[PATCH] cxl/hdm: Enforce CFMWS HDM-H policy at decoder commit time

[PATCH] cxl/hdm: Enforce CFMWS HDM-H policy at decoder commit time

[Mayank Rana]

A CXL Fixed Memory Window Structure (CFMWS) in the ACPI CEDT table
carries a restrictions field that describes the memory types a
platform window supports.  When the platform sets only
ACPI_CEDT_CFMWS_RESTRICT_HOSTONLYMEM (bit 1) without setting
ACPI_CEDT_CFMWS_RESTRICT_DEVMEM (bit 0), the window is advertised as
Host-Only Memory (HDM-H) only.  This platform intent is translated into
CXL_DECODER_F_TYPE3 without CXL_DECODER_F_TYPE2 on the root decoder by
cfmws_to_decoder_flags().

However, nothing currently prevents a caller from committing an endpoint
or switch decoder with target_type == CXL_DECODER_DEVMEM (HDM-DB) on
such a window.  A dual-capable device -- one that supports both HDM-H
and HDM-DB -- will accept HOSTONLY=0 + COMMIT=1 without asserting
COMMIT_ERROR, silently operating in HDM-DB mode despite the platform
policy prohibiting it.

Add a check in cxl_decoder_commit() that walks from the decoder's
assigned region to the root decoder and rejects the commit with
-EOPNOTSUPP if:

  1. target_type is CXL_DECODER_DEVMEM (HDM-DB requested), and
  2. The root decoder's CFMWS window lacks CXL_DECODER_F_TYPE2
     (HDM-DB not permitted by platform)

This makes the CFMWS restrictions field authoritative for HDM-H
enforcement regardless of individual device capability.  The existing
COMMIT_ERROR path in cxld_await_commit() remains as a secondary
safeguard for devices that cannot support HDM-H at all.

Fixes: 3e23d17ce198 ("cxl/acpi: Use the ACPI CFMWS to create static decoder objects")
Assisted-by: Claude:claude-sonnet-4-6
Signed-off-by: Mayank Rana <mayank.rana@oss.qualcomm.com>
---
Testing
-------

The bug and fix were validated using QEMU with a modified CXL configuration.

Two test-only changes were applied (not part of this patch):

  1. QEMU ACPI (hw/acpi/cxl.c): CFMWS restrictions field changed from
     0x0f to 0x02 (ACPI_CEDT_CFMWS_RESTRICT_HOSTONLYMEM only, without
     RESTRICT_DEVMEM).  This causes cfmws_to_decoder_flags() to set
     CXL_DECODER_F_TYPE3 only on the root decoder, simulating a platform
     that does not permit HDM-DB.

  2. Kernel (drivers/cxl/core/hdm.c): init_hdm_decoder() uncommitted
     endpoint path changed to force CXL_DECODER_DEVMEM unconditionally,
     simulating a dual-capable device (supports both HDM-H and HDM-DB).
     QEMU's cxl-type3 device reports CXL_DEVTYPE_CLASSMEM and defaults
     to HOSTONLYMEM; this override exercises the DEVMEM commit path that
     a real Type-2 or dual-capable Type-3 device would trigger.

Bug reproduction (without this patch):

  # cxl create-region -m mem0 -d decoder0.0 -t pmem
  created 1 region

  HDM-DB committed silently despite CFMWS advertising HDM-H only.
  No error or warning in dmesg.

Fix validation (with this patch):

  # cxl create-region -m mem0 -d decoder0.0 -t pmem
  cxl region: cmd_create_region: created 0 regions

  dmesg:
    cxl_core: cxl region0: mem0:decoder2.0 type mismatch: 2 vs 3
    cxl_port endpoint2: failed to attach decoder2.0 to region0: -6

  The decoder's target_type (2=DEVMEM) mismatches the region's required
  type (3=HOSTONLYMEM) enforced by the CFMWS restriction — commit blocked.

QEMU invocation:

  qemu-system-x86_64 \
    -kernel bzImage \
    -append "root=/dev/sda rw console=ttyS0" \
    -drive file=rootfs.img,index=0,media=disk,format=raw \
    -M q35,cxl=on -m 4G,maxmem=8G,slots=8 -smp 4 \
    -object memory-backend-file,id=cxl-mem1,share=on,mem-path=/tmp/cxltest.raw,size=256M \
    -object memory-backend-file,id=cxl-lsa1,share=on,mem-path=/tmp/lsa.raw,size=256M \
    -device pxb-cxl,bus_nr=12,bus=pcie.0,id=cxl.1 \
    -device cxl-rp,port=0,bus=cxl.1,id=root_port13,chassis=0,slot=2 \
    -device cxl-type3,bus=root_port13,persistent-memdev=cxl-mem1,lsa=cxl-lsa1,id=cxl-pmem0,sn=0x1 \
    -M cxl-fmw.0.targets.0=cxl.1,cxl-fmw.0.size=4G \
    -nographic

 drivers/cxl/core/hdm.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/drivers/cxl/core/hdm.c b/drivers/cxl/core/hdm.c
index 0c80b76a5f9b..c26dab185dc8 100644
--- a/drivers/cxl/core/hdm.c
+++ b/drivers/cxl/core/hdm.c
@@ -802,6 +802,7 @@ static int cxl_decoder_commit(struct cxl_decoder *cxld)
 	struct cxl_port *port = to_cxl_port(cxld->dev.parent);
 	struct cxl_hdm *cxlhdm = dev_get_drvdata(&port->dev);
 	void __iomem *hdm = cxlhdm->regs.hdm_decoder;
+	struct cxl_root_decoder *cxlrd;
 	int id = cxld->id, rc;
 
 	if (cxld->flags & CXL_DECODER_F_ENABLE)
@@ -834,6 +835,19 @@ static int cxl_decoder_commit(struct cxl_decoder *cxld)
 		}
 	}
 
+	/*
+	 * Enforce HDM-H: reject HDM-DB if CFMWS lacks CXL_DECODER_F_TYPE2.
+	 */
+	if (cxld->target_type == CXL_DECODER_DEVMEM && cxld->region) {
+		cxlrd = to_cxl_root_decoder(cxld->region->dev.parent);
+		if (!(cxlrd->cxlsd.cxld.flags & CXL_DECODER_F_TYPE2)) {
+			dev_err(&port->dev,
+				"HDM-DB commit rejected on %s, CFMWS restricts to HDM-H only\n",
+				dev_name(&cxld->dev));
+			return -EOPNOTSUPP;
+		}
+	}
+
 	scoped_guard(rwsem_read, &cxl_rwsem.dpa)
 		setup_hw_decoder(cxld, hdm);
 
-- 
2.34.1