i2c-imc-skylake: retract the CF8/CFC claim, harden the state machine

v2 said firmware filters CF8/CFC config writes to this function and that the registers are reachable only through ECAM. That was never tested; the only evidence was the boot line "PCI: Using configuration type 1", which names the accessor and says nothing about a write failing. Measured on the board, driver unloaded: # setpci -s 16:1e.5 9c.L=20085002 # read SPD 0x50 register 0x02 # setpci -s 16:1e.5 9c.L 20005002 # GO consumed by the engine # setpci -s 16:1e.5 a8.L 0000500c # READ_DONE, no error # setpci -s 16:1e.5 b4.L 0000000c # SPD byte 2, DDR4 type code The command executes and returns correct data through the ordinary accessors, and MSR_SMI_COUNT does not move across it. So the driver now uses pci_read_config_dword() and pci_write_config_dword(), the submission is a single patch again, and nothing in it touches the PCI core. The cover letter retracts the claim explicitly rather than dropping it quietly, because v2 was posted with it. Correctness work in the same pass: - the completion bits are latched, so a command word that never reaches the register is indistinguishable from a completed transfer and the caller gets the previous transaction's data. Read the command word back and require it to be the one just written; the engine only ever clears GO, which the measurement above shows directly; - compare the command registers after every transfer against what the driver left in them and fail with -EAGAIN on a mismatch. The original iMC driver had this check and it is what makes an unarbitrated system detectable instead of silently wrong; - use the i2c core's suspended-adapter mechanism rather than a private flag and -EHOSTDOWN; - use devm_mutex_init(), drop the unnecessary pci_enable_device(), and return -ENODEV rather than -EPERM from the default-off gate, which was printing a driver-core error on every boot; - mask GO when restoring a saved command word. An earlier version of the latched-DONE check required the GO bit to be seen set or the status word to change. That was wrong: repeated transfers with the same outcome leave STATUS bit for bit identical, and GO is consumed faster than a config read-back can observe it. It produced false positives on 3 of 15 smoke-test items before being replaced. Add Documentation/i2c/busses/i2c-imc-skylake.rst, which every other PC SMBus driver has and which was asked for on the 2020 iMC thread, and the tools/ scripts for the hardware measurements: probe-cf8-write.sh and probe-cf8-transaction.sh produced the result above, dump-pcu-config.sh is the search for a TSOD polling control, watch-engine.sh is the firmware activity measurement. Smoke test on the X299 system with the current module: 15 checks, 0 failures, dmesg clean.
2026-07-26 19:51:44 +02:00
parent 3cd1d6e0a6
commit 88a8b7eb27
13 changed files with 320 additions and 651 deletions
@@ -43,8 +43,6 @@ jobs:
          sudo apt-get update
          sudo apt-get install -y build-essential clang llvm linux-headers-$(uname -r)
      # A stock kernel has no pci_mmcfg_read_config() yet, so this exercises
      # the compat/ shim path. The in-tree job below covers the real thing.
      - name: Build module
        run: make W=1 KCFLAGS=-W ${{ matrix.make_args }}
@@ -69,7 +67,7 @@ jobs:
          if-no-files-found: error
  in-tree:
-    name: Current i2c-host integration (2-patch series)
+    name: Current i2c-host integration
    runs-on: ubuntu-latest
    timeout-minutes: 45
@@ -91,12 +89,6 @@ jobs:
      - name: Prepare current maintainer tree
        run: |
          git clone --depth=1 --branch i2c/i2c-host "$I2C_TREE" linux-i2c
          # Patch 1/2: the PCI/x86 accessor the driver depends on. If this
          # stops applying, the tracked copy is stale and must be refreshed
          # from the kernel tree - that is a real failure, not CI noise.
          git -C linux-i2c apply --verbose \
            ../docs/submission/0001-pci-mmcfg-accessor.patch
          # Patch 2/2: the driver itself.
          cp i2c-imc-skylake.c linux-i2c/drivers/i2c/busses/
          cat docs/submission/Kconfig.kernel >> linux-i2c/drivers/i2c/busses/Kconfig
          printf '%s\n' 'obj-$(CONFIG_I2C_IMC_SKYLAKE) += i2c-imc-skylake.o' \
@@ -110,15 +102,10 @@ jobs:
          scripts/config --file ../linux-out/.config --enable I2C --module I2C_IMC_SKYLAKE
          make O=../linux-out olddefconfig
          grep '^CONFIG_I2C_IMC_SKYLAKE=m' ../linux-out/.config
          grep '^CONFIG_PCI_MMCONFIG=y' ../linux-out/.config
-      - name: Build the series in-tree
+      - name: Build driver in-tree
        working-directory: linux-i2c
-        run: |
+        run: make O=../linux-out W=1 drivers/i2c/busses/i2c-imc-skylake.o
          make O=../linux-out W=1 \
            drivers/pci/access.o \
            arch/x86/pci/mmconfig-shared.o \
            drivers/i2c/busses/i2c-imc-skylake.o
      - name: Build arm64 COMPILE_TEST with Clang
        working-directory: linux-i2c
@@ -130,15 +117,12 @@ jobs:
          make O=../linux-out-arm64 ARCH=arm64 LLVM=1 olddefconfig
          grep '^CONFIG_I2C_IMC_SKYLAKE=m' ../linux-out-arm64/.config
          make O=../linux-out-arm64 ARCH=arm64 LLVM=1 W=1 \
            drivers/pci/access.o \
            drivers/i2c/busses/i2c-imc-skylake.o
      - name: Run Sparse in-tree
        working-directory: linux-i2c
        run: |
          make O=../linux-out C=2 CF=-D__CHECK_ENDIAN__ \
            drivers/pci/access.o \
            arch/x86/pci/mmconfig-shared.o \
            drivers/i2c/busses/i2c-imc-skylake.o
      - name: Run current-tree checkpatch
@@ -146,8 +130,6 @@ jobs:
        run: |
          scripts/checkpatch.pl --strict --no-tree -f \
            drivers/i2c/busses/i2c-imc-skylake.c
          scripts/checkpatch.pl --strict \
            ../docs/submission/0001-pci-mmcfg-accessor.patch
      - name: Build the documentation
        working-directory: linux-i2c
@@ -6,17 +6,6 @@ INSTALL_MOD_PATH ?= $(DESTDIR)
 INSTALL_MOD_DIR  ?= updates
 PWD    := $(shell pwd)
