From nobody Thu Apr 2 18:17:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 794D3C6FA82 for ; Wed, 21 Sep 2022 19:49:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229587AbiIUTtV (ORCPT ); Wed, 21 Sep 2022 15:49:21 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58176 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229560AbiIUTtS (ORCPT ); Wed, 21 Sep 2022 15:49:18 -0400 Received: from angie.orcam.me.uk (angie.orcam.me.uk [IPv6:2001:4190:8020::34]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id C35C3A0254; Wed, 21 Sep 2022 12:49:17 -0700 (PDT) Received: by angie.orcam.me.uk (Postfix, from userid 500) id 6251A92009C; Wed, 21 Sep 2022 21:49:16 +0200 (CEST) Received: from localhost (localhost [127.0.0.1]) by angie.orcam.me.uk (Postfix) with ESMTP id 5C5A892009B; Wed, 21 Sep 2022 20:49:16 +0100 (BST) Date: Wed, 21 Sep 2022 20:49:16 +0100 (BST) From: "Maciej W. Rozycki" To: Bjorn Helgaas cc: linux-pci@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v3] PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge Message-ID: User-Agent: Alpine 2.21 (DEB 202 2017-01-01) MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Fix an issue with the Tyan Tomcat IV S1564D system, the BIOS of which=20 does not assign PCI buses beyond #2, where our resource reallocation=20 code preserves the reset default of an I/O BAR assignment outside its=20 upstream PCI-to-PCI bridge's I/O forwarding range: pci 0000:06:08.0: BAR 4: no space for [io size 0x0020] pci 0000:06:08.0: BAR 4: trying firmware assignment [io 0xfce0-0xfcff] pci 0000:06:08.0: BAR 4: assigned [io 0xfce0-0xfcff] [...] pci_bus 0000:06: resource 0 [io 0x2000-0x2fff] Consequently when the device driver tries to access 06:08.0 according to=20 its designated address range it pokes at an unassigned I/O location,=20 likely subtractively decoded by the southbridge and forwarded to ISA,=20 causing the driver to become confused and bail out: uhci_hcd 0000:06:08.0: host system error, PCI problems? uhci_hcd 0000:06:08.0: host controller process error, something bad happene= d! uhci_hcd 0000:06:08.0: host controller halted, very bad! uhci_hcd 0000:06:08.0: HCRESET not completed yet! uhci_hcd 0000:06:08.0: HC died; cleaning up if good luck happens or if bad luck does, an infinite flood of messages: uhci_hcd 0000:06:08.0: host system error, PCI problems? uhci_hcd 0000:06:08.0: host controller process error, something bad happene= d! making the system virtually unusable. This is because we try to retain any BAR assignment the firmware may=20 have made here, which may be necessary for devices on the root bus with=20 some systems, but cannot work for devices that are behind a PCI-to-PCI=20 bridge where the BAR assignment is outside the upstream bridge's=20 forwarding range. Make sure then for a device behind a PCI-to-PCI bridge that any firmware=20 assignment is within the bridge's relevant forwarding window or do not=20 restore the assignment, fixing the system concerned as follows: pci 0000:06:08.0: BAR 4: no space for [io size 0x0020] pci 0000:06:08.0: BAR 4: failed to assign [io 0xfce0-0xfcff] [...] pci 0000:06:08.0: BAR 4: assigned [io 0x2000-0x201f] and making device 06:08.0 work correctly. Cf. Signed-off-by: Maciej W. Rozycki Link: https://lore.kernel.org/r/alpine.DEB.2.21.2203012338460.46819@angie.o= rcam.me.uk Fixes: 58c84eda0756 ("PCI: fall back to original BIOS BAR addresses") Cc: stable@vger.kernel.org # v2.6.35+ --- Hi Bjorn, I have trimmed the change description down as you requested and left the=20 change proper unmodified, as discussed in my earlier response. Let me know if you have any other concerns with this fix. Maciej Changes from v2: - Change description trimmed and rephrased, link to a full bootstrap log=20 earlier on in discussion added. Changes from v1: - Do restore firmware BAR assignments behind a PCI-PCI bridge, but only if=20 within the bridge's forwarding window. - Update the change description and heading accordingly (was: PCI: Do not=20 restore firmware BAR assignments behind a PCI-PCI bridge). --- drivers/pci/setup-res.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) linux-pci-setup-res-fw-address-nobridge.diff Index: linux-macro/drivers/pci/setup-res.c =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D --- linux-macro.orig/drivers/pci/setup-res.c +++ linux-macro/drivers/pci/setup-res.c @@ -212,9 +212,19 @@ static int pci_revert_fw_address(struct res->end =3D res->start + size - 1; res->flags &=3D ~IORESOURCE_UNSET; =20 + /* + * If we're behind a P2P or CardBus bridge, make sure we're + * inside the relevant forwarding window, or otherwise the + * assignment must have been bogus and accesses intended for + * the range assigned would not reach the device anyway. + * On the root bus accept anything under the assumption the + * host bridge will let it through. + */ root =3D pci_find_parent_resource(dev, res); if (!root) { - if (res->flags & IORESOURCE_IO) + if (dev->bus->parent) + return -ENXIO; + else if (res->flags & IORESOURCE_IO) root =3D &ioport_resource; else root =3D &iomem_resource;