds->dpa_res, res->start, resource_size(res));
- if (cxled->skip)
- release_skip(cxlds, skip_start, cxled->skip);
- cxled->skip = 0;
+ if (cxled->cxld.skip)
+ release_skip(cxlds, skip_start, cxled->cxld.skip);
+ cxled->cxld.skip = 0;
cxled->dpa_res = NULL;
put_device(&cxled->cxld.dev);
port->hdm_end--;
@@ -388,7 +383,7 @@ static int __cxl_dpa_reserve(struct cxl_endpoint_decoder *cxled,
return -EBUSY;
}
cxled->dpa_res = res;
- cxled->skip = skipped;
+ cxled->cxld.skip = skipped;
/*
* When allocating new capacity, ->part is already set, when
@@ -679,35 +674,6 @@ int cxl_dpa_alloc(struct cxl_endpoint_decoder *cxled, u64 size)
return devm_add_action_or_reset(&port->dev, cxl_dpa_release, cxled);
}
-static void cxld_set_interleave(struct cxl_decoder *cxld, u32 *ctrl)
-{
- u16 eig;
- u8 eiw;
-
- /*
- * Input validation ensures these warns never fire, but otherwise
- * suppress unititalized variable usage warnings.
- */
- if (WARN_ONCE(ways_to_eiw(cxld->interleave_ways, &eiw),
- "invalid interleave_ways: %d\n", cxld->interleave_ways))
- return;
- if (WARN_ONCE(granularity_to_eig(cxld->interleave_granularity, &eig),
- "invalid interleave_granularity: %d\n",
- cxld->interleave_granularity))
- return;
-
- u32p_replace_bits(ctrl, eig, CXL_HDM_DECODER0_CTRL_IG_MASK);
- u32p_replace_bits(ctrl, eiw, CXL_HDM_DECODER0_CTRL_IW_MASK);
- *ctrl |= CXL_HDM_DECODER0_CTRL_COMMIT;
-}
-
-static void cxld_set_type(struct cxl_decoder *cxld, u32 *ctrl)
-{
- u32p_replace_bits(ctrl,
- !!(cxld->target_type == CXL_DECODER_HOSTONLYMEM),
- CXL_HDM_DECODER0_CTRL_HOSTONLY);
-}
-
static void cxlsd_set_targets(struct cxl_switch_decoder *cxlsd, u64 *tgt)
{
struct cxl_dport **t = &cxlsd->target[0];
@@ -730,73 +696,6 @@ static void cxlsd_set_targets(struct cxl_switch_decoder *cxlsd, u64 *tgt)
*tgt |= FIELD_PREP(GENMASK_ULL(63, 56), t[7]->port_id);
}
-/*
- * Per CXL 2.0 8.2.5.12.20 Committing Decoder Programming, hardware must set
- * committed or error within 10ms, but just be generous with 20ms to account for
- * clock skew and other marginal behavior
- */
-#define COMMIT_TIMEOUT_MS 20
-static int cxld_await_commit(void __iomem *hdm, int id)
-{
- u32 ctrl;
- int i;
-
- for (i = 0; i < COMMIT_TIMEOUT_MS; i++) {
- ctrl = readl(hdm + CXL_HDM_DECODER0_CTRL_OFFSET(id));
- if (FIELD_GET(CXL_HDM_DECODER0_CTRL_COMMIT_ERROR, ctrl)) {
- ctrl &= ~CXL_HDM_DECODER0_CTRL_COMMIT;
- writel(ctrl, hdm + CXL_HDM_DECODER0_CTRL_OFFSET(id));
- return -EIO;
- }
- if (FIELD_GET(CXL_HDM_DECODER0_CTRL_COMMITTED, ctrl))
- return 0;
- fsleep(1000);
- }
-
- return -ETIMEDOUT;
-}
-
-static void setup_hw_decoder(struct cxl_decoder *cxld, void __iomem *hdm)
-{
- int id = cxld->id;
- u64 base, size;
- u32 ctrl;
-
- /* common decoder settings */
- ctrl = readl(hdm + CXL_HDM_DECODER0_CTRL_OFFSET(cxld->id));
- cxld_set_interleave(cxld, &ctrl);
- cxld_set_type(cxld, &ctrl);
- base = cxld->hpa_range.start;
- size = range_len(&cxld->hpa_range);
-
- writel(upper_32_bits(base), hdm + CXL_HDM_DECODER0_BASE_HIGH_OFFSET(id));
- writel(lower_32_bits(base), hdm + CXL_HDM_DECODER0_BASE_LOW_OFFSET(id));
- writel(upper_32_bits(size), hdm + CXL_HDM_DECODER0_SIZE_HIGH_OFFSET(id));
- writel(lower_32_bits(size), hdm + CXL_HDM_DECODER0_SIZE_LOW_OFFSET(id));
-
- if (is_switch_decoder(&cxld->dev)) {
- struct cxl_switch_decoder *cxlsd =
- to_cxl_switch_decoder(&cxld->dev);
- void __iomem *tl_hi = hdm + CXL_HDM_DECODER0_TL_HIGH(id);
- void __iomem *tl_lo = hdm + CXL_HDM_DECODER0_TL_LOW(id);
- u64 targets;
-
- cxlsd_set_targets(cxlsd, &targets);
- writel(upper_32_bits(targets), tl_hi);
- writel(lower_32_bits(targets), tl_lo);
- } else {
- struct cxl_endpoint_decoder *cxled =
- to_cxl_endpoint_decoder(&cxld->dev);
- void __iomem *sk_hi = hdm + CXL_HDM_DECODER0_SKIP_HIGH(id);
- void __iomem *sk_lo = hdm + CXL_HDM_DECODER0_SKIP_LOW(id);
-
- writel(upper_32_bits(cxled->skip), sk_hi);
- writel(lower_32_bits(cxled->skip), sk_lo);
- }
-
- writel(ctrl, hdm + CXL_HDM_DECODER0_CTRL_OFFSET(id));
-}
-
static int cxl_decoder_commit(struct cxl_decoder *cxld)
{
struct cxl_port *port = to_cxl_port(cxld->dev.parent);
@@ -834,17 +733,20 @@ static int cxl_decoder_commit(struct cxl_decoder *cxld)
}
}
- scoped_guard(rwsem_read, &cxl_rwsem.dpa)
- setup_hw_decoder(cxld, hdm);
+ if (is_switch_decoder(&cxld->dev)) {
+ struct cxl_switch_decoder *cxlsd =
+ to_cxl_switch_decoder(&cxld->dev);
+
+ cxlsd_set_targets(cxlsd, &cxld->targets);
+ }
- rc = cxld_await_commit(hdm, cxld->id);
+ rc = cxl_commit(&cxld->settings, hdm);
if (rc) {
dev_dbg(&port->dev, "%s: error %d committing decoder\n",
dev_name(&cxld->dev), rc);
return rc;
}
port->commit_end++;
- cxld->flags |= CXL_DECODER_F_ENABLE;
return 0;
}
diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c
index 1e211542b6b6..468cca014c94 100644
--- a/drivers/cxl/core/region.c
+++ b/drivers/cxl/core/region.c
@@ -2963,9 +2963,9 @@ static int poison_by_decoder(struct device *dev, void *arg)
cxlds = cxlmd->cxlds;
mode = cxlds->part[cxled->part].mode;
- if (cxled->skip) {
- offset = cxled->dpa_res->start - cxled->skip;
- length = cxled->skip;
+ if (cxled->cxld.skip) {
+ offset = cxled->dpa_res->start - cxled->cxld.skip;
+ length = cxled->cxld.skip;
rc = cxl_mem_get_poison(cxlmd, offset, length, NULL);
if (rc == -EFAULT && mode == CXL_PARTMODE_RAM)
rc = 0;
diff --git a/drivers/cxl/core/reset.c b/drivers/cxl/core/reset.c
new file mode 100644
index 000000000000..14f024098e82
--- /dev/null
+++ b/drivers/cxl/core/reset.c
@@ -0,0 +1,118 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/* Copyright(c) 2026 NVIDIA Corporation. All rights reserved. */
+#include <linux/delay.h>
+#include <linux/bug.h>
+#include <linux/errno.h>
+#include <linux/export.h>
+#include <linux/kernel.h>
+
+#include "cxl.h"
+#include "core.h"
+
+struct cxl_rwsem cxl_rwsem = {
+ .region = __RWSEM_INITIALIZER(cxl_rwsem.region),
+ .dpa = __RWSEM_INITIALIZER(cxl_rwsem.dpa),
+};
+EXPORT_SYMBOL_FOR_MODULES(cxl_rwsem, "cxl_core");
+
+static void cxld_set_interleave(struct cxl_decoder_settings *settings, u32 *ctrl)
+{
+ u16 eig;
+ u8 eiw;
+
+ /*
+ * Input validation ensures these warns never fire, but otherwise
+ * suppress uninitialized variable usage warnings.
+ */
+ if (WARN_ONCE(ways_to_eiw(settings->interleave_ways, &eiw),
+ "invalid interleave_ways: %d\n",
+ settings->interleave_ways))
+ return;
+ if (WARN_ONCE(granularity_to_eig(settings->interleave_granularity, &eig),
+ "invalid interleave_granularity: %d\n",
+ settings->interleave_granularity))
+ return;
+
+ u32p_replace_bits(ctrl, eig, CXL_HDM_DECODER0_CTRL_IG_MASK);
+ u32p_replace_bits(ctrl, eiw, CXL_HDM_DECODER0_CTRL_IW_MASK);
+ *ctrl |= CXL_HDM_DECODER0_CTRL_COMMIT;
+}
+
+static void cxld_set_type(struct cxl_decoder_settings *settings, u32 *ctrl)
+{
+ u32p_replace_bits(ctrl,
+ !!(settings->target_type == CXL_DECODER_HOSTONLYMEM),
+ CXL_HDM_DECODER0_CTRL_HOSTONLY);
+}
+
+/*
+ * Per CXL 2.0 8.2.5.12.20 Committing Decoder Programming, hardware must set
+ * committed or error within 10ms, but just be generous with 20ms to account for
+ * clock skew and other marginal behavior.
+ */
+#define COMMIT_TIMEOUT_MS 20
+static int cxld_await_commit(void __iomem *hdm, int id)
+{
+ u32 ctrl;
+ int i;
+
+ for (i = 0; i < COMMIT_TIMEOUT_MS; i++) {
+ ctrl = readl(hdm + CXL_HDM_DECODER0_CTRL_OFFSET(id));
+ if (FIELD_GET(CXL_HDM_DECODER0_CTRL_COMMIT_ERROR, ctrl)) {
+ ctrl &= ~CXL_HDM_DECODER0_CTRL_COMMIT;
+ writel(ctrl, hdm + CXL_HDM_DECODER0_CTRL_OFFSET(id));
+ return -EIO;
+ }
+ if (FIELD_GET(CXL_HDM_DECODER0_CTRL_COMMITTED, ctrl))
+ return 0;
+ fsleep(1000);
+ }
+
+ return -ETIMEDOUT;
+}
+
+static void setup_hw_decoder(struct cxl_decoder_settings *settings,
+ void __iomem *hdm)
+{
+ int id = settings->id;
+ u64 target_or_skip;
+ u64 base, size;
+ u32 ctrl;
+
+ ctrl = readl(hdm + CXL_HDM_DECODER0_CTRL_OFFSET(id));
+ cxld_set_interleave(settings, &ctrl);
+ cxld_set_type(settings, &ctrl);
+ base = settings->hpa_range.start;
+ size = range_len(&settings->hpa_range);
+ target_or_skip = settings->targets;
+
+ writel(upper_32_bits(base), hdm + CXL_HDM_DECODER0_BASE_HIGH_OFFSET(id));
+ writel(lower_32_bits(base), hdm + CXL_HDM_DECODER0_BASE_LOW_OFFSET(id));
+ writel(upper_32_bits(size), hdm + CXL_HDM_DECODER0_SIZE_HIGH_OFFSET(id));
+ writel(lower_32_bits(size), hdm + CXL_HDM_DECODER0_SIZE_LOW_OFFSET(id));
+ /* Target-list and endpoint-skip registers alias the same slot. */
+ writel(upper_32_bits(target_or_skip),
+ hdm + CXL_HDM_DECODER0_TL_HIGH(id));
+ writel(lower_32_bits(target_or_skip),
+ hdm + CXL_HDM_DECODER0_TL_LOW(id));
+
+ writel(ctrl, hdm + CXL_HDM_DECODER0_CTRL_OFFSET(id));
+}
+
+int cxl_commit(struct cxl_decoder_settings *settings, void __iomem *hdm)
+{
+ int rc;
+
+ scoped_guard(rwsem_read, &cxl_rwsem.dpa) {
+ setup_hw_decoder(settings, hdm);
+ }
+
+ rc = cxld_await_commit(hdm, settings->id);
+ if (rc)
+ return rc;
+
+ settings->flags |= CXL_DECODER_F_ENABLE;
+
+ return 0;
+}
+EXPORT_SYMBOL_FOR_MODULES(cxl_commit, "cxl_core");
diff --git a/drivers/cxl/cxl.h b/drivers/cxl/cxl.h
index c0e5308e4d1b..e995f189cad7 100644
--- a/drivers/cxl/cxl.h
+++ b/drivers/cxl/cxl.h
@@ -264,49 +264,8 @@ int cxl_dport_map_rcd_linkcap(struct pci_dev *pdev, struct cxl_dport *dport);
#define CXL_DECODER_F_NORMALIZED_ADDRESSING BIT(6)
#define CXL_DECODER_F_RESET_MASK (CXL_DECODER_F_ENABLE | CXL_DECODER_F_LOCK)
-enum cxl_decoder_type {
- CXL_DECODER_DEVMEM = 2,
- CXL_DECODER_HOSTONLYMEM = 3,
-};
-
-/*
- * Current specification goes up to 8, double that seems a reasonable
- * software max for the foreseeable future
- */
-#define CXL_DECODER_MAX_INTERLEAVE 16
-
#define CXL_QOS_CLASS_INVALID -1
-/**
- * struct cxl_decoder - Common CXL HDM Decoder Attributes
- * @dev: this decoder's device
- * @id: kernel device name id
- * @hpa_range: Host physical address range mapped by this decoder
- * @interleave_ways: number of cxl_dports in this decode
- * @interleave_granularity: data stride per dport
- * @target_type: accelerator vs expander (type2 vs type3) selector
- * @region: currently assigned region for this decoder
- * @flags: memory type capabilities and locking
- * @target_map: cached copy of hardware port-id list, available at init
- * before all @dport objects have been instantiated. While
- * dport id is 8bit, CFMWS interleave targets are 32bits.
- * @commit: device/decoder-type specific callback to commit settings to hw
- * @reset: device/decoder-type specific callback to reset hw settings
-*/
-struct cxl_decoder {
- struct device dev;
- int id;
- struct range hpa_range;
- int interleave_ways;
- int interleave_granularity;
- enum cxl_decoder_type target_type;
- struct cxl_region *region;
- unsigned long flags;
- u32 target_map[CXL_DECODER_MAX_INTERLEAVE];
- int (*commit)(struct cxl_decoder *cxld);
- void (*reset)(struct cxl_decoder *cxld);
-};
-
/*
* Track whether this decoder is free for userspace provisioning, reserved for
* region autodiscovery, whether it is started connecting (awaiting other
@@ -322,7 +281,6 @@ enum cxl_decoder_state {
* struct cxl_endpoint_decoder - Endpoint / SPA to DPA decoder
* @cxld: base cxl_decoder_object
* @dpa_res: actively claimed DPA span of this decoder
- * @skip: offset into @dpa_res where @cxld.hpa_range maps
* @state: autodiscovery state
* @part: partition index this decoder maps
* @pos: interleave position in @cxld.region
@@ -330,7 +288,6 @@ enum cxl_decoder_state {
struct cxl_endpoint_decoder {
struct cxl_decoder cxld;
struct resource *dpa_res;
- resource_size_t skip;
enum cxl_decoder_state state;
int part;
int pos;
diff --git a/include/cxl/cxl.h b/include/cxl/cxl.h
index 016c74fb747c..757d916a6330 100644
--- a/include/cxl/cxl.h
+++ b/include/cxl/cxl.h
@@ -5,8 +5,10 @@
#ifndef __CXL_CXL_H__
#define __CXL_CXL_H__
+#include <linux/device.h>
#include <linux/node.h>
#include <linux/ioport.h>
+#include <linux/range.h>
#include <cxl/mailbox.h>
/**
@@ -23,7 +25,56 @@ enum cxl_devtype {
CXL_DEVTYPE_CLASSMEM,
};
-struct device;
+struct cxl_region;
+
+enum cxl_decoder_type {
+ CXL_DECODER_DEVMEM = 2,
+ CXL_DECODER_HOSTONLYMEM = 3,
+};
+
+/*
+ * Current specification goes up to 8, double that seems a reasonable
+ * software max for the foreseeable future
+ */
+#define CXL_DECODER_MAX_INTERLEAVE 16
+
+/**
+ * struct cxl_decoder - Common CXL HDM Decoder Attributes
+ * @dev: this decoder's device
+ * @id: kernel device name id
+ * @hpa_range: Host physical address range mapped by this decoder
+ * @skip: offset into @dpa_res where @cxld.hpa_range maps (endpoint)
+ * @targets: interleave position to dport mapping (switch)
+ * @interleave_ways: number of cxl_dports in this decode
+ * @interleave_granularity: data stride per dport
+ * @target_type: accelerator vs expander (type2 vs type3) selector
+ * @flags: memory type capabilities and locking
+ * @region: currently assigned region for this decoder
+ * @target_map: cached copy of hardware port-id list, available at init
+ * before all @dport objects have been instantiated. While
+ * dport id is 8bit, CFMWS interleave targets are 32bits.
+ * @commit: device/decoder-type specific callback to commit settings to hw
+ * @reset: device/decoder-type specific callback to reset hw settings
+ */
+struct cxl_decoder {
+ struct device dev;
+
+ struct_group_tagged(cxl_decoder_settings, settings, int id;
+ struct range hpa_range;
+ union {
+ u64 skip;
+ u64 targets;
+ };
+ int interleave_ways;
+ int interleave_granularity;
+ enum cxl_decoder_type target_type;
+ unsigned long flags;
+ );
+ struct cxl_region *region;
+ u32 target_map[CXL_DECODER_MAX_INTERLEAVE];
+ int (*commit)(struct cxl_decoder *cxld);
+ void (*reset)(struct cxl_decoder *cxld);
+};
/*
* Using struct_group() allows for per register-block-type helper routines,
@@ -70,6 +121,8 @@ struct cxl_regs {
);
};
+int cxl_commit(struct cxl_decoder_settings *settings, void __iomem *hdm);
+
struct cxl_reg_map {
bool valid;
int id;
diff --git a/tools/testing/cxl/test/cxl.c b/tools/testing/cxl/test/cxl.c
index ef92dd35e030..589a9bf8c96f 100644
--- a/tools/testing/cxl/test/cxl.c
+++ b/tools/testing/cxl/test/cxl.c
@@ -847,11 +847,11 @@ static int cxld_registry_restore(struct cxl_decoder *cxld,
dbg_cxld(port, "restore", &td->cxled.cxld);
cxld_copy(cxld, &td->cxled.cxld);
cxled->state = td->cxled.state;
- cxled->skip = td->cxled.skip;
+ cxld->skip = td->cxled.cxld.skip;
if (range_len(&td->dpa_range)) {
rc = devm_cxl_dpa_reserve(cxled, td->dpa_range.start,
range_len(&td->dpa_range),
- td->cxled.skip);
+ td->cxled.cxld.skip);
if (rc) {
init_disabled_mock_decoder(cxld);
return rc;
@@ -889,7 +889,7 @@ static void __cxld_registry_save(struct cxl_test_decoder *td,
cxld_copy(&td->cxled.cxld, cxld);
td->cxled.state = cxled->state;
- td->cxled.skip = cxled->skip;
+ td->cxled.cxld.skip = cxled->cxld.skip;
if (!(cxld->flags & CXL_DECODER_F_ENABLE)) {
td->dpa_range.start = 0;
@@ -977,7 +977,7 @@ static void mock_decoder_reset(struct cxl_decoder *cxld)
to_cxl_endpoint_decoder(&cxld->dev);
cxled->state = CXL_DECODER_STATE_MANUAL;
- cxled->skip = 0;
+ cxled->cxld.skip = 0;
}
if (decoder_reset_preserve_registry)
dev_dbg(port->uport_dev, "decoder%d: skip registry update\n",
@@ -1028,7 +1028,7 @@ static void init_disabled_mock_decoder(struct cxl_decoder *cxld)
to_cxl_endpoint_decoder(&cxld->dev);
cxled->state = CXL_DECODER_STATE_MANUAL;
- cxled->skip = 0;
+ cxled->cxld.skip = 0;
}
}
--
2.43.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* Re: [PATCH v9 01/11] cxl: Split decoder programming into a reusable helper
2026-07-09 1:02 ` [PATCH v9 01/11] cxl: Split decoder programming into a reusable helper Srirangan Madhavan
@ 2026-07-09 1:14 ` sashiko-bot
2026-07-15 13:49 ` Alejandro Lucero Palau
1 sibling, 0 replies; 28+ messages in thread
From: sashiko-bot @ 2026-07-09 1:14 UTC (permalink / raw)
To: Srirangan Madhavan; +Cc: linux-pci, linux-cxl
> Move common HDM decoder settings to include/cxl/cxl.h and route the
> register programming sequence through cxl_commit(). This lets reset code
> restore cached HDM state without depending on private cxl_core types while
> keeping hdm.c in charge of the existing commit policy checks.
>
> Build the low-level HDM helper under CONFIG_CXL_HDM so it is available even
> when cxl_core is modular.
>
> Signed-off-by: Srirangan Madhavan <smadhavan@nvidia.com>
Sashiko has reviewed this patch and found no issues. It looks great!
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260709010304.680422-1-smadhavan@nvidia.com?part=1
^ permalink raw reply [flat|nested] 28+ messages in thread
* Re: [PATCH v9 01/11] cxl: Split decoder programming into a reusable helper
2026-07-09 1:02 ` [PATCH v9 01/11] cxl: Split decoder programming into a reusable helper Srirangan Madhavan
2026-07-09 1:14 ` sashiko-bot
@ 2026-07-15 13:49 ` Alejandro Lucero Palau
1 sibling, 0 replies; 28+ messages in thread
From: Alejandro Lucero Palau @ 2026-07-15 13:49 UTC (permalink / raw)
To: Srirangan Madhavan, Alison Schofield, Bjorn Helgaas, Dan Williams,
Dave Jiang, Davidlohr Bueso, Jonathan Cameron, Vishal Verma,
linux-cxl, linux-pci, linux-kernel
Cc: Alex Williamson, vsethi, alwilliamson, Dan Williams,
Sai Yashwanth Reddy Kancherla, Vishal Aslot, Manish Honap,
Jiandi An, Richard Cheng, linux-tegra
On 7/9/26 02:02, Srirangan Madhavan wrote:
> Move common HDM decoder settings to include/cxl/cxl.h and route the
> register programming sequence through cxl_commit(). This lets reset code
> restore cached HDM state without depending on private cxl_core types while
> keeping hdm.c in charge of the existing commit policy checks.
>
> Build the low-level HDM helper under CONFIG_CXL_HDM so it is available even
> when cxl_core is modular.