 # The driver calls pci_mmcfg_{read,write}_config(), added by patch 1/2 of the
 # upstream series. Against a kernel that does not have them yet, force-include
 # the out-of-tree shim so the driver source stays identical to the submitted
 # patch. See compat/pci-mmcfg-compat.h.
 IMC_NEED_COMPAT := $(shell grep -qs pci_mmcfg_read_config \
 	$(srctree)/include/linux/pci.h || echo y)
 ifeq ($(IMC_NEED_COMPAT),y)
 ccflags-y += -include $(src)/compat/pci-mmcfg-compat.h
 $(warning i2c-imc-skylake: target kernel lacks pci_mmcfg_read_config(); building with the out-of-tree compat shim)
 endif
 all:
 	$(MAKE) -C $(KDIR) M=$(PWD) modules
@@ -31,14 +31,8 @@ Patch series v2 is archived on
 [lore.kernel.org](https://lore.kernel.org/linux-i2c/[email protected]/T/#t)
 and received no replies.
-The next posting is an RFC in **two patches**:
+The next posting is `[PATCH v4]`, a single patch. See
-
+[docs/submission/cover-letter.txt](docs/submission/cover-letter.txt).
 1. a PCI/x86 change adding `pci_mmcfg_read_config()` / `pci_mmcfg_write_config()`,
   which force config access through the memory-mapped (ECAM) path;
 2. this driver, which uses them.
 The split exists because those are two decisions belonging to two different
 sets of maintainers. See [docs/submission/cover-letter.txt](docs/submission/cover-letter.txt).
 **No iMC I2C driver has ever been merged into mainline.** Andy Lutomirski's
 `i2c_imc` (2013-2016) and Stefan Schaeckeler's 2020 Broadwell rewrite both
@@ -47,21 +41,29 @@ either; it detects it. See the cover letter for what that means in practice.
 ---
-## Why the ECAM path
+## Retracted: the CF8/CFC claim
-The engine's registers are at config offsets `0x9C`-`0xB8`, inside the first
+Up to v3 this project claimed that firmware filters CF8/CFC config writes to
-256 bytes. On x86 that range is dispatched to `raw_pci_ops`, which is CF8/CFC
+the PCU function, and that the registers were reachable only through the
-whenever configuration type 1 is usable; the memory-mapped path is only used
+memory-mapped window. **That was wrong.** It was never tested directly; the
-from `0x100` upwards. On the tested X299 board a dword written through CF8/CFC
+only evidence was a boot log line naming the access method.
 to the command register does not take effect: the register reads back
 unchanged, the GO bit is never consumed, no transaction is issued. The same
 write through ECAM works.
-What drops the write is **not known**. Earlier revisions of this project
+Measured on this board, driver unloaded:
-attributed it to System Management Mode; the only evidence was a boot log line
+
-naming the access method, which says nothing about who filters the write, so
+```console
-that claim has been removed. [tools/probe-cf8-write.sh](tools/probe-cf8-write.sh)
+# setpci -s 16:1e.5 9c.L=20085002    # read SPD 0x50, register 0x02
-is there to settle it with an `MSR_SMI_COUNT` measurement.
+# setpci -s 16:1e.5 9c.L
 20005002                             # GO consumed
 # setpci -s 16:1e.5 a8.L
 0000500c                             # READ_DONE, no error
 # setpci -s 16:1e.5 b4.L
 0000000c                             # SPD byte 2: DDR4 type code
 ```
 The command executes and returns correct data through the ordinary accessors,
 and `MSR_SMI_COUNT` does not move across it. The driver now uses
 `pci_read_config_dword()` and `pci_write_config_dword()` like any other driver.
 Reproduce with [tools/probe-cf8-transaction.sh](tools/probe-cf8-transaction.sh).
 ---
@@ -73,9 +75,9 @@ is there to settle it with an `MSR_SMI_COUNT` measurement.
  of the transfer, restores both afterwards;
 * **compares the command registers after every transfer** against what it left
  in them, and fails with `-EAGAIN` if anything else changed;
-* requires a positive sign that the engine accepted the command, because the
+* reads the command word back and requires it to be the one just written,
-  done bits are latched and would otherwise let a never-executed command look
+  because the done bits are latched and a stale DONE would otherwise let a
-  like a completed one.
+  command that never reached the register look like a completed transfer.
 If your log shows
@@ -125,14 +127,6 @@ make reload ALLOW_UNSAFE=1    # load for testing, after checking arbitration
 sudo make install             # install into the kernel tree
 ```
 The driver calls `pci_mmcfg_read_config()`, which is added by patch 1 of the
 upstream series and is not in any released kernel yet. When the target kernel
 lacks it, the build force-includes
 [compat/pci-mmcfg-compat.h](compat/pci-mmcfg-compat.h), which reimplements the
 two accessors out-of-tree so the driver source stays byte-identical to the
 submitted patch. The build prints a warning when the shim is in use. The shim
 is **not** part of the upstream submission.
 To permit a later `modprobe` or PCI modalias load:
 ```bash
@@ -1,147 +0,0 @@
 /* SPDX-License-Identifier: GPL-2.0-only */
 /*
 * Out-of-tree compatibility shim - NOT part of the upstream submission.
