[PATCH v2] cxl/events: Test CME counter expiry with equality, not bitwise AND

[PATCH v2] cxl/events: Test CME counter expiry with equality, not bitwise AND

[Guixin Liu]

The Memory Event Type field in the General Media and DRAM event records
is an enumeration, not a bitmask. The validity checks for the advanced
programmable CME counter expiration event (05h) test the field with a
bitwise AND, so types 01h, 03h, 04h and 06h match it as well.

A device reporting one of those types trips WARN_ON_ONCE once the
general media or DRAM tracepoint is enabled, which is the case anywhere
rasdaemon collects CXL events. Under panic_on_warn=1 that kills the
machine.

Compare the type field for equality instead. Type 05h records that do
violate the spec conditions still warn.

Fixes: cd3b36cfc659 ("cxl/events: Add extra validity checks for corrected memory error count in General Media Event Record")
Fixes: d8145bb8af5c ("cxl/events: Add extra validity checks for CVME count in DRAM Event Record")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
---
Found by code inspection during review of a downstream backport of
these two patches. Reproduced in a QEMU CXL topology by injecting
General Media events through the cxl-inject-general-media-event QMP
command: a type 01h event warns in cxl_event_trace_record() without
the fix and is traced without a warning with it; type 05h events that
violate the spec conditions still warn.

Changes since v1 [1]:
- Collect the commit log suggested by Dave Jiang and the subject
  suggested by Alison Schofield.
- Move the reproducer explanation below '---' (Dave Jiang).
- Add the 'Assisted-by: LLM' tag (Dave Jiang).

[1]: https://lore.kernel.org/all/20260921120932.1769566-1-kanie@linux.alibaba.com/

 drivers/cxl/core/mbox.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/cxl/core/mbox.c b/drivers/cxl/core/mbox.c
index 55828a836c01..01341f524a93 100644
--- a/drivers/cxl/core/mbox.c
+++ b/drivers/cxl/core/mbox.c
@@ -942,11 +942,11 @@ void cxl_event_trace_record(struct cxl_memdev *cxlmd,
 
 			if (evt->gen_media.media_hdr.descriptor &
 			    CXL_GMER_EVT_DESC_THRESHOLD_EVENT)
-				WARN_ON_ONCE((evt->gen_media.media_hdr.type &
+				WARN_ON_ONCE((evt->gen_media.media_hdr.type ==
 					      CXL_GMER_MEM_EVT_TYPE_AP_CME_COUNTER_EXPIRE) &&
 					     !get_unaligned_le24(evt->gen_media.cme_count));
 			else
-				WARN_ON_ONCE(evt->gen_media.media_hdr.type &
+				WARN_ON_ONCE(evt->gen_media.media_hdr.type ==
 					     CXL_GMER_MEM_EVT_TYPE_AP_CME_COUNTER_EXPIRE);
 
 			trace_cxl_general_media(cxlmd, type, cxlr, hpa,
@@ -957,11 +957,11 @@ void cxl_event_trace_record(struct cxl_memdev *cxlmd,
 
 			if (evt->dram.media_hdr.descriptor &
 			    CXL_GMER_EVT_DESC_THRESHOLD_EVENT)
-				WARN_ON_ONCE((evt->dram.media_hdr.type &
+				WARN_ON_ONCE((evt->dram.media_hdr.type ==
 					      CXL_DER_MEM_EVT_TYPE_AP_CME_COUNTER_EXPIRE) &&
 					     !get_unaligned_le24(evt->dram.cvme_count));
 			else
-				WARN_ON_ONCE(evt->dram.media_hdr.type &
+				WARN_ON_ONCE(evt->dram.media_hdr.type ==
 					     CXL_DER_MEM_EVT_TYPE_AP_CME_COUNTER_EXPIRE);
 
 			trace_cxl_dram(cxlmd, type, cxlr, hpa, hpa_alias,
-- 
2.43.7

Re: [PATCH v2] cxl/events: Test CME counter expiry with equality, not bitwise AND

[Dave Jiang]

On 9/22/26 1:22 AM, Guixin Liu wrote:
> The Memory Event Type field in the General Media and DRAM event records
> is an enumeration, not a bitmask. The validity checks for the advanced
> programmable CME counter expiration event (05h) test the field with a
> bitwise AND, so types 01h, 03h, 04h and 06h match it as well.
> 
> A device reporting one of those types trips WARN_ON_ONCE once the
> general media or DRAM tracepoint is enabled, which is the case anywhere
> rasdaemon collects CXL events. Under panic_on_warn=1 that kills the
> machine.
> 
> Compare the type field for equality instead. Type 05h records that do
> violate the spec conditions still warn.
> 
> Fixes: cd3b36cfc659 ("cxl/events: Add extra validity checks for corrected memory error count in General Media Event Record")
> Fixes: d8145bb8af5c ("cxl/events: Add extra validity checks for CVME count in DRAM Event Record")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>