>
> Signed-off-by: Srirangan Madhavan <smadhavan@nvidia.com>
> ---
> drivers/cxl/Kconfig | 4 ++
> drivers/cxl/core/Makefile | 1 +
> drivers/cxl/core/hdm.c | 122 ++++-------------------------------
> drivers/cxl/core/region.c | 6 +-
> drivers/cxl/core/reset.c | 118 +++++++++++++++++++++++++++++++++
> drivers/cxl/cxl.h | 43 ------------
> include/cxl/cxl.h | 55 +++++++++++++++-
> tools/testing/cxl/test/cxl.c | 10 +--
> 8 files changed, 197 insertions(+), 162 deletions(-)
> create mode 100644 drivers/cxl/core/reset.c
<snip>
> /*
> * Track whether this decoder is free for userspace provisioning, reserved for
> * region autodiscovery, whether it is started connecting (awaiting other
> @@ -322,7 +281,6 @@ enum cxl_decoder_state {
> * struct cxl_endpoint_decoder - Endpoint / SPA to DPA decoder
> * @cxld: base cxl_decoder_object
> * @dpa_res: actively claimed DPA span of this decoder
> - * @skip: offset into @dpa_res where @cxld.hpa_range maps
> * @state: autodiscovery state
> * @part: partition index this decoder maps
> * @pos: interleave position in @cxld.region
> @@ -330,7 +288,6 @@ enum cxl_decoder_state {
> struct cxl_endpoint_decoder {
> struct cxl_decoder cxld;
> struct resource *dpa_res;
> - resource_size_t skip;
I understand this change moving skip to the cxl_decoder struct, but I do
not undertand why dpa_res is not moved as well since skip refers to an
offset inside dpa_res. Doesn't it?
If I am right this assumes only one decoder and mapping all the DPA. Is
this the intention?
^ permalink raw reply [flat|nested] 28+ messages in thread
* [PATCH v9 02/11] cxl: Cache decoder settings on PCI devices
2026-07-09 1:02 [PATCH v9 00/11] PCI/CXL: Add CXL reset support for Type 2 devices Srirangan Madhavan
2026-07-09 1:02 ` [PATCH v9 01/11] cxl: Split decoder programming into a reusable helper Srirangan Madhavan
@ 2026-07-09 1:02 ` Srirangan Madhavan
2026-07-09 1:16 ` sashiko-bot
2026-07-09 1:02 ` [PATCH v9 03/11] cxl: Share HDM decoder decode logic Srirangan Madhavan
` (9 subsequent siblings)
11 siblings, 1 reply; 28+ messages in thread
From: Srirangan Madhavan @ 2026-07-09 1:02 UTC (permalink / raw)
To: Alison Schofield, Bjorn Helgaas, Dan Williams, Dave Jiang,
Davidlohr Bueso, Jonathan Cameron, Vishal Verma, linux-cxl,
linux-pci, linux-kernel
Cc: Alex Williamson, vsethi, alwilliamson, Dan Williams,
Sai Yashwanth Reddy Kancherla, Vishal Aslot, Manish Honap,
Jiandi An, Richard Cheng, linux-tegra, Srirangan Madhavan
Cache CXL core's HDM decoder settings in pci_dev->hdm as decoders are
enumerated, committed, or reset. PCI reset paths can use this snapshot to
restore HDM programming without walking CXL topology during reset recovery.
Signed-off-by: Srirangan Madhavan <smadhavan@nvidia.com>
---
drivers/cxl/core/hdm.c | 81 +++++++++++++++++++++++++++++++++++++++++-
include/cxl/cxl.h | 12 +++++++
include/linux/pci.h | 6 ++++
3 files changed, 98 insertions(+), 1 deletion(-)
diff --git a/drivers/cxl/core/hdm.c b/drivers/cxl/core/hdm.c
index fa978c297546..83cda63f76a5 100644
--- a/drivers/cxl/core/hdm.c
+++ b/drivers/cxl/core/hdm.c
@@ -84,6 +84,76 @@ static void parse_hdm_decoder_caps(struct cxl_hdm *cxlhdm)
cxlhdm->iw_cap_mask |= BIT(16);
}
+static void clear_hdm_info(void *data)
+{
+ struct pci_dev *pdev = data;
+
+ WRITE_ONCE(pdev->hdm, NULL);
+}
+
+static int devm_cxl_pci_setup_hdm_info(struct cxl_hdm *cxlhdm)
+{
+ struct cxl_port *port = cxlhdm->port;
+ struct cxl_hdm_info *info;
+ struct pci_dev *pdev;
+ struct device *uport;
+
+ if (is_cxl_endpoint(port)) {
+ struct cxl_memdev *cxlmd = to_cxl_memdev(port->uport_dev);
+
+ uport = cxlmd->dev.parent;
+ } else {
+ uport = port->uport_dev;
+ }
+
+ if (!dev_is_pci(uport))
+ return 0;
+
+ pdev = to_pci_dev(uport);
+ info = devm_kzalloc(&pdev->dev,
+ struct_size(info, settings, cxlhdm->decoder_count),
+ GFP_KERNEL);
+ if (!info)
+ return -ENOMEM;
+
+ info->decoder_count = cxlhdm->decoder_count;
+ WRITE_ONCE(pdev->hdm, info);
+
+ return devm_add_action_or_reset(&pdev->dev, clear_hdm_info, pdev);
+}
+
+static void cxl_hdm_info_set_decoder(struct cxl_hdm *cxlhdm,
+ struct cxl_decoder *cxld)
+{
+ struct cxl_port *port = cxlhdm->port;
+ struct cxl_hdm_info *info;
+ struct pci_dev *pdev;
+ struct device *uport;
+
+ if (is_cxl_endpoint(port)) {
+ struct cxl_memdev *cxlmd = to_cxl_memdev(port->uport_dev);
+
+ uport = cxlmd->dev.parent;
+ } else {
+ uport = port->uport_dev;
+ }
+
+ if (!dev_is_pci(uport))
+ return;
+
+ pdev = to_pci_dev(uport);
+ info = READ_ONCE(pdev->hdm);
+ if (!info || cxld->id >= info->decoder_count)
+ return;
+
+ if (cxld->flags & CXL_DECODER_F_ENABLE)
+ info->settings[cxld->id] = cxld->settings;
+ else
+ info->settings[cxld->id] = (struct cxl_decoder_settings) {
+ .id = cxld->id,
+ };
+}
+
static bool should_emulate_decoders(struct cxl_endpoint_dvsec_info *info)
{
struct cxl_hdm *cxlhdm;
@@ -747,6 +817,7 @@ static int cxl_decoder_commit(struct cxl_decoder *cxld)
return rc;
}
port->commit_end++;
+ cxl_hdm_info_set_decoder(cxlhdm, cxld);
return 0;
}
@@ -819,6 +890,7 @@ static void cxl_decoder_reset(struct cxl_decoder *cxld)
writel(0, hdm + CXL_HDM_DECODER0_BASE_LOW_OFFSET(id));
cxld->flags &= ~CXL_DECODER_F_ENABLE;
+ cxl_hdm_info_set_decoder(cxlhdm, cxld);
/* Userspace is now responsible for reconfiguring this decoder */
if (is_endpoint_decoder(&cxld->dev)) {
@@ -989,6 +1061,7 @@ static int init_hdm_decoder(struct cxl_port *port, struct cxl_decoder *cxld,
lo = readl(hdm + CXL_HDM_DECODER0_TL_LOW(which));
hi = readl(hdm + CXL_HDM_DECODER0_TL_HIGH(which));
target_list.value = (hi << 32) + lo;
+ cxld->targets = target_list.value;
for (i = 0; i < cxld->interleave_ways; i++)
cxld->target_map[i] = target_list.target_id[i];
@@ -1062,11 +1135,16 @@ static int devm_cxl_enumerate_decoders(struct cxl_hdm *cxlhdm,
struct cxl_port *port = cxlhdm->port;
int i;
u64 dpa_base = 0;
+ int rc;
cxl_settle_decoders(cxlhdm);
+ rc = devm_cxl_pci_setup_hdm_info(cxlhdm);
+ if (rc)
+ return rc;
+
for (i = 0; i < cxlhdm->decoder_count; i++) {
- int rc, target_count = cxlhdm->target_count;
+ int target_count = cxlhdm->target_count;
struct cxl_decoder *cxld;
if (is_cxl_endpoint(port)) {
@@ -1101,6 +1179,7 @@ static int devm_cxl_enumerate_decoders(struct cxl_hdm *cxlhdm,
put_device(&cxld->dev);
return rc;
}
+ cxl_hdm_info_set_decoder(cxlhdm, cxld);
rc = add_hdm_decoder(port, cxld);
if (rc) {
dev_warn(&port->dev,
diff --git a/include/cxl/cxl.h b/include/cxl/cxl.h
index 757d916a6330..84924ca06e52 100644
--- a/include/cxl/cxl.h
+++ b/include/cxl/cxl.h
@@ -121,6 +121,18 @@ struct cxl_regs {
);
};
+/**
+ * struct cxl_hdm_info - PCI device HDM decoder programming cache
+ * @decoder_count: number of decoder settings entries
+ * @regs: mapped CXL component registers for this HDM decoder block
+ * @settings: cached per-decoder programming state
+ */
+struct cxl_hdm_info {
+ int decoder_count;
+ struct cxl_component_regs regs;
+ struct cxl_decoder_settings settings[] __counted_by(decoder_count);
+};
+
int cxl_commit(struct cxl_decoder_settings *settings, void __iomem *hdm);
struct cxl_reg_map {
diff --git a/include/linux/pci.h b/include/linux/pci.h
index 64b308b6e61c..a8e5cec96bae 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -335,6 +335,9 @@ struct pcie_link_state;
struct pci_sriov;
struct pci_p2pdma;
struct rcec_ea;
+#ifdef CONFIG_CXL_HDM
+struct cxl_hdm_info;
+#endif
/* struct pci_dev - describes a PCI device
*
@@ -562,6 +565,9 @@ struct pci_dev {
#ifdef CONFIG_PCI_DOE
struct xarray doe_mbs; /* Data Object Exchange mailboxes */
#endif
+#ifdef CONFIG_CXL_HDM
+ struct cxl_hdm_info *hdm; /* CXL HDM decoder reset state */
+#endif
#ifdef CONFIG_PCI_NPEM
struct npem *npem; /* Native PCIe Enclosure Management */
#endif
--
2.43.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* Re: [PATCH v9 02/11] cxl: Cache decoder settings on PCI devices
2026-07-09 1:02 ` [PATCH v9 02/11] cxl: Cache decoder settings on PCI devices Srirangan Madhavan
@ 2026-07-09 1:16 ` sashiko-bot
0 siblings, 0 replies; 28+ messages in thread
From: sashiko-bot @ 2026-07-09 1:16 UTC (permalink / raw)
To: Srirangan Madhavan; +Cc: linux-pci, linux-cxl
Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
New issues:
- [High] Resource Leak / Devres Lifecycle Bug
Pre-existing issues:
- [Critical] Out-of-bounds Read / Information Leak
- [High] Endianness / Byte Order Logic Error
--
--- Patch [2]: [PATCH v9 02/11] cxl: Cache decoder settings on PCI devices ---
commit b30e35d89911fd38d088f7e8ed1637175c1c6ae9
Author: Srirangan Madhavan <smadhavan@nvidia.com>
cxl: Cache decoder settings on PCI devices
This commit caches CXL core's HDM decoder settings in pci_dev->hdm as decoders
are enumerated, committed, or reset. PCI reset paths can use this snapshot to
restore HDM programming without walking CXL topology during reset recovery.
> diff --git a/drivers/cxl/core/hdm.c b/drivers/cxl/core/hdm.c
> index fa978c297546f..83cda63f76a5a 100644
> --- a/drivers/cxl/core/hdm.c
> +++ b/drivers/cxl/core/hdm.c
[ ... ]
> +static int devm_cxl_pci_setup_hdm_info(struct cxl_hdm *cxlhdm)
> +{
> + struct cxl_port *port = cxlhdm->port;
> + struct cxl_hdm_info *info;
> + struct pci_dev *pdev;
> + struct device *uport;
[ ... ]
> + if (!dev_is_pci(uport))
> + return 0;
> +
> + pdev = to_pci_dev(uport);
> + info = devm_kzalloc(&pdev->dev,
> + struct_size(info, settings, cxlhdm->decoder_count),
> + GFP_KERNEL);
> + if (!info)
> + return -ENOMEM;
> +
> + info->decoder_count = cxlhdm->decoder_count;
> + WRITE_ONCE(pdev->hdm, info);
> +
> + return devm_add_action_or_reset(&pdev->dev, clear_hdm_info, pdev);
> +}
[Severity: High]
Could this cause a memory leak if the CXL port driver is unbound and rebound
by a user via sysfs?
Because pdev is the long-lived parent PCI device rather than the child
cxl_port device being probed, these devres resources are tied to the
parent's lifecycle. Repeated bind/unbind cycles on the port driver could
cause the devres allocations and cleanup actions to accumulate infinitely
on the parent device.
[ ... ]
> @@ -989,6 +1061,7 @@ static int init_hdm_decoder(struct cxl_port *port, struct cxl_decoder *cxld,
> lo = readl(hdm + CXL_HDM_DECODER0_TL_LOW(which));
> hi = readl(hdm + CXL_HDM_DECODER0_TL_HIGH(which));
> target_list.value = (hi << 32) + lo;
[Severity: High]
This is a pre-existing issue, but does this byte-by-byte access of a
native 64-bit integer break on big-endian architectures?
Since hi and lo are correctly read as native 32-bit CPU-endian integers
and combined into a native 64-bit integer, accessing individual bytes via
target_list.target_id[i] on a big-endian system will place the most
significant byte at index 0. This would reverse the target IDs and result
in incorrect downstream port routing.
> + cxld->targets = target_list.value;
> for (i = 0; i < cxld->interleave_ways; i++)
> cxld->target_map[i] = target_list.target_id[i];
[Severity: Critical]
This isn't a bug introduced by this patch, but can this loop read past the
end of the 8-byte union and leak kernel stack memory?
Looking at parse_hdm_decoder_caps(), cxld->interleave_ways can be set
to 16. The target_list union is only 8 bytes long (containing an 8-byte
u64 value and an 8-byte unsigned char target_id[8]). If a device
reports a 16-way interleave, this loop will read uninitialized stack memory
from indices 8 through 15, which could then be exposed to userspace via
the sysfs target_list attribute.
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260709010304.680422-1-smadhavan@nvidia.com?part=2
^ permalink raw reply [flat|nested] 28+ messages in thread
* [PATCH v9 03/11] cxl: Share HDM decoder decode logic
2026-07-09 1:02 [PATCH v9 00/11] PCI/CXL: Add CXL reset support for Type 2 devices Srirangan Madhavan
2026-07-09 1:02 ` [PATCH v9 01/11] cxl: Split decoder programming into a reusable helper Srirangan Madhavan
2026-07-09 1:02 ` [PATCH v9 02/11] cxl: Cache decoder settings on PCI devices Srirangan Madhavan
@ 2026-07-09 1:02 ` Srirangan Madhavan
2026-07-09 1:18 ` sashiko-bot
2026-07-09 1:02 ` [PATCH v9 04/11] cxl: Cache endpoint decoder settings during PCI enumeration Srirangan Madhavan
` (8 subsequent siblings)
11 siblings, 1 reply; 28+ messages in thread
From: Srirangan Madhavan @ 2026-07-09 1:02 UTC (permalink / raw)
To: Alison Schofield, Bjorn Helgaas, Dan Williams, Dave Jiang,
Davidlohr Bueso, Jonathan Cameron, Vishal Verma, linux-cxl,
linux-pci, linux-kernel
Cc: Alex Williamson, vsethi, alwilliamson, Dan Williams,
Sai Yashwanth Reddy Kancherla, Vishal Aslot, Manish Honap,
Jiandi An, Richard Cheng, linux-tegra, Srirangan Madhavan
Move HDM decoder register decoding into a helper shared by normal CXL
core enumeration and early PCI HDM cache setup. This keeps validation of
base, size, interleave, target type, and enable state in one place before
adding another HDM parser.
Signed-off-by: Srirangan Madhavan <smadhavan@nvidia.com>
---
drivers/cxl/core/hdm.c | 61 +++++++++++-----------------------------
drivers/cxl/core/reset.c | 45 +++++++++++++++++++++++++++++
include/cxl/cxl.h | 3 ++
3 files changed, 64 insertions(+), 45 deletions(-)
diff --git a/drivers/cxl/core/hdm.c b/drivers/cxl/core/hdm.c
index 83cda63f76a5..e9e00c68a0ad 100644
--- a/drivers/cxl/core/hdm.c
+++ b/drivers/cxl/core/hdm.c
@@ -952,6 +952,7 @@ static int init_hdm_decoder(struct cxl_port *port, struct cxl_decoder *cxld,
u32 remainder;
int i, rc;
u32 ctrl;
+ struct cxl_decoder_settings settings;
union {
u64 value;
unsigned char target_id[8];
@@ -968,35 +969,28 @@ static int init_hdm_decoder(struct cxl_port *port, struct cxl_decoder *cxld,
lo = readl(hdm + CXL_HDM_DECODER0_SIZE_LOW_OFFSET(which));
hi = readl(hdm + CXL_HDM_DECODER0_SIZE_HIGH_OFFSET(which));
size = (hi << 32) + lo;
- committed = !!(ctrl & CXL_HDM_DECODER0_CTRL_COMMITTED);
+ lo = readl(hdm + CXL_HDM_DECODER0_TL_LOW(which));
+ hi = readl(hdm + CXL_HDM_DECODER0_TL_HIGH(which));
+ target_list.value = (hi << 32) + lo;
+ rc = cxl_hdm_decode_decoder(&settings, which, ctrl, base, size,
+ target_list.value, &committed);
+ if (rc) {
+ dev_warn(&port->dev,
+ "decoder%d.%d: Invalid decoder configuration (ctrl: %#x): %d\n",
+ port->id, cxld->id, ctrl, rc);
+ return rc;
+ }
+
cxld->commit = cxl_decoder_commit;
cxld->reset = cxl_decoder_reset;
-
- if (!committed)
- size = 0;
- if (base == U64_MAX || size == U64_MAX) {
- dev_warn(&port->dev, "decoder%d.%d: Invalid resource range\n",
- port->id, cxld->id);
- return -ENXIO;
- }
+ cxld->settings = settings;
+ size = range_len(&cxld->hpa_range);
if (info)
cxled = to_cxl_endpoint_decoder(&cxld->dev);
- cxld->hpa_range = (struct range) {
- .start = base,
- .end = base + size - 1,
- };
/* decoders are enabled if committed */
if (committed) {
- cxld->flags |= CXL_DECODER_F_ENABLE;
- if (ctrl & CXL_HDM_DECODER0_CTRL_LOCK)
- cxld->flags |= CXL_DECODER_F_LOCK;
- if (FIELD_GET(CXL_HDM_DECODER0_CTRL_HOSTONLY, ctrl))
- cxld->target_type = CXL_DECODER_HOSTONLYMEM;
- else
- cxld->target_type = CXL_DECODER_DEVMEM;
-
guard(rwsem_write)(&cxl_rwsem.region);
if (cxld->id != cxl_num_decoders_committed(port)) {
dev_warn(&port->dev,
@@ -1036,32 +1030,11 @@ static int init_hdm_decoder(struct cxl_port *port, struct cxl_decoder *cxld,
writel(ctrl, hdm + CXL_HDM_DECODER0_CTRL_OFFSET(which));
}
}
- rc = eiw_to_ways(FIELD_GET(CXL_HDM_DECODER0_CTRL_IW_MASK, ctrl),
- &cxld->interleave_ways);
- if (rc) {
- dev_warn(&port->dev,
- "decoder%d.%d: Invalid interleave ways (ctrl: %#x)\n",
- port->id, cxld->id, ctrl);
- return rc;
- }
- rc = eig_to_granularity(FIELD_GET(CXL_HDM_DECODER0_CTRL_IG_MASK, ctrl),
- &cxld->interleave_granularity);
- if (rc) {
- dev_warn(&port->dev,
- "decoder%d.%d: Invalid interleave granularity (ctrl: %#x)\n",
- port->id, cxld->id, ctrl);
- return rc;
- }
-
dev_dbg(&port->dev, "decoder%d.%d: range: %#llx-%#llx iw: %d ig: %d\n",
port->id, cxld->id, cxld->hpa_range.start, cxld->hpa_range.end,
cxld->interleave_ways, cxld->interleave_granularity);
if (!cxled) {
- lo = readl(hdm + CXL_HDM_DECODER0_TL_LOW(which));
- hi = readl(hdm + CXL_HDM_DECODER0_TL_HIGH(which));
- target_list.value = (hi << 32) + lo;
- cxld->targets = target_list.value;
for (i = 0; i < cxld->interleave_ways; i++)
cxld->target_map[i] = target_list.target_id[i];
@@ -1078,9 +1051,7 @@ static int init_hdm_decoder(struct cxl_port *port, struct cxl_decoder *cxld,
port->id, cxld->id, size, cxld->interleave_ways);
return -ENXIO;
}
- lo = readl(hdm + CXL_HDM_DECODER0_SKIP_LOW(which));
- hi = readl(hdm + CXL_HDM_DECODER0_SKIP_HIGH(which));
- skip = (hi << 32) + lo;
+ skip = cxld->skip;
rc = devm_cxl_dpa_reserve(cxled, *dpa_base + skip, dpa_size, skip);
if (rc) {
dev_err(&port->dev,
diff --git a/drivers/cxl/core/reset.c b/drivers/cxl/core/reset.c
index 14f024098e82..4c977fc47f8d 100644
--- a/drivers/cxl/core/reset.c
+++ b/drivers/cxl/core/reset.c
@@ -116,3 +116,48 @@ int cxl_commit(struct cxl_decoder_settings *settings, void __iomem *hdm)
return 0;
}
EXPORT_SYMBOL_FOR_MODULES(cxl_commit, "cxl_core");
+
+int cxl_hdm_decode_decoder(struct cxl_decoder_settings *settings, int id,
+ u32 ctrl, u64 base, u64 size, u64 target_or_skip,
+ bool *committed)
+{
+ bool enabled = FIELD_GET(CXL_HDM_DECODER0_CTRL_COMMITTED, ctrl);
+ int rc;
+
+ *settings = (struct cxl_decoder_settings) {
+ .id = id,
+ .targets = target_or_skip,
+ .target_type = FIELD_GET(CXL_HDM_DECODER0_CTRL_HOSTONLY, ctrl) ?
