[PATCH 0/2] cxl: Fix nvdimm_bus race for nvdimm_bridge

[PATCH 0/2] cxl: Fix nvdimm_bus race for nvdimm_bridge

[Dave Jiang]

A small series to address a race for nvdimm_bus object when using the
nvdimm_bridge object.


Dave Jiang (2):
  cxl/test: Removal of nvdimm_bus_register() wrapper in cxl_test
  cxl: Fix race of nvdimm_bus for the nvdimm_bridge object

 drivers/cxl/core/pmem.c       | 236 +++++++++++++++++++++++++++++++---
 drivers/cxl/pmem.c            | 199 +---------------------------
 include/linux/libnvdimm.h     |   2 +-
 tools/testing/cxl/Kbuild      |   1 -
 tools/testing/cxl/test/mock.c |  15 ---
 5 files changed, 221 insertions(+), 232 deletions(-)


base-commit: 18f7fcd5e69a04df57b563360b88be72471d6b62
-- 
2.52.0

[PATCH 1/2] cxl/test: Removal of nvdimm_bus_register() wrapper in cxl_test

[Dave Jiang]

Remove nvdimm_bus_register() wrapper in cxl_test driver in order to
address a fix in a different commit that fixes the issue of missing
nvdimm bus object due to an initialization race. The CXL CLI unit
test cxl-security.sh will be adjusted with this new change.

Suggested-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
---
 drivers/cxl/pmem.c            |  2 +-
 include/linux/libnvdimm.h     |  2 +-
 tools/testing/cxl/Kbuild      |  1 -
 tools/testing/cxl/test/mock.c | 15 ---------------
 4 files changed, 2 insertions(+), 18 deletions(-)

diff --git a/drivers/cxl/pmem.c b/drivers/cxl/pmem.c
index e197883690ef..45486a9d23a5 100644
--- a/drivers/cxl/pmem.c
+++ b/drivers/cxl/pmem.c
@@ -334,7 +334,7 @@ static int cxl_nvdimm_bridge_probe(struct device *dev)
 	struct cxl_nvdimm_bridge *cxl_nvb = to_cxl_nvdimm_bridge(dev);
 
 	cxl_nvb->nd_desc = (struct nvdimm_bus_descriptor) {
-		.provider_name = "CXL",
+		.provider_name = dev_name(dev->parent->parent),
 		.module = THIS_MODULE,
 		.ndctl = cxl_pmem_ctl,
 	};
diff --git a/include/linux/libnvdimm.h b/include/linux/libnvdimm.h
index 28f086c4a187..716163fc5e09 100644
--- a/include/linux/libnvdimm.h
+++ b/include/linux/libnvdimm.h
@@ -89,7 +89,7 @@ struct nvdimm_bus_descriptor {
 	unsigned long dimm_family_mask;
 	unsigned long bus_family_mask;
 	struct module *module;
-	char *provider_name;
+	const char *provider_name;
 	struct device_node *of_node;
 	ndctl_fn ndctl;
 	int (*flush_probe)(struct nvdimm_bus_descriptor *nd_desc);
diff --git a/tools/testing/cxl/Kbuild b/tools/testing/cxl/Kbuild
index 0e151d0572d1..44abab0275e4 100644
--- a/tools/testing/cxl/Kbuild
+++ b/tools/testing/cxl/Kbuild
@@ -3,7 +3,6 @@ ldflags-y += --wrap=acpi_table_parse_cedt
 ldflags-y += --wrap=is_acpi_device_node
 ldflags-y += --wrap=acpi_evaluate_integer
 ldflags-y += --wrap=acpi_pci_find_root
-ldflags-y += --wrap=nvdimm_bus_register
 ldflags-y += --wrap=cxl_await_media_ready
 ldflags-y += --wrap=devm_cxl_add_rch_dport
 ldflags-y += --wrap=cxl_endpoint_parse_cdat
diff --git a/tools/testing/cxl/test/mock.c b/tools/testing/cxl/test/mock.c
index 44bce80ef3ff..47b1aadabf98 100644
--- a/tools/testing/cxl/test/mock.c
+++ b/tools/testing/cxl/test/mock.c
@@ -148,21 +148,6 @@ struct acpi_pci_root *__wrap_acpi_pci_find_root(acpi_handle handle)
 }
 EXPORT_SYMBOL_GPL(__wrap_acpi_pci_find_root);
 
-struct nvdimm_bus *
-__wrap_nvdimm_bus_register(struct device *dev,
-			   struct nvdimm_bus_descriptor *nd_desc)
-{
-	int index;
-	struct cxl_mock_ops *ops = get_cxl_mock_ops(&index);
-
-	if (ops && ops->is_mock_dev(dev->parent->parent))
-		nd_desc->provider_name = "cxl_test";
-	put_cxl_mock_ops(index);
-
-	return nvdimm_bus_register(dev, nd_desc);
-}
-EXPORT_SYMBOL_GPL(__wrap_nvdimm_bus_register);
-
 int redirect_devm_cxl_switch_port_decoders_setup(struct cxl_port *port)
 {
 	int rc, index;
-- 
2.52.0

[PATCH 2/2] cxl: Fix race of nvdimm_bus for the nvdimm_bridge object

[Dave Jiang]

Running cxl_test regression tests will occasionally trip over this race
below. Move registration of nvdimm_bus to devm_cxl_add_nvdimm_bridge()
to ensure that nvdimm_bus is always present when nvdimm_bridge is created.
With the move, the nvdimm bridge driver is no longer needed and can be
removed.

