* Re: [PATCH] cxl/regs: Reject register blocks in an unassigned BAR
2026-09-10 9:38 [PATCH] cxl/regs: Reject register blocks in an unassigned BAR Junjie Cao
@ 2026-09-10 15:38 ` Dave Jiang
2026-09-10 20:55 ` Jonathan Cameron
2026-09-11 9:50 ` Li Ming
2026-09-11 16:04 ` Dave Jiang
2 siblings, 1 reply; 5+ messages in thread
From: Dave Jiang @ 2026-09-10 15:38 UTC (permalink / raw)
To: Junjie Cao, Jonathan Cameron, Jonathan Cameron, Davidlohr Bueso,
Alison Schofield, Vishal Verma, Dan Williams, linux-cxl
Cc: Ira Weiny, Li Ming, Richard Cheng, linux-kernel
On 9/10/26 2:38 AM, Junjie Cao wrote:
> cxl_decode_regblock() only checks that the Register Locator offset fits
> pci_resource_len(). A BAR the PCI core could not place is reset to zero
> start, end and flags while config space keeps the firmware value, so a
> zero offset passes and the block is mapped at physical address 0. On
> x86 ioremap() of the reserved low megabyte succeeds, the component
> register header does not match, and a switch port fails with "HDM
> decoder capability not found", pointing at the HDM decoders rather than
> at the BAR.
>
> Reject a BAR with no length or still unassigned, next to the existing size
> check. Skip empty Register Locator entries first: they decode as BAR0
> offset 0 and would trip the check, and nothing looks them up.
>
> Seen with edk2-stable202602 (f6489621b8ae, reverted in stable202605),
> which places 64-bit non-prefetchable BARs behind a bridge in the
> prefetchable window. Linux refuses to claim them and the switch
> upstream and downstream port BAR0s find no room in the 32-bit window.
> QEMU q35 with a CXL switch, Fedora 43 edk2-ovmf-20260213, before:
>
> pci 0000:0d:00.0: BAR 0 [mem size 0x00010000 64bit]: can't assign; no space
> cxl_port port2: HDM decoder capability not found
>
> after:
>
> pcieport 0000:0d:00.0: BAR0: not assigned (type: 1)
> cxl_port port2: No component registers mapped
> cxl_port port2: Failed to map HDM decoder capability
>
> Link: https://github.com/tianocore/edk2/issues/13104
> Signed-off-by: Junjie Cao <junjie.cao@intel.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
> ---
> drivers/cxl/core/regs.c | 14 ++++++++++++++
> 1 file changed, 14 insertions(+)
>
> diff --git a/drivers/cxl/core/regs.c b/drivers/cxl/core/regs.c
> index 20c2d9fbcfe7..41416fa2ce4a 100644
> --- a/drivers/cxl/core/regs.c
> +++ b/drivers/cxl/core/regs.c
> @@ -277,6 +277,20 @@ static bool cxl_decode_regblock(struct pci_dev *pdev, u32 reg_lo, u32 reg_hi,
> u64 offset = ((u64)reg_hi << 32) |
> (reg_lo & PCI_DVSEC_CXL_REG_LOCATOR_BLOCK_OFF_LOW);
>
> + if (reg_type == CXL_REGLOC_RBI_EMPTY)
> + return false;
> +
> + /*
> + * A BAR the PCI core could not place is reset to zero; decoding it
> + * would map the block at physical address 0.
> + */
> + if (!pci_resource_len(pdev, bar) ||
> + (pci_resource_flags(pdev, bar) & IORESOURCE_UNSET)) {
> + dev_warn(&pdev->dev, "BAR%d: not assigned (type: %d)\n", bar,
> + reg_type);
> + return false;
> + }
> +
> if (offset > pci_resource_len(pdev, bar)) {
> dev_warn(&pdev->dev,
> "BAR%d: %pr: too small (offset: %pa, type: %d)\n", bar,
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] cxl/regs: Reject register blocks in an unassigned BAR
2026-09-10 15:38 ` Dave Jiang
@ 2026-09-10 20:55 ` Jonathan Cameron
0 siblings, 0 replies; 5+ messages in thread
From: Jonathan Cameron @ 2026-09-10 20:55 UTC (permalink / raw)
To: Dave Jiang
Cc: Junjie Cao, Jonathan Cameron, Davidlohr Bueso, Alison Schofield,
Vishal Verma, Dan Williams, linux-cxl, Ira Weiny, Li Ming,
Richard Cheng, linux-kernel
On Thu, 10 Sep 2026 08:38:06 -0700
Dave Jiang <dave.jiang@intel.com> wrote:
> On 9/10/26 2:38 AM, Junjie Cao wrote:
> > cxl_decode_regblock() only checks that the Register Locator offset fits
> > pci_resource_len(). A BAR the PCI core could not place is reset to zero
> > start, end and flags while config space keeps the firmware value, so a
> > zero offset passes and the block is mapped at physical address 0. On
> > x86 ioremap() of the reserved low megabyte succeeds, the component
> > register header does not match, and a switch port fails with "HDM
> > decoder capability not found", pointing at the HDM decoders rather than
> > at the BAR.