+ CXL_DECODER_HOSTONLYMEM : CXL_DECODER_DEVMEM,
+ };
+
+ if (committed)
+ *committed = enabled;
+ if (!enabled)
+ size = 0;
+ if (base == U64_MAX || size == U64_MAX ||
+ (size && base > U64_MAX - (size - 1)))
+ return -ENXIO;
+ if (enabled && !size)
+ return -ENXIO;
+
+ settings->hpa_range = (struct range) {
+ .start = base,
+ .end = base + size - 1,
+ };
+ if (enabled) {
+ settings->flags = CXL_DECODER_F_ENABLE;
+ if (ctrl & CXL_HDM_DECODER0_CTRL_LOCK)
+ settings->flags |= CXL_DECODER_F_LOCK;
+ }
+
+ rc = eiw_to_ways(FIELD_GET(CXL_HDM_DECODER0_CTRL_IW_MASK, ctrl),
+ &settings->interleave_ways);
+ if (rc)
+ return rc;
+
+ return eig_to_granularity(FIELD_GET(CXL_HDM_DECODER0_CTRL_IG_MASK,
+ ctrl),
+ &settings->interleave_granularity);
+}
+EXPORT_SYMBOL_FOR_MODULES(cxl_hdm_decode_decoder, "cxl_core");
diff --git a/include/cxl/cxl.h b/include/cxl/cxl.h
index 84924ca06e52..80839517eabf 100644
--- a/include/cxl/cxl.h
+++ b/include/cxl/cxl.h
@@ -133,6 +133,9 @@ struct cxl_hdm_info {
struct cxl_decoder_settings settings[] __counted_by(decoder_count);
};
+int cxl_hdm_decode_decoder(struct cxl_decoder_settings *settings, int id,
+ u32 ctrl, u64 base, u64 size, u64 target_or_skip,
+ bool *committed);
int cxl_commit(struct cxl_decoder_settings *settings, void __iomem *hdm);
struct cxl_reg_map {
--
2.43.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* Re: [PATCH v9 03/11] cxl: Share HDM decoder decode logic
2026-07-09 1:02 ` [PATCH v9 03/11] cxl: Share HDM decoder decode logic Srirangan Madhavan
@ 2026-07-09 1:18 ` sashiko-bot
0 siblings, 0 replies; 28+ messages in thread
From: sashiko-bot @ 2026-07-09 1:18 UTC (permalink / raw)
To: Srirangan Madhavan; +Cc: linux-pci, linux-cxl
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
Pre-existing issues:
- [High] Out-of-bounds stack read leaking kernel memory to userspace via decoder target maps when processing decoders with more than 8 interleave ways.
- [High] Endianness bug when extracting 8-bit Target IDs via a 64-bit union, leading to broken routing on big-endian architectures.
--
--- Patch [3]: [PATCH v9 03/11] cxl: Share HDM decoder decode logic ---
commit 0c55ebf0416f52a7748df44eabd5450eb7aba244
Author: Srirangan Madhavan <smadhavan@nvidia.com>
cxl: Share HDM decoder decode logic
This commit moves HDM decoder register decoding into a shared helper function.
It consolidates the validation of base, size, interleave, target type, and
enable state to simplify early PCI HDM cache setup.
> diff --git a/drivers/cxl/core/hdm.c b/drivers/cxl/core/hdm.c
> index 83cda63f76a5a..e9e00c68a0ad9 100644
> --- a/drivers/cxl/core/hdm.c
> +++ b/drivers/cxl/core/hdm.c
> @@ -952,6 +952,7 @@ static int init_hdm_decoder(struct cxl_port *port, struct cxl_decoder *cxld,
> u32 remainder;
> int i, rc;
> u32 ctrl;
> + struct cxl_decoder_settings settings;
> union {
> u64 value;
> unsigned char target_id[8];
> } target_list;
[ ... ]
> @@ -1036,32 +1030,11 @@ static int init_hdm_decoder(struct cxl_port *port, struct cxl_decoder *cxld,
[ ... ]
> if (!cxled) {
> - lo = readl(hdm + CXL_HDM_DECODER0_TL_LOW(which));
> - hi = readl(hdm + CXL_HDM_DECODER0_TL_HIGH(which));
> - target_list.value = (hi << 32) + lo;
> - cxld->targets = target_list.value;
> for (i = 0; i < cxld->interleave_ways; i++)
> cxld->target_map[i] = target_list.target_id[i];
[Severity: High]
This isn't a bug introduced by this patch, but does this loop cause an
out-of-bounds stack read if cxld->interleave_ways is greater than 8?
The target_list union is only 8 bytes wide, but CXL decoders can have up to 16
interleave ways. This would result in reading uninitialized stack memory into
the target_map array.
[Severity: High]
This is a pre-existing issue, but can using a union to map a 64-bit integer
to a byte array lead to endianness issues here?
On big-endian CPUs, target_list.value would store the bytes in reverse order
compared to little-endian CPUs, causing the loop to map memory to the wrong
routing targets.
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260709010304.680422-1-smadhavan@nvidia.com?part=3
^ permalink raw reply [flat|nested] 28+ messages in thread
* [PATCH v9 04/11] cxl: Cache endpoint decoder settings during PCI enumeration
2026-07-09 1:02 [PATCH v9 00/11] PCI/CXL: Add CXL reset support for Type 2 devices Srirangan Madhavan
` (2 preceding siblings ...)
2026-07-09 1:02 ` [PATCH v9 03/11] cxl: Share HDM decoder decode logic Srirangan Madhavan
@ 2026-07-09 1:02 ` Srirangan Madhavan
2026-07-09 1:17 ` sashiko-bot
` (2 more replies)
2026-07-09 1:02 ` [PATCH v9 05/11] cxl: Add CXL Device Reset helper Srirangan Madhavan
` (7 subsequent siblings)
11 siblings, 3 replies; 28+ messages in thread
From: Srirangan Madhavan @ 2026-07-09 1:02 UTC (permalink / raw)
To: Alison Schofield, Bjorn Helgaas, Dan Williams, Dave Jiang,
Davidlohr Bueso, Jonathan Cameron, Vishal Verma, linux-cxl,
linux-pci, linux-kernel
Cc: Alex Williamson, vsethi, alwilliamson, Dan Williams,
Sai Yashwanth Reddy Kancherla, Vishal Aslot, Manish Honap,
Jiandi An, Richard Cheng, linux-tegra, Srirangan Madhavan
Populate pci_dev->hdm from PCI capability initialization for CXL.mem
functions. If Memory Space Enable is clear, temporarily set it while
reading HDM MMIO and restore the original PCI_COMMAND value before
returning. This gives driver-free reset paths an early HDM snapshot.
CXL core later reuses and refreshes the same cache. Move the register
helpers into the built-in CONFIG_CXL_HDM set so the early cache path is
available without cxl_core.
Signed-off-by: Srirangan Madhavan <smadhavan@nvidia.com>
---
drivers/cxl/core/Makefile | 3 +-
drivers/cxl/core/hdm.c | 59 ++++----
drivers/cxl/core/regs.c | 4 +
drivers/cxl/core/reset.c | 288 ++++++++++++++++++++++++++++++++++++++
drivers/pci/probe.c | 3 +
include/cxl/cxl.h | 31 +++-
6 files changed, 349 insertions(+), 39 deletions(-)
diff --git a/drivers/cxl/core/Makefile b/drivers/cxl/core/Makefile
index dc075cee0450..69cf2ea7ee74 100644
--- a/drivers/cxl/core/Makefile
+++ b/drivers/cxl/core/Makefile
@@ -1,6 +1,6 @@
# SPDX-License-Identifier: GPL-2.0
obj-$(CONFIG_CXL_BUS) += cxl_core.o
-obj-$(CONFIG_CXL_HDM) += reset.o
+obj-$(CONFIG_CXL_HDM) += regs.o reset.o
obj-$(CONFIG_CXL_SUSPEND) += suspend.o
ccflags-y += -I$(srctree)/drivers/cxl
@@ -8,7 +8,6 @@ CFLAGS_trace.o = -DTRACE_INCLUDE_PATH=. -I$(src)
cxl_core-y := port.o
cxl_core-y += pmem.o
-cxl_core-y += regs.o
cxl_core-y += memdev.o
cxl_core-y += mbox.o
cxl_core-y += pci.o
diff --git a/drivers/cxl/core/hdm.c b/drivers/cxl/core/hdm.c
index e9e00c68a0ad..7a1ade846c9c 100644
--- a/drivers/cxl/core/hdm.c
+++ b/drivers/cxl/core/hdm.c
@@ -84,18 +84,9 @@ static void parse_hdm_decoder_caps(struct cxl_hdm *cxlhdm)
cxlhdm->iw_cap_mask |= BIT(16);
}
-static void clear_hdm_info(void *data)
-{
- struct pci_dev *pdev = data;
-
- WRITE_ONCE(pdev->hdm, NULL);
-}
-
-static int devm_cxl_pci_setup_hdm_info(struct cxl_hdm *cxlhdm)
+static struct pci_dev *cxl_hdm_to_pci_dev(struct cxl_hdm *cxlhdm)
{
struct cxl_port *port = cxlhdm->port;
- struct cxl_hdm_info *info;
- struct pci_dev *pdev;
struct device *uport;
if (is_cxl_endpoint(port)) {
@@ -107,42 +98,42 @@ static int devm_cxl_pci_setup_hdm_info(struct cxl_hdm *cxlhdm)
}
if (!dev_is_pci(uport))
- return 0;
+ return NULL;
- pdev = to_pci_dev(uport);
- info = devm_kzalloc(&pdev->dev,
- struct_size(info, settings, cxlhdm->decoder_count),
- GFP_KERNEL);
- if (!info)
- return -ENOMEM;
+ return to_pci_dev(uport);
+}
- info->decoder_count = cxlhdm->decoder_count;
- WRITE_ONCE(pdev->hdm, info);
+static int devm_cxl_pci_setup_hdm_info(struct cxl_hdm *cxlhdm)
+{
+ struct cxl_hdm_info *info;
+ struct pci_dev *pdev;
- return devm_add_action_or_reset(&pdev->dev, clear_hdm_info, pdev);
+ pdev = cxl_hdm_to_pci_dev(cxlhdm);
+ if (!pdev)
+ return 0;
+
+ guard(rwsem_read)(&cxl_rwsem.dpa);
+ info = pdev->hdm;
+ if (info) {
+ if (info->decoder_count != cxlhdm->decoder_count)
+ return -ENXIO;
+ }
+
+ return 0;
}
static void cxl_hdm_info_set_decoder(struct cxl_hdm *cxlhdm,
struct cxl_decoder *cxld)
{
- struct cxl_port *port = cxlhdm->port;
struct cxl_hdm_info *info;
struct pci_dev *pdev;
- struct device *uport;
- if (is_cxl_endpoint(port)) {
- struct cxl_memdev *cxlmd = to_cxl_memdev(port->uport_dev);
-
- uport = cxlmd->dev.parent;
- } else {
- uport = port->uport_dev;
- }
-
- if (!dev_is_pci(uport))
+ pdev = cxl_hdm_to_pci_dev(cxlhdm);
+ if (!pdev)
return;
- pdev = to_pci_dev(uport);
- info = READ_ONCE(pdev->hdm);
+ guard(rwsem_write)(&cxl_rwsem.dpa);
+ info = pdev->hdm;
if (!info || cxld->id >= info->decoder_count)
return;
@@ -948,11 +939,11 @@ static int init_hdm_decoder(struct cxl_port *port, struct cxl_decoder *cxld,
{
struct cxl_endpoint_decoder *cxled = NULL;
u64 size, base, skip, dpa_size, lo, hi;
+ struct cxl_decoder_settings settings;
bool committed;
u32 remainder;
int i, rc;
u32 ctrl;
- struct cxl_decoder_settings settings;
union {
u64 value;
unsigned char target_id[8];
diff --git a/drivers/cxl/core/regs.c b/drivers/cxl/core/regs.c
index 93710cf4f0a6..040b0304f63c 100644
--- a/drivers/cxl/core/regs.c
+++ b/drivers/cxl/core/regs.c
@@ -199,6 +199,7 @@ void __iomem *devm_cxl_iomap_block(struct device *dev, resource_size_t addr,
return ret_val;
}
+EXPORT_SYMBOL_NS_GPL(devm_cxl_iomap_block, "CXL");
int cxl_map_component_regs(const struct cxl_register_map *map,
struct cxl_component_regs *regs,
@@ -517,6 +518,7 @@ u16 cxl_rcrb_to_aer(struct device *dev, resource_size_t rcrb)
return offset;
}
+EXPORT_SYMBOL_NS_GPL(cxl_rcrb_to_aer, "CXL");
static resource_size_t cxl_rcrb_to_linkcap(struct device *dev, struct cxl_dport *dport)
{
@@ -633,6 +635,7 @@ resource_size_t __rcrb_to_component(struct device *dev, struct cxl_rcrb_info *ri
return component_reg_phys;
}
+EXPORT_SYMBOL_NS_GPL(__rcrb_to_component, "CXL");
resource_size_t cxl_rcd_component_reg_phys(struct device *dev,
struct cxl_dport *dport)
@@ -641,3 +644,4 @@ resource_size_t cxl_rcd_component_reg_phys(struct device *dev,
return CXL_RESOURCE_NONE;
return __rcrb_to_component(dev, &dport->rcrb, CXL_RCRB_UPSTREAM);
}
+EXPORT_SYMBOL_NS_GPL(cxl_rcd_component_reg_phys, "CXL");
diff --git a/drivers/cxl/core/reset.c b/drivers/cxl/core/reset.c
index 4c977fc47f8d..97b72cc67b6b 100644
--- a/drivers/cxl/core/reset.c
+++ b/drivers/cxl/core/reset.c
@@ -2,9 +2,16 @@
/* Copyright(c) 2026 NVIDIA Corporation. All rights reserved. */
#include <linux/delay.h>
#include <linux/bug.h>
+#include <linux/bitfield.h>
#include <linux/errno.h>
#include <linux/export.h>
+#include <linux/io.h>
+#include <linux/ioport.h>
#include <linux/kernel.h>
+#include <linux/pci.h>
+#include <linux/slab.h>
+
+#include <cxlpci.h>
#include "cxl.h"
#include "core.h"
@@ -161,3 +168,284 @@ int cxl_hdm_decode_decoder(struct cxl_decoder_settings *settings, int id,
&settings->interleave_granularity);
}
EXPORT_SYMBOL_FOR_MODULES(cxl_hdm_decode_decoder, "cxl_core");
+
+struct cxl_hdm_decoder_state {
+ u32 ctrl;
+ u32 base_low;
+ u32 base_high;
+ u32 size_low;
+ u32 size_high;
+ u32 target_low;
+ u32 target_high;
+};
+
+void pci_cxl_hdm_release(struct pci_dev *pdev)
+{
+ struct cxl_hdm_info *info;
+
+ scoped_guard(rwsem_write, &cxl_rwsem.dpa) {
+ info = pdev->hdm;
+ pdev->hdm = NULL;
+ }
+ if (!info)
+ return;
+
+ kfree(info->decoder_state);
+ kfree(info);
+}
+
+static int cxl_pci_hdm_find_bar(struct pci_dev *pdev, resource_size_t hdm_start,
+ resource_size_t hdm_size, int *bar,
+ resource_size_t *offset)
+{
+ resource_size_t hdm_end = hdm_start + hdm_size - 1;
+
+ for (int i = 0; i < PCI_STD_NUM_BARS; i++) {
+ struct resource *res = &pdev->resource[i];
+
+ if (!pci_resource_len(pdev, i))
+ continue;
+ if (resource_type(res) != IORESOURCE_MEM)
+ continue;
+ if (hdm_start < res->start || hdm_end > res->end)
+ continue;
+
+ *bar = i;
+ *offset = hdm_start - res->start;
+ return 0;
+ }
+
+ return -ENODEV;
+}
+
+static void __iomem *cxl_pci_hdm_map(struct pci_dev *pdev,
+ struct cxl_register_map *map,
+ struct cxl_hdm_info *info)
+{
+ struct cxl_reg_map *hdm_map = &map->component_map.hdm_decoder;
+ resource_size_t hdm_start;
+ void __iomem *hdm;
+ int rc;
+
+ hdm_start = map->resource + hdm_map->offset;
+ info->hdm_size = hdm_map->size;
+
+ rc = cxl_pci_hdm_find_bar(pdev, hdm_start, info->hdm_size,
+ &info->hdm_bar, &info->hdm_offset);
+ if (rc)
+ return ERR_PTR(rc);
+
+ hdm = ioremap(hdm_start, info->hdm_size);
+ if (!hdm) {
+ pci_err(pdev, "failed to map CXL HDM decoder registers\n");
+ return ERR_PTR(-ENOMEM);
+ }
+
+ return hdm;
+}
+
+static void cxl_pci_hdm_read_decoder_state(struct cxl_hdm_decoder_state *state,
+ void __iomem *hdm, int id)
+{
+ state->ctrl = readl(hdm + CXL_HDM_DECODER0_CTRL_OFFSET(id));
+ state->base_low = readl(hdm + CXL_HDM_DECODER0_BASE_LOW_OFFSET(id));
+ state->base_high = readl(hdm + CXL_HDM_DECODER0_BASE_HIGH_OFFSET(id));
+ state->size_low = readl(hdm + CXL_HDM_DECODER0_SIZE_LOW_OFFSET(id));
+ state->size_high = readl(hdm + CXL_HDM_DECODER0_SIZE_HIGH_OFFSET(id));
+ state->target_low = readl(hdm + CXL_HDM_DECODER0_TL_LOW(id));
+ state->target_high = readl(hdm + CXL_HDM_DECODER0_TL_HIGH(id));
+}
+
+static int cxl_pci_hdm_read_decoder(struct pci_dev *pdev,
+ struct cxl_hdm_decoder_state *state,
+ struct cxl_decoder_settings *settings,
+ void __iomem *hdm, int id)
+{
+ u64 target_or_skip, base, size;
+ bool committed;
+ int rc;
+
+ cxl_pci_hdm_read_decoder_state(state, hdm, id);
+
+ base = ((u64)state->base_high << 32) | state->base_low;
+ size = ((u64)state->size_high << 32) | state->size_low;
+ target_or_skip = ((u64)state->target_high << 32) | state->target_low;
+
+ rc = cxl_hdm_decode_decoder(settings, id, state->ctrl, base, size,
+ target_or_skip, &committed);
+ if (rc) {
+ pci_err(pdev, "CXL HDM decoder %d has invalid configuration: %d\n",
+ id, rc);
+ return rc;
+ }
+ if (!committed)
+ return 0;
+
+ return 0;
+}
+
+static int cxl_pci_hdm_capable(struct pci_dev *pdev)
+{
+ u16 cap;
+ int dvsec;
+ int rc;
+
+ dvsec = pci_find_dvsec_capability(pdev, PCI_VENDOR_ID_CXL,
+ PCI_DVSEC_CXL_DEVICE);
+ if (!dvsec)
+ return -ENOTTY;
+
+ rc = pci_read_config_word(pdev, dvsec + PCI_DVSEC_CXL_CAP, &cap);
+ if (rc)
+ return pcibios_err_to_errno(rc);
+
+ if (!(cap & PCI_DVSEC_CXL_MEM_CAPABLE))
+ return -ENOTTY;
+
+ return 0;
+}
+
+static int __pci_cxl_hdm_init(struct pci_dev *pdev)
+{
+ struct cxl_decoder_settings *settings;
+ struct cxl_register_map map = { 0 };
+ struct cxl_hdm_info *info;
+ void __iomem *hdm = NULL;
+ bool restore_command = false;
+ bool allocated_info = false;
+ int decoder_count;
+ u16 command;
+ int rc;
+
+ scoped_guard(rwsem_read, &cxl_rwsem.dpa) {
+ info = pdev->hdm;
+ if (info)
+ return 0;
+ }
+
+ rc = cxl_pci_hdm_capable(pdev);
+ if (rc)
+ return rc;
+
+ rc = pci_read_config_word(pdev, PCI_COMMAND, &command);
+ if (rc)
+ return pcibios_err_to_errno(rc);
+
+ if (!(command & PCI_COMMAND_MEMORY))
+ restore_command = true;
+
+ if (restore_command) {
+ rc = pci_write_config_word(pdev, PCI_COMMAND,
+ command | PCI_COMMAND_MEMORY);
+ if (rc)
+ return pcibios_err_to_errno(rc);
+ }
+
+ if (!info) {
+ info = kzalloc_obj(*info, GFP_KERNEL);
+ if (!info)
+ goto err_nomem;
+ allocated_info = true;
+ }
+
+ rc = cxl_find_regblock(pdev, CXL_REGLOC_RBI_COMPONENT, &map);
+ if (rc)
+ goto out_restore_command;
+
+ rc = cxl_setup_regs(&map);
+ if (rc)
+ goto out_restore_command;
+
+ if (!map.component_map.hdm_decoder.valid) {
+ rc = -ENODEV;
+ goto out_restore_command;
+ }
+
+ hdm = cxl_pci_hdm_map(pdev, &map, info);
+ if (IS_ERR(hdm)) {
+ rc = PTR_ERR(hdm);
+ hdm = NULL;
+ goto out_restore_command;
+ }
+
+ decoder_count = cxl_hdm_decoder_count(readl(hdm +
+ CXL_HDM_DECODER_CAP_OFFSET));
+ if (decoder_count < 0) {
+ rc = decoder_count;
+ goto out_unmap;
+ }
+
+ if (decoder_count > CXL_HDM_DECODER_MAX_COUNT) {
+ rc = -ENXIO;
+ goto out_unmap;
+ }
+
+ if (info->decoder_count && info->decoder_count != decoder_count) {
+ rc = -ENXIO;
+ goto out_unmap;
+ }
+
+ info->decoder_count = decoder_count;
+ info->global_ctrl = readl(hdm + CXL_HDM_DECODER_CTRL_OFFSET);
+ info->decoder_state = kcalloc(decoder_count,
+ sizeof(*info->decoder_state),
+ GFP_KERNEL);
+ if (!info->decoder_state) {
+ rc = -ENOMEM;
+ goto out_unmap;
+ }
+
+ settings = info->settings;
+ for (int i = 0; i < info->decoder_count; i++) {
+ rc = cxl_pci_hdm_read_decoder(pdev, &info->decoder_state[i],
+ &settings[i], hdm, i);
+ if (rc)
+ goto out_unmap;
+ }
+
+ if (restore_command) {
+ rc = pci_write_config_word(pdev, PCI_COMMAND, command);
+ if (rc)
+ goto out_restore_failed;
+ }
+
+ scoped_guard(rwsem_write, &cxl_rwsem.dpa) {
+ if (pdev->hdm)
+ goto out_unmap;
+ pdev->hdm = info;
+ }
+ iounmap(hdm);
+ return 0;
+
+out_restore_failed:
+ rc = pcibios_err_to_errno(rc);
+ goto out_unmap;
+err_nomem:
+ rc = -ENOMEM;
+ goto out_restore_command;
+out_unmap:
+ if (hdm)
+ iounmap(hdm);
+out_restore_command:
+ if (allocated_info) {
+ kfree(info->decoder_state);
+ kfree(info);
+ }
+ if (restore_command) {
+ int rc2;
+
+ rc2 = pci_write_config_word(pdev, PCI_COMMAND, command);
+ if (rc2 && !rc)
+ rc = pcibios_err_to_errno(rc2);
+ }
+ return rc;
+}
+
+void pci_cxl_hdm_init(struct pci_dev *pdev)
+{
+ int rc;
+
+ rc = __pci_cxl_hdm_init(pdev);
+ if (rc && rc != -ENOTTY && rc != -ENODEV)
+ pci_dbg(pdev, "CXL HDM cache init failed: %d\n", rc);
+}
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index dd0abbc63e18..8080389d1fc3 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -24,6 +24,7 @@
#include <linux/pm_runtime.h>
#include <linux/bitfield.h>
#include <trace/events/pci.h>
+#include <cxl/cxl.h>
#include "pci.h"
static struct resource busn_resource = {
@@ -2484,6 +2485,7 @@ static void pci_release_dev(struct device *dev)
struct pci_dev *pci_dev;
pci_dev = to_pci_dev(dev);
+ pci_cxl_hdm_release(pci_dev);
pci_release_capabilities(pci_dev);
pci_release_of_node(pci_dev);
pcibios_release_device(pci_dev);
@@ -2674,6 +2676,7 @@ static void pci_init_capabilities(struct pci_dev *dev)
pci_rebar_init(dev); /* Resizable BAR */
pci_dev3_init(dev); /* Device 3 capabilities */
pci_ide_init(dev); /* Link Integrity and Data Encryption */
+ pci_cxl_hdm_init(dev); /* CXL HDM Decoder Capability */
pcie_report_downtraining(dev);
pci_init_reset_methods(dev);
diff --git a/include/cxl/cxl.h b/include/cxl/cxl.h
index 80839517eabf..2215fe1c3f78 100644
--- a/include/cxl/cxl.h
+++ b/include/cxl/cxl.h
@@ -26,6 +26,7 @@ enum cxl_devtype {
};
struct cxl_region;
+struct pci_dev;
enum cxl_decoder_type {
CXL_DECODER_DEVMEM = 2,
@@ -121,22 +122,46 @@ struct cxl_regs {
);
};
+#define CXL_HDM_DECODER_MAX_COUNT 32
+
+struct cxl_hdm_decoder_state;
+
/**
* struct cxl_hdm_info - PCI device HDM decoder programming cache
* @decoder_count: number of decoder settings entries
- * @regs: mapped CXL component registers for this HDM decoder block
+ * @hdm_bar: BAR containing the HDM decoder registers
+ * @hdm_offset: HDM decoder register offset relative to @hdm_bar
+ * @hdm_size: HDM decoder register resource size
+ * @global_ctrl: cached HDM decoder global control register
+ * @decoder_state: cached raw per-decoder register state
* @settings: cached per-decoder programming state
*/
struct cxl_hdm_info {
int decoder_count;
- struct cxl_component_regs regs;
- struct cxl_decoder_settings settings[] __counted_by(decoder_count);
+ int hdm_bar;
+ resource_size_t hdm_offset;
+ resource_size_t hdm_size;
+ u32 global_ctrl;
+ struct cxl_hdm_decoder_state *decoder_state;
+ struct cxl_decoder_settings settings[CXL_HDM_DECODER_MAX_COUNT];
};
int cxl_hdm_decode_decoder(struct cxl_decoder_settings *settings, int id,
u32 ctrl, u64 base, u64 size, u64 target_or_skip,
bool *committed);
int cxl_commit(struct cxl_decoder_settings *settings, void __iomem *hdm);
+#ifdef CONFIG_CXL_HDM
+void pci_cxl_hdm_init(struct pci_dev *pdev);
+void pci_cxl_hdm_release(struct pci_dev *pdev);
+#else
+static inline void pci_cxl_hdm_init(struct pci_dev *pdev)
+{
+}
+
+static inline void pci_cxl_hdm_release(struct pci_dev *pdev)
+{
+}
+#endif
struct cxl_reg_map {
bool valid;
--
2.43.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* Re: [PATCH v9 04/11] cxl: Cache endpoint decoder settings during PCI enumeration
2026-07-09 1:02 ` [PATCH v9 04/11] cxl: Cache endpoint decoder settings during PCI enumeration Srirangan Madhavan
@ 2026-07-09 1:17 ` sashiko-bot
2026-07-09 3:30 ` Alison Schofield
2026-07-10 0:48 ` Dan Williams (nvidia)
2 siblings, 0 replies; 28+ messages in thread
From: sashiko-bot @ 2026-07-09 1:17 UTC (permalink / raw)
To: Srirangan Madhavan; +Cc: linux-cxl, linux-pci
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] Enabling PCI_COMMAND_MEMORY and mapping unassigned BARs during early PCI enumeration causes severe resource conflicts and system instability.
