i2c-imc-skylake: split the submission into a PCI patch and the driver
The driver reached the PCU function's config space by walking the ACPI MCFG
table and mapping the ECAM page itself. That is one leaf driver deciding
config-space policy, and no other driver in mainline does it, so it was the
single most likely reason for a NAK.
Move that decision where it belongs: the upstream series is now two patches,
a PCI/x86 accessor that forces the memory-mapped path with the core's
locking, and this driver on top of it. Reviewers on each side now get
something they can act on, and get_maintainer.pl selects the PCI and x86
people by itself.
Correctness work in the same pass:
- the completion bits are latched, so a command the engine never accepted
was indistinguishable from a completed one and returned the previous
transaction's data as valid. Require a positive sign that the engine
acted on the command;
- compare the command registers after every transfer against what the
driver left in them and fail with -EAGAIN on a mismatch. The original
iMC driver had this check and it is what makes an unarbitrated system
detectable instead of silently wrong;
- use the i2c core's suspended-adapter mechanism rather than a private
flag and -EHOSTDOWN;
- use devm_mutex_init(), drop the unnecessary pci_enable_device(), and
return -ENODEV rather than -EPERM from the default-off gate, which was
printing a driver-core error on every boot;
- mask GO when restoring a saved command word.
Stop attributing the dropped CF8/CFC write to System Management Mode. The
only evidence was a boot log line naming the access method, which says
nothing about who filters the write. tools/probe-cf8-write.sh is there to
settle it with an MSR_SMI_COUNT measurement.
Add Documentation/i2c/busses/i2c-imc-skylake.rst, which every other PC SMBus
driver has and which was explicitly asked for on the 2020 iMC thread, the
tools/ scripts for the hardware measurements the submission still owes, and
compat/pci-mmcfg-compat.h so the driver still builds out-of-tree against a
kernel without the new accessor while the source stays byte-identical to the
submitted patch.
This commit is contained in:
Simone
@@ -0,0 +1,66 @@
|
||||
# Hardware measurements still owed to the submission
|
||||
|
||||
Three scripts, meant to be run by hand on an X299 (or Cascade Lake-X) system
|
||||
with the PCU function `8086:2085`. None of them is run by CI and none is run by
|
||||
`make test`.
|
||||
|
||||
Output of all three belongs in the cover letter or in a reply on the list, as
|
||||
raw numbers. Do not paraphrase them.
|
||||
|
||||
| Script | Answers | Writes to hardware |
|
||||
| --- | --- | --- |
|
||||
| `watch-engine.sh` | Is firmware using the engine on this system? | no |
|
||||
| `dump-pcu-config.sh` | Which PCU registers move on their own? Is there a TSOD polling control? | no |
|
||||
| `probe-cf8-write.sh` | Is the CF8/CFC write really dropped, and does it raise an SMI? | **yes**, requires `--i-understand` |
|
||||
|
||||
## 1. `watch-engine.sh` — foreign activity (read-only)
|
||||
|
||||
Samples the six per-channel registers and reports every change that this
|
||||
system's Linux side did not cause. Run it with the driver **unloaded**, so that
|
||||
anything observed is firmware.
|
||||
|
||||
```bash
|
||||
sudo ./tools/watch-engine.sh --seconds 3600
|
||||
```
|
||||
|
||||
What the cover letter needs: a run of at least one hour, ideally across a
|
||||
suspend/resume cycle, with the observed change count. A non-zero count on a
|
||||
system means the driver must not be loaded there, and is itself a result worth
|
||||
reporting.
|
||||
|
||||
## 2. `dump-pcu-config.sh` — register survey (read-only)
|
||||
|
||||
Dumps the function's 4 KB config space twice and diffs them, then prints the
|
||||
neighbourhood of the offsets that matter.
|
||||
|
||||
```bash
|
||||
sudo ./tools/dump-pcu-config.sh --settle 10
|
||||
```
|
||||
|
||||
This is the search for the open item F2: the Broadwell-E iMC driver stops the
|
||||
PCU's TSOD polling for the duration of a transfer by writing 0 to `TSODCNTL`
|
||||
at offset `0xe0` of its PCU function, waiting 10 ms for in-flight transactions
|
||||
to drain, and restoring the value afterwards. No equivalent register has been
|
||||
identified on `8086:2085`. A field that changes on its own with a fixed cadence
|
||||
is the first candidate.
