Merge branch 'for-6.15/features' into cxl-for-next (3b5d4324) · Commits · git / linux-nf

drivers/cxl/Kconfig

+11 −0

Original line number	Diff line number	Diff line
		@@ -102,6 +102,17 @@ config CXL_MEM

		If unsure say 'm'.

		config CXL_FEATURES
		bool "CXL: Features"
		depends on CXL_PCI
		help
		Enable support for CXL Features. A CXL device that includes a mailbox
		supports commands that allows listing, getting, and setting of
		optionally defined features such as memory sparing or post package
		sparing. Vendors may define custom features for the device.

		If unsure say 'n'

		config CXL_PORT
		default CXL_BUS
		tristate

drivers/cxl/core/Makefile

+1 −0

Original line number	Diff line number	Diff line
		@@ -19,3 +19,4 @@ cxl_core-y += acpi.o
		cxl_core-$(CONFIG_TRACING) += trace.o
		cxl_core-$(CONFIG_CXL_REGION) += region.o
		cxl_core-$(CONFIG_CXL_MCE) += mce.o
		cxl_core-$(CONFIG_CXL_FEATURES) += features.o

drivers/cxl/core/core.h

+15 −2

Original line number	Diff line number	Diff line
		@@ -4,6 +4,8 @@
		#ifndef __CXL_CORE_H__
		#define __CXL_CORE_H__

		#include <cxl/mailbox.h>

		extern const struct device_type cxl_nvdimm_bridge_type;
		extern const struct device_type cxl_nvdimm_type;
		extern const struct device_type cxl_pmu_type;
		@@ -65,9 +67,9 @@ static inline void cxl_region_exit(void)

		struct cxl_send_command;
		struct cxl_mem_query_commands;
		int cxl_query_cmd(struct cxl_memdev *cxlmd,
		int cxl_query_cmd(struct cxl_mailbox *cxl_mbox,
		struct cxl_mem_query_commands __user *q);
		int cxl_send_cmd(struct cxl_memdev cxlmd, struct cxl_send_command __user s);
		int cxl_send_cmd(struct cxl_mailbox cxl_mbox, struct cxl_send_command __user s);
		void __iomem devm_cxl_iomap_block(struct device dev, resource_size_t addr,
		resource_size_t length);

		@@ -121,4 +123,15 @@ int cxl_gpf_port_setup(struct device dport_dev, struct cxl_port port);
		int cxl_acpi_get_extended_linear_cache_size(struct resource *backing_res,
		int nid, resource_size_t *size);

		#ifdef CONFIG_CXL_FEATURES
		size_t cxl_get_feature(struct cxl_mailbox cxl_mbox, const uuid_t feat_uuid,
		enum cxl_get_feat_selection selection,
		void *feat_out, size_t feat_out_size, u16 offset,
		u16 *return_code);
		int cxl_set_feature(struct cxl_mailbox cxl_mbox, const uuid_t feat_uuid,
		u8 feat_version, const void *feat_data,
		size_t feat_data_size, u32 feat_flag, u16 offset,
		u16 *return_code);
		#endif

		#endif /* __CXL_CORE_H__ */

drivers/cxl/core/features.c

0 → 100644

+333 −0

Original line number	Diff line number	Diff line
		// SPDX-License-Identifier: GPL-2.0-only
		/* Copyright(c) 2024-2025 Intel Corporation. All rights reserved. */
		#include <linux/device.h>
		#include <cxl/mailbox.h>
		#include <cxl/features.h>
		#include "cxl.h"
		#include "core.h"
		#include "cxlmem.h"