Most of the code is moved as is from pmem.c to core/pmem.c. Scoped
based resource cleanup is added to devm_cxl_add_nvdimm_bridge() to ease
code maintainability.

[  192.884510] BUG: kernel NULL pointer dereference, address: 000000000000006c
[  192.886373] #PF: supervisor read access in kernel mode
[  192.887854] #PF: error_code(0x0000) - not-present page
[  192.889427] PGD 0 P4D 0
[  192.890357] Oops: Oops: 0000 [#1] SMP NOPTI
[  192.891568] CPU: 0 UID: 0 PID: 12 Comm: kworker/u32:0 Tainted: G           O        6.19.0-rc5+ #125 PREEMPT(voluntary)
[  192.894277] Tainted: [O]=OOT_MODULE
[  192.895383] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS edk2-20250812-19.fc42 08/12/2025
[  192.897721] Workqueue: cxl_port cxl_bus_rescan_queue [cxl_core]
[  192.899459] RIP: 0010:kobject_get+0xc/0x90
[  192.900720] Code: cc 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 85 ff 48 89 f8 74 48 48 83 ec 08 <f6> 47 3c 01 74 22 48 8d 78 38 ba 01 00 00 00 f0 0f c1 50 38 85 d2
[  192.905383] RSP: 0018:ffffc900000cfc28 EFLAGS: 00010296
[  192.906949] RAX: 0000000000000030 RBX: ffff888217275c18 RCX: 0000000000000000
[  192.908891] RDX: ffffffff83aa5b10 RSI: 0000000000000001 RDI: 0000000000000030
[  192.910980] RBP: 0000000000000001 R08: ffffffff81d6d3a0 R09: ffff8880f9ecc000
[  192.912868] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
[  192.914866] R13: 0000000000000001 R14: 0000000000000070 R15: ffff888217276c00
[  192.916721] FS:  0000000000000000(0000) GS:ffff8880f9ecc000(0000) knlGS:0000000000000000
[  192.919610] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  192.921703] CR2: 000000000000006c CR3: 0000000003c32001 CR4: 0000000000770ef0
[  192.923680] PKRU: 55555554
[  192.924871] Call Trace:
[  192.925959]  <TASK>
[  192.926976]  ? pm_runtime_init+0xb9/0xe0
[  192.929712]  __nd_device_register.part.0+0x4d/0xc0 [libnvdimm]
[  192.933314]  __nvdimm_create+0x206/0x290 [libnvdimm]
[  192.936662]  cxl_nvdimm_probe+0x119/0x1d0 [cxl_pmem]
[  192.940245]  cxl_bus_probe+0x1a/0x60 [cxl_core]
[  192.943349]  really_probe+0xde/0x380
[  192.945614]  ? _raw_spin_unlock_irq+0x18/0x40
[  192.948402]  ? __pfx___device_attach_driver+0x10/0x10
[  192.951407]  __driver_probe_device+0xc0/0x150
[  192.953997]  driver_probe_device+0x1f/0xa0
[  192.956456]  __device_attach_driver+0x85/0x130
[  192.959231]  ? _raw_spin_unlock+0x12/0x30
[  192.961615]  bus_for_each_drv+0x6c/0xb0
[  192.963935]  __device_attach+0xad/0x1c0
[  192.966213]  ? __pfx_cxl_rescan_attach+0x10/0x10 [cxl_core]
[  192.969350]  cxl_rescan_attach+0xa/0x20 [cxl_core]
[  192.972063]  bus_for_each_dev+0x63/0xa0
[  192.974367]  process_one_work+0x166/0x340
[  192.976758]  worker_thread+0x258/0x3a0
[  192.979011]  ? __pfx_worker_thread+0x10/0x10
[  192.981487]  kthread+0x108/0x220
[  192.983503]  ? __pfx_kthread+0x10/0x10
[  192.985335]  ? __pfx_kthread+0x10/0x10
[  192.986148]  ret_from_fork+0x246/0x280
[  192.987018]  ? __pfx_kthread+0x10/0x10
[  192.987891]  ret_from_fork_asm+0x1a/0x30
[  192.988768]  </TASK>
[  192.989359] Modules linked in: cxl_pmem(O) cxl_acpi(O-) kmem device_dax dax_cxl dax_pmem nd_pmem nd_btt cxl_mock_mem(O) dax_hmem cxl_pci nd_e820 nfit cxl_mem(O) cxl_port(O) cxl_mock(O) libnvdimm cxl_core(O) fwctl [last unloaded: cxl_translate(O)]
[  192.993533] CR2: 000000000000006c
[  192.994417] ---[ end trace 0000000000000000 ]---

Suggested-by: Dan Williams <dan.j.williams@intel.com>
Fixes: 8fdcb1704f61 ("cxl/pmem: Add initial infrastructure for pmem support")
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
---
 drivers/cxl/core/pmem.c | 236 +++++++++++++++++++++++++++++++++++++---
 drivers/cxl/pmem.c      | 199 +--------------------------------
 2 files changed, 220 insertions(+), 215 deletions(-)

diff --git a/drivers/cxl/core/pmem.c b/drivers/cxl/core/pmem.c
index 8853415c106a..9b823f4e4770 100644
--- a/drivers/cxl/core/pmem.c
+++ b/drivers/cxl/core/pmem.c
@@ -1,5 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /* Copyright(c) 2020 Intel Corporation. */
+#include <uapi/linux/ndctl.h>
+#include <linux/unaligned.h>
 #include <linux/device.h>
 #include <linux/slab.h>
 #include <linux/idr.h>
@@ -115,6 +117,209 @@ static void unregister_nvb(void *_cxl_nvb)
 	device_unregister(&cxl_nvb->dev);
 }
 