 *
 * i2c-imc-skylake.c reaches the PCU function's config space with
 * pci_mmcfg_read_config() / pci_mmcfg_write_config(), which are added by
 * patch 1/2 of the series ("PCI: provide config access forced through the
 * ECAM path").  A stock kernel does not have them yet.
 *
 * The Makefile force-includes this header when the target kernel lacks those
 * symbols, so the driver source stays byte-identical to the submitted patch
 * while remaining testable on an unpatched kernel.  It reimplements the two
 * accessors the way earlier revisions of the driver did it: locate the ECAM
 * base in the ACPI MCFG table and map the function's config page.
 *
 * Limitations, acceptable for a test shim and for nothing else:
 *   - a single device at a time (there is one PCU function per system);
 *   - dword accesses only, which is all the driver issues;
 *   - no participation in the PCI core's config-space locking.  That is
 *     precisely the problem patch 1/2 exists to solve.
 */
 #ifndef IMC_PCI_MMCFG_COMPAT_H
 #define IMC_PCI_MMCFG_COMPAT_H
 #include <linux/acpi.h>
 #include <linux/device.h>
 #include <linux/io.h>
 #include <linux/pci.h>
 #define IMC_COMPAT_CFG_SIZE	0x1000UL
 static void __iomem *imc_compat_cfg;
 static resource_size_t imc_compat_phys;
 static u64 imc_compat_mmcfg_base(struct pci_dev *pdev)
 {
 	unsigned int seg = pci_domain_nr(pdev->bus);
 	unsigned int bus = pdev->bus->number;
 	struct acpi_table_header *hdr;
 	struct acpi_table_mcfg *mcfg;
 	struct acpi_mcfg_allocation *e;
 	unsigned long n, i;
 	u64 base = 0;
 	if (ACPI_FAILURE(acpi_get_table(ACPI_SIG_MCFG, 0, &hdr)))
 		return 0;
 	mcfg = (struct acpi_table_mcfg *)hdr;
 	if (hdr->length < sizeof(*mcfg)) {
 		acpi_put_table(hdr);
 		return 0;
 	}
 	e = (struct acpi_mcfg_allocation *)(mcfg + 1);
 	n = (hdr->length - sizeof(*mcfg)) / sizeof(*e);
 	for (i = 0; i < n; i++) {
 		if (e[i].pci_segment == seg &&
 		    bus >= e[i].start_bus_number &&
 		    bus <= e[i].end_bus_number) {
 			base = e[i].address;
 			break;
 		}
 	}
 	acpi_put_table(hdr);
 	return base;
 }
 static void imc_compat_unmap(void *data)
 {
 	iounmap(imc_compat_cfg);
 	imc_compat_cfg = NULL;
 	imc_compat_phys = 0;
 }
 static void __iomem *imc_compat_map(struct pci_dev *pdev)
 {
 	resource_size_t phys;
 	u64 base;
 	base = imc_compat_mmcfg_base(pdev);
 	if (!base)
 		return NULL;
 	phys = base +
 	       ((resource_size_t)pdev->bus->number << 20) +
 	       ((resource_size_t)PCI_SLOT(pdev->devfn) << 15) +
 	       ((resource_size_t)PCI_FUNC(pdev->devfn) << 12);
 	if (phys < base || phys + IMC_COMPAT_CFG_SIZE < phys)
 		return NULL;
 	if (imc_compat_cfg && imc_compat_phys == phys)
 		return imc_compat_cfg;
 	if (imc_compat_cfg)
 		return NULL;	/* a second device would need a real cache */
 	imc_compat_cfg = ioremap_uc(phys, IMC_COMPAT_CFG_SIZE);
 	if (!imc_compat_cfg)
 		return NULL;
 	imc_compat_phys = phys;
 	if (devm_add_action_or_reset(&pdev->dev, imc_compat_unmap, NULL))
 		return NULL;
 	return imc_compat_cfg;
 }
 static inline int pci_mmcfg_read_config(struct pci_dev *dev, int where,
 					int size, u32 *val)
 {
 	void __iomem *cfg;
 	if (size != 4 || (where & 3) || where + size > 0x1000) {
 		*val = ~0U;
 		return -EINVAL;
 	}
 	cfg = imc_compat_map(dev);
 	if (!cfg) {
 		*val = ~0U;
 		return -ENXIO;
 	}
 	*val = readl(cfg + where);
 	return 0;
 }
 static inline int pci_mmcfg_write_config(struct pci_dev *dev, int where,
 					 int size, u32 val)
 {
 	void __iomem *cfg;
 	if (size != 4 || (where & 3) || where + size > 0x1000)
 		return -EINVAL;
 	cfg = imc_compat_map(dev);
 	if (!cfg)
 		return -ENXIO;
 	writel(val, cfg + where);
 	return 0;
 }
 #endif /* IMC_PCI_MMCFG_COMPAT_H */
@@ -1,204 +0,0 @@
 From 2bde3ce8de136654c563b0bc0b05847293bf15e5 Mon Sep 17 00:00:00 2001
 From: Simone Chifari <[email protected]>
 Date: Sun, 26 Jul 2026 19:24:49 +0200
 Subject: [RFC PATCH v4 1/2] PCI: allow config access forced through the
 memory-mapped path
 On x86, raw_pci_read() and raw_pci_write() dispatch the first 256 bytes
 of config space to raw_pci_ops, which is CF8/CFC whenever configuration
 type 1 is usable.  raw_pci_ext_ops, the memory-mapped (ECAM) path, is
 only consulted from offset 0x100 upwards.
 A platform that filters or drops CF8/CFC accesses to one function
 therefore makes that function's low config space unreachable through the
 normal accessors, even though the ECAM window reaches it.  This is
 observable on Intel Skylake-X boards: a dword written to the iMC SMBus
 command registers at offsets 0x9C-0xB8 of the PCU function 8086:2085
 does not take effect, the GO bit is never consumed and no transaction is
 issued, while the same write through ECAM works.  Everything else that
 reads or writes that function's low config space, including setpci and
 sysfs, is equally affected.