		/* All the features below are exclusive to the kernel */
		static const uuid_t cxl_exclusive_feats[] = {
		CXL_FEAT_PATROL_SCRUB_UUID,
		CXL_FEAT_ECS_UUID,
		CXL_FEAT_SPPR_UUID,
		CXL_FEAT_HPPR_UUID,
		CXL_FEAT_CACHELINE_SPARING_UUID,
		CXL_FEAT_ROW_SPARING_UUID,
		CXL_FEAT_BANK_SPARING_UUID,
		CXL_FEAT_RANK_SPARING_UUID,
		};

		static bool is_cxl_feature_exclusive(struct cxl_feat_entry *entry)
		{
		for (int i = 0; i < ARRAY_SIZE(cxl_exclusive_feats); i++) {
		if (uuid_equal(&entry->uuid, &cxl_exclusive_feats[i]))
		return true;
		}

		return false;
		}

		inline struct cxl_features_state to_cxlfs(struct cxl_dev_state cxlds)
		{
		return cxlds->cxlfs;
		}
		EXPORT_SYMBOL_NS_GPL(to_cxlfs, "CXL");

		static int cxl_get_supported_features_count(struct cxl_mailbox *cxl_mbox)
		{
		struct cxl_mbox_get_sup_feats_out mbox_out;
		struct cxl_mbox_get_sup_feats_in mbox_in;
		struct cxl_mbox_cmd mbox_cmd;
		int rc;

		memset(&mbox_in, 0, sizeof(mbox_in));
		mbox_in.count = cpu_to_le32(sizeof(mbox_out));
		memset(&mbox_out, 0, sizeof(mbox_out));
		mbox_cmd = (struct cxl_mbox_cmd) {
		.opcode = CXL_MBOX_OP_GET_SUPPORTED_FEATURES,
		.size_in = sizeof(mbox_in),
		.payload_in = &mbox_in,
		.size_out = sizeof(mbox_out),
		.payload_out = &mbox_out,
		.min_out = sizeof(mbox_out),
		};
		rc = cxl_internal_send_cmd(cxl_mbox, &mbox_cmd);
		if (rc < 0)
		return rc;

		return le16_to_cpu(mbox_out.supported_feats);
		}

		static struct cxl_feat_entries *
		get_supported_features(struct cxl_features_state *cxlfs)
		{
		int remain_feats, max_size, max_feats, start, rc, hdr_size;
		struct cxl_mailbox *cxl_mbox = &cxlfs->cxlds->cxl_mbox;
		int feat_size = sizeof(struct cxl_feat_entry);
		struct cxl_mbox_get_sup_feats_in mbox_in;
		struct cxl_feat_entry *entry;
		struct cxl_mbox_cmd mbox_cmd;
		int user_feats = 0;
		int count;

		count = cxl_get_supported_features_count(cxl_mbox);
		if (count <= 0)
		return NULL;

		struct cxl_feat_entries *entries __free(kvfree) =
		kvmalloc(struct_size(entries, ent, count), GFP_KERNEL);
		if (!entries)
		return NULL;

		struct cxl_mbox_get_sup_feats_out *mbox_out __free(kvfree) =
		kvmalloc(cxl_mbox->payload_size, GFP_KERNEL);
		if (!mbox_out)
		return NULL;

		hdr_size = struct_size(mbox_out, ents, 0);
		max_size = cxl_mbox->payload_size - hdr_size;
		/* max feat entries that can fit in mailbox max payload size */
		max_feats = max_size / feat_size;
		entry = entries->ent;

		start = 0;
		remain_feats = count;
		do {
		int retrieved, alloc_size, copy_feats;
		int num_entries;

		if (remain_feats > max_feats) {
		alloc_size = struct_size(mbox_out, ents, max_feats);
		remain_feats = remain_feats - max_feats;
		copy_feats = max_feats;
		} else {
		alloc_size = struct_size(mbox_out, ents, remain_feats);
		copy_feats = remain_feats;
		remain_feats = 0;
		}

		memset(&mbox_in, 0, sizeof(mbox_in));
		mbox_in.count = cpu_to_le32(alloc_size);
		mbox_in.start_idx = cpu_to_le16(start);
		memset(mbox_out, 0, alloc_size);
		mbox_cmd = (struct cxl_mbox_cmd) {
		.opcode = CXL_MBOX_OP_GET_SUPPORTED_FEATURES,
		.size_in = sizeof(mbox_in),
		.payload_in = &mbox_in,
		.size_out = alloc_size,
		.payload_out = mbox_out,
		.min_out = hdr_size,
		};
		rc = cxl_internal_send_cmd(cxl_mbox, &mbox_cmd);
		if (rc < 0)
		return NULL;

		if (mbox_cmd.size_out <= hdr_size)
		return NULL;