Reviewed-by: Dave Jiang <dave.jiang@intel.com>

> ---
> Found by code inspection during review of a downstream backport of
> these two patches. Reproduced in a QEMU CXL topology by injecting
> General Media events through the cxl-inject-general-media-event QMP
> command: a type 01h event warns in cxl_event_trace_record() without
> the fix and is traced without a warning with it; type 05h events that
> violate the spec conditions still warn.
> 
> Changes since v1 [1]:
> - Collect the commit log suggested by Dave Jiang and the subject
>   suggested by Alison Schofield.
> - Move the reproducer explanation below '---' (Dave Jiang).
> - Add the 'Assisted-by: LLM' tag (Dave Jiang).
> 
> [1]: https://lore.kernel.org/all/20260921120932.1769566-1-kanie@linux.alibaba.com/
> 
>  drivers/cxl/core/mbox.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/cxl/core/mbox.c b/drivers/cxl/core/mbox.c
> index 55828a836c01..01341f524a93 100644
> --- a/drivers/cxl/core/mbox.c
> +++ b/drivers/cxl/core/mbox.c
> @@ -942,11 +942,11 @@ void cxl_event_trace_record(struct cxl_memdev *cxlmd,
>  
>  			if (evt->gen_media.media_hdr.descriptor &
>  			    CXL_GMER_EVT_DESC_THRESHOLD_EVENT)
> -				WARN_ON_ONCE((evt->gen_media.media_hdr.type &
> +				WARN_ON_ONCE((evt->gen_media.media_hdr.type ==
>  					      CXL_GMER_MEM_EVT_TYPE_AP_CME_COUNTER_EXPIRE) &&
>  					     !get_unaligned_le24(evt->gen_media.cme_count));
>  			else
> -				WARN_ON_ONCE(evt->gen_media.media_hdr.type &
> +				WARN_ON_ONCE(evt->gen_media.media_hdr.type ==
>  					     CXL_GMER_MEM_EVT_TYPE_AP_CME_COUNTER_EXPIRE);
>  
>  			trace_cxl_general_media(cxlmd, type, cxlr, hpa,
> @@ -957,11 +957,11 @@ void cxl_event_trace_record(struct cxl_memdev *cxlmd,
>  
>  			if (evt->dram.media_hdr.descriptor &
>  			    CXL_GMER_EVT_DESC_THRESHOLD_EVENT)
> -				WARN_ON_ONCE((evt->dram.media_hdr.type &
> +				WARN_ON_ONCE((evt->dram.media_hdr.type ==
>  					      CXL_DER_MEM_EVT_TYPE_AP_CME_COUNTER_EXPIRE) &&
>  					     !get_unaligned_le24(evt->dram.cvme_count));
>  			else
> -				WARN_ON_ONCE(evt->dram.media_hdr.type &
> +				WARN_ON_ONCE(evt->dram.media_hdr.type ==
>  					     CXL_DER_MEM_EVT_TYPE_AP_CME_COUNTER_EXPIRE);
>  
>  			trace_cxl_dram(cxlmd, type, cxlr, hpa, hpa_alias,

Re: [PATCH v2] cxl/events: Test CME counter expiry with equality, not bitwise AND

[Jonathan Cameron]

On Tue, 22 Sep 2026 16:22:14 +0800
Guixin Liu <kanie@linux.alibaba.com> wrote:

> The Memory Event Type field in the General Media and DRAM event records
> is an enumeration, not a bitmask. The validity checks for the advanced
> programmable CME counter expiration event (05h) test the field with a
> bitwise AND, so types 01h, 03h, 04h and 06h match it as well.
> 
> A device reporting one of those types trips WARN_ON_ONCE once the
> general media or DRAM tracepoint is enabled, which is the case anywhere
> rasdaemon collects CXL events. Under panic_on_warn=1 that kills the
> machine.
> 
> Compare the type field for equality instead. Type 05h records that do
> violate the spec conditions still warn.
> 
> Fixes: cd3b36cfc659 ("cxl/events: Add extra validity checks for corrected memory error count in General Media Event Record")
> Fixes: d8145bb8af5c ("cxl/events: Add extra validity checks for CVME count in DRAM Event Record")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>