> >
> > Reject a BAR with no length or still unassigned, next to the existing size
> > check. Skip empty Register Locator entries first: they decode as BAR0
> > offset 0 and would trip the check, and nothing looks them up.
> >
> > Seen with edk2-stable202602 (f6489621b8ae, reverted in stable202605),
> > which places 64-bit non-prefetchable BARs behind a bridge in the
> > prefetchable window. Linux refuses to claim them and the switch
> > upstream and downstream port BAR0s find no room in the 32-bit window.
> > QEMU q35 with a CXL switch, Fedora 43 edk2-ovmf-20260213, before:
> >
> > pci 0000:0d:00.0: BAR 0 [mem size 0x00010000 64bit]: can't assign; no space
> > cxl_port port2: HDM decoder capability not found
> >
> > after:
> >
> > pcieport 0000:0d:00.0: BAR0: not assigned (type: 1)
> > cxl_port port2: No component registers mapped
> > cxl_port port2: Failed to map HDM decoder capability
> >
> > Link: https://github.com/tianocore/edk2/issues/13104
> > Signed-off-by: Junjie Cao <junjie.cao@intel.com>
>
> Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] cxl/regs: Reject register blocks in an unassigned BAR
2026-09-10 9:38 [PATCH] cxl/regs: Reject register blocks in an unassigned BAR Junjie Cao
2026-09-10 15:38 ` Dave Jiang
@ 2026-09-11 9:50 ` Li Ming
2026-09-11 16:04 ` Dave Jiang
2 siblings, 0 replies; 5+ messages in thread
From: Li Ming @ 2026-09-11 9:50 UTC (permalink / raw)
To: Junjie Cao, Dave Jiang, Jonathan Cameron, Jonathan Cameron,
Davidlohr Bueso, Alison Schofield, Vishal Verma, Dan Williams,
linux-cxl
Cc: Ira Weiny, Richard Cheng, linux-kernel
On 9/10/2026 5:38 PM, Junjie Cao wrote:
> cxl_decode_regblock() only checks that the Register Locator offset fits
> pci_resource_len(). A BAR the PCI core could not place is reset to zero
> start, end and flags while config space keeps the firmware value, so a
> zero offset passes and the block is mapped at physical address 0. On
> x86 ioremap() of the reserved low megabyte succeeds, the component
> register header does not match, and a switch port fails with "HDM
> decoder capability not found", pointing at the HDM decoders rather than
> at the BAR.
>
> Reject a BAR with no length or still unassigned, next to the existing size
> check. Skip empty Register Locator entries first: they decode as BAR0
> offset 0 and would trip the check, and nothing looks them up.
>
> Seen with edk2-stable202602 (f6489621b8ae, reverted in stable202605),
> which places 64-bit non-prefetchable BARs behind a bridge in the
> prefetchable window. Linux refuses to claim them and the switch
> upstream and downstream port BAR0s find no room in the 32-bit window.
> QEMU q35 with a CXL switch, Fedora 43 edk2-ovmf-20260213, before:
>
> pci 0000:0d:00.0: BAR 0 [mem size 0x00010000 64bit]: can't assign; no space
> cxl_port port2: HDM decoder capability not found
>
> after:
>
> pcieport 0000:0d:00.0: BAR0: not assigned (type: 1)
> cxl_port port2: No component registers mapped
> cxl_port port2: Failed to map HDM decoder capability
>
> Link: https://github.com/tianocore/edk2/issues/13104
> Signed-off-by: Junjie Cao <junjie.cao@intel.com>
Reviewed-by: Li Ming <ming.li@zohomail.com>
> ---
> drivers/cxl/core/regs.c | 14 ++++++++++++++
> 1 file changed, 14 insertions(+)
>
> diff --git a/drivers/cxl/core/regs.c b/drivers/cxl/core/regs.c
> index 20c2d9fbcfe7..41416fa2ce4a 100644
> --- a/drivers/cxl/core/regs.c
> +++ b/drivers/cxl/core/regs.c
> @@ -277,6 +277,20 @@ static bool cxl_decode_regblock(struct pci_dev *pdev, u32 reg_lo, u32 reg_hi,
> u64 offset = ((u64)reg_hi << 32) |
> (reg_lo & PCI_DVSEC_CXL_REG_LOCATOR_BLOCK_OFF_LOW);
>
> + if (reg_type == CXL_REGLOC_RBI_EMPTY)
> + return false;
> +
> + /*
> + * A BAR the PCI core could not place is reset to zero; decoding it
> + * would map the block at physical address 0.