		/*
		* Make sure retrieved out buffer is multiple of feature
		* entries.
		*/
		retrieved = mbox_cmd.size_out - hdr_size;
		if (retrieved % feat_size)
		return NULL;

		num_entries = le16_to_cpu(mbox_out->num_entries);
		/*
		* If the reported output entries * defined entry size !=
		* retrieved output bytes, then the output package is incorrect.
		*/
		if (num_entries * feat_size != retrieved)
		return NULL;

		memcpy(entry, mbox_out->ents, retrieved);
		for (int i = 0; i < num_entries; i++) {
		if (!is_cxl_feature_exclusive(entry + i))
		user_feats++;
		}
		entry += num_entries;
		/*
		* If the number of output entries is less than expected, add the
		* remaining entries to the next batch.
		*/
		remain_feats += copy_feats - num_entries;
		start += num_entries;
		} while (remain_feats);

		entries->num_features = count;
		entries->num_user_features = user_feats;

		return no_free_ptr(entries);
		}

		static void free_cxlfs(void *_cxlfs)
		{
		struct cxl_features_state *cxlfs = _cxlfs;
		struct cxl_dev_state *cxlds = cxlfs->cxlds;

		cxlds->cxlfs = NULL;
		kvfree(cxlfs->entries);
		kfree(cxlfs);
		}

		/**
		* devm_cxl_setup_features() - Allocate and initialize features context
		* @cxlds: CXL device context
		*
		* Return 0 on success or -errno on failure.
		*/
		int devm_cxl_setup_features(struct cxl_dev_state *cxlds)
		{
		struct cxl_mailbox *cxl_mbox = &cxlds->cxl_mbox;

		if (cxl_mbox->feat_cap < CXL_FEATURES_RO)
		return -ENODEV;

		struct cxl_features_state *cxlfs __free(kfree) =
		kzalloc(sizeof(*cxlfs), GFP_KERNEL);
		if (!cxlfs)
		return -ENOMEM;

		cxlfs->cxlds = cxlds;

		cxlfs->entries = get_supported_features(cxlfs);
		if (!cxlfs->entries)
		return -ENOMEM;

		cxlds->cxlfs = cxlfs;

		return devm_add_action_or_reset(cxlds->dev, free_cxlfs, no_free_ptr(cxlfs));
		}
		EXPORT_SYMBOL_NS_GPL(devm_cxl_setup_features, "CXL");

		size_t cxl_get_feature(struct cxl_mailbox cxl_mbox, const uuid_t feat_uuid,
		enum cxl_get_feat_selection selection,
		void *feat_out, size_t feat_out_size, u16 offset,
		u16 *return_code)
		{
		size_t data_to_rd_size, size_out;
		struct cxl_mbox_get_feat_in pi;
		struct cxl_mbox_cmd mbox_cmd;
		size_t data_rcvd_size = 0;
		int rc;

		if (return_code)
		*return_code = CXL_MBOX_CMD_RC_INPUT;

		if (!feat_out \|\| !feat_out_size)
		return 0;

		size_out = min(feat_out_size, cxl_mbox->payload_size);
		uuid_copy(&pi.uuid, feat_uuid);
		pi.selection = selection;
		do {
		data_to_rd_size = min(feat_out_size - data_rcvd_size,
		cxl_mbox->payload_size);
		pi.offset = cpu_to_le16(offset + data_rcvd_size);
		pi.count = cpu_to_le16(data_to_rd_size);

