[PATCH 0/2] cxl: Convert remaining PCIBIOS errors to errno

[PATCH 0/2] cxl: Convert remaining PCIBIOS errors to errno

[Richard Cheng]

This is a follow-up to "cxl/pci: Convert PCIBIOS errors to errno on
DVSEC config accesses". After that series landed by Dave Jiang, I
continued auditing the CXL code for PCI config accessors that propagate
positive PCIBIOS_* status codes where callers expect negative errnos,
and found a few more spots.

Patch 1 converts the remaining DVSEC and PCIe capability accesses in
update_gpf_port_dvsec() and the dport setup path that returned the raw
PCIBIOS status to callers testing for failure.

Patch 2 fixes __cxl_find_regblock_instance(), which ignored the
pci_read_config_dword() return value entirely. On a failed config read
the raw accessor leaves PCI_ERROR_RESPONSE (~0) in the destination, so
the code computed a bogus regblock count and decoded register block
addresses from garbage. Check the return value and convert it.

Richard Cheng (2):
  cxl: Convert PCIBIOS errors to errno on remaining DVSEC/PCIe accesses
  cxl/core/regs: Check return value of DVSEC register locator reads

 drivers/cxl/core/pci.c  |  2 +-
 drivers/cxl/core/regs.c | 14 ++++++++++----
 drivers/cxl/port.c      |  2 +-
 3 files changed, 12 insertions(+), 6 deletions(-)


base-commit: 26aa60e0276272ae61b843a05a91748dcb1130f9
-- 
2.43.0

[PATCH 1/2] cxl: Convert PCIBIOS errors to errno on remaining DVSEC/PCIe accesses

[Richard Cheng]

PCI config and PCIe capability accessors return positive PCIBIOS_*
status codes on failure, not negative errnos. update_gpf_port_dvsec()
and cxl_setup_parent_dport() propagate these raw values to callers that
test for failure with "if (rc)" and expect a negative errno, which can
misreport the error.

Conver the positive PCIBIOS status with pcibios_err_to_errno() on these
error paths.

Signed-off-by: Richard Cheng <icheng@nvidia.com>
---
 drivers/cxl/core/pci.c | 2 +-
 drivers/cxl/port.c     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/cxl/core/pci.c b/drivers/cxl/core/pci.c
index e4338fd7e01b..ea81a170132f 100644
--- a/drivers/cxl/core/pci.c
+++ b/drivers/cxl/core/pci.c
@@ -852,7 +852,7 @@ static int update_gpf_port_dvsec(struct pci_dev *pdev, int dvsec, int phase)
 		pci_dbg(pdev, "Port GPF phase %d timeout: %d0 secs\n",
 			phase, GPF_TIMEOUT_BASE_MAX);
 
-	return rc;
+	return pcibios_err_to_errno(rc);
 }
 
 int cxl_gpf_port_setup(struct cxl_dport *dport)
diff --git a/drivers/cxl/port.c b/drivers/cxl/port.c
index ada51948d52f..dc3029efb087 100644
--- a/drivers/cxl/port.c
+++ b/drivers/cxl/port.c
@@ -92,7 +92,7 @@ static int cxl_ras_unmask(struct cxl_port *port)
 
 	rc = pcie_capability_read_word(pdev, PCI_EXP_DEVCTL, &cap);
 	if (rc)
-		return rc;
+		return pcibios_err_to_errno(rc);
 
 	if (cap & PCI_EXP_DEVCTL_URRE) {
 		addr = port->regs.ras + CXL_RAS_UNCORRECTABLE_MASK_OFFSET;
-- 
2.43.0

Re: [PATCH 1/2] cxl: Convert PCIBIOS errors to errno on remaining DVSEC/PCIe accesses

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Incomplete conversion of PCIBIOS error codes leaves `update_gpf_port_dvsec()` with an inconsistent return type.
--

commit 84be8b4e0a3d7e5cbd94897e592a3a721caed448
Author: Richard Cheng <icheng@nvidia.com>

cxl: Convert PCIBIOS errors to errno on remaining DVSEC/PCIe accesses
    
PCI config and PCIe capability accessors return positive PCIBIOS_*
status codes on failure, not negative errnos. update_gpf_port_dvsec()
and cxl_setup_parent_dport() propagate these raw values to callers that
test for failure with "if (rc)" and expect a negative errno, which can
misreport the error.
    
Conver the positive PCIBIOS status with pcibios_err_to_errno() on these
error paths.

> diff --git a/drivers/cxl/core/pci.c b/drivers/cxl/core/pci.c
> index e4338fd7e01b4..ea81a170132fb 100644
> --- a/drivers/cxl/core/pci.c
> +++ b/drivers/cxl/core/pci.c
> @@ -852,7 +852,7 @@ static int update_gpf_port_dvsec(struct pci_dev *pdev, int dvsec, int phase)
>  		pci_dbg(pdev, "Port GPF phase %d timeout: %d0 secs\n",
>  			phase, GPF_TIMEOUT_BASE_MAX);
>  
> -	return rc;
> +	return pcibios_err_to_errno(rc);

[Severity: Medium]
Does this function still return an unconverted PCIBIOS error code on the early
read failure path?

Looking earlier in update_gpf_port_dvsec():

	rc = pci_read_config_word(pdev, dvsec + offset, &ctrl);
	if (rc)
		return rc;

If pci_read_config_word() fails, it returns a positive PCIBIOS error code.
This leaves the function with an inconsistent return type where it returns
positive error codes for read failures and negative errnos for write failures.