|
||||
|
||||
## 3. `probe-cf8-write.sh` — the dropped write (WRITES TO HARDWARE)
|
||||
|
||||
This is the only script that writes. It changes the register/offset field of a
|
||||
command register while the GO bit is clear, which does not start an SMBus
|
||||
transaction, then reads it back and reports whether the write stuck. It also
|
||||
reads `MSR_SMI_COUNT` (0x34) on every CPU before and after.
|
||||
|
||||
```bash
|
||||
sudo ./tools/probe-cf8-write.sh --i-understand
|
||||
```
|
||||
|
||||
Two results matter:
|
||||
|
||||
* the value does **not** read back → the claim "CF8/CFC writes to this function
|
||||
do not take effect" is confirmed on the tested board;
|
||||
* the SMI delta is **0** → the behaviour is not System Management Mode, and the
|
||||
driver's comments and the cover letter must not say it is.
|
||||
|
||||
Requirements: `msr-tools` (`rdmsr`), `pciutils` (`setpci`, `lspci`), and the
|
||||
`msr` module (`modprobe msr`).
|
||||
Executable
+90
@@ -0,0 +1,90 @@
|
||||
# Shared helpers for the tools/ scripts. Sourced, not executed.
|
||||
# shellcheck shell=bash
|
||||
|
||||
PCU_VENDOR_DEVICE=8086:2085
|
||||
|
||||
# Per-channel register offsets in the PCU function's config space.
|
||||
REG_CH0_DATA=0x9c
|
||||
REG_CH1_DATA=0xa0
|
||||
REG_CH0_STAT=0xa8
|
||||
REG_CH1_STAT=0xac
|
||||
REG_CH0_CTRL=0xb4
|
||||
REG_CH1_CTRL=0xb8
|
||||
|
||||
ALL_REGS=(
|
||||
"ch0.DATA:$REG_CH0_DATA"
|
||||
"ch1.DATA:$REG_CH1_DATA"
|
||||
"ch0.STAT:$REG_CH0_STAT"
|
||||
"ch1.STAT:$REG_CH1_STAT"
|
||||
"ch0.CTRL:$REG_CH0_CTRL"
|
||||
"ch1.CTRL:$REG_CH1_CTRL"
|
||||
)
|
||||
|
||||
die()
|
||||
{
|
||||
echo "error: $*" >&2
|
||||
exit 1
|
||||
}
|
||||
|
||||
require_root()
|
||||
{
|
||||
((EUID == 0)) || die "run as root"
|
||||
}
|
||||
|
||||
require_cmd()
|
||||
{
|
||||
local cmd
|
||||
for cmd in "$@"; do
|
||||
command -v "$cmd" >/dev/null || die "missing command: $cmd"
|
||||
done
|
||||
}
|
||||
|
||||
# Print the domain:bus:dev.fn of the PCU function, or fail.
|
||||
find_pcu()
|
||||
{
|
||||
local bdf
|
||||
|
||||
bdf=$(lspci -Dn -d "$PCU_VENDOR_DEVICE" | awk 'NR == 1 { print $1 }')
|
||||
[[ -n "$bdf" ]] || die "PCI function $PCU_VENDOR_DEVICE not found"
|
||||
printf '%s\n' "$bdf"
|
||||
}
|
||||
|
||||
# read_reg <bdf> <offset> -> 32-bit value as 0x%08x
|
||||
read_reg()
|
||||
{
|
||||
local bdf=$1 off=$2 raw
|
||||
|
||||
raw=$(setpci -s "$bdf" "$off.L") || die "setpci read $off failed"
|
||||
printf '0x%08x\n' "$((16#$raw))"
|
||||
}
|
||||
|
||||
# Snapshot every engine register into a "name=value" list.
|
||||
snapshot_regs()
|
||||
{
|
||||
local bdf=$1 entry name off
|
||||
|
||||
for entry in "${ALL_REGS[@]}"; do
|
||||
name=${entry%%:*}
|
||||
off=${entry##*:}
|
||||
printf '%s=%s\n' "$name" "$(read_reg "$bdf" "$off")"
