Re: [RFC 1/2] cxl/memdev: add support for mutipf device

On Fri, Aug 21, 2026 at 04:51:33PM +0800, [email protected] wrote:
> From: Alejandro Lucero <[email protected]>
> 
> A PCI device can present multiple Physical Functions(PFs) but the CXL
> specs restrict to the first one, PF0, the discovery and management of
> CXL capabilities accessed through a PF0 BAR. Other non-PF0 PFs need to
> obtain the CXL.mem range to work with somehow.
> 
> Although this could be handled internally by an accelerator/Type2
> driver, it requires to properly handle changes to the CXL mem device,
> mainly its release by the CXL core, but also potential CXL device
> resets. When this release happens, those other PFs need to be told about
> it.
> 
> Implement a way for non-PF0 PFs to register/unregister to the memdev
> linked to the PF0 device. At memdev release, trigger the release of
> those non-PF0 PFs devices registered to such memdev from the driver they
> are bound to.
> 
> Signed-off-by: Alejandro Lucero <[email protected]>
> ---
>  drivers/cxl/core/memdev.c | 122 ++++++++++++++++++++++++++++++++++++++
>  drivers/cxl/cxlmem.h      |   1 +
>  include/cxl/cxl.h         |   4 ++
>  3 files changed, 127 insertions(+)
> 
> diff --git a/drivers/cxl/core/memdev.c b/drivers/cxl/core/memdev.c
> index b3419df586b9..327c4da3208f 100644
> --- a/drivers/cxl/core/memdev.c
> +++ b/drivers/cxl/core/memdev.c
> @@ -26,6 +26,35 @@ static void cxl_memdev_release(struct device *dev)
>  {
>  	struct cxl_memdev *cxlmd = to_cxl_memdev(dev);
>  	struct device *parent = dev->parent;
> +	struct device *sibling;
> +	unsigned long index;
> +
> +	/*
> +	 * Type2 multipf support implies other non-PF0 PFs could be having a
> +	 * temporal reference to the memdev, only for registering/unregistering
> +	 * as sibling, requiring to postpone the memdev release and the sibling
> +	 * management until no further references. While detach_memdev() calls
> +	 * for pf0 release from its driver (parent device of the memdev device)
> +	 * it is not safe to invoke for sibling PFs to be detached at that time
> +	 * as it could race with PFs registering/unregistering as memdev siblings.
> +	 */
> +	if (cxlmd->attach) {
> +		xa_for_each(&cxlmd->siblings, index, sibling) {
> +			device_release_driver(sibling);
> +			xa_erase(&cxlmd->siblings, index);
> +		}
> +
> +		/* Several possibilities trigger a memdev release with one being
> +		 * its parent device (Type2 device) released from its driver. If
> +		 * so, such release is the context for this function, precluding
> +		 * the mutex lock and therefore safely avoiding to invoke the
> +		 * release again which would trigger a deadlock.
> +		 */
> +		if (mutex_trylock(&cxlmd->dev.parent->mutex)) {
> +			mutex_unlock(&cxlmd->dev.parent->mutex);
> +			device_release_driver(cxlmd->dev.parent);
> +		}
> +	}
>  
>  	ida_free(&cxl_memdev_ida, cxlmd->id);
>  	kfree(cxlmd);
> @@ -795,6 +824,7 @@ static struct cxl_memdev *cxl_memdev_alloc(struct cxl_dev_state *cxlds,
>  
>  	cdev = &cxlmd->cdev;
>  	cdev_init(cdev, fops);
> +	xa_init(&cxlmd->siblings);
>  	return cxlmd;
>  
>  err:
> @@ -802,6 +832,98 @@ static struct cxl_memdev *cxl_memdev_alloc(struct cxl_dev_state *cxlds,
>  	return ERR_PTR(rc);
>  }
>  
> +static int match_memdev_by_parent_device(struct device *dev, const void *data)
> +{
> +	const struct device *pf_dev = data;
> +	struct cxl_memdev *cxlmd;
> +
> +	if (!is_cxl_memdev(dev))
> +		return 0;
> +
> +	cxlmd = to_cxl_memdev(dev);
> +	return (cxlmd->cxlds->dev == pf_dev);
> +}
> +
> +/**
> + * cxl_get_pf0_memdev - register as PF0's memdev sibling
> + * @pf0: device for PF0 used to match current memdevs.
> + * @pfx: device to register as sibling to PF0's memdev.
> + * @index: where to register the device in the xarray.
> + * @range: to be set with the PF0's memdev range.
> + *
> + * Return: PF0 memdev pointer or error.
> + */
> +struct cxl_memdev *cxl_get_pf0_memdev(struct device *pf0, struct device *pfx,
> +				      unsigned long index, struct range *range)
> +{
> +	struct cxl_attach_region *attach;
> +	struct cxl_memdev *cxlmd;
> +	struct device *mem_dev __free(put_device) =
> +		bus_find_device(&cxl_bus_type, NULL, pf0,
> +				match_memdev_by_parent_device);
> +
> +	if (!mem_dev)
> +		return ERR_PTR(-ENODEV);
> +
> +	cxlmd = to_cxl_memdev(mem_dev);
> +
> +	/*
> +	 * we got the cxl_memdev and the implicit get_device in bus_find_device
> +	 * makes the next steps safe.
> +	 */
> +
> +	xa_store(&cxlmd->siblings, index, pfx, GFP_KERNEL);
> +	attach = container_of(cxlmd->attach, struct cxl_attach_region, attach);
> +
> +	/*
> +	 * The cxlmd object does exist and it can be found in the cxl bus after
> +	 * creation but before attach probe setting the proper HPA range. If so,
> +	 * the caller will need to try later.
> +	 */
> +	if (attach->hpa_range.end == -1)
> +		return ERR_PTR(-EPROBE_DEFER);
> +
> +	range->start =  attach->hpa_range.start;
> +	range->end =  attach->hpa_range.end;
> +
> +	return to_cxl_memdev(mem_dev);
> +}
> +EXPORT_SYMBOL_NS_GPL(cxl_get_pf0_memdev, "CXL");
> +
> +/**
> + * cxl_put_pf0_memdev - unregister as PF0's memdev sibling
> + * @pf0: device for PF0 used to match current memdevs.
> + * @pfx: device to register as sibling to PF0's memdev.
> + * @index: where to unregister the device in the xarray.
> + *
> + */
> +void cxl_put_pf0_memdev(struct device *pf0, struct device *pfx,
> +			unsigned long index)
> +{
> +	struct cxl_memdev *cxlmd;
> +	struct device *mem_dev __free(put_device) =
> +		bus_find_device(&cxl_bus_type, NULL, pf0,
> +				match_memdev_by_parent_device);
> +
> +	/*
> +	 * This is not an error but a possibility if triggered by PF0 being
> +	 * released which triggers the caller driver releasing pfx. It should
> +	 * not happen if the caller driver does the release of pfx independently
> +	 * but we do not have a simple way to ensure this here.
> +	 */
> +	if (!mem_dev)
> +		return;
> +
> +	/*
> +	 * we got the cxl_memdev and the implicit get_device in bus_find_device
> +	 * makes the next steps safe.
> +	 */
> +
> +	cxlmd = to_cxl_memdev(mem_dev);
> +	xa_erase(&cxlmd->siblings, index);
> +}
> +EXPORT_SYMBOL_NS_GPL(cxl_put_pf0_memdev, "CXL");
> +
>  static long __cxl_memdev_ioctl(struct cxl_memdev *cxlmd, unsigned int cmd,
>  			       unsigned long arg)
>  {
> diff --git a/drivers/cxl/cxlmem.h b/drivers/cxl/cxlmem.h
> index c401e3a1af06..430014c4a046 100644
> --- a/drivers/cxl/cxlmem.h
> +++ b/drivers/cxl/cxlmem.h
> @@ -54,6 +54,7 @@
>   */
>  struct cxl_memdev {
>  	struct device dev;
> +	struct xarray siblings;
>  	struct cdev cdev;
>  	struct cxl_dev_state *cxlds;
>  	struct work_struct detach_work;
> diff --git a/include/cxl/cxl.h b/include/cxl/cxl.h
> index 802b143de83d..883ce9f1b73f 100644
> --- a/include/cxl/cxl.h
> +++ b/include/cxl/cxl.h
> @@ -228,4 +228,8 @@ struct cxl_memdev *devm_cxl_probe_mem(struct cxl_dev_state *cxlds,
>  				      struct range *range);
>  
>  int cxl_set_capacity(struct cxl_dev_state *cxlds, u64 capacity);
> +struct cxl_memdev *cxl_get_pf0_memdev(struct device *pf0, struct device *pfx,
> +				      unsigned long index, struct range *range);
> +void cxl_put_pf0_memdev(struct device *pf0, struct device *pfx, unsigned long index);
> +//struct range *cxl_get_memdev_region_range(struct cxl_memdev *cxlmd);
>  #endif /* __CXL_CXL_H__ */
> -- 
> 2.34.1
> 
>