Should the read failure path also be converted with pcibios_err_to_errno()?

>  }
>  
>  int cxl_gpf_port_setup(struct cxl_dport *dport)

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260607070241.48978-1-icheng@nvidia.com?part=1

[PATCH 2/2] cxl/core/regs: Check return value of DVSEC register locator reads

[Richard Cheng]

__cxl_find_regblock_instance() reads the CXL Register Locator DVSEC via
pci_read_config_dword() but ignores the return value. On a failed config
read the raw accessor leaves PCI_ERROR_RESPONSE (~0) in the destination,
so the code computes a huge regblock count and decodes register block
addresses from garbage instead of detecting the failure.

Check the return value and convert the positive PCIBIOS_* status to a
negative errno with pcibios_err_to_errno() on the error paths.

Fixes: 303ebc1b1741 ("cxl/acpi: Map component registers for Root Ports")
Signed-off-by: Richard Cheng <icheng@nvidia.com>
---
 drivers/cxl/core/regs.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/drivers/cxl/core/regs.c b/drivers/cxl/core/regs.c
index 93710cf4f0a6..bbb1c278c4d8 100644
--- a/drivers/cxl/core/regs.c
+++ b/drivers/cxl/core/regs.c
@@ -303,7 +303,7 @@ static int __cxl_find_regblock_instance(struct pci_dev *pdev, enum cxl_regloc_ty
 {
 	u32 regloc_size, regblocks;
 	int instance = 0;
-	int regloc, i;
+	int regloc, i, rc;
 
 	*map = (struct cxl_register_map) {
 		.host = &pdev->dev,
@@ -315,7 +315,9 @@ static int __cxl_find_regblock_instance(struct pci_dev *pdev, enum cxl_regloc_ty
 	if (!regloc)
 		return -ENXIO;
 
-	pci_read_config_dword(pdev, regloc + PCI_DVSEC_HEADER1, &regloc_size);
+	rc = pci_read_config_dword(pdev, regloc + PCI_DVSEC_HEADER1, &regloc_size);
+	if (rc)
+		return pcibios_err_to_errno(rc);
 	regloc_size = PCI_DVSEC_HEADER1_LEN(regloc_size);
 
 	regloc += PCI_DVSEC_CXL_REG_LOCATOR_BLOCK1;
@@ -324,8 +326,12 @@ static int __cxl_find_regblock_instance(struct pci_dev *pdev, enum cxl_regloc_ty
 	for (i = 0; i < regblocks; i++, regloc += 8) {
 		u32 reg_lo, reg_hi;
 
-		pci_read_config_dword(pdev, regloc, &reg_lo);
-		pci_read_config_dword(pdev, regloc + 4, &reg_hi);
+		rc = pci_read_config_dword(pdev, regloc, &reg_lo);
+		if (rc)
+			return pcibios_err_to_errno(rc);
+		rc = pci_read_config_dword(pdev, regloc + 4, &reg_hi);
+		if (rc)
+			return pcibios_err_to_errno(rc);
 
 		if (!cxl_decode_regblock(pdev, reg_lo, reg_hi, map))
 			continue;
-- 
2.43.0

Re: [PATCH 2/2] cxl/core/regs: Check return value of DVSEC register locator reads

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The newly added early returns on `pci_read_config_dword()` failures leak intermediate register block state in the `map` output parameter. If a previous loop iteration successfully decoded a non-matching block, that state is retained and erroneously consumed by callers that ignore the return value.
--

commit 33d355daa1f588d8fa2e0001a3651a368f36be29
Author: Richard Cheng <icheng@nvidia.com>

cxl/core/regs: Check return value of DVSEC register locator reads

This commit checks the return value of pci_read_config_dword() when
reading the CXL Register Locator DVSEC. On failure, it converts the
PCIBIOS status to a negative errno to avoid decoding register block
addresses from garbage data.

> diff --git a/drivers/cxl/core/regs.c b/drivers/cxl/core/regs.c
> --- a/drivers/cxl/core/regs.c
> +++ b/drivers/cxl/core/regs.c
[ ... ]
> @@ -324,8 +326,12 @@ static int __cxl_find_regblock_instance(struct pci_dev *pdev, enum cxl_regloc_ty
>  	for (i = 0; i < regblocks; i++, regloc += 8) {
>  		u32 reg_lo, reg_hi;
>  
> -		pci_read_config_dword(pdev, regloc, &reg_lo);
> -		pci_read_config_dword(pdev, regloc + 4, &reg_hi);
> +		rc = pci_read_config_dword(pdev, regloc, &reg_lo);
> +		if (rc)
> +			return pcibios_err_to_errno(rc);

[Severity: High]
Does this early return leave map->resource populated with stale data?

If a previous loop iteration successfully decoded a non-matching block
(such as CXL_REGLOC_RBI_MEMDEV), map->resource and map->reg_type will
be populated. If a subsequent config read fails, returning early bypasses
the map->resource = CXL_RESOURCE_NONE cleanup at the end of the function.

Callers like find_component_registers() in drivers/cxl/core/port.c ignore
the return value of cxl_find_regblock() and blindly consume map.resource.
Will this cause the caller to erroneously map the wrong registers (like
the memdev registers) as component registers?

> +		rc = pci_read_config_dword(pdev, regloc + 4, &reg_hi);
> +		if (rc)
> +			return pcibios_err_to_errno(rc);
>  
>  		if (!cxl_decode_regblock(pdev, reg_lo, reg_hi, map))
>  			continue;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260607070241.48978-1-icheng@nvidia.com?part=2