		mbox_cmd = (struct cxl_mbox_cmd) {
		.opcode = CXL_MBOX_OP_GET_FEATURE,
		.size_in = sizeof(pi),
		.payload_in = &pi,
		.size_out = size_out,
		.payload_out = feat_out + data_rcvd_size,
		.min_out = data_to_rd_size,
		};
		rc = cxl_internal_send_cmd(cxl_mbox, &mbox_cmd);
		if (rc < 0 \|\| !mbox_cmd.size_out) {
		if (return_code)
		*return_code = mbox_cmd.return_code;
		return 0;
		}
		data_rcvd_size += mbox_cmd.size_out;
		} while (data_rcvd_size < feat_out_size);

		if (return_code)
		*return_code = CXL_MBOX_CMD_RC_SUCCESS;

		return data_rcvd_size;
		}

		/*
		* FEAT_DATA_MIN_PAYLOAD_SIZE - min extra number of bytes should be
		* available in the mailbox for storing the actual feature data so that
		* the feature data transfer would work as expected.
		*/
		#define FEAT_DATA_MIN_PAYLOAD_SIZE 10
		int cxl_set_feature(struct cxl_mailbox *cxl_mbox,
		const uuid_t *feat_uuid, u8 feat_version,
		const void *feat_data, size_t feat_data_size,
		u32 feat_flag, u16 offset, u16 *return_code)
		{
		size_t data_in_size, data_sent_size = 0;
		struct cxl_mbox_cmd mbox_cmd;
		size_t hdr_size;

		if (return_code)
		*return_code = CXL_MBOX_CMD_RC_INPUT;

		struct cxl_mbox_set_feat_in *pi __free(kfree) =
		kzalloc(cxl_mbox->payload_size, GFP_KERNEL);
		if (!pi)
		return -ENOMEM;

		uuid_copy(&pi->uuid, feat_uuid);
		pi->version = feat_version;
		feat_flag &= ~CXL_SET_FEAT_FLAG_DATA_TRANSFER_MASK;
		feat_flag \|= CXL_SET_FEAT_FLAG_DATA_SAVED_ACROSS_RESET;
		hdr_size = sizeof(pi->hdr);
		/*
		* Check minimum mbox payload size is available for
		* the feature data transfer.
		*/
		if (hdr_size + FEAT_DATA_MIN_PAYLOAD_SIZE > cxl_mbox->payload_size)
		return -ENOMEM;

		if (hdr_size + feat_data_size <= cxl_mbox->payload_size) {
		pi->flags = cpu_to_le32(feat_flag \|
		CXL_SET_FEAT_FLAG_FULL_DATA_TRANSFER);
		data_in_size = feat_data_size;
		} else {
		pi->flags = cpu_to_le32(feat_flag \|
		CXL_SET_FEAT_FLAG_INITIATE_DATA_TRANSFER);
		data_in_size = cxl_mbox->payload_size - hdr_size;
		}

		do {
		int rc;

		pi->offset = cpu_to_le16(offset + data_sent_size);
		memcpy(pi->feat_data, feat_data + data_sent_size, data_in_size);
		mbox_cmd = (struct cxl_mbox_cmd) {
		.opcode = CXL_MBOX_OP_SET_FEATURE,
		.size_in = hdr_size + data_in_size,
		.payload_in = pi,
		};
		rc = cxl_internal_send_cmd(cxl_mbox, &mbox_cmd);
		if (rc < 0) {
		if (return_code)
		*return_code = mbox_cmd.return_code;
		return rc;
		}

		data_sent_size += data_in_size;
		if (data_sent_size >= feat_data_size) {
		if (return_code)
		*return_code = CXL_MBOX_CMD_RC_SUCCESS;
		return 0;
		}