 Add pci_mmcfg_read_config() and pci_mmcfg_write_config().  They take
 pci_lock and honour pci_cfg_access_lock() like the other config
 accessors, on top of a weak arch_pci_mmcfg_access() hook.  x86
 implements the hook over the existing pci_mmcfg_list, so no MCFG table
 is re-parsed and no window that the architecture has already mapped is
 mapped a second time.  Architectures with no memory-mapped config space
 keep the default, which reports -ENXIO.
 These do not replace pci_read_config_dword() and friends.  They are
 meant for a device documented to be unreachable otherwise, and callers
 are expected to justify the use in a comment.
 Signed-off-by: Simone Chifari <[email protected]>
 ---
 arch/x86/pci/mmconfig-shared.c | 28 +++++++++++
 drivers/pci/access.c           | 89 ++++++++++++++++++++++++++++++++++
 include/linux/pci.h            | 11 +++++
 3 files changed, 128 insertions(+)
 diff --git a/arch/x86/pci/mmconfig-shared.c b/arch/x86/pci/mmconfig-shared.c
 index acdb8dcae..715fdcdae 100644
 --- a/arch/x86/pci/mmconfig-shared.c
 +++ b/arch/x86/pci/mmconfig-shared.c
@@ -779,6 +779,34 @@ static int __init pci_mmcfg_late_insert_resources(void)
  */
 late_initcall(pci_mmcfg_late_insert_resources);
 +/*
 + * raw_pci_read()/raw_pci_write() dispatch the first 256 config bytes to
 + * raw_pci_ops, which is CF8/CFC whenever configuration type 1 is usable.
 + * A platform that filters CF8/CFC for one function therefore makes that
 + * function's low config space unreachable through the normal accessors,
 + * even though the ECAM window reaches it.  Give the PCI core a way to
 + * select the ECAM path explicitly for such a device.
 + *
 + * See the pci_mmcfg_read_config() kerneldoc for the usage restrictions.
 + */
 +int arch_pci_mmcfg_access(struct pci_dev *dev, int where, int size, u32 *val,
 +			  bool write)
 +{
 +	unsigned int seg = pci_domain_nr(dev->bus);
 +	unsigned int bus = dev->bus->number;
 +	int ret;
 +
 +	if (!(pci_probe & PCI_PROBE_MMCONF) || pci_mmcfg_arch_init_failed)
 +		return -ENXIO;
 +
 +	if (write)
 +		ret = pci_mmcfg.write(seg, bus, dev->devfn, where, size, *val);
 +	else
 +		ret = pci_mmcfg.read(seg, bus, dev->devfn, where, size, val);
 +
 +	return ret < 0 ? ret : 0;
 +}
 +
 /* Add ECAM information for host bridges */
 int pci_mmconfig_insert(struct device *dev, u16 seg, u8 start, u8 end,
 			phys_addr_t addr)
 diff --git a/drivers/pci/access.c b/drivers/pci/access.c
 index b123da16b..e058b9f2b 100644
 --- a/drivers/pci/access.c
 +++ b/drivers/pci/access.c
@@ -277,6 +277,95 @@ PCI_USER_WRITE_CONFIG(byte, u8)
 PCI_USER_WRITE_CONFIG(word, u16)
 PCI_USER_WRITE_CONFIG(dword, u32)
 +/*
 + * Architecture hook for config access forced through the memory-mapped
 + * (ECAM) path.  Called with @pci_lock held and interrupts disabled.
 + * Architectures without a memory-mapped config space leave the default,
 + * which reports that the path does not exist.
 + */
 +int __weak arch_pci_mmcfg_access(struct pci_dev *dev, int where, int size,
 +				 u32 *val, bool write)
 +{
 +	return -ENXIO;
 +}
 +
 +static int pci_mmcfg_access(struct pci_dev *dev, int where, int size, u32 *val,
 +			    bool write)
 +{
 +	int ret;
 +
 +	if (size != 1 && size != 2 && size != 4)
 +		return -EINVAL;
 +	if (where & (size - 1))
 +		return -EINVAL;
 +	if (where + size > dev->cfg_size)
 +		return -EINVAL;
 +	if (pci_dev_is_disconnected(dev))
 +		return -ENODEV;
 +
 +	raw_spin_lock_irq(&pci_lock);
 +	if (unlikely(dev->block_cfg_access))
 +		pci_wait_cfg(dev);
 +	ret = arch_pci_mmcfg_access(dev, where, size, val, write);
 +	raw_spin_unlock_irq(&pci_lock);
 +
 +	return ret;
 +}
 +
 +/**
 + * pci_mmcfg_read_config - read config space through the ECAM path
 + * @dev: PCI device
 + * @where: byte offset in config space, naturally aligned for @size
 + * @size: 1, 2 or 4 bytes
 + * @val: where to store the value read
 + *
 + * Read config space of @dev through the memory-mapped (ECAM) path
 + * regardless of the access method the platform selected for the first 256
 + * config bytes.  On x86 that method is CF8/CFC, and some platforms filter
 + * or trap those accesses for individual functions, which makes the
 + * registers of such a function unreachable through the normal accessors.
 + *
 + * Drivers should use pci_read_config_dword() and friends.  This is only
 + * for a device documented to be unreachable otherwise, and callers must
 + * be able to justify why in a comment.
 + *
 + * Must be called from a context that may sleep.
 + *
 + * Return: 0 on success, -ENXIO when the platform has no ECAM path,
 + * otherwise a negative errno.  @val is set to all ones on error.
