Re: [PATCH v2] cxl/hdm: Enforce CFMWS memory type policy at decoder commit time
From: Mayank Rana
Date: Thu Jul 09 2026 - 18:04:18 EST
Sorry for sending this patch as it was diff to previous v1.
Please disregard this patch. I will review again and send update v2.
Regards,
Mayank
On 7/9/2026 2:47 PM, Mayank Rana wrote:
A CXL Fixed Memory Window Structure (CFMWS) in the ACPI CEDT table
carries a restrictions field that describes the memory types a platform
window supports. cfmws_to_decoder_flags() translates this into
CXL_DECODER_F_TYPE2 (HDM-DB permitted) and CXL_DECODER_F_TYPE3 (HDM-H
permitted) flags on the root decoder.
However, nothing currently prevents a caller from committing an endpoint
or switch decoder whose target_type conflicts with the CFMWS policy:
- A decoder with target_type == CXL_DECODER_DEVMEM (HDM-DB) can be
committed on a window that lacks CXL_DECODER_F_TYPE2 (HDM-H only).
A dual-capable device will accept HOSTONLY=0 + COMMIT=1 without
asserting COMMIT_ERROR, silently violating platform policy.
- Symmetrically, a decoder with target_type == CXL_DECODER_HOSTONLYMEM
(HDM-H) can be committed on a window that lacks CXL_DECODER_F_TYPE3
(HDM-DB only), again violating ACPI CFMWS restrictions.
Add a check in cxl_decoder_commit() that walks from the decoder's
assigned region to the root decoder and rejects the commit with
-EOPNOTSUPP if the decoder's target_type requires a capability flag that
the CFMWS window does not advertise:
- CXL_DECODER_DEVMEM requires CXL_DECODER_F_TYPE2 on root decoder
- CXL_DECODER_HOSTONLYMEM requires CXL_DECODER_F_TYPE3 on the root
decoder
required_flag is initialized to zero so that any future target_type
values not covered by the if/else-if chain leave the enforcement check
a no-op via the leading required_flag && guard.
This makes the CFMWS restrictions field authoritative for memory type
enforcement in both directions, regardless of individual device capability.
The existing COMMIT_ERROR path in cxld_await_commit() remains as a
secondary safeguard for devices that cannot support the requested mode.
Fixes: 3e23d17ce198 ("cxl/acpi: Use the ACPI CFMWS to create static decoder objects")
Assisted-by: Claude:claude-sonnet-4-6
Signed-off-by: Mayank Rana <mayank.rana@xxxxxxxxxxxxxxxx>
---
Changes in v2:
- Extend enforcement to cover both directions: HDM-H commits on
HDM-DB-only windows are now rejected in addition to HDM-DB commits
on HDM-H-only windows (reported by Sashiko AI review)
- Generalize condition from single DEVMEM check to type-dispatch
selecting required_flag based on target_type
- Update commit message and subject to reflect bidirectional policy
- Initialize required_flag = 0 and use explicit else-if for
CXL_DECODER_HOSTONLYMEM; guard enforcement with required_flag &&
so unknown target_type values skip the check cleanly
Testing
-------
The bug and fix were validated using QEMU with a modified CXL configuration
on linux-next (v7.2-rc2).
Two test-only kernel changes were applied (not part of this patch):
1. drivers/cxl/acpi.c: cfmws_to_decoder_flags() result overridden to
clear CXL_DECODER_F_TYPE2 and retain only CXL_DECODER_F_TYPE3,
simulating a CFMWS that restricts to HDM-H only (no HDM-DB).
2. drivers/cxl/core/hdm.c: cxl_decoder_commit() forced to set
target_type = CXL_DECODER_DEVMEM for endpoint decoders before the
CFMWS check, simulating a dual-capable device committing HDM-DB.