- [Medium] Mixing goto-based error handling with scope-based cleanup helpers (`scoped_guard()`), leading to a logical fall-through bug.
--
--- Patch [4]: [PATCH v9 04/11] cxl: Cache endpoint decoder settings during PCI enumeration ---
commit 64ea438bc1dd54d340a46889f9f340251bdf644f
Author: Srirangan Madhavan <smadhavan@nvidia.com>
cxl: Cache endpoint decoder settings during PCI enumeration
This patch populates pci_dev->hdm from PCI capability initialization
for CXL.mem functions. It temporarily sets memory space enable to read
HDM MMIO and restores the original configuration value.
> diff --git a/drivers/cxl/core/reset.c b/drivers/cxl/core/reset.c
> --- a/drivers/cxl/core/reset.c
> +++ b/drivers/cxl/core/reset.c
[ ... ]
> +static int __pci_cxl_hdm_init(struct pci_dev *pdev)
> +{
[ ... ]
> + if (!(command & PCI_COMMAND_MEMORY))
> + restore_command = true;
> +
> + if (restore_command) {
> + rc = pci_write_config_word(pdev, PCI_COMMAND,
> + command | PCI_COMMAND_MEMORY);
[Severity: High]
Is it safe to forcefully enable memory decoding before the PCI core has
verified or assigned safe base address registers?
Since this function is called during early enumeration in
pci_init_capabilities():
drivers/pci/probe.c:pci_init_capabilities() {
...
pci_ide_init(dev);
pci_cxl_hdm_init(dev);
...
}
Could uninitialized or overlapping physical addresses cause the endpoint to
decode transactions intended for system memory, leading to resource
conflicts or machine check exceptions?
> + if (rc)
> + return pcibios_err_to_errno(rc);
> + }
[ ... ]
> + scoped_guard(rwsem_write, &cxl_rwsem.dpa) {
> + if (pdev->hdm)
> + goto out_unmap;
[Severity: Medium]
Could this goto inside a scoped_guard() block lead to logical fall-through
bugs?
The cleanup subsystem guidelines advise against mixing goto and scope-based
cleanups in the same function. If pdev->hdm is already set, execution
jumps to out_unmap and then falls through to out_restore_command.
Could this cause the configuration write to be re-executed redundantly
during the error handling fall-through?
> + pdev->hdm = info;
> + }
> + iounmap(hdm);
> + return 0;
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260709010304.680422-1-smadhavan@nvidia.com?part=4
^ permalink raw reply [flat|nested] 28+ messages in thread* Re: [PATCH v9 04/11] cxl: Cache endpoint decoder settings during PCI enumeration
2026-07-09 1:02 ` [PATCH v9 04/11] cxl: Cache endpoint decoder settings during PCI enumeration Srirangan Madhavan
2026-07-09 1:17 ` sashiko-bot
@ 2026-07-09 3:30 ` Alison Schofield
2026-07-10 0:48 ` Dan Williams (nvidia)
2 siblings, 0 replies; 28+ messages in thread
From: Alison Schofield @ 2026-07-09 3:30 UTC (permalink / raw)
To: Srirangan Madhavan
Cc: Bjorn Helgaas, Dan Williams, Dave Jiang, Davidlohr Bueso,
Jonathan Cameron, Vishal Verma, linux-cxl, linux-pci,
linux-kernel, Alex Williamson, vsethi, alwilliamson, Dan Williams,
Sai Yashwanth Reddy Kancherla, Vishal Aslot, Manish Honap,
Jiandi An, Richard Cheng, linux-tegra
On Thu, Jul 09, 2026 at 01:02:57AM +0000, Srirangan Madhavan wrote:
> Populate pci_dev->hdm from PCI capability initialization for CXL.mem
> functions. If Memory Space Enable is clear, temporarily set it while
> reading HDM MMIO and restore the original PCI_COMMAND value before
> returning. This gives driver-free reset paths an early HDM snapshot.
>
> CXL core later reuses and refreshes the same cache. Move the register
> helpers into the built-in CONFIG_CXL_HDM set so the early cache path is
> available without cxl_core.
>
> Signed-off-by: Srirangan Madhavan <smadhavan@nvidia.com>
> ---
> drivers/cxl/core/Makefile | 3 +-
> drivers/cxl/core/hdm.c | 59 ++++----
> drivers/cxl/core/regs.c | 4 +
> drivers/cxl/core/reset.c | 288 ++++++++++++++++++++++++++++++++++++++
> drivers/pci/probe.c | 3 +
> include/cxl/cxl.h | 31 +++-
> 6 files changed, 349 insertions(+), 39 deletions(-)
>
> diff --git a/drivers/cxl/core/Makefile b/drivers/cxl/core/Makefile
> index dc075cee0450..69cf2ea7ee74 100644
> --- a/drivers/cxl/core/Makefile
> +++ b/drivers/cxl/core/Makefile
> @@ -1,6 +1,6 @@
> # SPDX-License-Identifier: GPL-2.0
> obj-$(CONFIG_CXL_BUS) += cxl_core.o
> -obj-$(CONFIG_CXL_HDM) += reset.o
> +obj-$(CONFIG_CXL_HDM) += regs.o reset.o
> obj-$(CONFIG_CXL_SUSPEND) += suspend.o
Hi Srirangan,
This breaks cxl-test module builds with an 'exported twice' error,
14 symbols are both built-in and in cxl_core.ko.
All from drivers/cxl/core/regs.c
With that fixed up, this set passes the cxl unit test suite :)
diff --git a/tools/testing/cxl/Kbuild b/tools/testing/cxl/Kbuild
index 2be1df80fcc9..e80500f457a9 100644
--- a/tools/testing/cxl/Kbuild
+++ b/tools/testing/cxl/Kbuild
@@ -55,7 +55,6 @@ obj-m += cxl_core.o
cxl_core-y := $(CXL_CORE_SRC)/port.o
cxl_core-y += $(CXL_CORE_SRC)/pmem.o
-cxl_core-y += $(CXL_CORE_SRC)/regs.o
cxl_core-y += $(CXL_CORE_SRC)/memdev.o
cxl_core-y += $(CXL_CORE_SRC)/mbox.o
cxl_core-y += $(CXL_CORE_SRC)/pci.o
-- Alison
^ permalink raw reply related [flat|nested] 28+ messages in thread
* Re: [PATCH v9 04/11] cxl: Cache endpoint decoder settings during PCI enumeration
2026-07-09 1:02 ` [PATCH v9 04/11] cxl: Cache endpoint decoder settings during PCI enumeration Srirangan Madhavan
2026-07-09 1:17 ` sashiko-bot
2026-07-09 3:30 ` Alison Schofield
@ 2026-07-10 0:48 ` Dan Williams (nvidia)
2 siblings, 0 replies; 28+ messages in thread
From: Dan Williams (nvidia) @ 2026-07-10 0:48 UTC (permalink / raw)
To: Srirangan Madhavan, Alison Schofield, Bjorn Helgaas, Dan Williams,
Dave Jiang, Davidlohr Bueso, Jonathan Cameron, Vishal Verma,
linux-cxl, linux-pci, linux-kernel
Cc: Alex Williamson, vsethi, alwilliamson, Dan Williams,
Sai Yashwanth Reddy Kancherla, Vishal Aslot, Manish Honap,
Jiandi An, Richard Cheng, linux-tegra, Srirangan Madhavan
Srirangan Madhavan wrote:
> Populate pci_dev->hdm from PCI capability initialization for CXL.mem
> functions. If Memory Space Enable is clear, temporarily set it while
> reading HDM MMIO and restore the original PCI_COMMAND value before
> returning. This gives driver-free reset paths an early HDM snapshot.
>
> CXL core later reuses and refreshes the same cache. Move the register
> helpers into the built-in CONFIG_CXL_HDM set so the early cache path is
> available without cxl_core.
>
> Signed-off-by: Srirangan Madhavan <smadhavan@nvidia.com>
[..]
> diff --git a/drivers/cxl/core/reset.c b/drivers/cxl/core/reset.c
> index 4c977fc47f8d..97b72cc67b6b 100644
> --- a/drivers/cxl/core/reset.c
> +++ b/drivers/cxl/core/reset.c
To Dave's point, and now the fact that Manish needs this information too
for VFIO, it probably best to call this file
drivers/cxl/core/resource.c. The scheme being PCI Core caches PCI MMIO
resource in the pdev, and CXL Core caches CXL HPA resources in the pdev.
> @@ -2,9 +2,16 @@
> /* Copyright(c) 2026 NVIDIA Corporation. All rights reserved. */
Should be "Copyright (c) 2026 NVIDIA Corporation & Affiliates"
...no requirement for All rights reserved.
> #include <linux/delay.h>
> #include <linux/bug.h>
> +#include <linux/bitfield.h>
> #include <linux/errno.h>
> #include <linux/export.h>
> +#include <linux/io.h>
> +#include <linux/ioport.h>
> #include <linux/kernel.h>
> +#include <linux/pci.h>
> +#include <linux/slab.h>
> +
> +#include <cxlpci.h>
>
> #include "cxl.h"
> #include "core.h"
> @@ -161,3 +168,284 @@ int cxl_hdm_decode_decoder(struct cxl_decoder_settings *settings, int id,
> &settings->interleave_granularity);
> }
> EXPORT_SYMBOL_FOR_MODULES(cxl_hdm_decode_decoder, "cxl_core");
> +
> +struct cxl_hdm_decoder_state {
> + u32 ctrl;
> + u32 base_low;
> + u32 base_high;
> + u32 size_low;
> + u32 size_high;
> + u32 target_low;
> + u32 target_high;
> +};
> +
> +void pci_cxl_hdm_release(struct pci_dev *pdev)
> +{
> + struct cxl_hdm_info *info;
> +
> + scoped_guard(rwsem_write, &cxl_rwsem.dpa) {
> + info = pdev->hdm;
> + pdev->hdm = NULL;
> + }
> + if (!info)
> + return;
> +
> + kfree(info->decoder_state);
> + kfree(info);
> +}
> +
> +static int cxl_pci_hdm_find_bar(struct pci_dev *pdev, resource_size_t hdm_start,
> + resource_size_t hdm_size, int *bar,
> + resource_size_t *offset)
> +{
> + resource_size_t hdm_end = hdm_start + hdm_size - 1;
> +
> + for (int i = 0; i < PCI_STD_NUM_BARS; i++) {
> + struct resource *res = &pdev->resource[i];
> +
> + if (!pci_resource_len(pdev, i))
> + continue;
> + if (resource_type(res) != IORESOURCE_MEM)
> + continue;
> + if (hdm_start < res->start || hdm_end > res->end)
> + continue;
> +
> + *bar = i;
> + *offset = hdm_start - res->start;
> + return 0;
> + }
> +
> + return -ENODEV;
> +}
> +
> +static void __iomem *cxl_pci_hdm_map(struct pci_dev *pdev,
> + struct cxl_register_map *map,
> + struct cxl_hdm_info *info)
> +{
> + struct cxl_reg_map *hdm_map = &map->component_map.hdm_decoder;
> + resource_size_t hdm_start;
> + void __iomem *hdm;
> + int rc;
> +
> + hdm_start = map->resource + hdm_map->offset;
> + info->hdm_size = hdm_map->size;
> +
> + rc = cxl_pci_hdm_find_bar(pdev, hdm_start, info->hdm_size,
> + &info->hdm_bar, &info->hdm_offset);
> + if (rc)
> + return ERR_PTR(rc);
> +
> + hdm = ioremap(hdm_start, info->hdm_size);
> + if (!hdm) {
> + pci_err(pdev, "failed to map CXL HDM decoder registers\n");
> + return ERR_PTR(-ENOMEM);
> + }
> +
> + return hdm;
> +}
> +
> +static void cxl_pci_hdm_read_decoder_state(struct cxl_hdm_decoder_state *state,
> + void __iomem *hdm, int id)
> +{
> + state->ctrl = readl(hdm + CXL_HDM_DECODER0_CTRL_OFFSET(id));
> + state->base_low = readl(hdm + CXL_HDM_DECODER0_BASE_LOW_OFFSET(id));
> + state->base_high = readl(hdm + CXL_HDM_DECODER0_BASE_HIGH_OFFSET(id));
> + state->size_low = readl(hdm + CXL_HDM_DECODER0_SIZE_LOW_OFFSET(id));
> + state->size_high = readl(hdm + CXL_HDM_DECODER0_SIZE_HIGH_OFFSET(id));
> + state->target_low = readl(hdm + CXL_HDM_DECODER0_TL_LOW(id));
> + state->target_high = readl(hdm + CXL_HDM_DECODER0_TL_HIGH(id));
> +}
> +
> +static int cxl_pci_hdm_read_decoder(struct pci_dev *pdev,
> + struct cxl_hdm_decoder_state *state,
> + struct cxl_decoder_settings *settings,
> + void __iomem *hdm, int id)
> +{
> + u64 target_or_skip, base, size;
> + bool committed;
> + int rc;
> +
> + cxl_pci_hdm_read_decoder_state(state, hdm, id);
> +
> + base = ((u64)state->base_high << 32) | state->base_low;
> + size = ((u64)state->size_high << 32) | state->size_low;
> + target_or_skip = ((u64)state->target_high << 32) | state->target_low;
> +
> + rc = cxl_hdm_decode_decoder(settings, id, state->ctrl, base, size,
> + target_or_skip, &committed);
> + if (rc) {
> + pci_err(pdev, "CXL HDM decoder %d has invalid configuration: %d\n",
> + id, rc);
> + return rc;
> + }
> + if (!committed)
> + return 0;
> +
> + return 0;
> +}
> +
> +static int cxl_pci_hdm_capable(struct pci_dev *pdev)
> +{
> + u16 cap;
> + int dvsec;
> + int rc;
> +
> + dvsec = pci_find_dvsec_capability(pdev, PCI_VENDOR_ID_CXL,
> + PCI_DVSEC_CXL_DEVICE);
> + if (!dvsec)
> + return -ENOTTY;
> +
> + rc = pci_read_config_word(pdev, dvsec + PCI_DVSEC_CXL_CAP, &cap);
> + if (rc)
> + return pcibios_err_to_errno(rc);
> +
> + if (!(cap & PCI_DVSEC_CXL_MEM_CAPABLE))
> + return -ENOTTY;
> +
> + return 0;
> +}
> +
> +static int __pci_cxl_hdm_init(struct pci_dev *pdev)
> +{
> + struct cxl_decoder_settings *settings;
> + struct cxl_register_map map = { 0 };
> + struct cxl_hdm_info *info;
> + void __iomem *hdm = NULL;
> + bool restore_command = false;
> + bool allocated_info = false;
> + int decoder_count;
> + u16 command;
> + int rc;
> +
> + scoped_guard(rwsem_read, &cxl_rwsem.dpa) {
> + info = pdev->hdm;
> + if (info)
> + return 0;
> + }
Is this function going to be reused for refreshing the state of the
decoder cache? Does not look like it in this set, so it should be
impossible for pdev->hdm to already be enabled, right?
> +
> + rc = cxl_pci_hdm_capable(pdev);
> + if (rc)
> + return rc;
> +
> + rc = pci_read_config_word(pdev, PCI_COMMAND, &command);
> + if (rc)
> + return pcibios_err_to_errno(rc);
> +
> + if (!(command & PCI_COMMAND_MEMORY))
> + restore_command = true;
> +
> + if (restore_command) {
> + rc = pci_write_config_word(pdev, PCI_COMMAND,
> + command | PCI_COMMAND_MEMORY);
> + if (rc)
> + return pcibios_err_to_errno(rc);
> + }
> +
> + if (!info) {
> + info = kzalloc_obj(*info, GFP_KERNEL);
> + if (!info)
> + goto err_nomem;
> + allocated_info = true;
> + }
> +
> + rc = cxl_find_regblock(pdev, CXL_REGLOC_RBI_COMPONENT, &map);
> + if (rc)
> + goto out_restore_command;
> +
> + rc = cxl_setup_regs(&map);
> + if (rc)
> + goto out_restore_command;
> +
> + if (!map.component_map.hdm_decoder.valid) {
> + rc = -ENODEV;
> + goto out_restore_command;
> + }
> +
> + hdm = cxl_pci_hdm_map(pdev, &map, info);
> + if (IS_ERR(hdm)) {
> + rc = PTR_ERR(hdm);
> + hdm = NULL;
> + goto out_restore_command;
> + }
> +
> + decoder_count = cxl_hdm_decoder_count(readl(hdm +
> + CXL_HDM_DECODER_CAP_OFFSET));
> + if (decoder_count < 0) {
> + rc = decoder_count;
> + goto out_unmap;
> + }
> +
> + if (decoder_count > CXL_HDM_DECODER_MAX_COUNT) {
> + rc = -ENXIO;
> + goto out_unmap;
> + }
> +
> + if (info->decoder_count && info->decoder_count != decoder_count) {
> + rc = -ENXIO;
> + goto out_unmap;
> + }
> +
> + info->decoder_count = decoder_count;
> + info->global_ctrl = readl(hdm + CXL_HDM_DECODER_CTRL_OFFSET);
> + info->decoder_state = kcalloc(decoder_count,
> + sizeof(*info->decoder_state),
> + GFP_KERNEL);
> + if (!info->decoder_state) {
> + rc = -ENOMEM;
> + goto out_unmap;
> + }
> +
> + settings = info->settings;
> + for (int i = 0; i < info->decoder_count; i++) {
> + rc = cxl_pci_hdm_read_decoder(pdev, &info->decoder_state[i],
> + &settings[i], hdm, i);
> + if (rc)
> + goto out_unmap;
> + }
> +
> + if (restore_command) {
> + rc = pci_write_config_word(pdev, PCI_COMMAND, command);
> + if (rc)
> + goto out_restore_failed;
> + }
> +
> + scoped_guard(rwsem_write, &cxl_rwsem.dpa) {
> + if (pdev->hdm)
> + goto out_unmap;
> + pdev->hdm = info;
> + }
If the plan is to later use this routine to refresh the cached
information then how does it know that pdev->hdm is more fresh then the
recent @info snapshot? Otherwise this looks out of place because there
is no driver to race in this early context.
> + iounmap(hdm);
> + return 0;
> +
> +out_restore_failed:
> + rc = pcibios_err_to_errno(rc);
> + goto out_unmap;
> +err_nomem:
> + rc = -ENOMEM;
> + goto out_restore_command;
> +out_unmap:
> + if (hdm)
> + iounmap(hdm);
> +out_restore_command:
> + if (allocated_info) {
> + kfree(info->decoder_state);
> + kfree(info);
> + }
> + if (restore_command) {
> + int rc2;
> +
> + rc2 = pci_write_config_word(pdev, PCI_COMMAND, command);
> + if (rc2 && !rc)
> + rc = pcibios_err_to_errno(rc2);
> + }
> + return rc;
> +}
> +
> +void pci_cxl_hdm_init(struct pci_dev *pdev)
> +{
> + int rc;
> +
> + rc = __pci_cxl_hdm_init(pdev);
> + if (rc && rc != -ENOTTY && rc != -ENODEV)
> + pci_dbg(pdev, "CXL HDM cache init failed: %d\n", rc);
> +}
> diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
> index dd0abbc63e18..8080389d1fc3 100644
> --- a/drivers/pci/probe.c
> +++ b/drivers/pci/probe.c
> @@ -24,6 +24,7 @@
> #include <linux/pm_runtime.h>
> #include <linux/bitfield.h>
> #include <trace/events/pci.h>
> +#include <cxl/cxl.h>
> #include "pci.h"
>
> static struct resource busn_resource = {
> @@ -2484,6 +2485,7 @@ static void pci_release_dev(struct device *dev)
> struct pci_dev *pci_dev;
>
> pci_dev = to_pci_dev(dev);
> + pci_cxl_hdm_release(pci_dev);
> pci_release_capabilities(pci_dev);
> pci_release_of_node(pci_dev);
> pcibios_release_device(pci_dev);
> @@ -2674,6 +2676,7 @@ static void pci_init_capabilities(struct pci_dev *dev)
> pci_rebar_init(dev); /* Resizable BAR */
> pci_dev3_init(dev); /* Device 3 capabilities */
> pci_ide_init(dev); /* Link Integrity and Data Encryption */
> + pci_cxl_hdm_init(dev); /* CXL HDM Decoder Capability */
I think Richard has a point that this is too early to be using device
MMIO resources. I took a look and the proper place appears to be
pci_bus_add_device(). Note how some of the quirks invoked by:
pci_fixup_device(pci_fixup_final, dev);
...do their own command register fixups and ioremap().