 + */
 +int pci_mmcfg_read_config(struct pci_dev *dev, int where, int size, u32 *val)
 +{
 +	int ret;
 +
 +	*val = 0;
 +	ret = pci_mmcfg_access(dev, where, size, val, false);
 +	if (ret)
 +		*val = ~0;
 +
 +	return ret;
 +}
 +EXPORT_SYMBOL_GPL(pci_mmcfg_read_config);
 +
 +/**
 + * pci_mmcfg_write_config - write config space through the ECAM path
 + * @dev: PCI device
 + * @where: byte offset in config space, naturally aligned for @size
 + * @size: 1, 2 or 4 bytes
 + * @val: value to write
 + *
 + * Write counterpart of pci_mmcfg_read_config().  The same restrictions
 + * apply; see that function.
 + *
 + * Return: 0 on success, -ENXIO when the platform has no ECAM path,
 + * otherwise a negative errno.
 + */
 +int pci_mmcfg_write_config(struct pci_dev *dev, int where, int size, u32 val)
 +{
 +	return pci_mmcfg_access(dev, where, size, &val, true);
 +}
 +EXPORT_SYMBOL_GPL(pci_mmcfg_write_config);
 +
 /**
  * pci_cfg_access_lock - Lock PCI config reads/writes
  * @dev:	pci device struct
 diff --git a/include/linux/pci.h b/include/linux/pci.h
 index 2c4454583..942b20dcc 100644
 --- a/include/linux/pci.h
 +++ b/include/linux/pci.h
@@ -1412,6 +1412,17 @@ int pci_user_write_config_byte(struct pci_dev *dev, int where, u8 val);
 int pci_user_write_config_word(struct pci_dev *dev, int where, u16 val);
 int pci_user_write_config_dword(struct pci_dev *dev, int where, u32 val);
 +/*
 + * Config access forced through the memory-mapped (ECAM) path.  Only for
 + * devices whose registers are unreachable with the access method the
 + * platform selected for the first 256 config bytes.  Both return -ENXIO on
 + * an architecture or platform that has no such path.
 + */
 +int arch_pci_mmcfg_access(struct pci_dev *dev, int where, int size, u32 *val,
 +			  bool write);
 +int pci_mmcfg_read_config(struct pci_dev *dev, int where, int size, u32 *val);
 +int pci_mmcfg_write_config(struct pci_dev *dev, int where, int size, u32 val);
 +
 int __must_check pci_enable_device(struct pci_dev *dev);
 int __must_check pci_enable_device_mem(struct pci_dev *dev);
 int __must_check pci_reenable_device(struct pci_dev *);
 -- 
 2.43.0
@@ -1,17 +1,13 @@
 config I2C_IMC_SKYLAKE
 	tristate "Intel Skylake-X iMC SMBus adapter"
-	depends on PCI && (PCI_MMCONFIG || COMPILE_TEST)
+	depends on PCI && (X86_64 || COMPILE_TEST)
 	help
 	  Say Y here if you want kernel support for the integrated memory
 	  controller (iMC) SMBus engine found in Intel Skylake-X / Cascade
 	  Lake-X processors (socket LGA 2066, platform X299, PCU function
 	  8086:2085).
-	  The engine is exposed through the PCI configuration space of the
+	  Two I2C adapters are registered, one per hardware SMBus channel,
 	  PCU function.  Those registers are unreachable through the config
 	  accessors the platform selects for the first 256 bytes, so the
 	  driver reaches them through the memory-mapped (ECAM) path.  Two
 	  I2C adapters are registered, one per hardware SMBus channel,
 	  allowing access to DDR4 DIMM SPD EEPROMs (0x50-0x57) and thermal
 	  sensors from userspace via standard i2c-tools and lm-sensors.
@@ -1,72 +1,50 @@
-Subject: [RFC PATCH v4 0/2] i2c: imc-skylake: Intel Skylake-X iMC SMBus adapter
+Subject: [PATCH v4] i2c: imc-skylake: add Intel Skylake-X iMC SMBus adapter
-This series exposes the two SMBus channels of the integrated memory
+The integrated memory controller of Intel Skylake-X and Cascade Lake-X
-controller of Intel Skylake-X and Cascade Lake-X processors as standard
+processors contains an SMBus engine wired to the DDR4 DIMMs.  This driver
-Linux I2C adapters, so that DDR4 SPD EEPROMs and DIMM thermal sensors can
+exposes its two channels as standard Linux I2C adapters, so that DDR4 SPD
-be read with i2c-tools, decode-dimms and lm-sensors.
+EEPROMs and DIMM thermal sensors can be read with i2c-tools, decode-dimms
 and lm-sensors.
-v3 was never posted. v2 was posted as i2c-imc-x299 and received no replies:
+v2 was posted as i2c-imc-x299 and received no replies:
  https://lore.kernel.org/linux-i2c/[email protected]/
-Patch 1 is a PCI/x86 change and is the reason this is still an RFC.
+v3 was never posted.
 Patch 2 is the driver and depends on patch 1.
-  1/2  PCI: allow config access forced through the memory-mapped path
+Correction to v2
-  2/2  i2c: imc-skylake: add driver for the Intel Skylake-X iMC SMBus engine
+~~~~~~~~~~~~~~~~
 v2 claimed that firmware filters CF8/CFC config writes to this function and
 that the registers can only be reached through the ECAM window.  That claim
 was wrong and I am retracting it.
-Why patch 1 exists
+It was never tested directly.  The only evidence behind it was the boot log
-~~~~~~~~~~~~~~~~~~
+line "PCI: Using configuration type 1", which says which accessor the kernel
-The engine's registers are at config space offsets 0x9C-0xB8, inside the
+uses and nothing about a write failing.  Measured on the same board:
 first 256 bytes. On x86, raw_pci_read()/raw_pci_write() dispatch that range
 to raw_pci_ops, which is CF8/CFC whenever configuration type 1 is usable
 (arch/x86/pci/common.c). The extended path, raw_pci_ext_ops, is only
 consulted from offset 0x100 upwards.
