linux-toradex.git/drivers/cxl, branch v6.19

cxl: Check for invalid addresses returned from translation functions on errors

2026-01-13T15:30:40+00:00

Translation functions may return an invalid address in case of errors.
If the address is not checked the further use of the invalid value
will cause an address corruption.

Consistently check for a valid address returned by translation
functions. Use RESOURCE_SIZE_MAX to indicate an invalid address for
type resource_size_t. Depending on the type either RESOURCE_SIZE_MAX
or ULLONG_MAX is used to indicate an address error.

Propagating an invalid address from a failed translation may cause
userspace to think it has received a valid SPA, when in fact it is
wrong. The CXL userspace API, using trace events, expects ULLONG_MAX
to indicate a translation failure. If ULLONG_MAX is not returned
immediately, subsequent calculations can transform that bad address
into a different value (!ULLONG_MAX), and an invalid SPA may be
returned to userspace. This can lead to incorrect diagnostics and
erroneous corrective actions.

[ dj: Added user impact statement from Alison. ]
[ dj: Fixed checkpatch tab alignment issue. ]

Reviewed-by: Dave Jiang 
Signed-off-by: Robert Richter 
Fixes: c3dd67681c70 ("cxl/region: Add inject and clear poison by region offset")
Fixes: b78b9e7b7979 ("cxl/region: Refactor address translation funcs for testing")
Reviewed-by: Alison Schofield 
Reviewed-by: Jonathan Cameron 
Link: https://patch.msgid.link/20260107120544.410993-1-rrichter@amd.com
Signed-off-by: Dave Jiang

cxl/hdm: Fix potential infinite loop in __cxl_dpa_reserve()

2026-01-12T15:59:16+00:00

In __cxl_dpa_reserve(), it will check if the new resource range is
included in one of paritions of the cxl memory device.
cxlds->nr_paritions is used to represent how many partitions information
the cxl memory device has. In the loop, if driver cannot find a
partition including the new resource range, it will be an infinite loop.

[ dj: Removed incorrect fixes tag ]

Fixes: 991d98f17d31 ("cxl: Make cxl_dpa_alloc() DPA partition number agnostic")
Signed-off-by: Li Ming 
Reviewed-by: Ira Weiny 
Reviewed-by: Dave Jiang 
Link: https://patch.msgid.link/20260112120526.530232-1-ming.li@zohomail.com
Signed-off-by: Dave Jiang

cxl/acpi: Restore HBIW check before dereferencing platform_data

2026-01-10T00:12:03+00:00

Commit 4fe516d2ad1a ("cxl/acpi: Make the XOR calculations available
for testing") split xormap handling code to create a reusable helper
function but inadvertently dropped the check of HBIW values before
dereferencing cxlrd->platform_data. When HBIW is 1 or 3, no xormaps
are needed and platform_data may be NULL, leading to a potential NULL
pointer dereference.

Affects platform configs using XOR Arithmetic with HBIWs of 1 or 3,
when performing DPA->HPA address translation for CXL events. Those
events would be any of poison ops, general media, or dram.

Restore the early return check for HBIW values of 1 and 3 before
dereferencing platform_data.

Fixes: 4fe516d2ad1a ("cxl/acpi: Make the XOR calculations available for testing")
Signed-off-by: Alison Schofield 
Reviewed-by: Dave Jiang 
Link: https://patch.msgid.link/20260109194946.431083-1-alison.schofield@intel.com
Signed-off-by: Dave Jiang

cxl/port: Fix target list setup for multiple decoders sharing the same dport

2026-01-09T16:25:15+00:00

If a switch port has more than one decoder that is using the same
downstream port, the enumeration of the target lists may fail with:

 # dmesg | grep target.list
 update_decoder_targets: cxl decoder1.0: dport3 found in target list, index 3
 update_decoder_targets: cxl decoder1.0: dport2 found in target list, index 2
 update_decoder_targets: cxl decoder1.0: dport0 found in target list, index 0
 update_decoder_targets: cxl decoder2.0: dport3 found in target list, index 1
 update_decoder_targets: cxl decoder4.0: dport3 found in target list, index 1
 cxl_mem mem6: failed to find endpoint12:0000:00:01.4 in target list of decoder2.1
 cxl_mem mem8: failed to find endpoint13:0000:20:01.4 in target list of decoder4.1

The case, that the same downstream port can be used in multiple target
lists, is allowed and possible.