> + */
> + if (!pci_resource_len(pdev, bar) ||
> + (pci_resource_flags(pdev, bar) & IORESOURCE_UNSET)) {
> + dev_warn(&pdev->dev, "BAR%d: not assigned (type: %d)\n", bar,
> + reg_type);
> + return false;
> + }
> +
> if (offset > pci_resource_len(pdev, bar)) {
> dev_warn(&pdev->dev,
> "BAR%d: %pr: too small (offset: %pa, type: %d)\n", bar,
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] cxl/regs: Reject register blocks in an unassigned BAR
2026-09-10 9:38 [PATCH] cxl/regs: Reject register blocks in an unassigned BAR Junjie Cao
2026-09-10 15:38 ` Dave Jiang
2026-09-11 9:50 ` Li Ming
@ 2026-09-11 16:04 ` Dave Jiang
2 siblings, 0 replies; 5+ messages in thread
From: Dave Jiang @ 2026-09-11 16:04 UTC (permalink / raw)
To: Junjie Cao, Jonathan Cameron, Jonathan Cameron, Davidlohr Bueso,
Alison Schofield, Vishal Verma, Dan Williams, linux-cxl
Cc: Ira Weiny, Li Ming, Richard Cheng, linux-kernel
On 9/10/26 2:38 AM, Junjie Cao wrote:
> cxl_decode_regblock() only checks that the Register Locator offset fits
> pci_resource_len(). A BAR the PCI core could not place is reset to zero
> start, end and flags while config space keeps the firmware value, so a
> zero offset passes and the block is mapped at physical address 0. On
> x86 ioremap() of the reserved low megabyte succeeds, the component
> register header does not match, and a switch port fails with "HDM
> decoder capability not found", pointing at the HDM decoders rather than
> at the BAR.
>
> Reject a BAR with no length or still unassigned, next to the existing size
> check. Skip empty Register Locator entries first: they decode as BAR0
> offset 0 and would trip the check, and nothing looks them up.
>
> Seen with edk2-stable202602 (f6489621b8ae, reverted in stable202605),
> which places 64-bit non-prefetchable BARs behind a bridge in the
> prefetchable window. Linux refuses to claim them and the switch
> upstream and downstream port BAR0s find no room in the 32-bit window.
> QEMU q35 with a CXL switch, Fedora 43 edk2-ovmf-20260213, before:
>
> pci 0000:0d:00.0: BAR 0 [mem size 0x00010000 64bit]: can't assign; no space
> cxl_port port2: HDM decoder capability not found
>
> after:
>
> pcieport 0000:0d:00.0: BAR0: not assigned (type: 1)
> cxl_port port2: No component registers mapped
> cxl_port port2: Failed to map HDM decoder capability
>
> Link: https://github.com/tianocore/edk2/issues/13104
> Signed-off-by: Junjie Cao <junjie.cao@intel.com>
Applied to cxl/next:
dc96f35358a1
> ---
> drivers/cxl/core/regs.c | 14 ++++++++++++++
> 1 file changed, 14 insertions(+)
>
> diff --git a/drivers/cxl/core/regs.c b/drivers/cxl/core/regs.c
> index 20c2d9fbcfe7..41416fa2ce4a 100644
> --- a/drivers/cxl/core/regs.c
> +++ b/drivers/cxl/core/regs.c
> @@ -277,6 +277,20 @@ static bool cxl_decode_regblock(struct pci_dev *pdev, u32 reg_lo, u32 reg_hi,
> u64 offset = ((u64)reg_hi << 32) |
> (reg_lo & PCI_DVSEC_CXL_REG_LOCATOR_BLOCK_OFF_LOW);
>
> + if (reg_type == CXL_REGLOC_RBI_EMPTY)
> + return false;
> +
> + /*
> + * A BAR the PCI core could not place is reset to zero; decoding it
> + * would map the block at physical address 0.
> + */
> + if (!pci_resource_len(pdev, bar) ||
> + (pci_resource_flags(pdev, bar) & IORESOURCE_UNSET)) {
> + dev_warn(&pdev->dev, "BAR%d: not assigned (type: %d)\n", bar,
> + reg_type);
> + return false;
> + }
> +
> if (offset > pci_resource_len(pdev, bar)) {
> dev_warn(&pdev->dev,
> "BAR%d: %pr: too small (offset: %pa, type: %d)\n", bar,
^ permalink raw reply [flat|nested] 5+ messages in thread