-On the tested board a dword written to the command register through
+  # setpci -s 16:1e.5 9c.L=20085002    # read SPD 0x50, register 0x02
-CF8/CFC does not take effect: the register reads back unchanged, the GO bit
+  # setpci -s 16:1e.5 9c.L
-is never consumed and no SMBus transaction is issued. The same write through
+  20005002                             # GO consumed
-the ECAM window works, and that is how the register layout was confirmed.
+  # setpci -s 16:1e.5 a8.L
  0000500c                             # READ_DONE, no error
  # setpci -s 16:1e.5 b4.L
  0000000c                             # SPD byte 2: DDR4 type code
-This is not only a problem for this driver. If CF8/CFC writes to that
+The command written through CF8/CFC is executed and returns correct data,
-function are dropped, then setpci, sysfs and anything else the kernel does
+and MSR_SMI_COUNT does not move across it.  This driver therefore uses
-to its low config space is equally unreliable. So rather than have a leaf
+pci_read_config_dword() and pci_write_config_dword() like any other driver.
-driver map the ECAM page itself, patch 1 adds
+There is no ECAM mapping, no MCFG parsing and no PCI-core change in this
-
+series any more.
  int pci_mmcfg_read_config(struct pci_dev *, int where, int size, u32 *val);
  int pci_mmcfg_write_config(struct pci_dev *, int where, int size, u32 val);
 in drivers/pci/access.c, taking pci_lock and honouring
 pci_cfg_access_lock(), on top of a weak arch_pci_mmcfg_access() hook that
 x86 implements over the already-validated pci_mmcfg_list. No MCFG re-parsing
 and no second mapping of a window the architecture has already mapped.
 Questions for the PCI and x86 maintainers:
  - is an explicit per-access opt-in the right shape, or should a platform
    that filters CF8/CFC for a function be handled by a quirk that redirects
    all of its config accesses?
  - if a helper is right, is drivers/pci/access.c plus a weak arch hook the
    right place, or should this live entirely in arch/x86?
 I do not consider patch 1 settled and will rework it in whatever direction
 you point.
 What causes the dropped write is not known. Earlier revisions of this
 driver attributed it to System Management Mode; the only evidence for that
 was the boot log line naming the access method, which says nothing about
 who filters the write, so the attribution has been removed everywhere. The
 observation stands on its own: the write does not reach the register.
 Firmware arbitration
 ~~~~~~~~~~~~~~~~~~~~
-This is the reason no iMC SMBus driver has ever been merged, and this
+This is the reason no iMC SMBus driver has ever been merged, and this patch
-series does not solve it either.
+does not solve it either.  It does make the condition detectable.
 Andy Lutomirski's original i2c_imc put it plainly: a BMC, the memory
 controller's power management, and possibly SMM all like to touch this bus,
-and Intel defined no way to arbitrate between them. That driver already had
+and Intel defined no way to arbitrate between them.  That driver already had
-a module parameter called allow_unsafe_access. Stefan Schaeckeler's 2020
+a module parameter called allow_unsafe_access.  Stefan Schaeckeler's 2020
 Broadwell rewrite went further and stopped the PCU's TSOD polling for the
 duration of a transfer (write 0 to TSODCNTL, wait 10 ms for in-flight
 transactions to drain, restore afterwards), because on Broadwell the
@@ -85,41 +63,44 @@ So this driver:
    duration of the transfer, and restores both afterwards;
  - after every transfer compares the command registers against what it
    left in them and fails the transfer with -EAGAIN if anything else
-    changed. This is the check the original driver had, and it is what makes
+    changed.  This is the check the original driver had, and it is what
-    an unarbitrated system detectable rather than silently wrong;
+    makes an unarbitrated system detectable rather than silently wrong;
-  - requires a positive sign that the engine acted on the command, because
+  - reads the command word back and requires it to be the one just
-    the done bits are latched: without that, a command that is never
+    written, because the done bits are latched.  With the driver unloaded
-    accepted is indistinguishable from a completed one and the caller would
+    and nothing running, STATUS on the test system reads 0x0000300c:
-    receive the previous transaction's data.
+    READ_DONE and WRITE_DONE both still set from an earlier transaction.
    Without the check, a command word that never reaches the register is
    indistinguishable from a completed transfer and the caller receives the
    previous transaction's data.  The engine only ever clears GO, so that
    is the single permitted difference between the two words.
 What is missing: no equivalent of Broadwell's TSODCNTL has been identified
-on this part, so a system with CLTT enabled is expected to trip the
+on this part.  Offset 0xe0, where Broadwell has it, reads as zero here.  A
-interference check rather than be arbitrated against. Finding that register
+system with CLTT enabled is therefore expected to trip the interference
-is the main open item. I would rather ship a driver that detects the
+check rather than be arbitrated against.  I would rather ship a driver that
-condition and refuses than one that quietly races.
+detects the condition and refuses than one that quietly races.
 Relation to prior work
 ~~~~~~~~~~~~~~~~~~~~~~
-There is no iMC I2C driver in mainline. Lutomirski's i2c-imc was an RFC;
+There is no iMC I2C driver in mainline.  Lutomirski's i2c-imc was an RFC;
-the 2020 resend and github.com/Linux4/i2c-imc are out of tree. Neither can
+the 2020 resend and github.com/Linux4/i2c-imc are out of tree.  Neither can
-be extended to cover this part: the device ID (0x2085 vs 0x3ca8/0x6fa8),
+be extended to cover this part: the device ID (0x2085 vs 0x3ca8/0x6fa8) and
-the register layout (0x9C-0xB8 vs 0x180-0x188) and the working access
+the register layout (0x9C-0xB8 vs 0x180-0x188) differ.  A separate file is
-method all differ. A separate file is cleaner than a hw_data table with
+cleaner than a hw_data table.
 mutually exclusive access paths.