|
||||
done
|
||||
}
|
||||
|
||||
# Sum of MSR_SMI_COUNT (0x34) across all CPUs. Prints -1 if unavailable.
|
||||
read_smi_count()
|
||||
{
|
||||
local cpu total=0 value
|
||||
|
||||
command -v rdmsr >/dev/null || { echo -1; return; }
|
||||
for cpu in /dev/cpu/[0-9]*; do
|
||||
[[ -e "$cpu/msr" ]] || continue
|
||||
value=$(rdmsr -p "${cpu##*/}" -d 0x34 2>/dev/null) || continue
|
||||
total=$((total + value))
|
||||
done
|
||||
printf '%s\n' "$total"
|
||||
}
|
||||
|
||||
driver_is_loaded()
|
||||
{
|
||||
lsmod | awk '$1 == "i2c_imc_skylake" { found = 1 } END { exit !found }'
|
||||
}
|
||||
Executable
+65
@@ -0,0 +1,65 @@
|
||||
#!/usr/bin/env bash
|
||||
# Dump the PCU function's config space twice and report what moved on its own.
|
||||
# Read-only. Used to look for a TSOD polling control register (see tools/README.md).
|
||||
set -euo pipefail
|
||||
|
||||
# shellcheck source=tools/common.sh
|
||||
source "$(dirname "$(readlink -f "$0")")/common.sh"
|
||||
|
||||
SETTLE=10
|
||||
OUTDIR=${OUTDIR:-.}
|
||||
|
||||
while (($#)); do
|
||||
case $1 in
|
||||
--settle) SETTLE=$2; shift 2 ;;
|
||||
--outdir) OUTDIR=$2; shift 2 ;;
|
||||
-h|--help)
|
||||
echo "usage: $0 [--settle SECONDS] [--outdir DIR]"
|
||||
exit 0
|
||||
;;
|
||||
*) die "unknown argument: $1" ;;
|
||||
esac
|
||||
done
|
||||
|
||||
require_root
|
||||
require_cmd lspci awk
|
||||
|
||||
BDF=$(find_pcu)
|
||||
first=$(mktemp)
|
||||
second=$(mktemp)
|
||||
trap 'rm -f "$first" "$second"' EXIT
|
||||
|
||||
echo "device: $BDF"
|
||||
if driver_is_loaded; then
|
||||
echo "warning: i2c-imc-skylake is loaded; unload it first for a clean survey." >&2
|
||||
fi
|
||||
|
||||
lspci -s "$BDF" -xxxx > "$first"
|
||||
echo "first dump taken, waiting ${SETTLE}s..."
|
||||
sleep "$SETTLE"
|
||||
lspci -s "$BDF" -xxxx > "$second"
|
||||
|
||||
stamp=$(date +%Y%m%d-%H%M%S)
|
||||
cp "$second" "$OUTDIR/pcu-config-$stamp.txt"
|
||||
echo "full dump saved to $OUTDIR/pcu-config-$stamp.txt"
|
||||
echo
|
||||
|
||||
echo "=== bytes that changed on their own over ${SETTLE}s ==="
|
||||
if diff -u "$first" "$second" | grep -E '^[+-][0-9a-f]{3}:' ; then
|
||||
echo
|
||||
echo "A field with a steady cadence is the first candidate for a TSOD"
|
||||
echo "polling control. Compare with the Broadwell-E driver's TSODCNTL (0xe0)."
|
||||
else
|
||||
echo "(none: the whole config space was stable)"
|
||||
fi
|
||||
echo
|
||||
|
||||
echo "=== engine registers ==="
|
||||
snapshot_regs "$BDF"
|
||||
echo
|
||||
|
||||
echo "=== neighbourhood of the Broadwell TSODCNTL offset (0xe0) ==="
|
||||
awk '/^0[cdef]0:/ { print }' "$second"
|
||||
echo
|
||||
echo "=== the driver's register window (0x90-0xbf) ==="
|
||||
awk '/^0[9ab]0:/ { print }' "$second"
