[PATCH v8 0/4] cxl: Repair poison enumeration regressions

[PATCH v8 0/4] cxl: Repair poison enumeration regressions

[Richard Cheng]

This series repairs four poison enumeration regressions introduced by
commit be5cbd084027 ("cxl: Kill enum cxl_decoder_mode"). It groups the
remaining poison fixes from v7 [1] into a poison repair set.

Patch 1: cxl_get_poison_unmapped() ends the partition walk when it
encounters a fully mapped partition. Continue to the next partition
instead, so unmapped poison in later partitions is still collected.

Patch 2: the unmapped scan tolerates -EFAULT for RAM partitions but
leaves the error in rc. If no later query overwrites rc, enumeration
incorrectly reports failure. Clear rc before continuing past the
tolerated error.

Patch 3: use the ctx->offset handoff from the committed-decoder walk
as the starting point for the unmapped scan. Starting after the highest
DPA allocation leaves ranges allocated to uncommitted decoders
unqueried. Resume at the committed boundary and scan later partitions
from their beginning.

Patch 4: cxl_get_poison_by_memdev() can overwrite an earlier partition
query failure with a later success. Stop on the first error that is
not already tolerated as a RAM -EFAULT, preserving the failure.

In v7 [1] patch 6's review, Jonathan also noted that
cxl_internal_send_cmd() documents -EFAULT as a hardware error.
I will send a separate patch to clarify its mapping from the Invalid
Physical Address device response.

Changes since v7 [1]:
- Retain v7 patches 2–5, renumbered as patches 1–4, and rebase onto
  current cxl/next.
- Drop v7 patches 1 and 7, which have been applied to cxl/next.
- Drop v7 patch 6 because the zero-sized HDM decoder series [2]
  already fixes its negative partition-index access. Specifically,
  commit 00f9ef9ad1ce ("cxl/hdm: Allow zero sized HDM decoders") [3]
  guards the partition lookup while allowing the decoder walk to continue.
- Expand patch 2's commit message to explain how a RAM poison query
  produces -EFAULT and why that response is tolerated.


[1]:
https://lore.kernel.org/linux-cxl/20260902053839.25595-1-icheng@nvidia.com/
[2]:
https://lore.kernel.org/linux-cxl/20260914090858.19181-1-icheng@nvidia.com/
[3]:
https://lore.kernel.org/linux-cxl/20260914090858.19181-3-icheng@nvidia.com/


Richard Cheng (4):
  cxl/region: Scan all partitions for unmapped poison
  cxl/region: Don't leak tolerated RAM -EFAULT from unmapped poison scan
  cxl/region: Start unmapped poison scan at the committed decoder
    boundary
  cxl/memdev: Don't overwrite the error from an earlier partition poison
    query

 drivers/cxl/core/memdev.c |  2 ++
 drivers/cxl/core/region.c | 13 ++++++-------
 2 files changed, 8 insertions(+), 7 deletions(-)


base-commit: f2e9991100c903ec2d8eb62c3a1d6e0b9c67432e
-- 
2.43.0

[PATCH v8 1/4] cxl/region: Scan all partitions for unmapped poison

[Richard Cheng]

cxl_get_poison_unmapped() sweeps the unmapped tail of each partition
from ctx->part onward. A fully-mapped partition has no unmapped tail,
it's a normal per-partition state, but the loop treated it with break,
aborting the whole sweep and silently skipping unmapped poison in all
later partition. Use continue so a fully-mapped partition is skipped and
later partitions are still scanned.

Fixes: be5cbd0840275 ("cxl: Kill enum cxl_decoder_mode")
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Tested-by: Alison Schofield <alison.schofield@intel.com>
Signed-off-by: Richard Cheng <icheng@nvidia.com>
---
 drivers/cxl/core/region.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c
index 5ef0ca0694ff..7c7287315d72 100644
--- a/drivers/cxl/core/region.c
+++ b/drivers/cxl/core/region.c
@@ -2952,7 +2952,7 @@ static int cxl_get_poison_unmapped(struct cxl_memdev *cxlmd,
 			offset = res->start;
 		length = res->end - offset + 1;
 		if (!length)
-			break;
+			continue;
 		rc = cxl_mem_get_poison(cxlmd, offset, length, NULL);
 		if (poison_efault_forgiven(rc, cxlds->part[i].mode))
 			continue;
-- 
2.43.0

[PATCH v8 2/4] cxl/region: Don't leak tolerated RAM -EFAULT from unmapped poison scan

[Richard Cheng]

CXL 3.0 section 8.2.9.8.4.1 requires Get Poison List to return Invalid
Physical Address for a volatile range when the device does not support
volatile poison lists.