+static int detach_nvdimm(struct device *dev, void *data)
+{
+	struct cxl_nvdimm *cxl_nvd;
+	bool release = false;
+
+	if (!is_cxl_nvdimm(dev))
+		return 0;
+
+	scoped_guard(device, dev) {
+		if (dev->driver) {
+			cxl_nvd = to_cxl_nvdimm(dev);
+			if (cxl_nvd->cxlmd && cxl_nvd->cxlmd->cxl_nvb == data)
+				release = true;
+		}
+	}
+	if (release)
+		device_release_driver(dev);
+	return 0;
+}
+
+static int cxl_pmem_set_config_data(struct cxl_memdev_state *mds,
+				    struct nd_cmd_set_config_hdr *cmd,
+				    unsigned int buf_len)
+{
+	struct cxl_mailbox *cxl_mbox = &mds->cxlds.cxl_mbox;
+	struct cxl_mbox_set_lsa *set_lsa;
+	struct cxl_mbox_cmd mbox_cmd;
+	int rc;
+
+	if (sizeof(*cmd) > buf_len)
+		return -EINVAL;
+
+	/* 4-byte status follows the input data in the payload */
+	if (size_add(struct_size(cmd, in_buf, cmd->in_length), 4) > buf_len)
+		return -EINVAL;
+
+	set_lsa =
+		kvzalloc(struct_size(set_lsa, data, cmd->in_length), GFP_KERNEL);
+	if (!set_lsa)
+		return -ENOMEM;
+
+	*set_lsa = (struct cxl_mbox_set_lsa) {
+		.offset = cpu_to_le32(cmd->in_offset),
+	};
+	memcpy(set_lsa->data, cmd->in_buf, cmd->in_length);
+	mbox_cmd = (struct cxl_mbox_cmd) {
+		.opcode = CXL_MBOX_OP_SET_LSA,
+		.payload_in = set_lsa,
+		.size_in = struct_size(set_lsa, data, cmd->in_length),
+	};
+
+	rc = cxl_internal_send_cmd(cxl_mbox, &mbox_cmd);
+
+	/*
+	 * Set "firmware" status (4-packed bytes at the end of the input
+	 * payload.
+	 */
+	put_unaligned(0, (u32 *) &cmd->in_buf[cmd->in_length]);
+	kvfree(set_lsa);
+
+	return rc;
+}
+
+static int cxl_pmem_get_config_size(struct cxl_memdev_state *mds,
+				    struct nd_cmd_get_config_size *cmd,
+				    unsigned int buf_len)
+{
+	struct cxl_mailbox *cxl_mbox = &mds->cxlds.cxl_mbox;
+
+	if (sizeof(*cmd) > buf_len)
+		return -EINVAL;
+
+	*cmd = (struct nd_cmd_get_config_size){
+		.config_size = mds->lsa_size,
+		.max_xfer =
+			cxl_mbox->payload_size - sizeof(struct cxl_mbox_set_lsa),
+	};
+
+	return 0;
+}
+
+static int cxl_pmem_get_config_data(struct cxl_memdev_state *mds,
+				    struct nd_cmd_get_config_data_hdr *cmd,
+				    unsigned int buf_len)
+{
+	struct cxl_mailbox *cxl_mbox = &mds->cxlds.cxl_mbox;
+	struct cxl_mbox_get_lsa get_lsa;
+	struct cxl_mbox_cmd mbox_cmd;
+	int rc;
+
+	if (sizeof(*cmd) > buf_len)
+		return -EINVAL;
+	if (struct_size(cmd, out_buf, cmd->in_length) > buf_len)
+		return -EINVAL;
+
+	get_lsa = (struct cxl_mbox_get_lsa) {
+		.offset = cpu_to_le32(cmd->in_offset),
+		.length = cpu_to_le32(cmd->in_length),
+	};
+	mbox_cmd = (struct cxl_mbox_cmd) {
+		.opcode = CXL_MBOX_OP_GET_LSA,
+		.payload_in = &get_lsa,
+		.size_in = sizeof(get_lsa),
+		.size_out = cmd->in_length,
+		.payload_out = cmd->out_buf,
+	};
+
+	rc = cxl_internal_send_cmd(cxl_mbox, &mbox_cmd);
+	cmd->status = 0;
+
+	return rc;
+}
+
+static int cxl_pmem_nvdimm_ctl(struct nvdimm *nvdimm, unsigned int cmd,
+			       void *buf, unsigned int buf_len)
+{
+	struct cxl_nvdimm *cxl_nvd = nvdimm_provider_data(nvdimm);
+	unsigned long cmd_mask = nvdimm_cmd_mask(nvdimm);
+	struct cxl_memdev *cxlmd = cxl_nvd->cxlmd;
+	struct cxl_memdev_state *mds = to_cxl_memdev_state(cxlmd->cxlds);
+
+	if (!test_bit(cmd, &cmd_mask))
+		return -ENOTTY;
+
+	switch (cmd) {
+	case ND_CMD_GET_CONFIG_SIZE:
+		return cxl_pmem_get_config_size(mds, buf, buf_len);
+	case ND_CMD_GET_CONFIG_DATA:
+		return cxl_pmem_get_config_data(mds, buf, buf_len);
+	case ND_CMD_SET_CONFIG_DATA:
+		return cxl_pmem_set_config_data(mds, buf, buf_len);
+	default:
+		return -ENOTTY;
+	}
+}
+
+static int cxl_pmem_ctl(struct nvdimm_bus_descriptor *nd_desc,
+			struct nvdimm *nvdimm, unsigned int cmd, void *buf,
+			unsigned int buf_len, int *cmd_rc)
+{
+	/*
+	 * No firmware response to translate, let the transport error
+	 * code take precedence.
+	 */
+	*cmd_rc = 0;
+
+	if (!nvdimm)
+		return -ENOTTY;
+	return cxl_pmem_nvdimm_ctl(nvdimm, cmd, buf, buf_len);
+}
+
+static void unregister_nvdimm_bus(void *_cxl_nvb)
+{
+	struct cxl_nvdimm_bridge *cxl_nvb = _cxl_nvb;
+	struct nvdimm_bus *nvdimm_bus = cxl_nvb->nvdimm_bus;
+
+	bus_for_each_dev(&cxl_bus_type, NULL, cxl_nvb, detach_nvdimm);
+
+	cxl_nvb->nvdimm_bus = NULL;
+	nvdimm_bus_unregister(nvdimm_bus);
+}
+
+DEFINE_FREE(put_cxl_nvb, struct cxl_nvdimm_bridge *, if (!IS_ERR_OR_NULL(_T)) put_device(&_T->dev))
+static struct cxl_nvdimm_bridge *
+__devm_cxl_add_nvdimm_bridge(struct device *host, struct cxl_port *port)
+{
+	struct device *dev;
+	int rc;
+
+	if (!IS_ENABLED(CONFIG_CXL_PMEM))
+		return ERR_PTR(-ENXIO);
+
+	struct cxl_nvdimm_bridge *cxl_nvb __free(put_cxl_nvb) =
+		cxl_nvdimm_bridge_alloc(port);
+	if (IS_ERR(cxl_nvb))
+		return cxl_nvb;
+
+	dev = &cxl_nvb->dev;
+	rc = dev_set_name(dev, "nvdimm-bridge%d", cxl_nvb->id);
+	if (rc)
+		return ERR_PTR(rc);
+
+	rc = device_add(dev);
+	if (rc)
+		return ERR_PTR(rc);
+
+	rc = devm_add_action_or_reset(host, unregister_nvb, cxl_nvb);
+	if (rc) {
+		retain_and_null_ptr(cxl_nvb);
+		return ERR_PTR(rc);
+	}
+
+	return no_free_ptr(cxl_nvb);
+}
+
+static void release_nvb(void *_cxl_nvb)
+{
+	struct cxl_nvdimm_bridge *cxl_nvb = _cxl_nvb;
+
+	devm_release_action(&cxl_nvb->dev, unregister_nvb, cxl_nvb);
+}
+
+DEFINE_FREE(release_cxl_nvb, struct cxl_nvdimm_bridge *, if (!IS_ERR_OR_NULL(_T)) release_nvb(_T))
 /**
  * devm_cxl_add_nvdimm_bridge() - add the root of a LIBNVDIMM topology
  * @host: platform firmware root device
@@ -125,36 +330,33 @@ static void unregister_nvb(void *_cxl_nvb)
 struct cxl_nvdimm_bridge *devm_cxl_add_nvdimm_bridge(struct device *host,
 						     struct cxl_port *port)
 {
-	struct cxl_nvdimm_bridge *cxl_nvb;
 	struct device *dev;
 	int rc;
 