Hi Alejandro,

I agree that non-PF0 functions must stop using the CXL range before it disappears.
However, I don't think cxl_memdev_release() is the right place to unbind them.

For Type-2 device, PF0 driver creates the memdev, and therefore the memdev
is tied to the PF0 driver, while CXL core manages its attachment to
the topology.

cxl_memdev_release() is the final object release callback. It can run much
later than the CXL attachment teardown.
For example, an open /dev/cxl/memX file holds a device ref. PF0 and the CXL
region can be torn down while that file remains open. During that time,
other PF driver remain bound with mapping to a range that's no longer valid.

I suggest replacing cxl_get_pf0_memdev() and cxl_put_pf0_memdev() with another
helper, e.g.:

int cxl_memdev_link_consumer(struct device *pf0, struct device *consumer, struct range *range);
 
It should live in cxl/core/memdev.c , and the behavior is something like

1. Find PF0's memdev and take a temp ref.
2. Lock the memdev
3. Verify that the memdev is still registered, driver-bound, attached, and has a valid HPA range
4. Create a managed devce link via device_link_add(consumer, &cxlmd->dev, DL_FLAG_AUTOREMOVE_CONSUMER);
5. Copy the HPA range
6. Unlock the memdev and drop the temp ref

This helper can return only an error code and the range. The sfc driver doesn't need the cxl_memdev pointer then, and
no put helper would be needed.

And driver core would unbind the non-PF0 consumer before unbinding or removing the supplier ( memdev ).

I think this can remove the sibling xarray , raw device pointers and mutex_trylock() context check.

Would this modle work for your teardown requirements ?

Best regards,
Richard Cheng.