Bug reproduction (without this patch):
# cxl create-region -m mem0 -d decoder0.0 -t pmem
cxl region: cmd_create_region: created 1 region
HDM-DB committed silently despite CFMWS advertising HDM-H only.
No error or warning in dmesg.
Fix validation (with this patch):
# cxl create-region -m mem0 -d decoder0.0 -t pmem
cxl region: create_region: region0: failed to commit decode: Operation not supported
cxl region: cmd_create_region: created 0 regions
dmesg:
cxl_port endpoint2: HDM-DB commit rejected on decoder2.0, \
CFMWS does not permit this memory type
HDM-DB commit blocked with -EOPNOTSUPP as expected.
QEMU invocation:
qemu-system-x86_64 \
-kernel bzImage \
-append "root=/dev/sda rw console=ttyS0" \
-drive file=rootfs.img,index=0,media=disk,format=raw \
-M q35,cxl=on -m 4G,maxmem=8G,slots=8 -smp 4 \
-object memory-backend-file,id=cxl-mem1,share=on,mem-path=/tmp/cxltest.raw,size=256M \
-object memory-backend-file,id=cxl-lsa1,share=on,mem-path=/tmp/lsa.raw,size=256M \
-device pxb-cxl,bus_nr=12,bus=pcie.0,id=cxl.1 \
-device cxl-rp,port=0,bus=cxl.1,id=root_port13,chassis=0,slot=2 \
-device cxl-type3,bus=root_port13,persistent-memdev=cxl-mem1,lsa=cxl-lsa1,id=cxl-pmem0,sn=0x1 \
-M cxl-fmw.0.targets.0=cxl.1,cxl-fmw.0.size=4G \
-nographic
drivers/cxl/core/hdm.c | 25 ++++++++++++++++++++-----
1 file changed, 20 insertions(+), 5 deletions(-)
diff --git a/drivers/cxl/core/hdm.c b/drivers/cxl/core/hdm.c
index c26dab185dc8..127a187cdadb 100644
--- a/drivers/cxl/core/hdm.c
+++ b/drivers/cxl/core/hdm.c
@@ -836,14 +836,29 @@ static int cxl_decoder_commit(struct cxl_decoder *cxld)
}
/*
- * Enforce HDM-H: reject HDM-DB if CFMWS lacks CXL_DECODER_F_TYPE2.
+ * Enforce CFMWS memory type policy: reject commits where the decoder
+ * target_type conflicts with the root decoder's CFMWS restrictions.
+ * - HDM-DB (DEVMEM) requires CXL_DECODER_F_TYPE2 on the root decoder.
+ * - HDM-H (HOSTONLYMEM) requires CXL_DECODER_F_TYPE3 on the root decoder.
+ * - Unknown target_type values leave required_flag zero; skip enforcement.
*/
- if (cxld->target_type == CXL_DECODER_DEVMEM && cxld->region) {
+ if (cxld->region) {
+ unsigned long required_flag = 0;
+ const char *type_name;
+
cxlrd = to_cxl_root_decoder(cxld->region->dev.parent);
- if (!(cxlrd->cxlsd.cxld.flags & CXL_DECODER_F_TYPE2)) {
+ if (cxld->target_type == CXL_DECODER_DEVMEM) {
+ required_flag = CXL_DECODER_F_TYPE2;
+ type_name = "HDM-DB";
+ } else if (cxld->target_type == CXL_DECODER_HOSTONLYMEM) {
+ required_flag = CXL_DECODER_F_TYPE3;
+ type_name = "HDM-H";
+ }
+
+ if (required_flag && !(cxlrd->cxlsd.cxld.flags & required_flag)) {
dev_err(&port->dev,
- "HDM-DB commit rejected on %s, CFMWS restricts to HDM-H only\n",
- dev_name(&cxld->dev));
+ "%s commit rejected on %s, CFMWS does not permit this memory type\n",
+ type_name, dev_name(&cxld->dev));
return -EOPNOTSUPP;
}
}