 The register encoding was cross-checked against an independent Windows
 implementation for the same engine, which predates this work:
  https://github.com/namazso/PawnIO.Modules/blob/c975ca1d1b8a9c7473a175fa1ca24d83b6cbc8f3/SmbusIntelSkylakeIMC.p
-It also implements SMBus BYTE through a pointer-select bit. That is not
+It also implements SMBus BYTE through a pointer-select bit.  That is not
 advertised here because it has not been validated on the Linux system, so
 i2cdetect cannot scan these buses; devices are addressed directly.
 Changes since v2
 ~~~~~~~~~~~~~~~~
-  - Split into a PCI/x86 patch and the driver; the driver no longer walks
+  - Retract the CF8/CFC claim; use the ordinary config accessors.  The
-    the MCFG table or maps the ECAM page itself.
+    driver no longer maps anything.
  - Rename i2c-imc-x299 to i2c-imc-skylake; the engine is in the CPU, not
    the chipset.
  - Add the default-off allow_unsafe_access gate.
@@ -127,35 +108,36 @@ Changes since v2
  - Preserve and restore command and TSOD state for both channels.
  - Validate READ_DONE, WRITE_DONE and the hardware error state.
  - Detect interference from another master and report it as -EAGAIN.
-  - Require a positive sign that a command was accepted.
+  - Read the command word back and require it to be the one written.
  - Add bounded command-toggle recovery for a stuck BUSY state.
  - Add WORD_DATA support with the hardware byte ordering.
  - Reject I2C_M_TEN explicitly and validate transfer direction.
  - Use the i2c core's suspended-adapter mechanism instead of a private
    flag and a non-standard errno.
  - Use devm_mutex_init() and devm-managed adapters; drop the unnecessary
-    pci_enable_device().
+    pci_enable_device(); return -ENODEV rather than -EPERM from the
    default-off gate, which was logging a driver-core error on every boot.
  - Add Documentation/i2c/busses/i2c-imc-skylake.rst.
-  - Drop the ACPI dependency; the Kconfig entry now depends on PCI_MMCONFIG.
+  - Drop the ACPI dependency.
  - Remove the unsupported attribution of the dropped write to SMM.
 Validation
 ~~~~~~~~~~
-  - In-tree build of both patches, W=1, x86_64, GCC: no diagnostics.
+  - In-tree build, W=1, x86_64 GCC and arm64 Clang COMPILE_TEST: no
-  - arm64 COMPILE_TEST with Clang: no diagnostics.
+    diagnostics.
-  - checkpatch.pl --strict: clean on both patches.
+  - checkpatch.pl --strict: clean.
  - Sparse with __CHECK_ENDIAN__: clean.
-  - Read-only hardware test on one Intel X299 system with four DDR4 DIMMs:
+  - Read-only hardware test on one Intel Core i9-10900X (Cascade Lake-X)
-    both adapters, four SPD EEPROMs, BYTE_DATA, WORD_DATA byte order, ENXIO
+    system with four DDR4 DIMMs: both adapters, four SPD EEPROMs, BYTE_DATA,
-    for an absent device, 100 concurrent reads per channel, the default-off
+    WORD_DATA byte order, ENXIO for an absent device, 100 concurrent reads
-    gate, and 20 unload/reload cycles, with no kernel warning or oops, no
+    per channel, the default-off gate, and 20 unload/reload cycles: 15
-    interference reported and every command accepted.
+    checks, 0 failures, no kernel warning or oops, no interference
    reported, every command word confirmed in the register.
  - Config space of the PCU function sampled with the driver unloaded: no
    register changed on its own, and TSOD_ACTIVE was clear on both channels,
    so no firmware activity was observed on this system.
-Still required before this can lose the RFC prefix: an independent
+Still missing: an independent Tested-by, ideally on Skylake-X rather than
-Tested-by, ideally on Cascade Lake-X; suspend/resume with active clients;
+Cascade Lake-X, and suspend/resume testing with active I2C clients.
 a measurement of MSR_SMI_COUNT across a failing CF8/CFC write, to say
 something about the mechanism rather than only about the effect; and a
 direction from the PCI and x86 maintainers on patch 1.
 Tool assistance
 ~~~~~~~~~~~~~~~
@@ -163,24 +145,18 @@ Per Documentation/process/generated-content.rst: this work was developed
 with an AI coding assistant, run interactively rather than autonomously.
  - What: Claude Code, model claude-opus-5.
-  - Where: it contributed to the transaction state machine of patch 2, the
+  - Where: it contributed to the transaction state machine, the .rst
-    kerneldoc and .rst documentation, the commit messages and this cover
+    documentation, the commit message and this cover letter.  The register
-    letter. The register decoding, the ECAM finding and every hardware
+    decoding is mine.
    measurement are mine.
  - How it was used: iteratively, one reviewed change at a time, in
-    response to specific requests, not from a single generating prompt. A
+    response to specific requests, not from a single generating prompt.  A
    representative request is "the done bits are latched; show me how a
    command that is never accepted can be mistaken for a completed one, and
-    make that case detectable", which produced the check now in
+    make that case detectable", which produced imc_engine_responded().  It
-    imc_engine_responded().
+    also designed the measurement that retracted the CF8/CFC claim above,
    after asking why that claim had never been tested directly.
  - Testing: every revision was built with W=1, checked with
-    checkpatch --strict and sparse, and the hardware behaviour was tested
+    checkpatch --strict and sparse, and tested on the hardware by me.
    on the X299 system by me.
 I have reviewed all of it, I understand it, and I take responsibility for
-it. The Assisted-by trailer is on patch 2, which is where the assistance
+it.
 went; patch 1 was written by hand from the existing arch/x86 code.