Fix the update of the target list. Enumerate all children of the
switch port and do not stop the iteration after the first matching
target was found.

With the fix applied:

 # dmesg | grep target.list
 update_decoder_targets: cxl decoder1.0: dport2 found in target list, index 2
 update_decoder_targets: cxl decoder1.0: dport0 found in target list, index 0
 update_decoder_targets: cxl decoder1.0: dport3 found in target list, index 3
 update_decoder_targets: cxl decoder2.0: dport3 found in target list, index 1
 update_decoder_targets: cxl decoder2.1: dport3 found in target list, index 1
 update_decoder_targets: cxl decoder4.0: dport3 found in target list, index 1
 update_decoder_targets: cxl decoder4.1: dport3 found in target list, index 1

Analyzing the conditions when this happens:

1) A dport is shared by multiple decoders.

2) The decoders have interleaving configured (ways > 1).

The configuration above has the following hierarchy details (fixed
version):

 root0
 |_
 | |
 | decoder0.1
 | ways: 2
 | target_list: 0,1
 |_______________________________________
 |                                       |
 | dport0                                | dport1
 |                                       |
 port2                                   port4
 |                                       |
 |___________________                    |_____________________
 | |                 |                   | |                   |
 | decoder2.0        decoder2.1          | decoder4.0          decoder4.1
 | ways: 2           ways: 2             | ways: 2             ways: 2
 | target_list: 2,3  target_list: 2,3    | target_list: 2,3    target_list: 2,3
 |___________________                    |___________________
 |                   |                   |                   |
 | dport2            | dport3            | dport2            | dport3
 |                   |                   |                   |
 endpoint7           endpoint12          endpoint9           endpoint13
 |_                  |_                  |_                  |_
 | |                 | |                 | |                 | |
 | decoder7.0        | decoder12.0       | decoder9.0        | decoder13.0
 | decoder7.2        | decoder12.2       | decoder9.2        | decoder13.2
 |                   |                   |                   |
 mem3                mem5                mem6                mem8

Note: Device numbers vary for every boot.

Current kernel fails to enumerate endpoint12 and endpoint13 as the
target list is not updated for the second decoder.

Fixes: 4f06d81e7c6a ("cxl: Defer dport allocation for switch ports")
Reviewed-by: Dave Jiang 
Reviewed-by: Alison Schofield 
Reviewed-by: Jonathan Cameron 
Signed-off-by: Robert Richter 
Link: https://patch.msgid.link/20260108101324.509667-1-rrichter@amd.com
Signed-off-by: Dave Jiang

cxl/region: fix format string for resource_size_t

2026-01-06T01:12:06+00:00

The size of this type is architecture specific, and the recommended
way to print it portably is through the custom %pap format string.

Fixes: d6602e25819d ("cxl/region: Add support to indicate region has extended linear cache")
Signed-off-by: Arnd Bergmann 
Reviewed-by: Ira Weiny 
Reviewed-by: Dave Jiang > ---
Reviewed-by: Alison Schofield 
Link: https://patch.msgid.link/20251204095237.1032528-1-arnd@kernel.org
Signed-off-by: Dave Jiang

Merge tag 'soc-drivers-6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc

2025-12-06T01:47:59+00:00

Pull more SoC driver updates from Arnd Bergmann:
 "These updates came a little late, or were based on a later 6.18-rc tag
  than the others:

   - A new driver for cache management on cxl devices with memory shared
     in a coherent cluster. This is part of the drivers/cache/ tree, but
     unlike the other drivers that back the dma-mapping interfaces, this
     one is needed only during CPU hotplug.

