Re: [PATCH v12 12/12] PCI/CXL: Restore CXL state after CXL bus reset

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [Critical] cxl_reset_bus_function bypasses memory range safety checks and CPU cache invalidation before initiating a bus reset, risking MCEs and system crashes.
- [High] Priority inversion in pci_reset_fn_methods[] bypasses cxl_reset_bus_function, causing CXL state restoration to fail if SBR is already unmasked.
--

commit a0905bda4417fb243d6c3399ed1032ddb3d39e35
Author: Srirangan Madhavan <smadhavan@nvidia.com>
Subject: PCI/CXL: Restore CXL state after CXL bus reset

This commit updates the CXL bus reset path to restore CXL HDM decoder
programming and CXL Device DVSEC protocol enables after a successful CXL
bus reset. It introduces a state restoration function that restores PCI
config state first, ensuring BARs are valid before restoring the cached
CXL state. It also rejects CXL bus reset for multifunction devices and PFs
with enabled VFs.

> diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
> index 157f06c576e93..a3ba4c28c62bc 100644
> --- a/drivers/pci/pci.c
> +++ b/drivers/pci/pci.c
[ ... ]
> @@ -5054,6 +5057,9 @@ static int cxl_reset_bus_function(struct pci_dev *dev, bool probe)
>  		pci_write_config_word(bridge, dvsec + PCI_DVSEC_CXL_PORT_CTL,
>  				      reg);
>  
> +	if (!rc)
> +		rc = cxl_restore_state_after_pci_reset(dev);
> +

[Severity: Critical]
This is a pre-existing issue, but does cxl_reset_bus_function() bypass
memory range safety checks and CPU cache invalidation before initiating a
bus reset?

The hardware bus reset is executed in this function (just prior to this
hunk via rc = pci_reset_bus_function()) without any preceding memory range
safety checks or cache invalidation. This bypasses the safety mechanisms
present in the traditional CXL reset path.

While cxl_reset_function() properly invokes cxl_hdm_ranges_prepare() to
verify no memory regions are busy and flush caches,
cxl_reset_bus_function() entirely skips these safety checks before issuing
the reset.

A hardware PCI bus reset instantly clears CXL HDM decoders. If the CXL
backing memory is in active use by the host (e.g., DAX or system RAM),
pulling the memory away can cause Machine Check Exceptions (MCE).

Could this allow a VFIO-assigned VM to crash the host via the sysfs reset
attribute?

[Severity: High]
This isn't a bug introduced by this patch, but does the priority inversion
in pci_reset_fn_methods[] bypass cxl_reset_bus_function() entirely?

The pci_reset_fn_methods[] array defines the fallback priority of reset
mechanisms. The cxl_bus entry is placed after bus:

drivers/pci/pci.c:pci_reset_fn_methods[] = {
    ...
    { pci_reset_bus_function, .name = "bus" },
    { cxl_reset_bus_function, .name = "cxl_bus" },
};

Placing cxl_bus after bus ensures that if the standard bus reset is
physically possible and unmasked, the CXL-specific wrapper with the state
restoration logic will never run.

If a CXL device's Secondary Bus Reset (SBR) is already unmasked,
pci_reset_bus_function() will successfully probe and execute the reset.
Because it returns 0 on success, the PCI reset core stops iterating and
completely bypasses cxl_reset_bus_function().

As a result, the newly added cxl_restore_state_after_pci_reset() is never
called, leaving the device with unprogrammed CXL HDM decoders.

>  	pci_dev_reset_iommu_done(dev);
>  	return rc;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260910070808.1444264-1-smadhavan@nvidia.com?part=12