		if ((feat_data_size - data_sent_size) <= (cxl_mbox->payload_size - hdr_size)) {
		data_in_size = feat_data_size - data_sent_size;
		pi->flags = cpu_to_le32(feat_flag \|
		CXL_SET_FEAT_FLAG_FINISH_DATA_TRANSFER);
		} else {
		pi->flags = cpu_to_le32(feat_flag \|
		CXL_SET_FEAT_FLAG_CONTINUE_DATA_TRANSFER);
		}
		} while (true);
		}

drivers/cxl/core/mbox.c

+77 −47

Original line number	Diff line number	Diff line
		@@ -350,40 +350,39 @@ static bool cxl_payload_from_user_allowed(u16 opcode, void *payload_in)
		return true;
		}

		static int cxl_mbox_cmd_ctor(struct cxl_mbox_cmd *mbox,
		struct cxl_memdev_state *mds, u16 opcode,
		static int cxl_mbox_cmd_ctor(struct cxl_mbox_cmd *mbox_cmd,
		struct cxl_mailbox *cxl_mbox, u16 opcode,
		size_t in_size, size_t out_size, u64 in_payload)
		{
		struct cxl_mailbox *cxl_mbox = &mds->cxlds.cxl_mbox;
		*mbox = (struct cxl_mbox_cmd) {
		*mbox_cmd = (struct cxl_mbox_cmd) {
		.opcode = opcode,
		.size_in = in_size,
		};

		if (in_size) {
		mbox->payload_in = vmemdup_user(u64_to_user_ptr(in_payload),
		mbox_cmd->payload_in = vmemdup_user(u64_to_user_ptr(in_payload),
		in_size);
		if (IS_ERR(mbox->payload_in))
		return PTR_ERR(mbox->payload_in);
		if (IS_ERR(mbox_cmd->payload_in))
		return PTR_ERR(mbox_cmd->payload_in);

		if (!cxl_payload_from_user_allowed(opcode, mbox->payload_in)) {
		dev_dbg(mds->cxlds.dev, "%s: input payload not allowed\n",
		if (!cxl_payload_from_user_allowed(opcode, mbox_cmd->payload_in)) {
		dev_dbg(cxl_mbox->host, "%s: input payload not allowed\n",
		cxl_mem_opcode_to_name(opcode));
		kvfree(mbox->payload_in);
		kvfree(mbox_cmd->payload_in);
		return -EBUSY;
		}
		}

		/* Prepare to handle a full payload for variable sized output */
		if (out_size == CXL_VARIABLE_PAYLOAD)
		mbox->size_out = cxl_mbox->payload_size;
		mbox_cmd->size_out = cxl_mbox->payload_size;
		else
		mbox->size_out = out_size;
		mbox_cmd->size_out = out_size;

		if (mbox->size_out) {
		mbox->payload_out = kvzalloc(mbox->size_out, GFP_KERNEL);
		if (!mbox->payload_out) {
		kvfree(mbox->payload_in);
		if (mbox_cmd->size_out) {
		mbox_cmd->payload_out = kvzalloc(mbox_cmd->size_out, GFP_KERNEL);
		if (!mbox_cmd->payload_out) {
		kvfree(mbox_cmd->payload_in);
		return -ENOMEM;
		}
		}
		@@ -398,10 +397,8 @@ static void cxl_mbox_cmd_dtor(struct cxl_mbox_cmd *mbox)

		static int cxl_to_mem_cmd_raw(struct cxl_mem_command *mem_cmd,
		const struct cxl_send_command *send_cmd,
		struct cxl_memdev_state *mds)
		struct cxl_mailbox *cxl_mbox)
		{
		struct cxl_mailbox *cxl_mbox = &mds->cxlds.cxl_mbox;

		if (send_cmd->raw.rsvd)
		return -EINVAL;

		@@ -416,7 +413,7 @@ static int cxl_to_mem_cmd_raw(struct cxl_mem_command *mem_cmd,
		if (!cxl_mem_raw_command_allowed(send_cmd->raw.opcode))
		return -EPERM;

		dev_WARN_ONCE(mds->cxlds.dev, true, "raw command path used\n");
		dev_WARN_ONCE(cxl_mbox->host, true, "raw command path used\n");