   - A shared branch for reset controllers using swnode infrastructure

   - Added support for new SoC variants in the Amlogic soc_device
     identification

   - Minor updates in Freescale, Microchip, Samsung, and Apple SoC
     drivers"

* tag 'soc-drivers-6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (24 commits)
  soc: samsung: exynos-pmu: fix device leak on regmap lookup
  soc: samsung: exynos-pmu: Fix structure initialization
  soc: fsl: qbman: use kmalloc_array() instead of kmalloc()
  soc: fsl: qbman: add WQ_PERCPU to alloc_workqueue users
  MAINTAINERS: Update email address for Christophe Leroy
  MAINTAINERS: refer to intended file in STANDALONE CACHE CONTROLLER DRIVERS
  cache: Support cache maintenance for HiSilicon SoC Hydra Home Agent
  cache: Make top level Kconfig menu a boolean dependent on RISCV
  MAINTAINERS: Add Jonathan Cameron to drivers/cache and add lib/cache_maint.c + header
  arm64: Select GENERIC_CPU_CACHE_MAINTENANCE
  lib: Support ARCH_HAS_CPU_CACHE_INVALIDATE_MEMREGION
  soc: amlogic: meson-gx-socinfo: add new SoCs id
  dt-bindings: arm: amlogic: meson-gx-ao-secure: support more SoCs
  memregion: Support fine grained invalidate by cpu_cache_invalidate_memregion()
  memregion: Drop unused IORES_DESC_* parameter from cpu_cache_invalidate_memregion()
  dt-bindings: cache: sifive,ccache0: add a pic64gx compatible
  MAINTAINERS: rename Microchip RISC-V entry
  MAINTAINERS: add new soc drivers to Microchip RISC-V entry
  soc: microchip: add mfd drivers for two syscon regions on PolarFire SoC
  dt-bindings: soc: microchip: document the simple-mfd syscon on PolarFire SoC
  ...

Merge tag 'cxl-for-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl

2025-12-05T01:55:18+00:00

Pull compute express link (CXL) updates from Dave Jiang:
 "The additions of note are adding CXL region remove support for locked
  CXL decoders, adding unit testing support for XOR address translation,
  and adding unit testing support for extended linear cache.

  Misc:
   - Remove incorrect page-allocator quirk section in documentation
   - Remove unused devm_cxl_port_enumerate_dports() function
   - Fix typo in cdat.c code comment
   - Replace use of system_wq with system_percpu_wq
   - Add locked CXL decoder support for region removal
   - Return when generic target updated
   - Rename region_res_match_cxl_range() to spa_maps_hpa()
   - Clarify comment in spa_maps_hpa()

  Enable unit testing for XOR address translation of SPA to DPA and vice versa:
   - Refactor address translation funcs for testing in cxl_region
   - Make the XOR calculations available for testing
   - Add cxl_translate module for address translation testing in
     cxl_test

  Extended Linear Cache changes:
   - Add extended linear cache size sysfs attribute
   - Adjust failure emission of extended linear cache detection in
     cxl_acpi
   - Added extended linear cache unit testing support in cxl_test

  Preparation refactor patches for PRM translation support:
   - Simplify cxl_rd_ops allocation and handling
   - Group xor arithmetric setup code in a single block
   - Remove local variable @inc in cxl_port_setup_targets()"