-	if (!IS_ENABLED(CONFIG_CXL_PMEM))
-		return ERR_PTR(-ENXIO);
-
-	cxl_nvb = cxl_nvdimm_bridge_alloc(port);
+	struct cxl_nvdimm_bridge *cxl_nvb __free(release_cxl_nvb) =
+		__devm_cxl_add_nvdimm_bridge(host, port);
 	if (IS_ERR(cxl_nvb))
 		return cxl_nvb;
 
 	dev = &cxl_nvb->dev;
-	rc = dev_set_name(dev, "nvdimm-bridge%d", cxl_nvb->id);
-	if (rc)
-		goto err;
+	cxl_nvb->nd_desc = (struct nvdimm_bus_descriptor) {
+		.provider_name = dev_name(dev->parent->parent),
+		.module = THIS_MODULE,
+		.ndctl = cxl_pmem_ctl,
+	};
 
-	rc = device_add(dev);
-	if (rc)
-		goto err;
+	cxl_nvb->nvdimm_bus =
+		nvdimm_bus_register(&cxl_nvb->dev, &cxl_nvb->nd_desc);
+	if (!cxl_nvb->nvdimm_bus)
+		return ERR_PTR(-ENOMEM);
 
-	rc = devm_add_action_or_reset(host, unregister_nvb, cxl_nvb);
+	rc = devm_add_action_or_reset(dev, unregister_nvdimm_bus, cxl_nvb);
 	if (rc)
 		return ERR_PTR(rc);
 
-	return cxl_nvb;
-
-err:
-	put_device(dev);
-	return ERR_PTR(rc);
+	return no_free_ptr(cxl_nvb);
 }
+
 EXPORT_SYMBOL_NS_GPL(devm_cxl_add_nvdimm_bridge, "CXL");
 
 static void cxl_nvdimm_release(struct device *dev)
diff --git a/drivers/cxl/pmem.c b/drivers/cxl/pmem.c
index 45486a9d23a5..49f6ab7c4fe1 100644
--- a/drivers/cxl/pmem.c
+++ b/drivers/cxl/pmem.c
@@ -167,196 +167,6 @@ static struct cxl_driver cxl_nvdimm_driver = {
 	},
 };
 
