Re: [PATCH v20 8/9] PCI/CXL: Mask/Unmask CXL protocol errors

["Bowman, Terry" <terry.bowman@amd.com>]

On 9/2/2026 9:03 AM, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] Devres memory and action leak on CXL endpoint port unbind/rebind for RCH topologies.
> --
> 
> commit 6742f1a341d88bb57310da7468fadf1a3f3b4556
> Author: Terry Bowman <terry.bowman@amd.com>
> 
> PCI/CXL: Mask/Unmask CXL protocol errors
> 
> This commit introduces helpers to mask and unmask CXL protocol errors. It
> unmasks internal errors in cxl_dport_map_ras() and devm_cxl_port_ras_setup()
> after the RAS register block is successfully mapped, and adds a devm action
> to restore the mask on teardown.
> 
>> diff --git a/drivers/cxl/core/ras.c b/drivers/cxl/core/ras.c
>> index fac37b6fd882f..f1e05d240059b 100644
>> --- a/drivers/cxl/core/ras.c
>> +++ b/drivers/cxl/core/ras.c
> 
> [ ... ]
> 
>> @@ -124,16 +124,64 @@ static void cxl_cper_prot_err_work_fn(struct work_struct *work)
>>  }
>>  static DECLARE_WORK(cxl_cper_prot_err_work, cxl_cper_prot_err_work_fn);
> 
> [ ... ]
> 
>>  static void cxl_dport_map_ras(struct cxl_dport *dport)
>>  {
>>  	struct cxl_register_map *map = &dport->reg_map;
>>  	struct device *dev = dport->dport_dev;
>>  
>> -	if (!map->component_map.ras.valid)
>> +	if (!map->component_map.ras.valid) {
>>  		dev_dbg(dev, "RAS registers not found\n");
>> -	else if (cxl_map_component_regs(map, &dport->regs.component,
>> -					BIT(CXL_CM_CAP_CAP_ID_RAS)))
>> +		return;
>> +	}
>> +
>> +	if (cxl_map_component_regs(map, &dport->regs.component,
>> +				   BIT(CXL_CM_CAP_CAP_ID_RAS))) {
>>  		dev_dbg(dev, "Failed to map RAS capability.\n");
>> +		return;
>> +	}
>> +
>> +	if (!dev_is_pci(dev))
>> +		return;
>> +
>> +	cxl_unmask_proto_interrupts(dev);
>> +	if (devm_add_action_or_reset(dport_to_host(dport),
>> +				     cxl_mask_proto_irqs, dev)) {
> 
> [Severity: High]
> Does this devres action cause an unbounded memory and action leak when a CXL
> endpoint port is unbound and rebound in RCH topologies?
> 

No. CXL 1.1 RCD/RCH is not hotpluggable — the RCH Downstream Port and RCD
are enumerated once by platform firmware and are never hot-removed or
rebound. The unbind/rebind cycle this accumulation depends on does not
occur, so the action is registered once, not repeatedly.

CXL4.0 - 9.9 Hot-Plug
"By definition, RCDs and RCHs do not support Hot-Plug."*

Terry

> In cxl_endpoint_port_probe() in drivers/cxl/port.c, when dport->rch is true,
> it calls devm_cxl_dport_rch_ras_setup(dport). This executes repeatedly across
> unbind/bind cycles of the endpoint port.
> 
> That setup path eventually calls cxl_dport_map_ras(dport), which registers
> the cxl_mask_proto_irqs action on the device returned by
> dport_to_host(dport).
> 
> For RCH topologies, dport_to_host(dport) evaluates to the parent root port's
> host device (the ACPI host bridge), not the endpoint port being probed.
> 
> Because the action is tied to the parent host device instead of the endpoint
> port, unbinding and rebinding the endpoint port does not free the devres
> action. This leaves a leaked action on the parent host device each time the
> endpoint port is probed.
> 
>> +		dev_warn(dev, "failed to defer CXL proto-irq mask; CXL protocol error reporting disabled\n");
>> +		dport->regs.component.ras = NULL;
>> +	}
>>  }
>