* tag 'cxl-for-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: (22 commits)
  cxl/test: Assign overflow_err_count from log->nr_overflow
  cxl/test: Remove ret_limit race condition in mock_get_event()
  cxl/test: remove unused mock function for cxl_rcd_component_reg_phys()
  cxl/test: Add support for acpi extended linear cache
  cxl/test: Add cxl_test CFMWS support for extended linear cache
  cxl/test: Standardize CXL auto region size
  cxl/region: Remove local variable @inc in cxl_port_setup_targets()
  cxl/acpi: Group xor arithmetric setup code in a single block
  cxl: Simplify cxl_rd_ops allocation and handling
  cxl: Clarify comment in spa_maps_hpa()
  cxl: Rename region_res_match_cxl_range() to spa_maps_hpa()
  acpi/hmat: Return when generic target is updated
  cxl: Add handling of locked CXL decoder
  cxl/region: Add support to indicate region has extended linear cache
  cxl: Adjust extended linear cache failure emission in cxl_acpi
  cxl/test: Add cxl_translate module for address translation testing
  cxl/acpi: Make the XOR calculations available for testing
  cxl/region: Refactor address translation funcs for testing
  cxl/pci: replace use of system_wq with system_percpu_wq
  cxl: fix typos in cdat.c comments
  ...

Merge tag 'cache-for-v6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into soc/drivers-late

2025-11-27T22:00:45+00:00

standalone cache drivers for v6.19

ccache:
Add a compatible for the pic64gx SoC. No driver change needed, as it
falls back to the PolarFire SoC.

hisi hha/generic cpu cache maintenance:
Add support for a non-architectural mechanism for invalidating memory
regions, needed for some cxl implementations on arm64 (and probably
elsewhere in the future). The HiSilicon Hydra Home Agent is the first
driver to provide this support.

Signed-off-by: Conor Dooley 

* tag 'cache-for-v6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux:
  MAINTAINERS: refer to intended file in STANDALONE CACHE CONTROLLER DRIVERS
  cache: Support cache maintenance for HiSilicon SoC Hydra Home Agent
  cache: Make top level Kconfig menu a boolean dependent on RISCV
  MAINTAINERS: Add Jonathan Cameron to drivers/cache and add lib/cache_maint.c + header
  arm64: Select GENERIC_CPU_CACHE_MAINTENANCE
  lib: Support ARCH_HAS_CPU_CACHE_INVALIDATE_MEMREGION
  memregion: Support fine grained invalidate by cpu_cache_invalidate_memregion()
  memregion: Drop unused IORES_DESC_* parameter from cpu_cache_invalidate_memregion()
  dt-bindings: cache: sifive,ccache0: add a pic64gx compatible

Signed-off-by: Arnd Bergmann

memregion: Support fine grained invalidate by cpu_cache_invalidate_memregion()

2025-11-17T23:45:45+00:00

Extend cpu_cache_invalidate_memregion() to support invalidating a
particular range of memory by introducing start and length parameters.
Control of types of invalidation is left for when use cases turn up. For
now everything is Clean and Invalidate.

Where the range is unknown, use the provided cpu_cache_invalidate_all()
helper to act as documentation of intent in a fashion that is clearer than
passing (0, -1) to cpu_cache_invalidate_memregion().

Signed-off-by: Yicong Yang 
Reviewed-by: Dan Williams 
Acked-by: Davidlohr Bueso 
Signed-off-by: Jonathan Cameron 
Signed-off-by: Conor Dooley

memregion: Drop unused IORES_DESC_* parameter from cpu_cache_invalidate_memregion()

2025-11-17T23:45:45+00:00

The res_desc parameter was originally introduced for documentation purposes
and with the idea that with HDM-DB CXL invalidation could be triggered from
the device. That has not come to pass and the continued existence of the
option is confusing when we add a range in the following patch which might
not be a strict subset of the res_desc. So avoid that confusion by dropping
the parameter.

Link: https://lore.kernel.org/linux-mm/686eedb25ed02_24471002e@dwillia2-xfh.jf.intel.com.notmuch/
Reviewed-by: Dan Williams 
Suggested-by: Dan Williams 
Signed-off-by: Jonathan Cameron 
Signed-off-by: Conor Dooley