		*mem_cmd = (struct cxl_mem_command) {
		.info = {
		@@ -432,7 +429,7 @@ static int cxl_to_mem_cmd_raw(struct cxl_mem_command *mem_cmd,

		static int cxl_to_mem_cmd(struct cxl_mem_command *mem_cmd,
		const struct cxl_send_command *send_cmd,
		struct cxl_memdev_state *mds)
		struct cxl_mailbox *cxl_mbox)
		{
		struct cxl_mem_command *c = &cxl_mem_commands[send_cmd->id];
		const struct cxl_command_info *info = &c->info;
		@@ -447,11 +444,11 @@ static int cxl_to_mem_cmd(struct cxl_mem_command *mem_cmd,
		return -EINVAL;

		/* Check that the command is enabled for hardware */
		if (!test_bit(info->id, mds->enabled_cmds))
		if (!test_bit(info->id, cxl_mbox->enabled_cmds))
		return -ENOTTY;

		/* Check that the command is not claimed for exclusive kernel use */
		if (test_bit(info->id, mds->exclusive_cmds))
		if (test_bit(info->id, cxl_mbox->exclusive_cmds))
		return -EBUSY;

		/* Check the input buffer is the expected size */
		@@ -480,7 +477,7 @@ static int cxl_to_mem_cmd(struct cxl_mem_command *mem_cmd,
		/**
		* cxl_validate_cmd_from_user() - Check fields for CXL_MEM_SEND_COMMAND.
		* @mbox_cmd: Sanitized and populated &struct cxl_mbox_cmd.
		* @mds: The driver data for the operation
		* @cxl_mbox: CXL mailbox context
		* @send_cmd: &struct cxl_send_command copied in from userspace.
		*
		* Return:
		@@ -495,10 +492,9 @@ static int cxl_to_mem_cmd(struct cxl_mem_command *mem_cmd,
		* safe to send to the hardware.
		*/
		static int cxl_validate_cmd_from_user(struct cxl_mbox_cmd *mbox_cmd,
		struct cxl_memdev_state *mds,
		struct cxl_mailbox *cxl_mbox,
		const struct cxl_send_command *send_cmd)
		{
		struct cxl_mailbox *cxl_mbox = &mds->cxlds.cxl_mbox;
		struct cxl_mem_command mem_cmd;
		int rc;

		@@ -515,24 +511,23 @@ static int cxl_validate_cmd_from_user(struct cxl_mbox_cmd *mbox_cmd,

		/* Sanitize and construct a cxl_mem_command */
		if (send_cmd->id == CXL_MEM_COMMAND_ID_RAW)
		rc = cxl_to_mem_cmd_raw(&mem_cmd, send_cmd, mds);
		rc = cxl_to_mem_cmd_raw(&mem_cmd, send_cmd, cxl_mbox);
		else
		rc = cxl_to_mem_cmd(&mem_cmd, send_cmd, mds);
		rc = cxl_to_mem_cmd(&mem_cmd, send_cmd, cxl_mbox);

		if (rc)
		return rc;

		/* Sanitize and construct a cxl_mbox_cmd */
		return cxl_mbox_cmd_ctor(mbox_cmd, mds, mem_cmd.opcode,
		return cxl_mbox_cmd_ctor(mbox_cmd, cxl_mbox, mem_cmd.opcode,
		mem_cmd.info.size_in, mem_cmd.info.size_out,
		send_cmd->in.payload);
		}

		int cxl_query_cmd(struct cxl_memdev *cxlmd,
		int cxl_query_cmd(struct cxl_mailbox *cxl_mbox,
		struct cxl_mem_query_commands __user *q)
		{
		struct cxl_memdev_state *mds = to_cxl_memdev_state(cxlmd->cxlds);
		struct device *dev = &cxlmd->dev;
		struct device *dev = cxl_mbox->host;
		struct cxl_mem_command *cmd;
		u32 n_commands;
		int j = 0;
		@@ -553,9 +548,9 @@ int cxl_query_cmd(struct cxl_memdev *cxlmd,
		cxl_for_each_cmd(cmd) {
		struct cxl_command_info info = cmd->info;