-static int cxl_pmem_get_config_size(struct cxl_memdev_state *mds,
-				    struct nd_cmd_get_config_size *cmd,
-				    unsigned int buf_len)
-{
-	struct cxl_mailbox *cxl_mbox = &mds->cxlds.cxl_mbox;
-
-	if (sizeof(*cmd) > buf_len)
-		return -EINVAL;
-
-	*cmd = (struct nd_cmd_get_config_size){
-		.config_size = mds->lsa_size,
-		.max_xfer =
-			cxl_mbox->payload_size - sizeof(struct cxl_mbox_set_lsa),
-	};
-
-	return 0;
-}
-
-static int cxl_pmem_get_config_data(struct cxl_memdev_state *mds,
-				    struct nd_cmd_get_config_data_hdr *cmd,
-				    unsigned int buf_len)
-{
-	struct cxl_mailbox *cxl_mbox = &mds->cxlds.cxl_mbox;
-	struct cxl_mbox_get_lsa get_lsa;
-	struct cxl_mbox_cmd mbox_cmd;
-	int rc;
-
-	if (sizeof(*cmd) > buf_len)
-		return -EINVAL;
-	if (struct_size(cmd, out_buf, cmd->in_length) > buf_len)
-		return -EINVAL;
-
-	get_lsa = (struct cxl_mbox_get_lsa) {
-		.offset = cpu_to_le32(cmd->in_offset),
-		.length = cpu_to_le32(cmd->in_length),
-	};
-	mbox_cmd = (struct cxl_mbox_cmd) {
-		.opcode = CXL_MBOX_OP_GET_LSA,
-		.payload_in = &get_lsa,
-		.size_in = sizeof(get_lsa),
-		.size_out = cmd->in_length,
-		.payload_out = cmd->out_buf,
-	};
-
-	rc = cxl_internal_send_cmd(cxl_mbox, &mbox_cmd);
-	cmd->status = 0;
-
-	return rc;
-}
-
-static int cxl_pmem_set_config_data(struct cxl_memdev_state *mds,
-				    struct nd_cmd_set_config_hdr *cmd,
-				    unsigned int buf_len)
-{
-	struct cxl_mailbox *cxl_mbox = &mds->cxlds.cxl_mbox;
-	struct cxl_mbox_set_lsa *set_lsa;
-	struct cxl_mbox_cmd mbox_cmd;
-	int rc;
-
-	if (sizeof(*cmd) > buf_len)
-		return -EINVAL;
-
-	/* 4-byte status follows the input data in the payload */
-	if (size_add(struct_size(cmd, in_buf, cmd->in_length), 4) > buf_len)
-		return -EINVAL;
-
-	set_lsa =
-		kvzalloc(struct_size(set_lsa, data, cmd->in_length), GFP_KERNEL);
-	if (!set_lsa)
-		return -ENOMEM;
-
-	*set_lsa = (struct cxl_mbox_set_lsa) {
-		.offset = cpu_to_le32(cmd->in_offset),
-	};
-	memcpy(set_lsa->data, cmd->in_buf, cmd->in_length);
-	mbox_cmd = (struct cxl_mbox_cmd) {
-		.opcode = CXL_MBOX_OP_SET_LSA,
-		.payload_in = set_lsa,
-		.size_in = struct_size(set_lsa, data, cmd->in_length),
-	};
-
-	rc = cxl_internal_send_cmd(cxl_mbox, &mbox_cmd);
-
-	/*
-	 * Set "firmware" status (4-packed bytes at the end of the input
-	 * payload.
-	 */
-	put_unaligned(0, (u32 *) &cmd->in_buf[cmd->in_length]);
-	kvfree(set_lsa);
-
-	return rc;
-}
-
-static int cxl_pmem_nvdimm_ctl(struct nvdimm *nvdimm, unsigned int cmd,
-			       void *buf, unsigned int buf_len)
-{
-	struct cxl_nvdimm *cxl_nvd = nvdimm_provider_data(nvdimm);
-	unsigned long cmd_mask = nvdimm_cmd_mask(nvdimm);
-	struct cxl_memdev *cxlmd = cxl_nvd->cxlmd;
-	struct cxl_memdev_state *mds = to_cxl_memdev_state(cxlmd->cxlds);
-
-	if (!test_bit(cmd, &cmd_mask))
-		return -ENOTTY;
-
-	switch (cmd) {
-	case ND_CMD_GET_CONFIG_SIZE:
-		return cxl_pmem_get_config_size(mds, buf, buf_len);
-	case ND_CMD_GET_CONFIG_DATA:
-		return cxl_pmem_get_config_data(mds, buf, buf_len);
-	case ND_CMD_SET_CONFIG_DATA:
-		return cxl_pmem_set_config_data(mds, buf, buf_len);
-	default:
-		return -ENOTTY;
-	}
-}
-
-static int cxl_pmem_ctl(struct nvdimm_bus_descriptor *nd_desc,
-			struct nvdimm *nvdimm, unsigned int cmd, void *buf,
-			unsigned int buf_len, int *cmd_rc)
-{
-	/*
-	 * No firmware response to translate, let the transport error
-	 * code take precedence.
-	 */
-	*cmd_rc = 0;
-
-	if (!nvdimm)
-		return -ENOTTY;
-	return cxl_pmem_nvdimm_ctl(nvdimm, cmd, buf, buf_len);
-}
-
-static int detach_nvdimm(struct device *dev, void *data)
-{
-	struct cxl_nvdimm *cxl_nvd;
-	bool release = false;
-
-	if (!is_cxl_nvdimm(dev))
-		return 0;
-
-	scoped_guard(device, dev) {
-		if (dev->driver) {
-			cxl_nvd = to_cxl_nvdimm(dev);
-			if (cxl_nvd->cxlmd && cxl_nvd->cxlmd->cxl_nvb == data)
-				release = true;
-		}
-	}
-	if (release)
-		device_release_driver(dev);
-	return 0;
-}
-
-static void unregister_nvdimm_bus(void *_cxl_nvb)
-{
-	struct cxl_nvdimm_bridge *cxl_nvb = _cxl_nvb;
-	struct nvdimm_bus *nvdimm_bus = cxl_nvb->nvdimm_bus;
-
-	bus_for_each_dev(&cxl_bus_type, NULL, cxl_nvb, detach_nvdimm);
-
-	cxl_nvb->nvdimm_bus = NULL;
-	nvdimm_bus_unregister(nvdimm_bus);
-}
-
-static int cxl_nvdimm_bridge_probe(struct device *dev)
-{
-	struct cxl_nvdimm_bridge *cxl_nvb = to_cxl_nvdimm_bridge(dev);
-
-	cxl_nvb->nd_desc = (struct nvdimm_bus_descriptor) {
-		.provider_name = dev_name(dev->parent->parent),
-		.module = THIS_MODULE,
-		.ndctl = cxl_pmem_ctl,
-	};
-
-	cxl_nvb->nvdimm_bus =
-		nvdimm_bus_register(&cxl_nvb->dev, &cxl_nvb->nd_desc);
-
-	if (!cxl_nvb->nvdimm_bus)
-		return -ENOMEM;
-
-	return devm_add_action_or_reset(dev, unregister_nvdimm_bus, cxl_nvb);
-}
-
-static struct cxl_driver cxl_nvdimm_bridge_driver = {
-	.name = "cxl_nvdimm_bridge",
-	.probe = cxl_nvdimm_bridge_probe,
-	.id = CXL_DEVICE_NVDIMM_BRIDGE,
-	.drv = {
-		.suppress_bind_attrs = true,
-	},
-};
-
 static void unregister_nvdimm_region(void *nd_region)
 {
 	nvdimm_region_delete(nd_region);
@@ -504,13 +314,9 @@ static __init int cxl_pmem_init(void)
 	set_bit(CXL_MEM_COMMAND_ID_SET_SHUTDOWN_STATE, exclusive_cmds);
 	set_bit(CXL_MEM_COMMAND_ID_SET_LSA, exclusive_cmds);
 