|
||||
Executable
+128
@@ -0,0 +1,128 @@
|
||||
#!/usr/bin/env bash
|
||||
#
|
||||
# WRITES TO HARDWARE. Answers two questions the submission still owes:
|
||||
#
|
||||
# 1. does a CF8/CFC dword write to the iMC SMBus command register take
|
||||
# effect on this board?
|
||||
# 2. does that write raise an SMI?
|
||||
#
|
||||
# It modifies only the register/offset field, DATA[7:0], while the GO bit is
|
||||
# clear, so no SMBus transaction is issued, and it restores the original value
|
||||
# on every exit path. It refuses to run if the engine is busy, if a transaction
|
||||
# is armed, if TSOD is active, or if the driver is loaded.
|
||||
#
|
||||
set -euo pipefail
|
||||
|
||||
# shellcheck source=tools/common.sh
|
||||
source "$(dirname "$(readlink -f "$0")")/common.sh"
|
||||
|
||||
GO_BIT=$((1 << 19))
|
||||
TSOD_ACTIVE_BIT=$((1 << 20))
|
||||
STAT_BUSY=1
|
||||
|
||||
CHANNEL=0
|
||||
CONFIRMED=false
|
||||
|
||||
while (($#)); do
|
||||
case $1 in
|
||||
--i-understand) CONFIRMED=true; shift ;;
|
||||
--channel) CHANNEL=$2; shift 2 ;;
|
||||
-h|--help)
|
||||
sed -n '3,14p' "$0"
|
||||
echo "usage: $0 --i-understand [--channel 0|1]"
|
||||
exit 0
|
||||
;;
|
||||
*) die "unknown argument: $1" ;;
|
||||
esac
|
||||
done
|
||||
|
||||
if ! $CONFIRMED; then
|
||||
cat >&2 <<-'EOF'
|
||||
This script writes to a register of the memory controller's SMBus engine.
|
||||
|
||||
It is written to be a no-op for the bus: the GO bit stays clear, so no
|
||||
SMBus transaction is issued, and the original register value is restored
|
||||
before the script exits. It is still a write to firmware-owned hardware.
|
||||
|
||||
Re-run with --i-understand to proceed.
|
||||
EOF
|
||||
exit 2
|
||||
fi
|
||||
|
||||
require_root
|
||||
require_cmd lspci setpci awk
|
||||
|
||||
case $CHANNEL in
|
||||
0) REG_DATA=$REG_CH0_DATA; REG_STAT=$REG_CH0_STAT ;;
|
||||
1) REG_DATA=$REG_CH1_DATA; REG_STAT=$REG_CH1_STAT ;;
|
||||
*) die "channel must be 0 or 1" ;;
|
||||
esac
|
||||
|
||||
if ! command -v rdmsr >/dev/null; then
|
||||
echo "warning: rdmsr not found, the SMI question will stay unanswered." >&2
|
||||
echo " install msr-tools and 'modprobe msr' for the full result." >&2
|
||||
fi
|
||||
|
||||
driver_is_loaded && die "unload i2c-imc-skylake first"
|
||||
|
||||
BDF=$(find_pcu)
|
||||
echo "device: $BDF"
|
||||
echo "channel: $CHANNEL (DATA at $REG_DATA, STATUS at $REG_STAT)"
|
||||
echo
|
||||
|
||||
original=$(read_reg "$BDF" "$REG_DATA")
|
||||
status=$(read_reg "$BDF" "$REG_STAT")
|
||||
echo "DATA before: $original"
|
||||
echo "STATUS before: $status"
|
||||
|
||||
((original & GO_BIT)) && die "GO is set: a transaction is armed, refusing"
|
||||
((original & TSOD_ACTIVE_BIT)) &&
|
||||
die "TSOD_ACTIVE is set: firmware is using the engine, refusing"
|
||||
((status & STAT_BUSY)) && die "engine is BUSY, refusing"
|
||||
|
||||
restore()
|
||||
{
|
||||
setpci -s "$BDF" "$REG_DATA.L=$(printf '%08x' "$original")" || true
|
||||
echo "DATA restored to $(read_reg "$BDF" "$REG_DATA")"
|
||||
}
|
||||
trap restore EXIT
|
||||
|
||||
# Flip the low byte to something that is certainly different, GO still clear.
|
||||
probe=$(( (original & ~0xff) | ( ((original & 0xff) ^ 0x5a) & 0xff ) ))
|
||||
probe_hex=$(printf '0x%08x' "$probe")
|
||||
|
||||
smi_before=$(read_smi_count)
|
||||
echo
|
||||
echo "writing $probe_hex through CF8/CFC (setpci)..."
|
||||
setpci -s "$BDF" "$REG_DATA.L=$(printf '%08x' "$probe")"
|
||||
readback=$(read_reg "$BDF" "$REG_DATA")
|
||||
smi_after=$(read_smi_count)
|
||||
|
||||
echo "DATA after write: $readback"
|
||||
echo
|
||||
|
||||
echo "=== result 1: did the write take effect? ==="
|
||||
if [[ "$readback" == "$probe_hex" ]]; then
|
||||
echo "STUCK - the CF8/CFC write reached the register."