For example, consider a memdev with a single RAM partition and a
committed decoder covering only part of it:

  RAM partition: [ committed decoder ][ unmapped tail ]

On a device without volatile poison-list support, querying this tail
returns Invalid Physical Address, which cxl_internal_send_cmd() maps
to -EFAULT. The driver tolerates this response for RAM because volatile
poison-list support is optional.

When cxl_get_poison_unmapped() was converted to iterate over partitions,
the RAM-specific error handling became a continue without clearing rc.
If no subsequent query overwrites rc, the function returns the tolerated
-EFAULT and incorrectly reports the enumeration as failed.

Clear rc before continuing, restoring the previous handling of this
expected response for RAM partitions.

Fixes: be5cbd0840275 ("cxl: Kill enum cxl_decoder_mode")
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Signed-off-by: Richard Cheng <icheng@nvidia.com>
---
 drivers/cxl/core/region.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c
index 7c7287315d72..042356c71ed7 100644
--- a/drivers/cxl/core/region.c
+++ b/drivers/cxl/core/region.c
@@ -2954,8 +2954,10 @@ static int cxl_get_poison_unmapped(struct cxl_memdev *cxlmd,
 		if (!length)
 			continue;
 		rc = cxl_mem_get_poison(cxlmd, offset, length, NULL);
-		if (poison_efault_forgiven(rc, cxlds->part[i].mode))
+		if (poison_efault_forgiven(rc, cxlds->part[i].mode)) {
+			rc = 0;
 			continue;
+		}
 		if (rc)
 			break;
 	}
-- 
2.43.0

Re: [PATCH v8 2/4] cxl/region: Don't leak tolerated RAM -EFAULT from unmapped poison scan

[Jonathan Cameron]

On Tue, 22 Sep 2026 18:11:27 +0800
Richard Cheng <icheng@nvidia.com> wrote:

> CXL 3.0 section 8.2.9.8.4.1 requires Get Poison List to return Invalid
> Physical Address for a volatile range when the device does not support
> volatile poison lists.
> 
> For example, consider a memdev with a single RAM partition and a
> committed decoder covering only part of it:
> 
>   RAM partition: [ committed decoder ][ unmapped tail ]
> 
> On a device without volatile poison-list support, querying this tail
> returns Invalid Physical Address, which cxl_internal_send_cmd() maps
> to -EFAULT. The driver tolerates this response for RAM because volatile
> poison-list support is optional.
> 
> When cxl_get_poison_unmapped() was converted to iterate over partitions,
> the RAM-specific error handling became a continue without clearing rc.
> If no subsequent query overwrites rc, the function returns the tolerated
> -EFAULT and incorrectly reports the enumeration as failed.
> 
> Clear rc before continuing, restoring the previous handling of this
> expected response for RAM partitions.
> 
> Fixes: be5cbd0840275 ("cxl: Kill enum cxl_decoder_mode")
> Reviewed-by: Dave Jiang <dave.jiang@intel.com>
> Reviewed-by: Alison Schofield <alison.schofield@intel.com>
> Signed-off-by: Richard Cheng <icheng@nvidia.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>

[PATCH v8 3/4] cxl/region: Start unmapped poison scan at the committed decoder boundary

[Richard Cheng]

poison_by_decoder() stops at the last committed decoder and records the
handoff in ctx->offset, but cxl_get_poison_unmapped() ignores it and
starts after the highest DPA allocation instead. Allocation exist for
uncommitted decoders too, so their DPA is skipped by both phases and
poison there is never reported. Resume the scan at ctx->offset, and scan
later partitions in full, restoring the pre-rewrite behavior.

Fixes: be5cbd084027 ("cxl: Kill enum cxl_decoder_mode")
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Richard Cheng <icheng@nvidia.com>
---
 drivers/cxl/core/region.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c
index 042356c71ed7..4869cdd6a3d4 100644
--- a/drivers/cxl/core/region.c
+++ b/drivers/cxl/core/region.c
@@ -2931,7 +2931,6 @@ static int cxl_get_poison_unmapped(struct cxl_memdev *cxlmd,
 {
 	struct cxl_dev_state *cxlds = cxlmd->cxlds;
 	const struct resource *res;
-	struct resource *p, *last;
 	u64 offset, length;
 	int rc = 0;
 