-	rc = cxl_driver_register(&cxl_nvdimm_bridge_driver);
-	if (rc)
-		return rc;
-
 	rc = cxl_driver_register(&cxl_nvdimm_driver);
 	if (rc)
-		goto err_nvdimm;
+		return rc;
 
 	rc = cxl_driver_register(&cxl_pmem_region_driver);
 	if (rc)
@@ -520,8 +326,6 @@ static __init int cxl_pmem_init(void)
 
 err_region:
 	cxl_driver_unregister(&cxl_nvdimm_driver);
-err_nvdimm:
-	cxl_driver_unregister(&cxl_nvdimm_bridge_driver);
 	return rc;
 }
 
@@ -529,7 +333,6 @@ static __exit void cxl_pmem_exit(void)
 {
 	cxl_driver_unregister(&cxl_pmem_region_driver);
 	cxl_driver_unregister(&cxl_nvdimm_driver);
-	cxl_driver_unregister(&cxl_nvdimm_bridge_driver);
 }
 
 MODULE_DESCRIPTION("CXL PMEM: Persistent Memory Support");
-- 
2.52.0

Re: [PATCH 2/2] cxl: Fix race of nvdimm_bus for the nvdimm_bridge object

[kernel test robot]

Hi Dave,

kernel test robot noticed the following build errors:

[auto build test ERROR on 18f7fcd5e69a04df57b563360b88be72471d6b62]

url:    https://github.com/intel-lab-lkp/linux/commits/Dave-Jiang/cxl-test-Removal-of-nvdimm_bus_register-wrapper-in-cxl_test/20260205-081838
base:   18f7fcd5e69a04df57b563360b88be72471d6b62
patch link:    https://lore.kernel.org/r/20260205001633.1813643-3-dave.jiang%40intel.com
patch subject: [PATCH 2/2] cxl: Fix race of nvdimm_bus for the nvdimm_bridge object
config: i386-randconfig-013-20260205 (https://download.01.org/0day-ci/archive/20260205/202602051405.Laq0NMV5-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260205/202602051405.Laq0NMV5-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202602051405.Laq0NMV5-lkp@intel.com/