|
||||
echo " The premise of the ECAM patch does not hold on this board;"
|
||||
echo " do not claim CF8/CFC writes are dropped."
|
||||
else
|
||||
echo "DROPPED - wrote $probe_hex, read back $readback."
|
||||
echo " Confirms that CF8/CFC writes to this function do not"
|
||||
echo " take effect on this board."
|
||||
fi
|
||||
echo
|
||||
|
||||
echo "=== result 2: was an SMI raised? ==="
|
||||
if ((smi_before < 0 || smi_after < 0)); then
|
||||
echo "UNKNOWN - MSR_SMI_COUNT not readable (need msr-tools + modprobe msr)."
|
||||
else
|
||||
delta=$((smi_after - smi_before))
|
||||
echo "MSR_SMI_COUNT: $smi_before -> $smi_after (delta $delta)"
|
||||
if ((delta == 0)); then
|
||||
echo "NO SMI - the behaviour must not be attributed to SMM."
|
||||
else
|
||||
echo "SMI RAISED - System Management Mode is involved; say so, with"
|
||||
echo " this number, in the changelog."
|
||||
fi
|
||||
fi
|
||||
Executable
+71
@@ -0,0 +1,71 @@
|
||||
#!/usr/bin/env bash
|
||||
# Report changes to the iMC SMBus engine registers that Linux did not cause.
|
||||
# Read-only. Run with the driver unloaded so anything observed is firmware.
|
||||
set -euo pipefail
|
||||
|
||||
# shellcheck source=tools/common.sh
|
||||
source "$(dirname "$(readlink -f "$0")")/common.sh"
|
||||
|
||||
SECONDS_TOTAL=3600
|
||||
INTERVAL=1
|
||||
|
||||
while (($#)); do
|
||||
case $1 in
|
||||
--seconds) SECONDS_TOTAL=$2; shift 2 ;;
|
||||
--interval) INTERVAL=$2; shift 2 ;;
|
||||
-h|--help)
|
||||
echo "usage: $0 [--seconds N] [--interval N]"
|
||||
exit 0
|
||||
;;
|
||||
*) die "unknown argument: $1" ;;
|
||||
esac
|
||||
done
|
||||
|
||||
require_root
|
||||
require_cmd lspci setpci awk
|
||||
|
||||
BDF=$(find_pcu)
|
||||
|
||||
if driver_is_loaded; then
|
||||
echo "warning: i2c-imc-skylake is loaded; changes may be caused by Linux." >&2
|
||||
echo " unload it for a clean firmware-activity measurement." >&2
|
||||
fi
|
||||
|
||||
echo "device: $BDF"
|
||||
echo "duration: ${SECONDS_TOTAL}s, sampling every ${INTERVAL}s"
|
||||
echo "started: $(date -Is)"
|
||||
echo
|
||||
|
||||
mapfile -t previous < <(snapshot_regs "$BDF")
|
||||
printf 'baseline: %s\n' "${previous[*]}"
|
||||
|
||||
changes=0
|
||||
samples=0
|
||||
deadline=$((SECONDS + SECONDS_TOTAL))
|
||||
|
||||
while ((SECONDS < deadline)); do
|
||||
sleep "$INTERVAL"
|
||||
mapfile -t current < <(snapshot_regs "$BDF")
|
||||
((samples++))
|
||||
|
||||
for i in "${!current[@]}"; do
|
||||
if [[ "${current[i]}" != "${previous[i]}" ]]; then
|
||||
printf '%s CHANGE %s -> %s\n' \
|
||||
"$(date -Is)" "${previous[i]}" "${current[i]}"
|
||||
((changes++))
|
||||
fi
|
||||
done
|
||||
previous=("${current[@]}")
|
||||
done
|
||||
|
||||
echo
|
||||
echo "finished: $(date -Is)"
|
||||
echo "samples: $samples"
|
||||
echo "changes: $changes"
|
||||
echo
|
||||
if ((changes == 0)); then
|
||||
echo "RESULT: no foreign activity observed on this system over ${SECONDS_TOTAL}s."
|
||||
else
|
||||
echo "RESULT: the engine is in use by something other than Linux."
|
||||
echo " Do not load i2c-imc-skylake on this system."
|
||||
fi
|
||||
Reference in New Issue
Block a user