linux-kernel - Re: [PATCH v2] PCI: Fixup the RTIT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20190207150243.GH7268@google.com>
Date:   Thu, 7 Feb 2019 09:02:44 -0600
From:   Bjorn Helgaas <helgaas@...nel.org>
To:     Alexander Shishkin <alexander.shishkin@...ux.intel.com>
Cc:     x86@...nel.org, linux-pci@...r.kernel.org,
        linux-kernel@...r.kernel.org, stable@...r.kernel.org
Subject: Re: [PATCH v2] PCI: Fixup the RTIT_BAR of Intel TH on Denverton

On Thu, Feb 07, 2019 at 03:30:05PM +0200, Alexander Shishkin wrote:
> On Denverton's integration of the Intel(R) Trace Hub (for a reference
> and overview see Documentation/trace/intel_th.txt) the reported size of
> one of its resources (RTIT_BAR) doesn't match its actual size, which
> leads to overlaps with other devices' resources.
> 
> In practice, it overlaps with XHCI MMIO space, which results in the xhci
> driver bailing out after seeing its registers as 0xffffffff, and perceived
> disappearance of all USB devices:
> 
> > intel_th_pci 0000:00:1f.7: enabling device (0004 -> 0006)
> > xhci_hcd 0000:00:15.0: xHCI host controller not responding, assume dead
> > xhci_hcd 0000:00:15.0: xHC not responding in xhci_irq, assume controller is dead
> > xhci_hcd 0000:00:15.0: HC died; cleaning up
> > usb 1-1: USB disconnect, device number 2
> ...
> 
> For this reason, we need to resize the RTIT_BAR on Denverton to its
> actual size, which in this case is 4MB. The corresponding erratum is
> DNV36 at the link below.
> 
> Link: https://www.intel.com/content/dam/www/public/us/en/documents/specification-updates/atom-c3000-family-spec-update.pdf
> Fixes: 5118ccd34780 ("intel_th: pci: Add Denverton SOC support")
> Signed-off-by: Alexander Shishkin <alexander.shishkin@...ux.intel.com>
> Cc: stable@...r.kernel.org

I applied this with the changelog below to pci/enumeration for v5.1,
thanks!

commit 68071384ca08
Author: Alexander Shishkin <alexander.shishkin@...ux.intel.com>
Date:   Thu Feb 7 15:30:05 2019 +0200

    x86/PCI: Fixup RTIT_BAR of Intel Denverton Trace Hub
    
    On Denverton's integration of the Intel(R) Trace Hub (for a reference and
    overview see Documentation/trace/intel_th.txt) the reported size of one of
    its resources (RTIT_BAR) doesn't match its actual size, which leads to
    overlaps with other devices' resources.
    
    In practice, it overlaps with XHCI MMIO space, which results in the xhci
    driver bailing out after seeing its registers as 0xffffffff, and perceived
    disappearance of all USB devices:
    
      intel_th_pci 0000:00:1f.7: enabling device (0004 -> 0006)
      xhci_hcd 0000:00:15.0: xHCI host controller not responding, assume dead
      xhci_hcd 0000:00:15.0: xHC not responding in xhci_irq, assume controller is dead
      xhci_hcd 0000:00:15.0: HC died; cleaning up
      usb 1-1: USB disconnect, device number 2
    
    For this reason, we need to resize the RTIT_BAR on Denverton to its actual
    size, which in this case is 4MB.  The corresponding erratum is DNV36 at the
    link below:
    
      DNV36.       Processor Host Root Complex May Incorrectly Route Memory
                   Accesses to Intel® Trace Hub
    
      Problem:     The Intel® Trace Hub RTIT_BAR (B0:D31:F7 offset 20h) is
                   reported as a 2KB memory range.  Due to this erratum, the
                   processor Host Root Complex will forward addresses from
                   RTIT_BAR to RTIT_BAR + 4MB -1 to Intel® Trace Hub.
    
      Implication: Devices assigned within the RTIT_BAR to RTIT_BAR + 4MB -1
                   space may not function correctly.
    
      Workaround:  A BIOS code change has been identified and may be
                   implemented as a workaround for this erratum.
    
      Status:      No Fix.
    
    Note that 5118ccd34780 ("intel_th: pci: Add Denverton SOC support") updates
    the Trace Hub driver so it claims the Denverton device, but the resource
    overlap exists regardless of whether that driver is loaded or that commit
    is included.
    
    Link: https://www.intel.com/content/dam/www/public/us/en/documents/specification-updates/atom-c3000-family-spec-update.pdf
    Signed-off-by: Alexander Shishkin <alexander.shishkin@...ux.intel.com>
    [bhelgaas: include erratum text, clarify relationship with 5118ccd34780]
    Signed-off-by: Bjorn Helgaas <bhelgaas@...gle.com>
    Cc: stable@...r.kernel.org

> ---
>  arch/x86/pci/fixup.c | 16 ++++++++++++++++
>  1 file changed, 16 insertions(+)
> 
> diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c
> index 30a5111ae5fd..527e69b12002 100644
> --- a/arch/x86/pci/fixup.c
> +++ b/arch/x86/pci/fixup.c
> @@ -635,6 +635,22 @@ static void quirk_no_aersid(struct pci_dev *pdev)
>  DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, PCI_ANY_ID,
>  			      PCI_CLASS_BRIDGE_PCI, 8, quirk_no_aersid);
>  
> +static void quirk_intel_th_dnv(struct pci_dev *dev)
> +{
> +	struct resource *r = &dev->resource[4];
> +
> +	/*
> +	 * Denverton reports 2k of RTIT_BAR (intel_th resource 4), which
> +	 * appears to be 4 MB in reality.
> +	 */
> +	if (r->end == r->start + 0x7ff) {
> +		r->start = 0;
> +		r->end   = 0x3fffff;
> +		r->flags |= IORESOURCE_UNSET;
> +	}
> +}
> +DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x19e1, quirk_intel_th_dnv);
> +
>  #ifdef CONFIG_PHYS_ADDR_T_64BIT
>  
>  #define AMD_141b_MMIO_BASE(x)	(0x80 + (x) * 0x8)
> -- 
> 2.20.1
>