^ permalink raw reply [flat|nested] 28+ messages in thread
* [PATCH v9 05/11] cxl: Add CXL Device Reset helper
2026-07-09 1:02 [PATCH v9 00/11] PCI/CXL: Add CXL reset support for Type 2 devices Srirangan Madhavan
` (3 preceding siblings ...)
2026-07-09 1:02 ` [PATCH v9 04/11] cxl: Cache endpoint decoder settings during PCI enumeration Srirangan Madhavan
@ 2026-07-09 1:02 ` Srirangan Madhavan
2026-07-09 1:15 ` sashiko-bot
2026-07-09 1:02 ` [PATCH v9 06/11] cxl: Validate HDM ranges before CXL reset Srirangan Madhavan
` (6 subsequent siblings)
11 siblings, 1 reply; 28+ messages in thread
From: Srirangan Madhavan @ 2026-07-09 1:02 UTC (permalink / raw)
To: Alison Schofield, Bjorn Helgaas, Dan Williams, Dave Jiang,
Davidlohr Bueso, Jonathan Cameron, Vishal Verma, linux-cxl,
linux-pci, linux-kernel
Cc: Alex Williamson, vsethi, alwilliamson, Dan Williams,
Sai Yashwanth Reddy Kancherla, Vishal Aslot, Manish Honap,
Jiandi An, Richard Cheng, linux-tegra, Srirangan Madhavan
Add an internal CXL Device Reset helper for Type 2 functions that advertise
CXL Reset in the CXL Device DVSEC. The helper disables CXL.cache, performs
cache writeback when supported, initiates reset with Memory Clear disabled,
waits for completion, and re-enables CXL.cache on exit.
Leave the helper unregistered until range validation and reset-scope
validation are in place.
Signed-off-by: Srirangan Madhavan <smadhavan@nvidia.com>
---
drivers/cxl/core/reset.c | 224 ++++++++++++++++++++++++++++++++++
include/cxl/cxl.h | 7 ++
include/uapi/linux/pci_regs.h | 13 ++
3 files changed, 244 insertions(+)
diff --git a/drivers/cxl/core/reset.c b/drivers/cxl/core/reset.c
index 97b72cc67b6b..7a9b1ecfadcf 100644
--- a/drivers/cxl/core/reset.c
+++ b/drivers/cxl/core/reset.c
@@ -7,6 +7,8 @@
#include <linux/export.h>
#include <linux/io.h>
#include <linux/ioport.h>
+#include <linux/iommu.h>
+#include <linux/jiffies.h>
#include <linux/kernel.h>
#include <linux/pci.h>
#include <linux/slab.h>
@@ -449,3 +451,225 @@ void pci_cxl_hdm_init(struct pci_dev *pdev)
if (rc && rc != -ENOTTY && rc != -ENODEV)
pci_dbg(pdev, "CXL HDM cache init failed: %d\n", rc);
}
+
+/*
+ * CXL r4.0 sec 9.7.2 defines the reset completion timeout encodings.
+ * Sec 9.7.3 leaves config-space access behavior undefined for 100 ms after
+ * initiating CXL Reset, then limits software to CXL Status2 access until
+ * reset completion, timeout, or error.
+ */
+#define CXL_RESET_RRS_WAIT_MS 100
+#define CXL_RESET_STATUS_POLL_MS 20
+static const u32 cxl_reset_timeout_ms[] = {
+ 10, 100, 1000, 10000, 100000,
+};
+
+#define CXL_CACHE_WBI_TIMEOUT_US 100000
+#define CXL_CACHE_WBI_POLL_US 100
+
+static int cxl_reset_dvsec(struct pci_dev *pdev)
+{
+ int dvsec, rc;
+ u16 cap;
+
+ dvsec = pci_find_dvsec_capability(pdev, PCI_VENDOR_ID_CXL,
+ PCI_DVSEC_CXL_DEVICE);
+ if (!dvsec)
+ return -ENOTTY;
+
+ rc = pci_read_config_word(pdev, dvsec + PCI_DVSEC_CXL_CAP, &cap);
+ if (rc)
+ return pcibios_err_to_errno(rc);
+
+ if ((cap & (PCI_DVSEC_CXL_CACHE_CAPABLE |
+ PCI_DVSEC_CXL_MEM_CAPABLE)) !=
+ (PCI_DVSEC_CXL_CACHE_CAPABLE | PCI_DVSEC_CXL_MEM_CAPABLE))
+ return -ENOTTY;
+
+ if (!(cap & PCI_DVSEC_CXL_RST_CAPABLE))
+ return -ENOTTY;
+
+ return dvsec;
+}
+
+static int cxl_reset_update_ctrl2(struct pci_dev *pdev, int dvsec, u16 set,
+ u16 clear)
+{
+ u16 cmd = PCI_DVSEC_CXL_INIT_CACHE_WBI | PCI_DVSEC_CXL_INIT_CXL_RST;
+ u16 ctrl2;
+ int rc;
+
+ rc = pci_read_config_word(pdev, dvsec + PCI_DVSEC_CXL_CTRL2, &ctrl2);
+ if (rc)
+ return pcibios_err_to_errno(rc);
+
+ ctrl2 &= ~cmd;
+ ctrl2 |= set;
+ ctrl2 &= ~clear;
+
+ rc = pci_write_config_word(pdev, dvsec + PCI_DVSEC_CXL_CTRL2, ctrl2);
+ if (rc)
+ return pcibios_err_to_errno(rc);
+
+ return 0;
+}
+
+static int cxl_reset_enable_cache(struct pci_dev *pdev, int dvsec)
+{
+ return cxl_reset_update_ctrl2(pdev, dvsec, 0,
+ PCI_DVSEC_CXL_DISABLE_CACHING);
+}
+
+static int cxl_reset_disable_cache(struct pci_dev *pdev, int dvsec, u16 cap)
+{
+ int remaining_us = CXL_CACHE_WBI_TIMEOUT_US;
+ u16 status2;
+ int rc, rc2;
+
+ rc = cxl_reset_update_ctrl2(pdev, dvsec,
+ PCI_DVSEC_CXL_DISABLE_CACHING, 0);
+ if (rc)
+ return rc;
+
+ if (!(cap & PCI_DVSEC_CXL_CACHE_WBI_CAPABLE))
+ return 0;
+
+ rc = cxl_reset_update_ctrl2(pdev, dvsec,
+ PCI_DVSEC_CXL_INIT_CACHE_WBI, 0);
+ if (rc)
+ goto err_enable_cache;
+
+ do {
+ usleep_range(CXL_CACHE_WBI_POLL_US, CXL_CACHE_WBI_POLL_US + 1);
+ remaining_us -= CXL_CACHE_WBI_POLL_US;
+
+ rc = pci_read_config_word(pdev, dvsec + PCI_DVSEC_CXL_STATUS2,
+ &status2);
+ if (rc) {
+ rc = pcibios_err_to_errno(rc);
+ goto err_enable_cache;
+ }
+ } while (!(status2 & PCI_DVSEC_CXL_CACHE_INV) && remaining_us > 0);
+
+ if (!(status2 & PCI_DVSEC_CXL_CACHE_INV)) {
+ rc = -ETIMEDOUT;
+ goto err_enable_cache;
+ }
+
+ return 0;
+
+err_enable_cache:
+ /*
+ * DISABLE_CACHING can be rolled back here. INIT_CACHE_WBI is
+ * self-clearing on completion, so leave any in-flight writeback alone.
+ */
+ rc2 = cxl_reset_enable_cache(pdev, dvsec);
+ if (rc2)
+ pci_warn(pdev, "failed to re-enable CXL caching: %d\n", rc2);
+ return rc;
+}
+
+static int cxl_reset_wait_done(struct pci_dev *pdev, int dvsec, u16 cap)
+{
+ unsigned long deadline;
+ u32 timeout_ms;
+ u16 status2;
+ int idx, rc;
+
+ idx = FIELD_GET(PCI_DVSEC_CXL_RST_TIMEOUT, cap);
+ if (idx >= ARRAY_SIZE(cxl_reset_timeout_ms)) {
+ int last = ARRAY_SIZE(cxl_reset_timeout_ms) - 1;
+
+ pci_warn(pdev,
+ "unknown CXL reset timeout encoding %d; using %u ms\n",
+ idx, cxl_reset_timeout_ms[last]);
+ idx = last;
+ }
+
+ timeout_ms = max_t(u32, cxl_reset_timeout_ms[idx],
+ CXL_RESET_RRS_WAIT_MS);
+ deadline = jiffies + msecs_to_jiffies(timeout_ms);
+ msleep(CXL_RESET_RRS_WAIT_MS);
+
+ do {
+ rc = pci_read_config_word(pdev, dvsec + PCI_DVSEC_CXL_STATUS2,
+ &status2);
+ if (rc || status2 == U16_MAX)
+ goto not_ready;
+
+ if (status2 & PCI_DVSEC_CXL_RST_ERR)
+ return -EIO;
+
+ if (status2 & PCI_DVSEC_CXL_RST_DONE)
+ return 0;
+
+not_ready:
+ if (time_after_eq(jiffies, deadline))
+ return -ETIMEDOUT;
+
+ msleep(CXL_RESET_STATUS_POLL_MS);
+ } while (true);
+}
+
+static int cxl_reset_execute(struct pci_dev *pdev, int dvsec)
+{
+ bool cache_disabled = false;
+ u16 cap;
+ int rc;
+
+ rc = pci_read_config_word(pdev, dvsec + PCI_DVSEC_CXL_CAP, &cap);
+ if (rc)
+ return pcibios_err_to_errno(rc);
+
+ if (!pci_wait_for_pending_transaction(pdev))
+ pci_err(pdev, "timed out waiting for pending transactions\n");
+
+ rc = pci_dev_reset_iommu_prepare(pdev);
+ if (rc) {
+ pci_err(pdev, "failed to stop IOMMU for CXL reset: %d\n", rc);
+ return rc;
+ }
+
+ rc = cxl_reset_disable_cache(pdev, dvsec, cap);
+ if (rc)
+ goto out;
+ cache_disabled = true;
+
+ rc = cxl_reset_update_ctrl2(pdev, dvsec, PCI_DVSEC_CXL_INIT_CXL_RST,
+ PCI_DVSEC_CXL_RST_MEM_CLR_EN);
+ if (rc)
+ goto out;
+
+ rc = cxl_reset_wait_done(pdev, dvsec, cap);
+ if (rc)
+ goto out;
+
+out:
+ if (cache_disabled) {
+ int rc2;
+
+ rc2 = cxl_reset_enable_cache(pdev, dvsec);
+ if (rc2 && rc)
+ pci_warn(pdev, "failed to re-enable CXL caching: %d\n",
+ rc2);
+ else if (rc2)
+ rc = rc2;
+ }
+
+ pci_dev_reset_iommu_done(pdev);
+ return rc;
+}
+
+int cxl_reset_function(struct pci_dev *pdev, bool probe)
+{
+ int dvsec;
+
+ dvsec = cxl_reset_dvsec(pdev);
+ if (dvsec < 0)
+ return dvsec;
+
+ if (probe)
+ return 0;
+
+ return cxl_reset_execute(pdev, dvsec);
+}
diff --git a/include/cxl/cxl.h b/include/cxl/cxl.h
index 2215fe1c3f78..de58f484b7d9 100644
--- a/include/cxl/cxl.h
+++ b/include/cxl/cxl.h
@@ -9,6 +9,7 @@
#include <linux/node.h>
#include <linux/ioport.h>
#include <linux/range.h>
+#include <linux/errno.h>
#include <cxl/mailbox.h>
/**
@@ -153,6 +154,7 @@ int cxl_commit(struct cxl_decoder_settings *settings, void __iomem *hdm);
#ifdef CONFIG_CXL_HDM
void pci_cxl_hdm_init(struct pci_dev *pdev);
void pci_cxl_hdm_release(struct pci_dev *pdev);
+int cxl_reset_function(struct pci_dev *pdev, bool probe);
#else
static inline void pci_cxl_hdm_init(struct pci_dev *pdev)
{
@@ -161,6 +163,11 @@ static inline void pci_cxl_hdm_init(struct pci_dev *pdev)
static inline void pci_cxl_hdm_release(struct pci_dev *pdev)
{
}
+
+static inline int cxl_reset_function(struct pci_dev *pdev, bool probe)
+{
+ return -ENOTTY;
+}
#endif
struct cxl_reg_map {
diff --git a/include/uapi/linux/pci_regs.h b/include/uapi/linux/pci_regs.h
index facaa324bd86..9b24cdcfd648 100644
--- a/include/uapi/linux/pci_regs.h
+++ b/include/uapi/linux/pci_regs.h
@@ -1352,8 +1352,21 @@
#define PCI_DVSEC_CXL_CACHE_CAPABLE _BITUL(0)
#define PCI_DVSEC_CXL_MEM_CAPABLE _BITUL(2)
#define PCI_DVSEC_CXL_HDM_COUNT __GENMASK(5, 4)
+#define PCI_DVSEC_CXL_CACHE_WBI_CAPABLE _BITUL(6)
+#define PCI_DVSEC_CXL_RST_CAPABLE _BITUL(7)
+#define PCI_DVSEC_CXL_RST_TIMEOUT __GENMASK(10, 8)
+#define PCI_DVSEC_CXL_RST_MEM_CLR_CAPABLE _BITUL(11)
#define PCI_DVSEC_CXL_CTRL 0xC
#define PCI_DVSEC_CXL_MEM_ENABLE _BITUL(2)
+#define PCI_DVSEC_CXL_CTRL2 0x10
+#define PCI_DVSEC_CXL_DISABLE_CACHING _BITUL(0)
+#define PCI_DVSEC_CXL_INIT_CACHE_WBI _BITUL(1)
+#define PCI_DVSEC_CXL_INIT_CXL_RST _BITUL(2)
+#define PCI_DVSEC_CXL_RST_MEM_CLR_EN _BITUL(3)
+#define PCI_DVSEC_CXL_STATUS2 0x12
+#define PCI_DVSEC_CXL_CACHE_INV _BITUL(0)
+#define PCI_DVSEC_CXL_RST_DONE _BITUL(1)
+#define PCI_DVSEC_CXL_RST_ERR _BITUL(2)
#define PCI_DVSEC_CXL_RANGE_SIZE_HIGH(i) (0x18 + (i * 0x10))
#define PCI_DVSEC_CXL_RANGE_SIZE_LOW(i) (0x1C + (i * 0x10))
#define PCI_DVSEC_CXL_MEM_INFO_VALID _BITUL(0)
--
2.43.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* Re: [PATCH v9 05/11] cxl: Add CXL Device Reset helper
2026-07-09 1:02 ` [PATCH v9 05/11] cxl: Add CXL Device Reset helper Srirangan Madhavan
@ 2026-07-09 1:15 ` sashiko-bot
0 siblings, 0 replies; 28+ messages in thread
From: sashiko-bot @ 2026-07-09 1:15 UTC (permalink / raw)
To: Srirangan Madhavan; +Cc: linux-cxl, linux-pci
Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
- [High] Incorrect ordering of CXL cache writeback (WBI), pending transaction wait, and IOMMU reset preparation.
- [Medium] Premature success of WBI wait loop on device disconnect due to unhandled U16_MAX status.
- [Medium] Potential false timeout in the reset wait loop due to a missing final hardware status check.
--
--- Patch [5]: [PATCH v9 05/11] cxl: Add CXL Device Reset helper ---
commit c832f1294f231fc19fa036ee29639b20e723c1a1
Author: Srirangan Madhavan <smadhavan@nvidia.com>
cxl: Add CXL Device Reset helper
This commit adds an internal CXL Device Reset helper for Type 2 functions
that advertise CXL Reset in the CXL Device DVSEC. The helper handles cache
disabling, writeback, reset initiation, and re-enabling caching.
> diff --git a/drivers/cxl/core/reset.c b/drivers/cxl/core/reset.c
> index 97b72cc67b6bd..7a9b1ecfadcf9 100644
> --- a/drivers/cxl/core/reset.c
> +++ b/drivers/cxl/core/reset.c
[ ... ]
> +static int cxl_reset_disable_cache(struct pci_dev *pdev, int dvsec, u16 cap)
> +{
> + int remaining_us = CXL_CACHE_WBI_TIMEOUT_US;
> + u16 status2;
> + int rc, rc2;
> +
> + rc = cxl_reset_update_ctrl2(pdev, dvsec,
> + PCI_DVSEC_CXL_DISABLE_CACHING, 0);
> + if (rc)
> + return rc;
> +
> + if (!(cap & PCI_DVSEC_CXL_CACHE_WBI_CAPABLE))
> + return 0;
> +
> + rc = cxl_reset_update_ctrl2(pdev, dvsec,
> + PCI_DVSEC_CXL_INIT_CACHE_WBI, 0);
> + if (rc)
> + goto err_enable_cache;
> +
> + do {
> + usleep_range(CXL_CACHE_WBI_POLL_US, CXL_CACHE_WBI_POLL_US + 1);
> + remaining_us -= CXL_CACHE_WBI_POLL_US;
> +
> + rc = pci_read_config_word(pdev, dvsec + PCI_DVSEC_CXL_STATUS2,
> + &status2);
> + if (rc) {
> + rc = pcibios_err_to_errno(rc);
> + goto err_enable_cache;
> + }
> + } while (!(status2 & PCI_DVSEC_CXL_CACHE_INV) && remaining_us > 0);
[Severity: Medium]
If the device is disconnected or offline, pci_read_config_word() will return
success (0) and set status2 to U16_MAX (0xFFFF). Would this cause the loop
condition !(status2 & PCI_DVSEC_CXL_CACHE_INV) to evaluate to false and
bypass the wait entirely, falsely reporting success?
> +
> + if (!(status2 & PCI_DVSEC_CXL_CACHE_INV)) {
> + rc = -ETIMEDOUT;
> + goto err_enable_cache;
> + }
> +
> + return 0;
[ ... ]
> +static int cxl_reset_wait_done(struct pci_dev *pdev, int dvsec, u16 cap)
> +{
[ ... ]
> + do {
> + rc = pci_read_config_word(pdev, dvsec + PCI_DVSEC_CXL_STATUS2,
> + &status2);
> + if (rc || status2 == U16_MAX)
> + goto not_ready;
> +
> + if (status2 & PCI_DVSEC_CXL_RST_ERR)
> + return -EIO;
> +
> + if (status2 & PCI_DVSEC_CXL_RST_DONE)
> + return 0;
> +
> +not_ready:
> + if (time_after_eq(jiffies, deadline))
> + return -ETIMEDOUT;
[Severity: Medium]
Does this timeout check need a final hardware status read?
If a thread preemption, interrupt, or scheduling delay occurs after the
config space read but before the timeout check, the hardware condition may
be met concurrently while the jiffies have advanced past the deadline. This
could potentially lead to a false -ETIMEDOUT error despite the device being
ready.
> +
> + msleep(CXL_RESET_STATUS_POLL_MS);
> + } while (true);
> +}
> +
> +static int cxl_reset_execute(struct pci_dev *pdev, int dvsec)
> +{
> + bool cache_disabled = false;
> + u16 cap;
> + int rc;
> +
> + rc = pci_read_config_word(pdev, dvsec + PCI_DVSEC_CXL_CAP, &cap);
> + if (rc)
> + return pcibios_err_to_errno(rc);
> +
> + if (!pci_wait_for_pending_transaction(pdev))
> + pci_err(pdev, "timed out waiting for pending transactions\n");
> +
> + rc = pci_dev_reset_iommu_prepare(pdev);
> + if (rc) {
> + pci_err(pdev, "failed to stop IOMMU for CXL reset: %d\n", rc);
> + return rc;
> + }
> +
> + rc = cxl_reset_disable_cache(pdev, dvsec, cap);
[Severity: High]
Is it safe to wait for pending transactions and prepare the IOMMU for reset
before initiating the CXL cache Write-Back Invalidate (WBI)?
Initiating WBI in cxl_reset_disable_cache() forces the device to flush its
dirty cache lines via new DMA transactions. If the IOMMU has already been
prepared for reset (which may disable ATS, PRI, and block translations), could
these WBI transactions fault and lead to silent data loss or IOMMU errors?
Additionally, creating new pending transactions immediately before asserting
the CXL Reset might violate the PCIe requirement to drain all transactions
prior to reset. Should cxl_reset_disable_cache() happen before the IOMMU
preparation and pending transaction wait?
> + if (rc)
> + goto out;
> + cache_disabled = true;
> +
> + rc = cxl_reset_update_ctrl2(pdev, dvsec, PCI_DVSEC_CXL_INIT_CXL_RST,
> + PCI_DVSEC_CXL_RST_MEM_CLR_EN);
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260709010304.680422-1-smadhavan@nvidia.com?part=5
^ permalink raw reply [flat|nested] 28+ messages in thread
* [PATCH v9 06/11] cxl: Validate HDM ranges before CXL reset
2026-07-09 1:02 [PATCH v9 00/11] PCI/CXL: Add CXL reset support for Type 2 devices Srirangan Madhavan
` (4 preceding siblings ...)
2026-07-09 1:02 ` [PATCH v9 05/11] cxl: Add CXL Device Reset helper Srirangan Madhavan
@ 2026-07-09 1:02 ` Srirangan Madhavan
2026-07-09 1:28 ` sashiko-bot
2026-07-09 1:03 ` [PATCH v9 07/11] PCI/CXL: Discover the CXL reset scope Srirangan Madhavan
` (5 subsequent siblings)
11 siblings, 1 reply; 28+ messages in thread
From: Srirangan Madhavan @ 2026-07-09 1:02 UTC (permalink / raw)
To: Alison Schofield, Bjorn Helgaas, Dan Williams, Dave Jiang,
Davidlohr Bueso, Jonathan Cameron, Vishal Verma, linux-cxl,
linux-pci, linux-kernel
Cc: Alex Williamson, vsethi, alwilliamson, Dan Williams,
Sai Yashwanth Reddy Kancherla, Vishal Aslot, Manish Honap,
Jiandi An, Richard Cheng, linux-tegra, Srirangan Madhavan
Before reset, collect enabled cached HDM decoder ranges and reserve them
with request_mem_region(). This rejects reset while affected CXL memory is
busy and keeps the validation stable through reset.
If CPU cache invalidation support is available, invalidate the affected
ranges before reset. If the runtime backend is unavailable, continue after
the range reservation succeeds.
