Re: [PATCH] cxl/events: Fix event type check for CME counter expiration

[Guixin Liu <kanie@linux.alibaba.com>]

在 2026/9/22 00:54, Dave Jiang 写道:
>
> On 9/21/26 5:09 AM, Guixin Liu wrote:
>> The Memory Event Type field of the General Media and DRAM event
>> records is an enumeration; 05h designates the advanced programmable
>> CME counter expiration event. The validity checks for that event
>> test the field with a bitwise AND against
>> CXL_GMER_MEM_EVT_TYPE_AP_CME_COUNTER_EXPIRE instead of comparing it
>> for equality, so benign event types that share a bit with 05h, such
>> as 01h (Invalid Address), 03h (TE State Violation), 04h (Scrub
>> Media ECC Error) or 06h (CKID Violation), match too.
>>
>> A device reporting any of those types with an otherwise valid record
>> therefore trips WARN_ON_ONCE, once the general media or DRAM
>> tracepoint is enabled, which is the case for any deployment
>> collecting CXL events with rasdaemon. The warning panics the kernel
>> under panic_on_warn=1.
>>
>> Compare the type field for equality instead.
>>
>> Found by code inspection during review of a downstream backport of
>> these two patches. Reproduced in a QEMU CXL topology by injecting a
>> General Media event with type 01h through the
>> cxl-inject-general-media-event QMP command, which warns in
>> cxl_event_trace_record(); with the fix the same injection is traced
>> without a warning. Events that do violate the spec conditions, type
>> 05h without the threshold event descriptor bit and type 05h with the
>> bit set but a zero CME count, still warn.
> Please consider using the following simplified commit log:
>
>     The Memory Event Type field in the General Media and DRAM event records
>     is an enumeration, not a bitmask. The validity checks for the advanced
>     programmable CME counter expiration event (05h) test the field with a
>     bitwise AND, so types 01h, 03h, 04h and 06h match it as well.
>
>     A device reporting one of those types trips WARN_ON_ONCE once the
>     general media or DRAM tracepoint is enabled, which is the case anywhere
>     rasdaemon collects CXL events. Under panic_on_warn=1 that kills the
>     machine.
>
>     Compare the type field for equality instead. Type 05h records that do
>     violate the spec conditions still warn.
>
> Move the explanation on reproducer under '---'.
>
OK, changed in v2, thanks.

Best Regards,
Guixin Liu
> Otherwise LGTM
>
> DJ
>
>> Fixes: cd3b36cfc659 ("cxl/events: Add extra validity checks for corrected memory error count in General Media Event Record")
>> Fixes: d8145bb8af5c ("cxl/events: Add extra validity checks for CVME count in DRAM Event Record")
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
>> ---
>>  drivers/cxl/core/mbox.c | 8 ++++----
>>  1 file changed, 4 insertions(+), 4 deletions(-)
>>
>> diff --git a/drivers/cxl/core/mbox.c b/drivers/cxl/core/mbox.c
>> index 55828a836c01..01341f524a93 100644
>> --- a/drivers/cxl/core/mbox.c
>> +++ b/drivers/cxl/core/mbox.c
>> @@ -942,11 +942,11 @@ void cxl_event_trace_record(struct cxl_memdev *cxlmd,
>>  
>>  			if (evt->gen_media.media_hdr.descriptor &
>>  			    CXL_GMER_EVT_DESC_THRESHOLD_EVENT)
>> -				WARN_ON_ONCE((evt->gen_media.media_hdr.type &
>> +				WARN_ON_ONCE((evt->gen_media.media_hdr.type ==
>>  					      CXL_GMER_MEM_EVT_TYPE_AP_CME_COUNTER_EXPIRE) &&
>>  					     !get_unaligned_le24(evt->gen_media.cme_count));
>>  			else
>> -				WARN_ON_ONCE(evt->gen_media.media_hdr.type &
>> +				WARN_ON_ONCE(evt->gen_media.media_hdr.type ==
>>  					     CXL_GMER_MEM_EVT_TYPE_AP_CME_COUNTER_EXPIRE);
>>  
>>  			trace_cxl_general_media(cxlmd, type, cxlr, hpa,
>> @@ -957,11 +957,11 @@ void cxl_event_trace_record(struct cxl_memdev *cxlmd,
>>  
>>  			if (evt->dram.media_hdr.descriptor &
>>  			    CXL_GMER_EVT_DESC_THRESHOLD_EVENT)
>> -				WARN_ON_ONCE((evt->dram.media_hdr.type &
>> +				WARN_ON_ONCE((evt->dram.media_hdr.type ==
>>  					      CXL_DER_MEM_EVT_TYPE_AP_CME_COUNTER_EXPIRE) &&
>>  					     !get_unaligned_le24(evt->dram.cvme_count));
>>  			else
>> -				WARN_ON_ONCE(evt->dram.media_hdr.type &
>> +				WARN_ON_ONCE(evt->dram.media_hdr.type ==
>>  					     CXL_DER_MEM_EVT_TYPE_AP_CME_COUNTER_EXPIRE);
>>  
>>  			trace_cxl_dram(cxlmd, type, cxlr, hpa, hpa_alias,