		if (test_bit(info.id, mds->enabled_cmds))
		if (test_bit(info.id, cxl_mbox->enabled_cmds))
		info.flags \|= CXL_MEM_COMMAND_FLAG_ENABLED;
		if (test_bit(info.id, mds->exclusive_cmds))
		if (test_bit(info.id, cxl_mbox->exclusive_cmds))
		info.flags \|= CXL_MEM_COMMAND_FLAG_EXCLUSIVE;

		if (copy_to_user(&q->commands[j++], &info, sizeof(info)))
		@@ -570,7 +565,7 @@ int cxl_query_cmd(struct cxl_memdev *cxlmd,

		/**
		* handle_mailbox_cmd_from_user() - Dispatch a mailbox command for userspace.
		* @mds: The driver data for the operation
		* @cxl_mbox: The mailbox context for the operation.
		* @mbox_cmd: The validated mailbox command.
		* @out_payload: Pointer to userspace's output payload.
		* @size_out: (Input) Max payload size to copy out.
		@@ -591,13 +586,12 @@ int cxl_query_cmd(struct cxl_memdev *cxlmd,
		*
		* See cxl_send_cmd().
		*/
		static int handle_mailbox_cmd_from_user(struct cxl_memdev_state *mds,
		static int handle_mailbox_cmd_from_user(struct cxl_mailbox *cxl_mbox,
		struct cxl_mbox_cmd *mbox_cmd,
		u64 out_payload, s32 *size_out,
		u32 *retval)
		{
		struct cxl_mailbox *cxl_mbox = &mds->cxlds.cxl_mbox;
		struct device *dev = mds->cxlds.dev;
		struct device *dev = cxl_mbox->host;
		int rc;

		dev_dbg(dev,
		@@ -634,10 +628,9 @@ static int handle_mailbox_cmd_from_user(struct cxl_memdev_state *mds,
		return rc;
		}

		int cxl_send_cmd(struct cxl_memdev cxlmd, struct cxl_send_command __user s)
		int cxl_send_cmd(struct cxl_mailbox cxl_mbox, struct cxl_send_command __user s)
		{
		struct cxl_memdev_state *mds = to_cxl_memdev_state(cxlmd->cxlds);
		struct device *dev = &cxlmd->dev;
		struct device *dev = cxl_mbox->host;
		struct cxl_send_command send;
		struct cxl_mbox_cmd mbox_cmd;
		int rc;
		@@ -647,11 +640,11 @@ int cxl_send_cmd(struct cxl_memdev cxlmd, struct cxl_send_command __user s)
		if (copy_from_user(&send, s, sizeof(send)))
		return -EFAULT;

		rc = cxl_validate_cmd_from_user(&mbox_cmd, mds, &send);
		rc = cxl_validate_cmd_from_user(&mbox_cmd, cxl_mbox, &send);
		if (rc)
		return rc;

		rc = handle_mailbox_cmd_from_user(mds, &mbox_cmd, send.out.payload,
		rc = handle_mailbox_cmd_from_user(cxl_mbox, &mbox_cmd, send.out.payload,
		&send.out.size, &send.retval);
		if (rc)
		return rc;
		@@ -714,6 +707,35 @@ static int cxl_xfer_log(struct cxl_memdev_state mds, uuid_t uuid,
		return 0;
		}

		static int check_features_opcodes(u16 opcode, int ro_cmds, int wr_cmds)
		{
		switch (opcode) {
		case CXL_MBOX_OP_GET_SUPPORTED_FEATURES:
		case CXL_MBOX_OP_GET_FEATURE:
		(*ro_cmds)++;
		return 1;
		case CXL_MBOX_OP_SET_FEATURE:
		(*wr_cmds)++;
		return 1;
		default:
		return 0;
		}
		}