All errors (new ones prefixed by >>):

   ld: drivers/cxl/core/pmem.o: in function `unregister_nvdimm_bus':
>> drivers/cxl/core/pmem.c:279:(.text+0x320): undefined reference to `nvdimm_bus_unregister'
   ld: drivers/cxl/core/pmem.o: in function `devm_cxl_add_nvdimm_bridge':
>> drivers/cxl/core/pmem.c:349:(.text+0x473): undefined reference to `nvdimm_bus_register'
   ld: drivers/cxl/core/pmem.o: in function `cxl_pmem_nvdimm_ctl':
>> drivers/cxl/core/pmem.c:236:(.text+0x91c): undefined reference to `nvdimm_provider_data'
>> ld: drivers/cxl/core/pmem.c:237:(.text+0x926): undefined reference to `nvdimm_cmd_mask'


vim +279 drivers/cxl/core/pmem.c

   232	
   233	static int cxl_pmem_nvdimm_ctl(struct nvdimm *nvdimm, unsigned int cmd,
   234				       void *buf, unsigned int buf_len)
   235	{
 > 236		struct cxl_nvdimm *cxl_nvd = nvdimm_provider_data(nvdimm);
 > 237		unsigned long cmd_mask = nvdimm_cmd_mask(nvdimm);
   238		struct cxl_memdev *cxlmd = cxl_nvd->cxlmd;
   239		struct cxl_memdev_state *mds = to_cxl_memdev_state(cxlmd->cxlds);
   240	
   241		if (!test_bit(cmd, &cmd_mask))
   242			return -ENOTTY;
   243	
   244		switch (cmd) {
   245		case ND_CMD_GET_CONFIG_SIZE:
   246			return cxl_pmem_get_config_size(mds, buf, buf_len);
   247		case ND_CMD_GET_CONFIG_DATA:
   248			return cxl_pmem_get_config_data(mds, buf, buf_len);
   249		case ND_CMD_SET_CONFIG_DATA:
   250			return cxl_pmem_set_config_data(mds, buf, buf_len);
   251		default:
   252			return -ENOTTY;
   253		}
   254	}
   255	
   256	static int cxl_pmem_ctl(struct nvdimm_bus_descriptor *nd_desc,
   257				struct nvdimm *nvdimm, unsigned int cmd, void *buf,
   258				unsigned int buf_len, int *cmd_rc)
   259	{
   260		/*
   261		 * No firmware response to translate, let the transport error
   262		 * code take precedence.
   263		 */
   264		*cmd_rc = 0;
   265	
   266		if (!nvdimm)
   267			return -ENOTTY;
   268		return cxl_pmem_nvdimm_ctl(nvdimm, cmd, buf, buf_len);
   269	}
   270	
   271	static void unregister_nvdimm_bus(void *_cxl_nvb)
   272	{
   273		struct cxl_nvdimm_bridge *cxl_nvb = _cxl_nvb;
   274		struct nvdimm_bus *nvdimm_bus = cxl_nvb->nvdimm_bus;
   275	
   276		bus_for_each_dev(&cxl_bus_type, NULL, cxl_nvb, detach_nvdimm);
   277	
   278		cxl_nvb->nvdimm_bus = NULL;
 > 279		nvdimm_bus_unregister(nvdimm_bus);
   280	}
   281	
   282	DEFINE_FREE(put_cxl_nvb, struct cxl_nvdimm_bridge *, if (!IS_ERR_OR_NULL(_T)) put_device(&_T->dev))
   283	static struct cxl_nvdimm_bridge *
   284	__devm_cxl_add_nvdimm_bridge(struct device *host, struct cxl_port *port)
   285	{
   286		struct device *dev;
   287		int rc;
   288	
   289		if (!IS_ENABLED(CONFIG_CXL_PMEM))
   290			return ERR_PTR(-ENXIO);
   291	
   292		struct cxl_nvdimm_bridge *cxl_nvb __free(put_cxl_nvb) =
   293			cxl_nvdimm_bridge_alloc(port);
   294		if (IS_ERR(cxl_nvb))
   295			return cxl_nvb;
   296	
   297		dev = &cxl_nvb->dev;
   298		rc = dev_set_name(dev, "nvdimm-bridge%d", cxl_nvb->id);
   299		if (rc)
   300			return ERR_PTR(rc);
   301	
   302		rc = device_add(dev);
   303		if (rc)
   304			return ERR_PTR(rc);
   305	
   306		rc = devm_add_action_or_reset(host, unregister_nvb, cxl_nvb);
   307		if (rc) {
   308			retain_and_null_ptr(cxl_nvb);
   309			return ERR_PTR(rc);
   310		}
   311	
   312		return no_free_ptr(cxl_nvb);
   313	}
   314	
   315	static void release_nvb(void *_cxl_nvb)
   316	{
   317		struct cxl_nvdimm_bridge *cxl_nvb = _cxl_nvb;
   318	
   319		devm_release_action(&cxl_nvb->dev, unregister_nvb, cxl_nvb);
   320	}
   321	
   322	DEFINE_FREE(release_cxl_nvb, struct cxl_nvdimm_bridge *, if (!IS_ERR_OR_NULL(_T)) release_nvb(_T))
   323	/**
   324	 * devm_cxl_add_nvdimm_bridge() - add the root of a LIBNVDIMM topology
   325	 * @host: platform firmware root device
   326	 * @port: CXL port at the root of a CXL topology
   327	 *
   328	 * Return: bridge device that can host cxl_nvdimm objects
   329	 */
   330	struct cxl_nvdimm_bridge *devm_cxl_add_nvdimm_bridge(struct device *host,
   331							     struct cxl_port *port)
   332	{
   333		struct device *dev;
   334		int rc;
   335	
   336		struct cxl_nvdimm_bridge *cxl_nvb __free(release_cxl_nvb) =
   337			__devm_cxl_add_nvdimm_bridge(host, port);
   338		if (IS_ERR(cxl_nvb))
   339			return cxl_nvb;
   340	
   341		dev = &cxl_nvb->dev;
   342		cxl_nvb->nd_desc = (struct nvdimm_bus_descriptor) {
   343			.provider_name = dev_name(dev->parent->parent),
   344			.module = THIS_MODULE,
   345			.ndctl = cxl_pmem_ctl,
   346		};
   347	
   348		cxl_nvb->nvdimm_bus =
 > 349			nvdimm_bus_register(&cxl_nvb->dev, &cxl_nvb->nd_desc);
   350		if (!cxl_nvb->nvdimm_bus)
   351			return ERR_PTR(-ENOMEM);
   352	
   353		rc = devm_add_action_or_reset(dev, unregister_nvdimm_bus, cxl_nvb);
   354		if (rc)
   355			return ERR_PTR(rc);
   356	
   357		return no_free_ptr(cxl_nvb);
   358	}
   359	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH 2/2] cxl: Fix race of nvdimm_bus for the nvdimm_bridge object

