linux-kernel - [PATCH v4 1/2] PCI: Fix isolated PCI function probing with ARI and SR-IOV

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20251023-ari_no_bus_dev-v4-1-8482e2ed10bd@linux.ibm.com>
Date: Thu, 23 Oct 2025 17:20:41 +0200
From: Niklas Schnelle <schnelle@...ux.ibm.com>
To: Bjorn Helgaas <bhelgaas@...gle.com>
Cc: Jan Kiszka <jan.kiszka@...mens.com>, Huacai Chen <chenhuacai@...nel.org>,
        linux-s390 <linux-s390@...r.kernel.org>, loongarch@...ts.linux.dev,
        Farhan Ali <alifm@...ux.ibm.com>,
        Matthew Rosato <mjrosato@...ux.ibm.com>,
        Tianrui Zhao <zhaotianrui@...ngson.cn>,
        Gerald Schaefer <gerald.schaefer@...ux.ibm.com>,
        Heiko Carstens <hca@...ux.ibm.com>, Vasily Gorbik <gor@...ux.ibm.com>,
        Alexander Gordeev <agordeev@...ux.ibm.com>,
        Sven Schnelle <svens@...ux.ibm.com>,
        Christian Borntraeger <borntraeger@...ux.ibm.com>,
        Gerd Bayer <gbayer@...ux.ibm.com>, linux-s390@...r.kernel.org,
        linux-kernel@...r.kernel.org, linux-pci@...r.kernel.org,
        jailhouse-dev@...glegroups.com,
        Niklas Schnelle <schnelle@...ux.ibm.com>
Subject: [PATCH v4 1/2] PCI: Fix isolated PCI function probing with ARI and
 SR-IOV

When the isolated PCI function probing mechanism is used in conjunction
with ARI or SR-IOV it may not find all available PCI functions. In the
case of ARI the problem is that next_ari_fn() always returns -ENODEV if
dev is NULL and thus if fn 0 is missing the scan stops.

For SR-IOV things are more complex. Here the problem is that the check
for multifunction may fail. One example where this can occur is if the
first passed-through function is a VF with devfn 8. Now in
pci_scan_slot() this means it is fn 0 and thus multifunction doesn't get
set. Since VFs don't get multifunction set via PCI_HEADER_TYPE_MFD it
remains unset and probing stops even if there is a devfn 9.

Now at the moment both of these issues are hidden on s390. The first one
because ARI is detected as disabled as struct pci_bus's self is NULL
even though firmware does enable and use ARI. The second issue is hidden
as a side effect of commit 25f39d3dcb48 ("s390/pci: Ignore RID for
isolated VFs"). This is because VFs are either put on their own virtual
bus if the parent PF is not passed-through to the same instance or VFs
are hotplugged once SR-IOV is enabled on the parent PF and then
pci_scan_single_device() is used.

Still especially the first issue prevents correct detection of ARI and
the second might be a problem for other users of isolated function
probing. Fix both issues by keeping things as simple as possible. If
isolated function probing is enabled simply scan every possible devfn.

Fixes: 189c6c33ff42 ("PCI: Extend isolated function probing to s390")
Link: https://lore.kernel.org/linux-pci/d3f11e8562f589ddb2c1c83e74161bd8948084c3.camel@linux.ibm.com/
Signed-off-by: Niklas Schnelle <schnelle@...ux.ibm.com>
---
 drivers/pci/probe.c | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index 0ce98e18b5a876afe72af35a9f4a44d598e8d500..13495b12fbcfae4b890bbd4b2f913742adf6dfed 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -2808,16 +2808,18 @@ static int next_ari_fn(struct pci_bus *bus, struct pci_dev *dev, int fn)
 	return next_fn;
 }

-static int next_fn(struct pci_bus *bus, struct pci_dev *dev, int fn)
+static int next_fn(struct pci_bus *bus, struct pci_dev *dev, int fn, bool isolated)
 {
-	if (pci_ari_enabled(bus))
-		return next_ari_fn(bus, dev, fn);
+	if (!isolated) {
+		if (pci_ari_enabled(bus))
+			return next_ari_fn(bus, dev, fn);

+		/* only multifunction devices may have more functions */
+		if (dev && !dev->multifunction)
+			return -ENODEV;
+	}
 	if (fn >= 7)
 		return -ENODEV;
-	/* only multifunction devices may have more functions */
-	if (dev && !dev->multifunction)
-		return -ENODEV;

 	return fn + 1;
 }
@@ -2857,12 +2859,14 @@ static int only_one_child(struct pci_bus *bus)
  */
 int pci_scan_slot(struct pci_bus *bus, int devfn)
 {
+	bool isolated_functions;
 	struct pci_dev *dev;
 	int fn = 0, nr = 0;

 	if (only_one_child(bus) && (devfn > 0))
 		return 0; /* Already scanned the entire slot */

+	isolated_functions = hypervisor_isolated_pci_functions();
 	do {
 		dev = pci_scan_single_device(bus, devfn + fn);
 		if (dev) {
@@ -2876,10 +2880,10 @@ int pci_scan_slot(struct pci_bus *bus, int devfn)
 			 * a hypervisor that passes through individual PCI
 			 * functions.
 			 */
-			if (!hypervisor_isolated_pci_functions())
+			if (!isolated_functions)
 				break;
 		}
-		fn = next_fn(bus, dev, fn);
+		fn = next_fn(bus, dev, fn, isolated_functions);
 	} while (fn >= 0);

 	/* Only one slot has PCIe device */

-- 
2.48.1