Signed-off-by: Srirangan Madhavan <smadhavan@nvidia.com>
---
drivers/cxl/core/reset.c | 240 ++++++++++++++++++++++++++++++++++++++-
1 file changed, 239 insertions(+), 1 deletion(-)
diff --git a/drivers/cxl/core/reset.c b/drivers/cxl/core/reset.c
index 7a9b1ecfadcf..fb741b66e502 100644
--- a/drivers/cxl/core/reset.c
+++ b/drivers/cxl/core/reset.c
@@ -10,6 +10,8 @@
#include <linux/iommu.h>
#include <linux/jiffies.h>
#include <linux/kernel.h>
+#include <linux/list.h>
+#include <linux/memregion.h>
#include <linux/pci.h>
#include <linux/slab.h>
@@ -467,6 +469,231 @@ static const u32 cxl_reset_timeout_ms[] = {
#define CXL_CACHE_WBI_TIMEOUT_US 100000
#define CXL_CACHE_WBI_POLL_US 100
+struct cxl_hdm_range {
+ struct list_head list;
+ struct pci_dev *pdev;
+ struct range hpa_range;
+ struct resource *res;
+};
+
+struct cxl_hdm_range_context {
+ struct list_head ranges;
+};
+
+static void cxl_hdm_range_context_init(struct cxl_hdm_range_context *ctx)
+{
+ INIT_LIST_HEAD(&ctx->ranges);
+}
+
+static void cxl_hdm_range_context_destroy(struct cxl_hdm_range_context *ctx)
+{
+ struct cxl_hdm_range *range, *next;
+
+ list_for_each_entry_safe(range, next, &ctx->ranges, list) {
+ list_del(&range->list);
+ if (range->res)
+ release_mem_region(range->hpa_range.start,
+ resource_size(range->res));
+ kfree(range);
+ }
+}
+
+static int cxl_hdm_range_add(struct cxl_hdm_range_context *ctx,
+ struct pci_dev *pdev, const struct range *hpa_range)
+{
+ struct cxl_hdm_range *range;
+
+ if (hpa_range->end < hpa_range->start)
+ return -EINVAL;
+
+ list_for_each_entry(range, &ctx->ranges, list)
+ if (range->hpa_range.start == hpa_range->start &&
+ range->hpa_range.end == hpa_range->end)
+ return 0;
+
+ range = kzalloc_obj(*range);
+ if (!range)
+ return -ENOMEM;
+
+ range->pdev = pdev;
+ range->hpa_range = *hpa_range;
+ list_add_tail(&range->list, &ctx->ranges);
+
+ return 0;
+}
+
+static int cxl_hdm_ranges_collect(struct cxl_hdm_range_context *ctx,
+ struct pci_dev *pdev)
+{
+ struct cxl_hdm_info *info = READ_ONCE(pdev->hdm);
+ int rc;
+
+ if (!info) {
+ pci_err(pdev, "CXL HDM decoder state unavailable\n");
+ return -ENXIO;
+ }
+
+ for (int i = 0; i < info->decoder_count; i++) {
+ struct cxl_decoder_settings *settings = &info->settings[i];
+
+ if (!(settings->flags & CXL_DECODER_F_ENABLE))
+ continue;
+
+ if (settings->flags & CXL_DECODER_F_NORMALIZED_ADDRESSING) {
+ pci_err(pdev,
+ "CXL reset does not support normalized address decoders\n");
+ return -EOPNOTSUPP;
+ }
+
+ rc = cxl_hdm_range_add(ctx, pdev, &settings->hpa_range);
+ if (rc)
+ return rc;
+ }
+
+ return 0;
+}
+
+static int cxl_hdm_range_len(struct pci_dev *pdev,
+ const struct range *hpa_range, u64 *len)
+{
+ if (sizeof(resource_size_t) < sizeof(hpa_range->start) &&
+ (hpa_range->start > (resource_size_t)~0ULL ||
+ hpa_range->end > (resource_size_t)~0ULL)) {
+ pci_err(pdev,
+ "CXL reset range [%#llx-%#llx] exceeds resource address size\n",
+ hpa_range->start, hpa_range->end);
+ return -EOVERFLOW;
+ }
+
+ if (hpa_range->end < hpa_range->start)
+ return -EINVAL;
+
+ if (!hpa_range->start && hpa_range->end == U64_MAX) {
+ pci_err(pdev,
+ "CXL reset range [%#llx-%#llx] exceeds resource size\n",
+ hpa_range->start, hpa_range->end);
+ return -EOVERFLOW;
+ }
+
+ *len = range_len(hpa_range);
+ if (sizeof(resource_size_t) < sizeof(*len) &&
+ *len > (resource_size_t)~0ULL) {
+ pci_err(pdev,
+ "CXL reset range [%#llx-%#llx] exceeds resource size\n",
+ hpa_range->start, hpa_range->end);
+ return -EOVERFLOW;
+ }
+
+ if (sizeof(size_t) < sizeof(*len) && *len > SIZE_MAX) {
+ pci_err(pdev,
+ "CXL reset range [%#llx-%#llx] exceeds cache flush size\n",
+ hpa_range->start, hpa_range->end);
+ return -EOVERFLOW;
+ }
+
+ return 0;
+}
+
+static int cxl_hdm_range_request(struct cxl_hdm_range *range)
+{
+ struct pci_dev *pdev = range->pdev;
+ const struct range *hpa_range = &range->hpa_range;
+ u64 len;
+ int rc;
+
+ rc = cxl_hdm_range_len(pdev, hpa_range, &len);
+ if (rc)
+ return rc;
+
+ range->res = request_mem_region(hpa_range->start, len, "cxl_reset");
+ if (!range->res) {
+ pci_err(pdev,
+ "cannot reset while CXL memory range is busy [%#llx-%#llx]\n",
+ hpa_range->start, hpa_range->end);
+ return -EBUSY;
+ }
+
+ return 0;
+}
+
+static int cxl_hdm_ranges_request(struct cxl_hdm_range_context *ctx)
+{
+ struct cxl_hdm_range *range;
+ int rc;
+
+ lockdep_assert_held_write(&cxl_rwsem.region);
+
+ list_for_each_entry(range, &ctx->ranges, list) {
+ rc = cxl_hdm_range_request(range);
+ if (rc)
+ return rc;
+ }
+
+ return 0;
+}
+
+static int cxl_hdm_range_flush_cache(struct cxl_hdm_range *range)
+{
+ struct pci_dev *pdev = range->pdev;
+ const struct range *hpa_range = &range->hpa_range;
+ u64 len;
+ int rc;
+
+ rc = cxl_hdm_range_len(pdev, hpa_range, &len);
+ if (rc)
+ return rc;
+
+ rc = cpu_cache_invalidate_memregion(hpa_range->start, len);
+ if (rc)
+ pci_err(pdev,
+ "failed to invalidate CPU cache [%#llx-%#llx]: %d\n",
+ hpa_range->start, hpa_range->end, rc);
+
+ return rc;
+}
+
+static int cxl_hdm_ranges_flush_cpu_caches(struct cxl_hdm_range_context *ctx,
+ struct pci_dev *pdev)
+{
+ struct cxl_hdm_range *range;
+ int rc;
+
+ if (list_empty(&ctx->ranges))
+ return 0;
+
+ if (!cpu_cache_has_invalidate_memregion()) {
+ pci_warn(pdev,
+ "CPU cache synchronization unavailable; continuing without cache invalidation\n");
+ return 0;
+ }
+
+ list_for_each_entry(range, &ctx->ranges, list) {
+ rc = cxl_hdm_range_flush_cache(range);
+ if (rc)
+ return rc;
+ }
+
+ return 0;
+}
+
+static int cxl_hdm_ranges_prepare(struct cxl_hdm_range_context *ctx,
+ struct pci_dev *pdev)
+{
+ int rc;
+
+ lockdep_assert_held_write(&cxl_rwsem.region);
+
+ rc = cxl_hdm_ranges_collect(ctx, pdev);
+ if (rc)
+ return rc;
+
+ rc = cxl_hdm_ranges_request(ctx);
+ if (rc)
+ return rc;
+
+ return cxl_hdm_ranges_flush_cpu_caches(ctx, pdev);
+}
+
static int cxl_reset_dvsec(struct pci_dev *pdev)
{
int dvsec, rc;
@@ -662,7 +889,9 @@ static int cxl_reset_execute(struct pci_dev *pdev, int dvsec)
int cxl_reset_function(struct pci_dev *pdev, bool probe)
{
+ struct cxl_hdm_range_context range_ctx;
int dvsec;
+ int rc;
dvsec = cxl_reset_dvsec(pdev);
if (dvsec < 0)
@@ -671,5 +900,14 @@ int cxl_reset_function(struct pci_dev *pdev, bool probe)
if (probe)
return 0;
- return cxl_reset_execute(pdev, dvsec);
+ cxl_hdm_range_context_init(&range_ctx);
+
+ scoped_guard(rwsem_write, &cxl_rwsem.region) {
+ rc = cxl_hdm_ranges_prepare(&range_ctx, pdev);
+ if (!rc)
+ rc = cxl_reset_execute(pdev, dvsec);
+ }
+
+ cxl_hdm_range_context_destroy(&range_ctx);
+ return rc;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* Re: [PATCH v9 06/11] cxl: Validate HDM ranges before CXL reset
2026-07-09 1:02 ` [PATCH v9 06/11] cxl: Validate HDM ranges before CXL reset Srirangan Madhavan
@ 2026-07-09 1:28 ` sashiko-bot
0 siblings, 0 replies; 28+ messages in thread
From: sashiko-bot @ 2026-07-09 1:28 UTC (permalink / raw)
To: Srirangan Madhavan; +Cc: linux-cxl, linux-pci
Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
- [High] cxl_hdm_ranges_collect() reads HDM decoder settings without holding the required cxl_rwsem.dpa lock, leading to data races with concurrent modifications.
- [High] cxl_hdm_range_context_destroy() releases memory regions outside the cxl_rwsem.region lock, causing spurious -EBUSY errors for concurrent resets.
- [Medium] Functions contain both goto-based error handling and scope-based cleanup (__free() / scoped_guard()), violating subsystem guidelines.
--
--- Patch [6]: [PATCH v9 06/11] cxl: Validate HDM ranges before CXL reset ---
commit c90294fef588f0141e340a7198edc3285f1a401d
Author: Srirangan Madhavan <smadhavan@nvidia.com>
cxl: Validate HDM ranges before CXL reset
Before reset, collect enabled cached HDM decoder ranges and reserve them
with request_mem_region(). This rejects reset while affected CXL memory is
busy and keeps the validation stable through reset.
[Severity: Medium]
Is it expected that cxl_restore_hdm() and __pci_cxl_hdm_init() mix
goto-based error handling with scope-based cleanup (__free() and
scoped_guard())?
The cleanup subsystem guidelines strictly mandate converting all resources
to scope-based cleanup or none of them to avoid LIFO ordering mistakes.
Mixing these paradigms increases the risk of double-free or resource leak
bugs due to confusing ownership semantics.
> diff --git a/drivers/cxl/core/reset.c b/drivers/cxl/core/reset.c
> index 7a9b1ecfadcf9..fb741b66e5022 100644
> --- a/drivers/cxl/core/reset.c
> +++ b/drivers/cxl/core/reset.c
[ ... ]
> @@ -467,6 +469,231 @@ static const u32 cxl_reset_timeout_ms[] = {
[ ... ]
> +static int cxl_hdm_ranges_collect(struct cxl_hdm_range_context *ctx,
> + struct pci_dev *pdev)
> +{
> + struct cxl_hdm_info *info = READ_ONCE(pdev->hdm);
> + int rc;
> +
> + if (!info) {
> + pci_err(pdev, "CXL HDM decoder state unavailable\n");
> + return -ENXIO;
> + }
> +
> + for (int i = 0; i < info->decoder_count; i++) {
> + struct cxl_decoder_settings *settings = &info->settings[i];
[Severity: High]
Is it safe to read info->settings[i] here without holding the
cxl_rwsem.dpa lock?
If a concurrent userspace PCI reset via sysfs triggers
cxl_reset_function() and calls cxl_hdm_ranges_collect(), this code
iterates over info->settings holding only cxl_rwsem.region.
Concurrently, an asynchronous device probe calling
cxl_hdm_info_set_decoder() could modify info->settings holding only
cxl_rwsem.dpa for write.
Could this lead to a torn read of settings->hpa_range, which is then
passed to request_mem_region(), potentially causing memory corruption or
a kernel panic by requesting a garbage memory region?
> +
> + if (!(settings->flags & CXL_DECODER_F_ENABLE))
> + continue;
[ ... ]
> @@ -662,7 +889,9 @@ static int cxl_reset_execute(struct pci_dev *pdev, int dvsec)
[ ... ]
> int cxl_reset_function(struct pci_dev *pdev, bool probe)
> {
> + struct cxl_hdm_range_context range_ctx;
> int dvsec;
> + int rc;
>
> dvsec = cxl_reset_dvsec(pdev);
> if (dvsec < 0)
> @@ -671,5 +900,14 @@ int cxl_reset_function(struct pci_dev *pdev, bool probe)
> if (probe)
> return 0;
>
> - return cxl_reset_execute(pdev, dvsec);
> + cxl_hdm_range_context_init(&range_ctx);
> +
> + scoped_guard(rwsem_write, &cxl_rwsem.region) {
> + rc = cxl_hdm_ranges_prepare(&range_ctx, pdev);
> + if (!rc)
> + rc = cxl_reset_execute(pdev, dvsec);
> + }
> +
> + cxl_hdm_range_context_destroy(&range_ctx);
[Severity: High]
Could this cause spurious -EBUSY errors for concurrent resets?
When two endpoints of an interleaved CXL region are reset concurrently,
they both attempt to lock the same hpa_range.
If thread A acquires cxl_rwsem.region, calls request_mem_region(), and
finishes the reset block, it then releases cxl_rwsem.region before calling
cxl_hdm_range_context_destroy() to release the memory region.
If thread B immediately acquires cxl_rwsem.region and calls
request_mem_region() on the same hpa_range, it seems thread B would fail
with -EBUSY because thread A still holds the global iomem_resource for
this range.
Would it be safer to place the context destruction inside the lock scope
to ensure proper serialization?
> + return rc;
> }
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260709010304.680422-1-smadhavan@nvidia.com?part=6
^ permalink raw reply [flat|nested] 28+ messages in thread
* [PATCH v9 07/11] PCI/CXL: Discover the CXL reset scope
2026-07-09 1:02 [PATCH v9 00/11] PCI/CXL: Add CXL reset support for Type 2 devices Srirangan Madhavan
` (5 preceding siblings ...)
2026-07-09 1:02 ` [PATCH v9 06/11] cxl: Validate HDM ranges before CXL reset Srirangan Madhavan
@ 2026-07-09 1:03 ` Srirangan Madhavan
2026-07-09 1:24 ` sashiko-bot
2026-07-10 1:00 ` Dan Williams (nvidia)
2026-07-09 1:03 ` [PATCH v9 08/11] cxl: Restore CXL HDM state after PCI reset Srirangan Madhavan
` (4 subsequent siblings)
11 siblings, 2 replies; 28+ messages in thread
From: Srirangan Madhavan @ 2026-07-09 1:03 UTC (permalink / raw)
To: Alison Schofield, Bjorn Helgaas, Dan Williams, Dave Jiang,
Davidlohr Bueso, Jonathan Cameron, Vishal Verma, linux-cxl,
linux-pci, linux-kernel
Cc: Alex Williamson, vsethi, alwilliamson, Dan Williams,
Sai Yashwanth Reddy Kancherla, Vishal Aslot, Manish Honap,
Jiandi An, Richard Cheng, linux-tegra, Srirangan Madhavan
Add reset context support to validate that CXL Reset is function-scoped
before advertising it as a PCI reset method. Use the Non-CXL Function
Map, ARI/devfn rules, and CXL.cache/mem capability bits to reject reset
when another same-scope function would also be affected.
If the Function Map cannot be read, warn and conservatively treat all
candidate same-scope functions as CXL-capable for scope validation.
Signed-off-by: Srirangan Madhavan <smadhavan@nvidia.com>
---
drivers/cxl/core/reset.c | 152 +++++++++++++++++++++++++++++++++-
include/uapi/linux/pci_regs.h | 1 +
2 files changed, 151 insertions(+), 2 deletions(-)
diff --git a/drivers/cxl/core/reset.c b/drivers/cxl/core/reset.c
index fb741b66e502..cdfaa699583d 100644
--- a/drivers/cxl/core/reset.c
+++ b/drivers/cxl/core/reset.c
@@ -1,5 +1,6 @@
// SPDX-License-Identifier: GPL-2.0-only
/* Copyright(c) 2026 NVIDIA Corporation. All rights reserved. */
+#include <linux/bitmap.h>
#include <linux/delay.h>
#include <linux/bug.h>
#include <linux/bitfield.h>
@@ -469,6 +470,21 @@ static const u32 cxl_reset_timeout_ms[] = {
#define CXL_CACHE_WBI_TIMEOUT_US 100000
#define CXL_CACHE_WBI_POLL_US 100
+/* CXL r4.0 sec 8.1.4 defines 256 bits of Non-CXL Function Map. */
+#define CXL_RESET_MAX_FUNCTIONS 256
+#define CXL_RESET_FUNCTION_MAP_REGS (CXL_RESET_MAX_FUNCTIONS / 32)
+
+struct cxl_reset_context {
+ struct pci_dev *target;
+};
+
+struct cxl_reset_walk_context {
+ struct cxl_reset_context *ctx;
+ DECLARE_BITMAP(non_cxl_func_map, CXL_RESET_MAX_FUNCTIONS);
+ bool ari;
+ int rc;
+};
+
struct cxl_hdm_range {
struct list_head list;
struct pci_dev *pdev;
@@ -480,6 +496,137 @@ struct cxl_hdm_range_context {
struct list_head ranges;
};
+static void cxl_reset_context_init(struct cxl_reset_context *ctx,
+ struct pci_dev *pdev)
+{
+ *ctx = (struct cxl_reset_context) {
+ .target = pdev,
+ };
+}
+
+static void cxl_reset_read_non_cxl_func_map(struct pci_dev *pdev,
+ unsigned long *map)
+{
+ u32 words[CXL_RESET_FUNCTION_MAP_REGS];
+ int dvsec, reg;
+
+ bitmap_zero(map, CXL_RESET_MAX_FUNCTIONS);
+
+ dvsec = pci_find_dvsec_capability(pdev, PCI_VENDOR_ID_CXL,
+ PCI_DVSEC_CXL_FUNCTION_MAP);
+ if (!dvsec)
+ return;
+
+ for (reg = 0; reg < CXL_RESET_FUNCTION_MAP_REGS; reg++) {
+ int offset = dvsec + PCI_DVSEC_CXL_FUNCTION_MAP_REG +
+ reg * sizeof(u32);
+ int rc;
+
+ rc = pci_read_config_dword(pdev, offset, &words[reg]);
+ if (rc) {
+ pci_warn(pdev,
+ "failed to read Non-CXL Function Map; treating same-scope functions as CXL\n");
+ bitmap_zero(map, CXL_RESET_MAX_FUNCTIONS);
+ return;
+ }
+ }
+
+ bitmap_from_arr32(map, words, CXL_RESET_MAX_FUNCTIONS);
+}
+
+static int cxl_reset_func_map_bit(struct pci_dev *sibling, bool ari)
+{
+ if (ari)
+ return sibling->devfn;
+
+ /*
+ * Without ARI, the Function Map is organized as 32 device slots per
+ * conventional 3-bit function number.
+ */
+ return PCI_FUNC(sibling->devfn) * 32 + PCI_SLOT(sibling->devfn);
+}
+
+static int cxl_reset_read_cxl_cap(struct pci_dev *pdev, u16 *cap)
+{
+ int dvsec, rc;
+
+ dvsec = pci_find_dvsec_capability(pdev, PCI_VENDOR_ID_CXL,
+ PCI_DVSEC_CXL_DEVICE);
+ if (!dvsec)
+ return -ENODEV;
+
+ rc = pci_read_config_word(pdev, dvsec + PCI_DVSEC_CXL_CAP, cap);
+ if (rc) {
+ rc = pcibios_err_to_errno(rc);
+ pci_warn(pdev, "failed to read CXL capability: %d\n", rc);
+ return rc;
+ }
+
+ return 0;
+}
+
+static int cxl_reset_has_cache_or_mem(struct pci_dev *pdev)
+{
+ u16 cap;
+ int rc;
+
+ rc = cxl_reset_read_cxl_cap(pdev, &cap);
+ if (rc == -ENODEV)
+ return 0;
+ if (rc)
+ return rc;
+
+ return !!(cap & (PCI_DVSEC_CXL_CACHE_CAPABLE |
+ PCI_DVSEC_CXL_MEM_CAPABLE));
+}
+
+static int cxl_reset_validate_function_scope(struct pci_dev *sibling,
+ void *data)
+{
+ struct cxl_reset_walk_context *wctx = data;
+ struct cxl_reset_context *ctx = wctx->ctx;
+ struct pci_dev *pdev = ctx->target;
+ int fn, rc;
+
+ if (sibling == pdev)
+ return 0;
+
+ if (sibling->bus != pdev->bus)
+ return 0;
+
+ if (!wctx->ari && PCI_SLOT(sibling->devfn) != PCI_SLOT(pdev->devfn))
+ return 0;
+
+ fn = cxl_reset_func_map_bit(sibling, wctx->ari);
+ if (test_bit(fn, wctx->non_cxl_func_map))
+ return 0;
+
+ rc = cxl_reset_has_cache_or_mem(sibling);
+ if (rc < 0) {
+ wctx->rc = rc;
+ return rc;
+ }
+ if (!rc)
+ return 0;
+
+ wctx->rc = -ENOTTY;
+ return wctx->rc;
+}
+
+static int cxl_reset_validate_function_scoped(struct cxl_reset_context *ctx)
+{
+ struct pci_dev *pdev = ctx->target;
+ struct cxl_reset_walk_context wctx = {
+ .ctx = ctx,
+ .ari = pci_ari_enabled(pdev->bus),
+ };
+
+ cxl_reset_read_non_cxl_func_map(pdev, wctx.non_cxl_func_map);
+ pci_walk_bus(pdev->bus, cxl_reset_validate_function_scope, &wctx);
+
+ return wctx.rc;
+}
+
static void cxl_hdm_range_context_init(struct cxl_hdm_range_context *ctx)
{
INIT_LIST_HEAD(&ctx->ranges);
@@ -890,6 +1037,7 @@ static int cxl_reset_execute(struct pci_dev *pdev, int dvsec)
int cxl_reset_function(struct pci_dev *pdev, bool probe)
{
struct cxl_hdm_range_context range_ctx;
+ struct cxl_reset_context ctx;
int dvsec;
int rc;
@@ -897,8 +1045,9 @@ int cxl_reset_function(struct pci_dev *pdev, bool probe)
if (dvsec < 0)
return dvsec;
+ cxl_reset_context_init(&ctx, pdev);
if (probe)
- return 0;
+ return cxl_reset_validate_function_scoped(&ctx);
cxl_hdm_range_context_init(&range_ctx);
@@ -907,7 +1056,6 @@ int cxl_reset_function(struct pci_dev *pdev, bool probe)
if (!rc)
rc = cxl_reset_execute(pdev, dvsec);
}
-
cxl_hdm_range_context_destroy(&range_ctx);
return rc;
}
diff --git a/include/uapi/linux/pci_regs.h b/include/uapi/linux/pci_regs.h
index 9b24cdcfd648..761057c90f5a 100644
--- a/include/uapi/linux/pci_regs.h
+++ b/include/uapi/linux/pci_regs.h
@@ -1381,6 +1381,7 @@
/* CXL r4.0, 8.1.4: Non-CXL Function Map DVSEC */
#define PCI_DVSEC_CXL_FUNCTION_MAP 2
+#define PCI_DVSEC_CXL_FUNCTION_MAP_REG 0x0C
/* CXL r4.0, 8.1.5: Extensions DVSEC for Ports */
#define PCI_DVSEC_CXL_PORT 3
--
2.43.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* Re: [PATCH v9 07/11] PCI/CXL: Discover the CXL reset scope
2026-07-09 1:03 ` [PATCH v9 07/11] PCI/CXL: Discover the CXL reset scope Srirangan Madhavan
@ 2026-07-09 1:24 ` sashiko-bot
2026-07-10 1:00 ` Dan Williams (nvidia)
1 sibling, 0 replies; 28+ messages in thread
From: sashiko-bot @ 2026-07-09 1:24 UTC (permalink / raw)
To: Srirangan Madhavan; +Cc: linux-pci, linux-cxl
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] CXL Reset scope validation is conditionally bypassed during actual reset execution, creating a TOCTOU vulnerability that fails to protect siblings.
