[PATCH 0/2] PCI/CXL: Distinguish CXL capabilities in MCAP

[PATCH 0/2] PCI/CXL: Distinguish CXL capabilities in MCAP

[peng.guo]

From: pguo <peng.guo@montage-tech.com>

When MMPT is enabled, a device may expose PCI-SIG-defined MMPT
capabilities alongside CXL-defined capabilities in the same MMIO
Capabilities Register Block (MCAP).

MCAP capability IDs are scoped by Vendor ID, but the CXL capability
parser currently matches entries using only their capability IDs. This
can cause MMPT entries to be interpreted as CXL register blocks.

Add the generic PCI MCAP register definitions, then update the CXL
parser to process only capabilities carrying the CXL Vendor ID.

Patch 1 adds the PCI MCAP array and capability header definitions.
Patch 2 filters non-CXL capabilities before interpreting their IDs.

The fix has been tested on a CXL device with MMPT enabled and prevents
both the Mailbox and Status capability misidentification.

pguo (2):
  PCI: Add MMIO Capabilities Register Block definitions
  cxl/core: Skip non-CXL capabilities in MCAP

 drivers/cxl/core/regs.c       |  8 +++++++-
 include/uapi/linux/pci_regs.h | 21 +++++++++++++++++++++
 2 files changed, 28 insertions(+), 1 deletion(-)

-- 
2.43.0

[PATCH 1/2] PCI: Add MMIO Capabilities Register Block definitions

[peng.guo]

From: pguo <peng.guo@montage-tech.com>

The PCIe Management Message Passthrough via MMIO Mailbox ECN defines
the MMIO Capabilities Register Block (MCAP). MCAP contains an array
header followed by capability headers that describe the ID, version,
location, size, and vendor of each MMIO capability.

Add definitions for the MCAP array and capability headers so that
subsystem drivers can distinguish capabilities with overlapping IDs
by using the Vendor ID field.

Signed-off-by: pguo <peng.guo@montage-tech.com>
---
 include/uapi/linux/pci_regs.h | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/include/uapi/linux/pci_regs.h b/include/uapi/linux/pci_regs.h
index 14f634ab9350..5fe6bc711526 100644
--- a/include/uapi/linux/pci_regs.h
+++ b/include/uapi/linux/pci_regs.h
@@ -1338,6 +1338,27 @@
 #define  PCI_IDE_SEL_ADDR_3(x)		(28 + (x) * PCI_IDE_SEL_ADDR_BLOCK_SIZE)
 #define PCI_IDE_SEL_BLOCK_SIZE(nr_assoc)  (20 + PCI_IDE_SEL_ADDR_BLOCK_SIZE * (nr_assoc))
 
+/* MMIO Capabilities Register Block (MCAP) */
+#define PCI_MCAP_ARRAY_1		0x00
+#define  PCI_MCAP_ARRAY_ID		__GENMASK(15, 0)
+#define  PCI_MCAP_ARRAY_VERSION		__GENMASK(23, 16)
+#define  PCI_MCAP_ARRAY_TYPE		__GENMASK(27, 24)
+#define  PCI_MCAP_ARRAY_TYPE_CLASS_CODE	0x0
+#define PCI_MCAP_ARRAY_2		0x04
+#define  PCI_MCAP_ARRAY_COUNT		__GENMASK(15, 0)
+
+#define PCI_MCAP_HDR_SIZEOF		0x10
+#define PCI_MCAP_HDR_BASE(n)		((n) * PCI_MCAP_HDR_SIZEOF)
+#define PCI_MCAP_HDR_REG_1		0x00
+#define  PCI_MCAP_CAP_ID		__GENMASK(15, 0)
+#define  PCI_MCAP_CAP_VERSION		__GENMASK(23, 16)
+#define PCI_MCAP_HDR_REG_2		0x04
+#define  PCI_MCAP_HDR_OFFSET		__GENMASK(31, 0)
+#define PCI_MCAP_HDR_REG_3		0x08
+#define  PCI_MCAP_HDR_LENGTH		__GENMASK(31, 0)
+#define PCI_MCAP_HDR_REG_4		0x0c
+#define  PCI_MCAP_HDR_VENDOR_ID		__GENMASK(15, 0)
+
 /*
  * Compute Express Link (CXL r4.0, sec 8.1)
  *
-- 
2.43.0