		/* 'Get Supported Features' and 'Get Feature' */
		#define MAX_FEATURES_READ_CMDS 2
		static void set_features_cap(struct cxl_mailbox *cxl_mbox,
		int ro_cmds, int wr_cmds)
		{
		/* Setting up Features capability while walking the CEL */
		if (ro_cmds == MAX_FEATURES_READ_CMDS) {
		if (wr_cmds)
		cxl_mbox->feat_cap = CXL_FEATURES_RW;
		else
		cxl_mbox->feat_cap = CXL_FEATURES_RO;
		}
		}

		/**
		* cxl_walk_cel() - Walk through the Command Effects Log.
		* @mds: The driver data for the operation
		@@ -725,10 +747,11 @@ static int cxl_xfer_log(struct cxl_memdev_state mds, uuid_t uuid,
		*/
		static void cxl_walk_cel(struct cxl_memdev_state mds, size_t size, u8 cel)
		{
		struct cxl_mailbox *cxl_mbox = &mds->cxlds.cxl_mbox;
		struct cxl_cel_entry *cel_entry;
		const int cel_entries = size / sizeof(*cel_entry);
		struct device *dev = mds->cxlds.dev;
		int i;
		int i, ro_cmds = 0, wr_cmds = 0;

		cel_entry = (struct cxl_cel_entry *) cel;

		@@ -738,10 +761,13 @@ static void cxl_walk_cel(struct cxl_memdev_state mds, size_t size, u8 cel)
		int enabled = 0;

		if (cmd) {
		set_bit(cmd->info.id, mds->enabled_cmds);
		set_bit(cmd->info.id, cxl_mbox->enabled_cmds);
		enabled++;
		}

		enabled += check_features_opcodes(opcode, &ro_cmds,
		&wr_cmds);

		if (cxl_is_poison_command(opcode)) {
		cxl_set_poison_cmd_enabled(&mds->poison, opcode);
		enabled++;
		@@ -755,6 +781,8 @@ static void cxl_walk_cel(struct cxl_memdev_state mds, size_t size, u8 cel)
		dev_dbg(dev, "Opcode 0x%04x %s\n", opcode,
		enabled ? "enabled" : "unsupported by driver");
		}

		set_features_cap(cxl_mbox, ro_cmds, wr_cmds);
		}

		static struct cxl_mbox_get_supported_logs cxl_get_gsl(struct cxl_memdev_state mds)
		@@ -808,6 +836,7 @@ static const uuid_t log_uuid[] = {
		*/
		int cxl_enumerate_cmds(struct cxl_memdev_state *mds)
		{
		struct cxl_mailbox *cxl_mbox = &mds->cxlds.cxl_mbox;
		struct cxl_mbox_get_supported_logs *gsl;
		struct device *dev = mds->cxlds.dev;
		struct cxl_mem_command *cmd;
		@@ -846,7 +875,7 @@ int cxl_enumerate_cmds(struct cxl_memdev_state *mds)
		/* In case CEL was bogus, enable some default commands. */
		cxl_for_each_cmd(cmd)
		if (cmd->flags & CXL_CMD_FLAG_FORCE_ENABLE)
		set_bit(cmd->info.id, mds->enabled_cmds);
		set_bit(cmd->info.id, cxl_mbox->enabled_cmds);

		/* Found the required CEL */
		rc = 0;
		@@ -1469,6 +1498,7 @@ struct cxl_memdev_state cxl_memdev_state_create(struct device dev)
		mutex_init(&mds->event.log_lock);
		mds->cxlds.dev = dev;
		mds->cxlds.reg_map.host = dev;
		mds->cxlds.cxl_mbox.host = dev;
		mds->cxlds.reg_map.resource = CXL_RESOURCE_NONE;
		mds->cxlds.type = CXL_DEVTYPE_CLASSMEM;