--
--- Patch [7]: [PATCH v9 07/11] PCI/CXL: Discover the CXL reset scope ---
commit 363800e2ebd7dad78179683be8d0a027b5bd8a7e
Author: Srirangan Madhavan <smadhavan@nvidia.com>
PCI/CXL: Discover the CXL reset scope
This commit adds reset context support to validate that a CXL Reset is
function-scoped before advertising it as a PCI reset method. It uses the
Non-CXL Function Map, ARI/devfn rules, and CXL capability bits to reject
the reset if another same-scope function would be affected.
> diff --git a/drivers/cxl/core/reset.c b/drivers/cxl/core/reset.c
> index fb741b66e5022..cdfaa699583d2 100644
> --- a/drivers/cxl/core/reset.c
> +++ b/drivers/cxl/core/reset.c
[ ... ]
> @@ -890,6 +1037,7 @@ static int cxl_reset_execute(struct pci_dev *pdev, int dvsec)
> int cxl_reset_function(struct pci_dev *pdev, bool probe)
> {
> struct cxl_hdm_range_context range_ctx;
> + struct cxl_reset_context ctx;
> int dvsec;
> int rc;
>
> @@ -897,8 +1045,9 @@ int cxl_reset_function(struct pci_dev *pdev, bool probe)
> if (dvsec < 0)
> return dvsec;
>
> + cxl_reset_context_init(&ctx, pdev);
> if (probe)
> - return 0;
> + return cxl_reset_validate_function_scoped(&ctx);
[Severity: High]
Is it safe to conditionally bypass scope validation when probe is false?
During the early probe phase, when this is called from pci_init_capabilities()
for Function 0, higher-numbered sibling functions might not have been
enumerated and added to the bus list yet. As a result,
cxl_reset_validate_function_scoped() could find no siblings and incorrectly
report the reset as safe.
Later, when a user or driver actually triggers the reset and this function
is called with probe=0, it skips validation and executes the reset directly.
Could this inadvertently reset and destroy the state of active sibling
functions that were enumerated after the initial probe?
>
> cxl_hdm_range_context_init(&range_ctx);
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260709010304.680422-1-smadhavan@nvidia.com?part=7
^ permalink raw reply [flat|nested] 28+ messages in thread* Re: [PATCH v9 07/11] PCI/CXL: Discover the CXL reset scope
2026-07-09 1:03 ` [PATCH v9 07/11] PCI/CXL: Discover the CXL reset scope Srirangan Madhavan
2026-07-09 1:24 ` sashiko-bot
@ 2026-07-10 1:00 ` Dan Williams (nvidia)
1 sibling, 0 replies; 28+ messages in thread
From: Dan Williams (nvidia) @ 2026-07-10 1:00 UTC (permalink / raw)
To: Srirangan Madhavan, Alison Schofield, Bjorn Helgaas, Dan Williams,
Dave Jiang, Davidlohr Bueso, Jonathan Cameron, Vishal Verma,
linux-cxl, linux-pci, linux-kernel
Cc: Alex Williamson, vsethi, alwilliamson, Dan Williams,
Sai Yashwanth Reddy Kancherla, Vishal Aslot, Manish Honap,
Jiandi An, Richard Cheng, linux-tegra, Srirangan Madhavan
Srirangan Madhavan wrote:
> Add reset context support to validate that CXL Reset is function-scoped
> before advertising it as a PCI reset method. Use the Non-CXL Function
> Map, ARI/devfn rules, and CXL.cache/mem capability bits to reject reset
> when another same-scope function would also be affected.
>
> If the Function Map cannot be read, warn and conservatively treat all
> candidate same-scope functions as CXL-capable for scope validation.
I was hoping that all the sibling logic could be dropped after the
realization that function scoped reset *must* not affect siblings.
The small corner case of multi-function device, but only function0 is
impacted by CXL Reset can be an add-on patch if someone really needs it,
otherwise just do a simple:
if (dev->multifunction)
...check for now.
It would also be good to fix the bug in cxl_reset_bus_function() with
the same check. That handler currently allows reset for multifunction
devices. Give Alex credit with a Reported-by.
^ permalink raw reply [flat|nested] 28+ messages in thread
* [PATCH v9 08/11] cxl: Restore CXL HDM state after PCI reset
2026-07-09 1:02 [PATCH v9 00/11] PCI/CXL: Add CXL reset support for Type 2 devices Srirangan Madhavan
` (6 preceding siblings ...)
2026-07-09 1:03 ` [PATCH v9 07/11] PCI/CXL: Discover the CXL reset scope Srirangan Madhavan
@ 2026-07-09 1:03 ` Srirangan Madhavan
2026-07-09 1:17 ` sashiko-bot
2026-07-09 1:03 ` [PATCH v9 09/11] PCI/CXL: Expose CXL Reset as a PCI reset method Srirangan Madhavan
` (3 subsequent siblings)
11 siblings, 1 reply; 28+ messages in thread
From: Srirangan Madhavan @ 2026-07-09 1:03 UTC (permalink / raw)
To: Alison Schofield, Bjorn Helgaas, Dan Williams, Dave Jiang,
Davidlohr Bueso, Jonathan Cameron, Vishal Verma, linux-cxl,
linux-pci, linux-kernel
Cc: Alex Williamson, vsethi, alwilliamson, Dan Williams,
Sai Yashwanth Reddy Kancherla, Vishal Aslot, Manish Honap,
Jiandi An, Richard Cheng, linux-tegra, Srirangan Madhavan
After CXL reset, restore PCI config state enough to reach HDM MMIO,
restore cached global and per-decoder HDM state, and then run the normal
PCI restore callbacks.
Keep the target IOMMU reset block active until HDM restore completes so
Bus Master Enable cannot reopen DMA before decoder state is valid.
Signed-off-by: Srirangan Madhavan <smadhavan@nvidia.com>
---
drivers/cxl/core/hdm.c | 4 +
drivers/cxl/core/reset.c | 321 +++++++++++++++++++++++++++++++++++++--
2 files changed, 311 insertions(+), 14 deletions(-)
diff --git a/drivers/cxl/core/hdm.c b/drivers/cxl/core/hdm.c
index 7a1ade846c9c..96f0de889073 100644
--- a/drivers/cxl/core/hdm.c
+++ b/drivers/cxl/core/hdm.c
@@ -137,6 +137,10 @@ static void cxl_hdm_info_set_decoder(struct cxl_hdm *cxlhdm,
if (!info || cxld->id >= info->decoder_count)
return;
+ if (cxlhdm->regs.hdm_decoder)
+ info->global_ctrl = readl(cxlhdm->regs.hdm_decoder +
+ CXL_HDM_DECODER_CTRL_OFFSET);
+
if (cxld->flags & CXL_DECODER_F_ENABLE)
info->settings[cxld->id] = cxld->settings;
else
diff --git a/drivers/cxl/core/reset.c b/drivers/cxl/core/reset.c
index cdfaa699583d..f708c7b80acf 100644
--- a/drivers/cxl/core/reset.c
+++ b/drivers/cxl/core/reset.c
@@ -83,6 +83,21 @@ static int cxld_await_commit(void __iomem *hdm, int id)
return -ETIMEDOUT;
}
+static int cxld_await_uncommit(void __iomem *hdm, int id)
+{
+ u32 ctrl;
+ int i;
+
+ for (i = 0; i < COMMIT_TIMEOUT_MS; i++) {
+ ctrl = readl(hdm + CXL_HDM_DECODER0_CTRL_OFFSET(id));
+ if (!FIELD_GET(CXL_HDM_DECODER0_CTRL_COMMITTED, ctrl))
+ return 0;
+ fsleep(1000);
+ }
+
+ return -ETIMEDOUT;
+}
+
static void setup_hw_decoder(struct cxl_decoder_settings *settings,
void __iomem *hdm)
{
@@ -92,6 +107,8 @@ static void setup_hw_decoder(struct cxl_decoder_settings *settings,
u32 ctrl;
ctrl = readl(hdm + CXL_HDM_DECODER0_CTRL_OFFSET(id));
+ ctrl &= ~(CXL_HDM_DECODER0_CTRL_COMMIT |
+ CXL_HDM_DECODER0_CTRL_COMMIT_ERROR);
cxld_set_interleave(settings, &ctrl);
cxld_set_type(settings, &ctrl);
base = settings->hpa_range.start;
@@ -249,6 +266,31 @@ static void __iomem *cxl_pci_hdm_map(struct pci_dev *pdev,
return hdm;
}
+static void __iomem *cxl_pci_hdm_ioremap_current(struct pci_dev *pdev,
+ int bar,
+ resource_size_t offset,
+ resource_size_t size)
+{
+ resource_size_t hdm_start, bar_len;
+ void __iomem *hdm;
+
+ if (bar < 0 || bar >= PCI_STD_NUM_BARS || !size)
+ return ERR_PTR(-EINVAL);
+
+ bar_len = pci_resource_len(pdev, bar);
+ if (!bar_len || offset > bar_len || size > bar_len - offset)
+ return ERR_PTR(-ENODEV);
+
+ hdm_start = pci_resource_start(pdev, bar) + offset;
+ hdm = ioremap(hdm_start, size);
+ if (!hdm) {
+ pci_err(pdev, "failed to remap CXL HDM decoder registers\n");
+ return ERR_PTR(-ENOMEM);
+ }
+
+ return hdm;
+}
+
static void cxl_pci_hdm_read_decoder_state(struct cxl_hdm_decoder_state *state,
void __iomem *hdm, int id)
{
@@ -261,6 +303,40 @@ static void cxl_pci_hdm_read_decoder_state(struct cxl_hdm_decoder_state *state,
state->target_high = readl(hdm + CXL_HDM_DECODER0_TL_HIGH(id));
}
+static int cxl_hdm_enable_mem(struct pci_dev *pdev, u16 *command,
+ bool *restore_command)
+{
+ int rc;
+
+ *restore_command = false;
+
+ rc = pci_read_config_word(pdev, PCI_COMMAND, command);
+ if (rc)
+ return pcibios_err_to_errno(rc);
+
+ if (*command & PCI_COMMAND_MEMORY)
+ return 0;
+
+ rc = pci_write_config_word(pdev, PCI_COMMAND,
+ *command | PCI_COMMAND_MEMORY);
+ if (rc)
+ return pcibios_err_to_errno(rc);
+
+ *restore_command = true;
+ return 0;
+}
+
+static int cxl_hdm_restore_command(struct pci_dev *pdev, u16 command)
+{
+ int rc;
+
+ rc = pci_write_config_word(pdev, PCI_COMMAND, command);
+ if (rc)
+ return pcibios_err_to_errno(rc);
+
+ return 0;
+}
+
static int cxl_pci_hdm_read_decoder(struct pci_dev *pdev,
struct cxl_hdm_decoder_state *state,
struct cxl_decoder_settings *settings,
@@ -455,6 +531,164 @@ void pci_cxl_hdm_init(struct pci_dev *pdev)
pci_dbg(pdev, "CXL HDM cache init failed: %d\n", rc);
}
+static int cxl_hdm_decoder_uncommit(struct pci_dev *pdev, void __iomem *hdm,
+ int id, bool *locked_committed)
+{
+ u32 ctrl;
+ int rc;
+
+ *locked_committed = false;
+ ctrl = readl(hdm + CXL_HDM_DECODER0_CTRL_OFFSET(id));
+ if (ctrl & CXL_HDM_DECODER0_CTRL_LOCK) {
+ if (ctrl & CXL_HDM_DECODER0_CTRL_COMMITTED) {
+ pci_dbg(pdev,
+ "CXL HDM decoder %d retained locked committed state\n",
+ id);
+ *locked_committed = true;
+ return 0;
+ }
+
+ pci_err(pdev, "CXL HDM decoder %d is locked\n", id);
+ return -EBUSY;
+ }
+
+ if (!(ctrl & CXL_HDM_DECODER0_CTRL_COMMITTED))
+ return 0;
+
+ ctrl &= ~CXL_HDM_DECODER0_CTRL_COMMIT;
+ writel(ctrl, hdm + CXL_HDM_DECODER0_CTRL_OFFSET(id));
+
+ rc = cxld_await_uncommit(hdm, id);
+ if (rc)
+ pci_err(pdev, "CXL HDM decoder %d uncommit failed: %d\n",
+ id, rc);
+
+ return rc;
+}
+
+static void cxl_restore_hdm_decoder_state(struct cxl_hdm_decoder_state *state,
+ void __iomem *hdm, int id)
+{
+ u32 ctrl = state->ctrl;
+
+ ctrl &= ~(CXL_HDM_DECODER0_CTRL_COMMIT |
+ CXL_HDM_DECODER0_CTRL_COMMITTED |
+ CXL_HDM_DECODER0_CTRL_COMMIT_ERROR);
+
+ writel(state->base_high, hdm + CXL_HDM_DECODER0_BASE_HIGH_OFFSET(id));
+ writel(state->base_low, hdm + CXL_HDM_DECODER0_BASE_LOW_OFFSET(id));
+ writel(state->size_high, hdm + CXL_HDM_DECODER0_SIZE_HIGH_OFFSET(id));
+ writel(state->size_low, hdm + CXL_HDM_DECODER0_SIZE_LOW_OFFSET(id));
+ writel(state->target_high, hdm + CXL_HDM_DECODER0_TL_HIGH(id));
+ writel(state->target_low, hdm + CXL_HDM_DECODER0_TL_LOW(id));
+ /* Ensure raw decoder fields are visible before restoring control. */
+ wmb();
+ writel(ctrl, hdm + CXL_HDM_DECODER0_CTRL_OFFSET(id));
+}
+
+static int cxl_restore_hdm_decoder(struct pci_dev *pdev,
+ struct cxl_hdm_decoder_state *state,
+ struct cxl_decoder_settings *settings,
+ void __iomem *hdm)
+{
+ bool locked_committed;
+ int rc;
+
+ rc = cxl_hdm_decoder_uncommit(pdev, hdm, settings->id,
+ &locked_committed);
+ if (rc)
+ return rc;
+ if (locked_committed)
+ return 0;
+
+ cxl_restore_hdm_decoder_state(state, hdm, settings->id);
+
+ if (!(settings->flags & CXL_DECODER_F_ENABLE))
+ return 0;
+
+ rc = cxl_commit(settings, hdm);
+ if (rc)
+ pci_err(pdev, "CXL HDM decoder %d restore failed: %d\n",
+ settings->id, rc);
+
+ return rc;
+}
+
+static int cxl_restore_hdm(struct pci_dev *pdev)
+{
+ struct cxl_hdm_decoder_state *decoder_state __free(kfree) = NULL;
+ struct cxl_decoder_settings *settings __free(kfree) = NULL;
+ struct cxl_hdm_info *info;
+ resource_size_t hdm_offset;
+ resource_size_t hdm_size;
+ void __iomem *hdm;
+ int decoder_count;
+ int first_rc = 0;
+ u32 global_ctrl;
+ bool restore_command = false;
+ u16 command;
+ int hdm_bar;
+ int rc;
+
+ scoped_guard(rwsem_read, &cxl_rwsem.dpa) {
+ info = pdev->hdm;
+ if (!info)
+ return 0;
+
+ decoder_count = info->decoder_count;
+ hdm_bar = info->hdm_bar;
+ hdm_offset = info->hdm_offset;
+ hdm_size = info->hdm_size;
+ global_ctrl = info->global_ctrl;
+ settings = kmemdup_array(info->settings, decoder_count,
+ sizeof(*settings), GFP_KERNEL);
+ if (!settings)
+ return -ENOMEM;
+ decoder_state = kmemdup_array(info->decoder_state,
+ decoder_count,
+ sizeof(*decoder_state),
+ GFP_KERNEL);
+ if (!decoder_state)
+ return -ENOMEM;
+ }
+
+ rc = cxl_hdm_enable_mem(pdev, &command, &restore_command);
+ if (rc)
+ return rc;
+
+ hdm = cxl_pci_hdm_ioremap_current(pdev, hdm_bar, hdm_offset, hdm_size);
+ if (IS_ERR(hdm)) {
+ first_rc = PTR_ERR(hdm);
+ goto out_restore_command;
+ }
+
+ /*
+ * Restore global HDM control before per-decoder commit. PCI config
+ * memory decoding is enabled for MMIO access, but IOMMU reset blocks
+ * remain active until HDM restore completes.
+ */
+ writel(global_ctrl, hdm + CXL_HDM_DECODER_CTRL_OFFSET);
+
+ for (int i = 0; i < decoder_count; i++) {
+ int rc;
+
+ rc = cxl_restore_hdm_decoder(pdev, &decoder_state[i],
+ &settings[i], hdm);
+ if (rc && !first_rc)
+ first_rc = rc;
+ }
+
+ iounmap(hdm);
+out_restore_command:
+ if (restore_command) {
+ rc = cxl_hdm_restore_command(pdev, command);
+ if (rc && !first_rc)
+ first_rc = rc;
+ }
+
+ return first_rc;
+}
+
/*
* CXL r4.0 sec 9.7.2 defines the reset completion timeout encodings.
* Sec 9.7.3 leaves config-space access behavior undefined for 100 ms after
@@ -476,6 +710,7 @@ static const u32 cxl_reset_timeout_ms[] = {
struct cxl_reset_context {
struct pci_dev *target;
+ bool target_prepared;
};
struct cxl_reset_walk_context {
@@ -627,6 +862,38 @@ static int cxl_reset_validate_function_scoped(struct cxl_reset_context *ctx)
return wctx.rc;
}
+static void cxl_pci_target_reset_done(struct cxl_reset_context *ctx)
+{
+ if (!ctx->target_prepared)
+ return;
+
+ pci_dev_reset_iommu_done(ctx->target);
+ ctx->target_prepared = false;
+}
+
+static int cxl_pci_target_reset_prepare(struct cxl_reset_context *ctx)
+{
+ struct pci_dev *pdev = ctx->target;
+ int rc;
+
+ if (!pci_wait_for_pending_transaction(pdev))
+ pci_err(pdev, "timed out waiting for pending transactions\n");
+
+ rc = pci_dev_reset_iommu_prepare(pdev);
+ if (rc) {
+ pci_err(pdev, "failed to stop IOMMU for CXL reset: %d\n", rc);
+ return rc;
+ }
+
+ ctx->target_prepared = true;
+ return 0;
+}
+
+static int cxl_restore_hdm_decoders(struct cxl_reset_context *ctx)
+{
+ return cxl_restore_hdm(ctx->target);
+}
+
static void cxl_hdm_range_context_init(struct cxl_hdm_range_context *ctx)
{
INIT_LIST_HEAD(&ctx->ranges);
@@ -672,9 +939,11 @@ static int cxl_hdm_range_add(struct cxl_hdm_range_context *ctx,
static int cxl_hdm_ranges_collect(struct cxl_hdm_range_context *ctx,
struct pci_dev *pdev)
{
- struct cxl_hdm_info *info = READ_ONCE(pdev->hdm);
+ struct cxl_hdm_info *info;
int rc;
+ guard(rwsem_read)(&cxl_rwsem.dpa);
+ info = pdev->hdm;
if (!info) {
pci_err(pdev, "CXL HDM decoder state unavailable\n");
return -ENXIO;
@@ -824,8 +1093,9 @@ static int cxl_hdm_ranges_flush_cpu_caches(struct cxl_hdm_range_context *ctx,
}
static int cxl_hdm_ranges_prepare(struct cxl_hdm_range_context *ctx,
- struct pci_dev *pdev)
+ struct cxl_reset_context *reset_ctx)
{
+ struct pci_dev *pdev = reset_ctx->target;
int rc;
lockdep_assert_held_write(&cxl_rwsem.region);
@@ -866,6 +1136,25 @@ static int cxl_reset_dvsec(struct pci_dev *pdev)
return dvsec;
}
+static bool cxl_reset_hdm_available(struct pci_dev *pdev)
+{
+ struct cxl_hdm_info *info;
+
+ /*
+ * pdev->hdm is owned by the PCI device and released with pci_dev, so
+ * reset-method probes and reset requests can test availability without
+ * a CXL driver bound to the device.
+ */
+ guard(rwsem_read)(&cxl_rwsem.dpa);
+ info = pdev->hdm;
+ return info && info->hdm_size;
+}
+
+static bool cxl_reset_scope_hdm_available(struct cxl_reset_context *ctx)
+{
+ return cxl_reset_hdm_available(ctx->target);
+}
+
static int cxl_reset_update_ctrl2(struct pci_dev *pdev, int dvsec, u16 set,
u16 clear)
{
@@ -995,18 +1284,9 @@ static int cxl_reset_execute(struct pci_dev *pdev, int dvsec)
if (rc)
return pcibios_err_to_errno(rc);
- if (!pci_wait_for_pending_transaction(pdev))
- pci_err(pdev, "timed out waiting for pending transactions\n");
-
- rc = pci_dev_reset_iommu_prepare(pdev);
- if (rc) {
- pci_err(pdev, "failed to stop IOMMU for CXL reset: %d\n", rc);
- return rc;
- }
-
rc = cxl_reset_disable_cache(pdev, dvsec, cap);
if (rc)
- goto out;
+ return rc;
cache_disabled = true;
rc = cxl_reset_update_ctrl2(pdev, dvsec, PCI_DVSEC_CXL_INIT_CXL_RST,
@@ -1030,7 +1310,6 @@ static int cxl_reset_execute(struct pci_dev *pdev, int dvsec)
rc = rc2;
}
- pci_dev_reset_iommu_done(pdev);
return rc;
}
@@ -1051,11 +1330,25 @@ int cxl_reset_function(struct pci_dev *pdev, bool probe)
cxl_hdm_range_context_init(&range_ctx);
+ if (!cxl_reset_scope_hdm_available(&ctx)) {
+ rc = -ENOTTY;
+ goto out;
+ }
+
+ rc = cxl_pci_target_reset_prepare(&ctx);
+ if (rc)
+ goto out;
+
scoped_guard(rwsem_write, &cxl_rwsem.region) {
- rc = cxl_hdm_ranges_prepare(&range_ctx, pdev);
+ rc = cxl_hdm_ranges_prepare(&range_ctx, &ctx);
if (!rc)
rc = cxl_reset_execute(pdev, dvsec);
+ if (!rc)
+ rc = cxl_restore_hdm_decoders(&ctx);
}
+
+ cxl_pci_target_reset_done(&ctx);
+out:
cxl_hdm_range_context_destroy(&range_ctx);
return rc;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* Re: [PATCH v9 08/11] cxl: Restore CXL HDM state after PCI reset
2026-07-09 1:03 ` [PATCH v9 08/11] cxl: Restore CXL HDM state after PCI reset Srirangan Madhavan
@ 2026-07-09 1:17 ` sashiko-bot
0 siblings, 0 replies; 28+ messages in thread
From: sashiko-bot @ 2026-07-09 1:17 UTC (permalink / raw)
To: Srirangan Madhavan; +Cc: linux-pci, linux-cxl
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] Hardware PCI BARs are not restored before attempting HDM MMIO access post-reset, causing the restore to fail silently or trigger bus errors.