Re: [PATCH 1/2] PCI: Add MMIO Capabilities Register Block definitions

[Lukas Wunner]

On Sun, Aug 16, 2026 at 04:49:56PM +0800, peng.guo@montage-tech.com wrote:
> The PCIe Management Message Passthrough via MMIO Mailbox ECN defines
> the MMIO Capabilities Register Block (MCAP). MCAP contains an array
> header followed by capability headers that describe the ID, version,
> location, size, and vendor of each MMIO capability.

That ECN went into PCIe r6.2.  For ECNs that are already part of the
PCIe Base Spec, it's better to cite the section in the latest spec
revision, i.e. PCIe r7.0 sec 6.35, rather than the ECN that originally
introduced the feature.  Reviewers (like me) generally have the latest
spec revision at hand, but not every ECN.

Otherwise this is
Reviewed-by: Lukas Wunner <lukas@wunner.de>

[PATCH 2/2] cxl/core: Skip non-CXL capabilities in MCAP

[peng.guo]

From: pguo <peng.guo@montage-tech.com>

When MMPT is enabled, a CXL device may expose both CXL-defined capabilities
and PCIe Management Message Passthrough (MMPT) capabilities in the same
MMIO Capabilities Register Block (MCAP).

The CXL capability parser currently identifies entries using only the
capability ID. Since capability IDs are scoped by Vendor ID, a
PCI-SIG-defined capability may have the same ID as a CXL-defined
capability. This causes non-CXL entries, including MMPT and MMIO Mailbox,
to be interpreted as CXL register blocks.

The MMPT register block may be interpreted as a CXL mailbox. This
causes mailbox initialization to fail with:

    cxl_pci 0000:3b:00.0: Mailbox is too small (64b)

Check the MCAP Vendor ID before interpreting an entry as a CXL-defined
capability. This prevents PCI-SIG-defined MMPT capabilities from being
mistaken for CXL mailbox capabilities.

Fixes: 8adaf747c9f0 ("cxl/mem: Find device capabilities")
Suggested-by: Johnny <johnny.li@montage-tech.com>
Signed-off-by: pguo <peng.guo@montage-tech.com>
---
 drivers/cxl/core/regs.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/cxl/core/regs.c b/drivers/cxl/core/regs.c
index 93710cf4f0a6..79edb7bac8eb 100644
--- a/drivers/cxl/core/regs.c
+++ b/drivers/cxl/core/regs.c
@@ -134,7 +134,13 @@ void cxl_probe_device_regs(struct device *dev, void __iomem *base,
 	for (cap = 1; cap <= cap_count; cap++) {
 		struct cxl_reg_map *rmap;
 		u32 offset, length;
-		u16 cap_id;
+		u16 cap_id, vendor_id;
+
+		vendor_id = FIELD_GET(PCI_MCAP_HDR_VENDOR_ID,
+				      readl(base + PCI_MCAP_HDR_BASE(cap) +
+					    PCI_MCAP_HDR_REG_4));
+		if (vendor_id != PCI_VENDOR_ID_CXL)
+			continue;
 
 		cap_id = FIELD_GET(CXLDEV_CAP_HDR_CAP_ID_MASK,
 				   readl(base + cap * 0x10));
-- 
2.43.0

Re: [PATCH 2/2] cxl/core: Skip non-CXL capabilities in MCAP

[Lukas Wunner]

On Sun, Aug 16, 2026 at 04:49:57PM +0800, peng.guo@montage-tech.com wrote:
> +++ b/drivers/cxl/core/regs.c
> @@ -134,7 +134,13 @@ void cxl_probe_device_regs(struct device *dev, void __iomem *base,
>  	for (cap = 1; cap <= cap_count; cap++) {
>  		struct cxl_reg_map *rmap;
>  		u32 offset, length;
> -		u16 cap_id;
> +		u16 cap_id, vendor_id;
> +

Nit: Move the u16 line above the u32 line to maintain inverse Christmas
tree convention.

Thanks,

Lukas