@@ -2944,10 +2943,8 @@ static int cxl_get_poison_unmapped(struct cxl_memdev *cxlmd,
 	 */
 	for (int i = ctx->part; i < cxlds->nr_partitions; i++) {
 		res = &cxlds->part[i].res;
-		for (p = res->child, last = NULL; p; p = p->sibling)
-			last = p;
-		if (last)
-			offset = last->end + 1;
+		if (i == ctx->part)
+			offset = ctx->offset;
 		else
 			offset = res->start;
 		length = res->end - offset + 1;
-- 
2.43.0

Re: [PATCH v8 3/4] cxl/region: Start unmapped poison scan at the committed decoder boundary

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] cxl: integer underflow in cxl_get_poison_unmapped() from unmapped decoder offset
--

commit 8602a2ffbae3a910b43392bb444acb65b6b365e7
Author: Richard Cheng <icheng@nvidia.com>

cxl/region: Start unmapped poison scan at the committed decoder boundary

poison_by_decoder() stops at the last committed decoder and records the
handoff in ctx->offset, but cxl_get_poison_unmapped() ignores it and
starts after the highest DPA allocation instead. Allocation exist for
uncommitted decoders too, so their DPA is skipped by both phases and
poison there is never reported. Resume the scan at ctx->offset, and scan
later partitions in full, restoring the pre-rewrite behavior.

> diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c
> index 042356c71ed79..4869cdd6a3d48 100644
> --- a/drivers/cxl/core/region.c
> +++ b/drivers/cxl/core/region.c

[ ... ]

> @@ -2944,10 +2943,8 @@ static int cxl_get_poison_unmapped(struct cxl_memdev *cxlmd,
>  	 */
>  	for (int i = ctx->part; i < cxlds->nr_partitions; i++) {
>  		res = &cxlds->part[i].res;
> -		for (p = res->child, last = NULL; p; p = p->sibling)
> -			last = p;
> -		if (last)
> -			offset = last->end + 1;
> +		if (i == ctx->part)
> +			offset = ctx->offset;
> +		else
> +			offset = res->start;
>  		length = res->end - offset + 1;

[Severity: High]
Does this code risk an integer underflow if offset is greater than res->end?

If poison_by_decoder() encounters a zero-sized commit_end decoder, it can
set ctx->part = -1 and ctx->offset = cxled->dpa_res->end + 1. If that
decoder was configured by firmware with a large skip value, ctx->offset can
be strictly greater than the end of the first partition (part[0].res.end).

Later, cxl_get_poison_by_endpoint() forces ctx.part = 0 before calling
cxl_get_poison_unmapped():

drivers/cxl/core/region.c:cxl_get_poison_by_endpoint() {
    ...
	if (rc == 1) {
		/* ... */
		if (ctx.part < 0)
			ctx.part = 0;
		rc = cxl_get_poison_unmapped(to_cxl_memdev(port->uport_dev),
					     &ctx);
	}
    ...
}

Because ctx.offset is not reset to part[0].res.start, offset is assigned
the out-of-bounds ctx->offset when i == 0. This causes the length
calculation to underflow in unsigned 64-bit arithmetic to an enormous
positive value.

Could this underflow bypass the !length check and result in sending an
invalid mailbox command to the hardware?

A massive out-of-bounds length passed directly to cxl_mem_get_poison() may
cause the CXL device to hang, time out, or process out-of-bounds requests,
leading to system instability.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260922101129.52794-1-icheng@nvidia.com?part=3

[PATCH v8 4/4] cxl/memdev: Don't overwrite the error from an earlier partition poison query

[Richard Cheng]

cxl_get_poison_by_memdev() queries Get Poison List per partition but
never checks the result inside the loop, so a later partition's success
overwrites an earlier partition's failure and the whole scan reports
success while that partition's poison went unlisted. Before the loop
conversion the PMEM query returned early on error. Stop the loop on any
error not already tolerated as a RAM -EFAULT.

Fixes: be5cbd084027 ("cxl: Kill enum cxl_decoder_mode")
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Closes: https://sashiko.dev/#/patchset/20260708074228.43654-1-icheng@nvidia.com?part=5
Signed-off-by: Richard Cheng <icheng@nvidia.com>
---
 drivers/cxl/core/memdev.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/cxl/core/memdev.c b/drivers/cxl/core/memdev.c
index b3419df586b9..e39b3d13fd56 100644
--- a/drivers/cxl/core/memdev.c
+++ b/drivers/cxl/core/memdev.c
@@ -231,6 +231,8 @@ static int cxl_get_poison_by_memdev(struct cxl_memdev *cxlmd)
 		 */
 		if (rc == -EFAULT && cxlds->part[i].mode == CXL_PARTMODE_RAM)
 			rc = 0;
+		if (rc)
+			break;
 	}
 	return rc;
 }
-- 
2.43.0