- [Medium] Mixing `goto`-based error handling with scope-based cleanups (`__free()` and `scoped_guard()`) in the same function.
--
--- Patch [8]: [PATCH v9 08/11] cxl: Restore CXL HDM state after PCI reset ---
commit a1cce28cbb5bb68a25127de7ce247a2950193943
Author: Srirangan Madhavan <smadhavan@nvidia.com>
cxl: Restore CXL HDM state after PCI reset
After CXL reset, restore PCI config state enough to reach HDM MMIO,
restore cached global and per-decoder HDM state, and then run the normal
PCI restore callbacks.
> diff --git a/drivers/cxl/core/reset.c b/drivers/cxl/core/reset.c
> --- a/drivers/cxl/core/reset.c
> +++ b/drivers/cxl/core/reset.c
> @@ -455,6 +531,164 @@ void pci_cxl_hdm_init(struct pci_dev *pdev)
[ ... ]
> +static int cxl_restore_hdm(struct pci_dev *pdev)
> +{
> + struct cxl_hdm_decoder_state *decoder_state __free(kfree) = NULL;
> + struct cxl_decoder_settings *settings __free(kfree) = NULL;
[ ... ]
> + hdm = cxl_pci_hdm_ioremap_current(pdev, hdm_bar, hdm_offset, hdm_size);
> + if (IS_ERR(hdm)) {
> + first_rc = PTR_ERR(hdm);
> + goto out_restore_command;
> + }
[Severity: Medium]
Is it safe to mix goto-based error handling with scope-based cleanups
like __free() in this function?
The kernel cleanup guidelines suggest converting all resources that need a
goto cleanup to scope-based cleanup, or converting none of them, because
mixing them creates confusing ownership semantics.
> +
> + /*
> + * Restore global HDM control before per-decoder commit. PCI config
> + * memory decoding is enabled for MMIO access, but IOMMU reset blocks
> + * remain active until HDM restore completes.
> + */
> + writel(global_ctrl, hdm + CXL_HDM_DECODER_CTRL_OFFSET);
[Severity: High]
Will this MMIO access fail or trigger bus errors?
The CXL reset clears the device's PCI configuration space, which sets the
hardware BARs to 0. Although cxl_hdm_enable_mem() sets the
PCI_COMMAND_MEMORY bit earlier in this function, it doesn't appear to write
the physical address back into the hardware BARs before we attempt to access
the MMIO region here.
[ ... ]
> int cxl_reset_function(struct pci_dev *pdev, bool probe)
> {
[ ... ]
> cxl_hdm_range_context_init(&range_ctx);
>
> + if (!cxl_reset_scope_hdm_available(&ctx)) {
> + rc = -ENOTTY;
> + goto out;
> + }
> +
> + rc = cxl_pci_target_reset_prepare(&ctx);
> + if (rc)
> + goto out;
> +
> scoped_guard(rwsem_write, &cxl_rwsem.region) {
[Severity: Medium]
Could we also avoid mixing the legacy goto error paths with the
scoped_guard() block in this function?
> - rc = cxl_hdm_ranges_prepare(&range_ctx, pdev);
> + rc = cxl_hdm_ranges_prepare(&range_ctx, &ctx);
> if (!rc)
> rc = cxl_reset_execute(pdev, dvsec);
> + if (!rc)
> + rc = cxl_restore_hdm_decoders(&ctx);
> }
> +
> + cxl_pci_target_reset_done(&ctx);
> +out:
> cxl_hdm_range_context_destroy(&range_ctx);
> return rc;
> }
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260709010304.680422-1-smadhavan@nvidia.com?part=8
^ permalink raw reply [flat|nested] 28+ messages in thread
* [PATCH v9 09/11] PCI/CXL: Expose CXL Reset as a PCI reset method
2026-07-09 1:02 [PATCH v9 00/11] PCI/CXL: Add CXL reset support for Type 2 devices Srirangan Madhavan
` (7 preceding siblings ...)
2026-07-09 1:03 ` [PATCH v9 08/11] cxl: Restore CXL HDM state after PCI reset Srirangan Madhavan
@ 2026-07-09 1:03 ` Srirangan Madhavan
2026-07-09 1:27 ` sashiko-bot
2026-07-09 1:03 ` [PATCH v9 10/11] Documentation/ABI: Document CXL Reset " Srirangan Madhavan
` (2 subsequent siblings)
11 siblings, 1 reply; 28+ messages in thread
From: Srirangan Madhavan @ 2026-07-09 1:03 UTC (permalink / raw)
To: Alison Schofield, Bjorn Helgaas, Dan Williams, Dave Jiang,
Davidlohr Bueso, Jonathan Cameron, Vishal Verma, linux-cxl,
linux-pci, linux-kernel
Cc: Alex Williamson, vsethi, alwilliamson, Dan Williams,
Sai Yashwanth Reddy Kancherla, Vishal Aslot, Manish Honap,
Jiandi An, Richard Cheng, linux-tegra, Srirangan Madhavan
Add the CXL Reset helper to the PCI reset-method table so userspace can
select it through the existing reset_method ABI.
Advertise the method for Type 2 CXL devices that report CXL Reset
support in the CXL Device DVSEC and pass the function-scope check. Reset
execution requires cached HDM decoder state for the target so affected
ranges can be validated and HDM programming can be restored. If that
state is unavailable at reset time, return -ENOTTY so PCI can try the
next reset method.
Signed-off-by: Srirangan Madhavan <smadhavan@nvidia.com>
---
drivers/pci/pci.c | 2 ++
include/linux/pci.h | 2 +-
2 files changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 77b17b13ee61..ef25ba5f7fe9 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -34,6 +34,7 @@
#include <linux/aer.h>
#include <linux/bitfield.h>
#include <linux/suspend.h>
+#include <cxl/cxl.h>
#include "pci.h"
DEFINE_MUTEX(pci_slot_mutex);
@@ -5092,6 +5093,7 @@ const struct pci_reset_fn_method pci_reset_fn_methods[] = {
{ },
{ pci_dev_specific_reset, .name = "device_specific" },
{ pci_dev_acpi_reset, .name = "acpi" },
+ { cxl_reset_function, .name = "cxl_reset" },
{ pcie_reset_flr, .name = "flr" },
{ pci_af_flr, .name = "af_flr" },
{ pci_pm_reset, .name = "pm" },
diff --git a/include/linux/pci.h b/include/linux/pci.h
index a8e5cec96bae..9319182b5692 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -52,7 +52,7 @@
PCI_STATUS_PARITY)
/* Number of reset methods used in pci_reset_fn_methods array in pci.c */
-#define PCI_NUM_RESET_METHODS 8
+#define PCI_NUM_RESET_METHODS 9
#define PCI_RESET_PROBE true
#define PCI_RESET_DO_RESET false
--
2.43.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* Re: [PATCH v9 09/11] PCI/CXL: Expose CXL Reset as a PCI reset method
2026-07-09 1:03 ` [PATCH v9 09/11] PCI/CXL: Expose CXL Reset as a PCI reset method Srirangan Madhavan
@ 2026-07-09 1:27 ` sashiko-bot
0 siblings, 0 replies; 28+ messages in thread
From: sashiko-bot @ 2026-07-09 1:27 UTC (permalink / raw)
To: Srirangan Madhavan; +Cc: linux-cxl, linux-pci
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The CXL reset method skips function-scoped validation during execution, relying entirely on a flawed probe-time check that occurs before sibling functions are added to the PCI bus.
--
--- Patch [9]: [PATCH v9 09/11] PCI/CXL: Expose CXL Reset as a PCI reset method ---
commit f2ff500e92a2699aaf86703b4ef5bcf21ad27f7b
Author: Srirangan Madhavan <smadhavan@nvidia.com>
PCI/CXL: Expose CXL Reset as a PCI reset method
Add the CXL Reset helper to the PCI reset-method table so userspace can
select it through the existing reset_method ABI. Advertise the method for
Type 2 CXL devices that report CXL Reset support in the CXL Device DVSEC.
> diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
> index 77b17b13ee615..ef25ba5f7fe95 100644
> --- a/drivers/pci/pci.c
> +++ b/drivers/pci/pci.c
[ ... ]
> @@ -5092,6 +5093,7 @@ const struct pci_reset_fn_method pci_reset_fn_methods[] = {
> { },
> { pci_dev_specific_reset, .name = "device_specific" },
> { pci_dev_acpi_reset, .name = "acpi" },
> + { cxl_reset_function, .name = "cxl_reset" },
[Severity: High]
Does adding this reset method here introduce a regression where multi-function
CXL devices are exposed to state corruption when a reset is triggered?
During early system boot, PCI enumeration calls pci_init_reset_methods()
which evaluates this method with probe = true. The method then calls
cxl_reset_validate_function_scoped() to walk the bus looking for siblings:
drivers/cxl/core/reset.c:cxl_reset_validate_function_scoped() {
...
pci_walk_bus(pdev->bus, cxl_reset_validate_function_scope, &wctx);
...
}
Because function 0 has not yet been added to the bus list at this early stage
and sibling functions have not been scanned, the bus walk is empty. The reset
method is then incorrectly recorded as valid for function 0.
When the reset is actually executed later via VFIO or sysfs,
cxl_reset_function() is called with probe = false. This skips the validation:
drivers/cxl/core/reset.c:cxl_reset_function() {
...
if (probe)
return cxl_reset_validate_function_scoped(&ctx);
...
}
This means the bus is not re-evaluated when the siblings are actually present.
Will this proceed to reset the entire device without isolating sibling
functions, resulting in corrupted or lost state for those siblings?
> { pcie_reset_flr, .name = "flr" },
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260709010304.680422-1-smadhavan@nvidia.com?part=9
^ permalink raw reply [flat|nested] 28+ messages in thread
* [PATCH v9 10/11] Documentation/ABI: Document CXL Reset PCI reset method
2026-07-09 1:02 [PATCH v9 00/11] PCI/CXL: Add CXL reset support for Type 2 devices Srirangan Madhavan
` (8 preceding siblings ...)
2026-07-09 1:03 ` [PATCH v9 09/11] PCI/CXL: Expose CXL Reset as a PCI reset method Srirangan Madhavan
@ 2026-07-09 1:03 ` Srirangan Madhavan
2026-07-09 1:05 ` sashiko-bot
2026-07-09 1:03 ` [PATCH v9 11/11] PCI/CXL: Restore HDM state after CXL bus reset Srirangan Madhavan
2026-07-15 15:14 ` [PATCH v9 00/11] PCI/CXL: Add CXL reset support for Type 2 devices Alejandro Lucero Palau
11 siblings, 1 reply; 28+ messages in thread
From: Srirangan Madhavan @ 2026-07-09 1:03 UTC (permalink / raw)
To: Alison Schofield, Bjorn Helgaas, Dan Williams, Dave Jiang,
Davidlohr Bueso, Jonathan Cameron, Vishal Verma, linux-cxl,
linux-pci, linux-kernel
Cc: Alex Williamson, vsethi, alwilliamson, Dan Williams,
Sai Yashwanth Reddy Kancherla, Vishal Aslot, Manish Honap,
Jiandi An, Richard Cheng, linux-tegra, Srirangan Madhavan
Document the "cxl_reset" PCI reset_method value for Type 2 CXL devices.
CXL Reset is device scoped, requires affected memory to be idle,
invalidates CPU caches, restores cached HDM decoder state, and does not
request Memory Clear.
Signed-off-by: Srirangan Madhavan <smadhavan@nvidia.com>
---
Documentation/ABI/testing/sysfs-bus-pci | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/Documentation/ABI/testing/sysfs-bus-pci b/Documentation/ABI/testing/sysfs-bus-pci
index b767db2c52cb..5ab46a4340ae 100644
--- a/Documentation/ABI/testing/sysfs-bus-pci
+++ b/Documentation/ABI/testing/sysfs-bus-pci
@@ -153,6 +153,20 @@ Description:
"default" enables all supported reset methods in the
default ordering.
+ If present, "cxl_reset" selects CXL Reset for CXL Type 2
+ devices that advertise CXL Reset support and whose reset scope is
+ limited to the selected PCI function. The method is not listed
+ when CXL Reset would affect another CXL.cache or CXL.mem function.
+
+ Before issuing CXL Reset, the kernel quiesces the PCI function,
+ rejects the operation if cached HDM state is unavailable or
+ affected CXL memory is busy, invalidates CPU caches for enabled
+ HDM ranges, disables CXL.cache, and initiates cache write-back
+ where supported. After reset, the kernel restores PCI config
+ state needed to access HDM MMIO, restores cached HDM decoder
+ state, and completes PCI reset recovery. "cxl_reset" does not
+ request CXL Reset Memory Clear.
+
What: /sys/bus/pci/devices/.../reset
Date: July 2009
Contact: Michael S. Tsirkin <mst@redhat.com>
--
2.43.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* [PATCH v9 11/11] PCI/CXL: Restore HDM state after CXL bus reset
2026-07-09 1:02 [PATCH v9 00/11] PCI/CXL: Add CXL reset support for Type 2 devices Srirangan Madhavan
` (9 preceding siblings ...)
2026-07-09 1:03 ` [PATCH v9 10/11] Documentation/ABI: Document CXL Reset " Srirangan Madhavan
@ 2026-07-09 1:03 ` Srirangan Madhavan
2026-07-09 1:20 ` sashiko-bot
2026-07-15 15:14 ` [PATCH v9 00/11] PCI/CXL: Add CXL reset support for Type 2 devices Alejandro Lucero Palau
11 siblings, 1 reply; 28+ messages in thread
From: Srirangan Madhavan @ 2026-07-09 1:03 UTC (permalink / raw)
To: Alison Schofield, Bjorn Helgaas, Dan Williams, Dave Jiang,
Davidlohr Bueso, Jonathan Cameron, Vishal Verma, linux-cxl,
linux-pci, linux-kernel
Cc: Alex Williamson, vsethi, alwilliamson, Dan Williams,
Sai Yashwanth Reddy Kancherla, Vishal Aslot, Manish Honap,
Jiandi An, Richard Cheng, linux-tegra, Srirangan Madhavan
CXL bus reset can clear HDM global control and decoder programming. Restore
cached HDM state after a successful cxl_bus reset while the IOMMU reset block
remains active.
This intentionally restores only the HDM component decoder state cached by the
CXL reset support. It does not attempt to restore CXL Device DVSEC
range/control registers.
This was exercised with cxl_bus reset on a CXL Type 2 device. Testing confirmed
that CXL Device DVSEC range/control state is a separate restore class from HDM
component decoder state.
This depends on the CXL reset series because it reuses the HDM state cache and
restore helper introduced there.
Signed-off-by: Srirangan Madhavan <smadhavan@nvidia.com>
---
drivers/cxl/core/reset.c | 5 +++++
drivers/pci/pci.c | 3 +++
include/cxl/cxl.h | 6 ++++++
3 files changed, 14 insertions(+)
diff --git a/drivers/cxl/core/reset.c b/drivers/cxl/core/reset.c
index f708c7b80acf..67cdc51182f7 100644
--- a/drivers/cxl/core/reset.c
+++ b/drivers/cxl/core/reset.c
@@ -894,6 +894,11 @@ static int cxl_restore_hdm_decoders(struct cxl_reset_context *ctx)
return cxl_restore_hdm(ctx->target);
}
+int cxl_restore_hdm_after_pci_reset(struct pci_dev *pdev)
+{
+ return cxl_restore_hdm(pdev);
+}
+
static void cxl_hdm_range_context_init(struct cxl_hdm_range_context *ctx)
{
INIT_LIST_HEAD(&ctx->ranges);
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index ef25ba5f7fe9..b394704950a5 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -5004,6 +5004,9 @@ static int cxl_reset_bus_function(struct pci_dev *dev, bool probe)
pci_write_config_word(bridge, dvsec + PCI_DVSEC_CXL_PORT_CTL,
reg);
+ if (!rc)
+ rc = cxl_restore_hdm_after_pci_reset(dev);
+
pci_dev_reset_iommu_done(dev);
return rc;
}
diff --git a/include/cxl/cxl.h b/include/cxl/cxl.h
index de58f484b7d9..c1019e1b3b27 100644
--- a/include/cxl/cxl.h
+++ b/include/cxl/cxl.h
@@ -154,6 +154,7 @@ int cxl_commit(struct cxl_decoder_settings *settings, void __iomem *hdm);
#ifdef CONFIG_CXL_HDM
void pci_cxl_hdm_init(struct pci_dev *pdev);
void pci_cxl_hdm_release(struct pci_dev *pdev);
+int cxl_restore_hdm_after_pci_reset(struct pci_dev *pdev);
int cxl_reset_function(struct pci_dev *pdev, bool probe);
#else
static inline void pci_cxl_hdm_init(struct pci_dev *pdev)
@@ -164,6 +165,11 @@ static inline void pci_cxl_hdm_release(struct pci_dev *pdev)
{
}
+static inline int cxl_restore_hdm_after_pci_reset(struct pci_dev *pdev)
+{
+ return 0;
+}
+
static inline int cxl_reset_function(struct pci_dev *pdev, bool probe)
{
return -ENOTTY;
--
2.43.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* Re: [PATCH v9 11/11] PCI/CXL: Restore HDM state after CXL bus reset
2026-07-09 1:03 ` [PATCH v9 11/11] PCI/CXL: Restore HDM state after CXL bus reset Srirangan Madhavan
@ 2026-07-09 1:20 ` sashiko-bot
0 siblings, 0 replies; 28+ messages in thread
From: sashiko-bot @ 2026-07-09 1:20 UTC (permalink / raw)
To: Srirangan Madhavan; +Cc: linux-pci, linux-cxl
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] HDM decoder restoration is performed before the PCI device's BARs are restored, causing MMIO writes to be dropped by the hardware or triggering Unsupported Requests.
--
--- Patch [11]: [PATCH v9 11/11] PCI/CXL: Restore HDM state after CXL bus reset ---
commit 4e02f0f18a7abbebc3cc9b8384269906531ad726
Author: Srirangan Madhavan <smadhavan@nvidia.com>
PCI/CXL: Restore HDM state after CXL bus reset
This commit restores cached HDM state after a successful CXL bus reset while
the IOMMU reset block remains active. It introduces a helper to restore the
state and calls it directly from the PCI reset path.
> diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
> index ef25ba5f7fe95..b394704950a5f 100644
> --- a/drivers/pci/pci.c
> +++ b/drivers/pci/pci.c
> @@ -5004,6 +5004,9 @@ static int cxl_reset_bus_function(struct pci_dev *dev, bool probe)
> pci_write_config_word(bridge, dvsec + PCI_DVSEC_CXL_PORT_CTL,
> reg);
>
> + if (!rc)
> + rc = cxl_restore_hdm_after_pci_reset(dev);
> +
[Severity: High]
Is it safe to restore the HDM decoders here before the PCI state (including
BARs) has been restored?
When pci_reset_bus_function() is called earlier in this function, the
hardware reset clears the device's BARs to 0. The caller of the reset
function typically restores the saved PCI state after this returns.
However, cxl_restore_hdm_after_pci_reset() calls cxl_restore_hdm(), which
enables memory decoding and writes to the cached BAR address:
drivers/cxl/core/reset.c:cxl_restore_hdm() {
...
rc = cxl_hdm_enable_mem(pdev, &command, &restore_command);
...
writel(global_ctrl, hdm + CXL_HDM_DECODER_CTRL_OFFSET);
...
}
Because the hardware BARs are still 0 at this point, will enabling
PCI_COMMAND_MEMORY cause the device to incorrectly claim physical address 0?
Furthermore, will the MMIO writes to the cached BAR address result in PCIe
Unsupported Requests (Master Aborts) since the hardware isn't actually
decoding the cached address yet?
> pci_dev_reset_iommu_done(dev);
> return rc;
> }
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260709010304.680422-1-smadhavan@nvidia.com?part=11
^ permalink raw reply [flat|nested] 28+ messages in thread
* Re: [PATCH v9 00/11] PCI/CXL: Add CXL reset support for Type 2 devices
2026-07-09 1:02 [PATCH v9 00/11] PCI/CXL: Add CXL reset support for Type 2 devices Srirangan Madhavan
` (10 preceding siblings ...)
2026-07-09 1:03 ` [PATCH v9 11/11] PCI/CXL: Restore HDM state after CXL bus reset Srirangan Madhavan
@ 2026-07-15 15:14 ` Alejandro Lucero Palau
11 siblings, 0 replies; 28+ messages in thread
From: Alejandro Lucero Palau @ 2026-07-15 15:14 UTC (permalink / raw)
To: Srirangan Madhavan, Alison Schofield, Bjorn Helgaas, Dan Williams,
Dave Jiang, Davidlohr Bueso, Jonathan Cameron, Vishal Verma,
linux-cxl, linux-pci, linux-kernel
Cc: Alex Williamson, vsethi, alwilliamson, Dan Williams,
Sai Yashwanth Reddy Kancherla, Vishal Aslot, Manish Honap,
Jiandi An, Richard Cheng, linux-tegra
On 7/9/26 02:02, Srirangan Madhavan wrote:
> Hi folks!
>
> This series adds CXL Reset support for CXL Type 2 devices through the
> existing PCI reset_method ABI. The reset sequence follows the CXL 4.0
> specification [1], including CXL.cache disable, optional cache
> writeback, CXL Reset initiation, ResetComplete polling, and ResetError
> reporting.
Hi Srirangan,
I'm working on understanding all the implications in this patchset, and
I have to say my mind is on adding multipf support to Type2 drivers,
with a RFC coming soon to the list.
Some comments below.
Thanks.
> The userspace ABI is the existing PCI reset interface:
>
> /sys/bus/pci/devices/.../reset_method
> /sys/bus/pci/devices/.../reset
Not sure if this will be available in any device PFs, but I think it
should only be available for PF0 as the specs define this function as
the one having the CXL DVSEC. In any case, the reset will only be
possible if PF0 is not attached to the Type2 driver and therefore the
memdev is not there. With the multipf support that will also be the case
as any none PF0 device will rely on PF0 CXL driver initialization and if
PF0 is detached from the driver, so will it be for non PF0 devices.
Note this is not the same than the "Non-CXL Function Map DVSEC" you are
checking later on.
<snip>
>
> The CPU cache invalidation step depends on
> cpu_cache_invalidate_memregion() support for the affected address ranges.
> If no runtime provider is available, the kernel emits a warning and
> continues after the affected HDM ranges have been reserved.
Because no memdev should be there this step should not be necessary.
Maybe as a sanity check.
^ permalink raw reply [flat|nested] 28+ messages in thread