[kernel test robot]

Hi Dave,

kernel test robot noticed the following build errors:

[auto build test ERROR on 18f7fcd5e69a04df57b563360b88be72471d6b62]

url:    https://github.com/intel-lab-lkp/linux/commits/Dave-Jiang/cxl-test-Removal-of-nvdimm_bus_register-wrapper-in-cxl_test/20260205-081838
base:   18f7fcd5e69a04df57b563360b88be72471d6b62
patch link:    https://lore.kernel.org/r/20260205001633.1813643-3-dave.jiang%40intel.com
patch subject: [PATCH 2/2] cxl: Fix race of nvdimm_bus for the nvdimm_bridge object
config: parisc-randconfig-r061-20260205 (https://download.01.org/0day-ci/archive/20260206/202602060104.uSyuffEI-lkp@intel.com/config)
compiler: hppa-linux-gcc (GCC) 11.5.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260206/202602060104.uSyuffEI-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202602060104.uSyuffEI-lkp@intel.com/

All errors (new ones prefixed by >>, old ones prefixed by <<):

>> ERROR: modpost: "nvdimm_bus_unregister" [drivers/cxl/core/cxl_core.ko] undefined!
>> ERROR: modpost: "nvdimm_provider_data" [drivers/cxl/core/cxl_core.ko] undefined!
>> ERROR: modpost: "nvdimm_bus_register" [drivers/cxl/core/cxl_core.ko] undefined!
>> ERROR: modpost: "nvdimm_cmd_mask" [drivers/cxl/core/cxl_core.ko] undefined!

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH 0/2] cxl: Fix nvdimm_bus race for nvdimm_bridge

[Dave Jiang]

On 2/4/26 5:16 PM, Dave Jiang wrote:
> A small series to address a race for nvdimm_bus object when using the
> nvdimm_bridge object.
> 
> 
> Dave Jiang (2):
>   cxl/test: Removal of nvdimm_bus_register() wrapper in cxl_test
>   cxl: Fix race of nvdimm_bus for the nvdimm_bridge object
> 
>  drivers/cxl/core/pmem.c       | 236 +++++++++++++++++++++++++++++++---
>  drivers/cxl/pmem.c            | 199 +---------------------------
>  include/linux/libnvdimm.h     |   2 +-
>  tools/testing/cxl/Kbuild      |   1 -
>  tools/testing/cxl/test/mock.c |  15 ---
>  5 files changed, 221 insertions(+), 232 deletions(-)
> 
> 
> base-commit: 18f7fcd5e69a04df57b563360b88be72471d6b62

Don't bother reviewing this. Going to try a different approach. 

Re: [PATCH 1/2] cxl/test: Removal of nvdimm_bus_register() wrapper in cxl_test

[Ira Weiny]

Dave Jiang wrote:
> Remove nvdimm_bus_register() wrapper in cxl_test driver in order to
> address a fix in a different commit that fixes the issue of missing
> nvdimm bus object due to an initialization race. The CXL CLI unit
> test cxl-security.sh will be adjusted with this new change.
> 
> Suggested-by: Dan Williams <dan.j.williams@intel.com>
> Signed-off-by: Dave Jiang <dave.jiang@intel.com>
> ---
>  drivers/cxl/pmem.c            |  2 +-
>  include/linux/libnvdimm.h     |  2 +-

For the nvdimm bit
Acked-by: Ira Weiny <ira.weiny@intel.com>

[snip]

Re: [PATCH 0/2] cxl: Fix nvdimm_bus race for nvdimm_bridge

[Alison Schofield]

On Wed, Feb 04, 2026 at 05:16:31PM -0700, Dave Jiang wrote:
> A small series to address a race for nvdimm_bus object when using the
> nvdimm_bridge object.
> 
Hi Dave,

Sorry for the delay tagging. I was hoping to find a crisp
reproducer to add to the commit log, but nothing nice enough
for a unit test, yet!

For the series:
Tested-by: Alison Schofield <alison.schofield@intel.com>
Reviewed-by: Alison Schofield <alison.schofield@intel.com?


> 
> Dave Jiang (2):
>   cxl/test: Removal of nvdimm_bus_register() wrapper in cxl_test
>   cxl: Fix race of nvdimm_bus for the nvdimm_bridge object
> 
>  drivers/cxl/core/pmem.c       | 236 +++++++++++++++++++++++++++++++---
>  drivers/cxl/pmem.c            | 199 +---------------------------
>  include/linux/libnvdimm.h     |   2 +-
>  tools/testing/cxl/Kbuild      |   1 -
>  tools/testing/cxl/test/mock.c |  15 ---
>  5 files changed, 221 insertions(+), 232 deletions(-)
> 
> 
> base-commit: 18f7fcd5e69a04df57b563360b88be72471d6b62
> -- 
> 2.52.0
>