 Simone Chifari (2):
  PCI: allow config access forced through the memory-mapped path
  i2c: imc-skylake: add driver for the Intel Skylake-X iMC SMBus engine
@@ -73,21 +73,8 @@ Config space access
 -------------------
 The engine's registers live at config space offsets 0x9C-0xB8 of the PCU
-function.  On x86 the first 256 bytes of config space are reached with the
+function and are reached with the ordinary ``pci_read_config_dword()`` and
-access method the platform selected at boot, which is normally CF8/CFC.  On the
+``pci_write_config_dword()``.  Nothing special is required.
 tested board a write issued that way to the command register has no effect: the
 GO bit is never consumed and no SMBus transaction is issued.  The same write
 through the memory-mapped (ECAM) path works.
 The driver therefore uses ``pci_mmcfg_read_config()`` and
 ``pci_mmcfg_write_config()``, which force the ECAM path for this device.  It
 requires ``CONFIG_PCI_MMCONFIG``; on a system booted with ``pci=nommconf`` the
 driver will fail to probe.
 The mechanism that drops the CF8/CFC write has not been identified.
 ``MSR_SMI_COUNT`` does not increase across a failing write, so it is not
 attributed to System Management Mode here.
 Supported transactions
 ----------------------
@@ -3,23 +3,12 @@
 * Intel Skylake-X iMC SMBus I2C adapter.
 *
 * The integrated memory controller (iMC) on Intel Skylake-X / Cascade Lake-X
- * processors exposes an SMBus engine used to reach the SPD EEPROMs and thermal
+ * processors contains an SMBus engine wired to the DDR4 DIMMs.  It reaches the
- * sensors on DDR4 DIMMs.  The engine is driven through the PCI configuration
+ * SPD EEPROMs (0x50-0x57) and the thermal sensors (0x18-0x1f) of the installed
- * space of the Sky Lake-E PCU function (8086:2085).  This driver presents that
+ * modules.  The engine is driven through the PCI configuration space of the
- * engine as two standard Linux I2C adapters - one per hardware SMBus channel -
+ * Sky Lake-E PCU function (8086:2085).  This driver presents it as two standard
- * so that i2c-tools and lm-sensors can use it without bespoke sysfs hacks.
+ * Linux I2C adapters - one per hardware SMBus channel - so that i2c-tools,
- *
+ * decode-dimms and lm-sensors can use it without bespoke sysfs hacks.
 * Why the config accesses go through pci_mmcfg_{read,write}_config():
 *   The SMBus registers live at offsets 0x9C-0xB8, inside the first 256 config
 *   bytes.  raw_pci_read()/raw_pci_write() dispatch that range to raw_pci_ops,
 *   which on this platform is CF8/CFC (the boot log reports "PCI: Using
 *   configuration type 1").  On the tested board a dword written that way to
 *   the command register does not take effect: the register reads back without
 *   the GO bit ever having been consumed and no SMBus transaction is issued.
 *   The same write through the ECAM window does work, and that is also how the
 *   register layout was confirmed on hardware.  The mechanism behind the
 *   dropped write has not been identified; measurements of MSR_SMI_COUNT
 *   across a failing write show no SMI, so it is not attributed to SMM here.
 *
 * Per-channel register triple within the config space of the function:
 *                  ch0     ch1
@@ -30,12 +19,11 @@
 *   SMBus command byte (DATA bits[15:8]) = (rw << 7) | addr7: the 7-bit slave
 *   address with bit7 = direction (1 write / 0 read).  The register/offset goes
 *   in DATA[7:0].  So 0x50 reads SPD EEPROM 0x50.  This was decoded and
- *   confirmed on hardware.
+ *   confirmed on hardware, and cross-checked against an independent Windows
 *   implementation of the same engine.
 *
 * The two channels are independent SMBus buses (DIMMs 1,2 on ch0; DIMMs 3,4 on
 * ch1), hence two i2c_adapter instances exposed as separate /dev/i2c-* nodes.
 * Each channel carries the DIMM SPD EEPROMs (0x50-0x57) and thermal sensors -
 * all reachable by 7-bit address.
 *
 * Bus arbitration / concurrency with firmware:
 *   The driver cannot coordinate with SMM, a BMC, or the iMC's own closed-loop
@@ -66,15 +54,10 @@
 #include <linux/pci.h>
 #include <linux/pci_ids.h>
-/* expected PCI id of the Sky Lake-E PCU SMBus function */
+/* PCI id of the Sky Lake-E PCU function carrying the SMBus engine */
 #define PCU_DEVICE	0x2085
 #define PCU_ID		((PCU_DEVICE << 16) | PCI_VENDOR_ID_INTEL)
-/* function-global config registers */
+/* per-channel register offsets in the function's config space */
 #define CFG_VENDOR_DEV	0x00	/* cfg[0]: vendor/device id, for sanity check */
 #define CFG_IMC_BUS	0xCC	/* cfg[0xCC] bits[15:8]: iMC SMBus bus number */
 /* per-channel register offsets */
 #define CH0_CTRL	0xB4
 #define CH0_DATA	0x9C
 #define CH0_STAT	0xA8
@@ -103,8 +86,10 @@
 #define WRITE_OPERATION	BIT(15)
 #define COMMAND_PREFIX	(COMMAND_TOGGLE | GO_BIT)
 #define COMMAND_KEEP_MASK	(~TSOD_ACTIVE_BIT)
-/* command bits this driver produces itself; everything else belongs to nobody
+/*
- * we know about, so a change in them during a transfer means interference.
+ * Command bits this driver produces itself.  Everything outside this mask
 * belongs to whoever else is driving the engine, so a change there during a
 * transfer means interference.
 */
 #define COMMAND_OUR_BITS	(COMMAND_TOGGLE | GO_BIT | WORD_BIT | \
 				 GENMASK(15, 0))
@@ -157,20 +142,19 @@ struct imc_xfer_state {
 };
 /*
- * Config accessors.  Every access goes through the ECAM path; see the comment
+ * Register accessors.  A config-space failure is recorded in s->io_err and
- * at the top of the file.  A failure is recorded in s->io_err and reported
+ * reported once, at the end of the transfer, so the transaction logic does not
- * once, at the end of the transfer, so the transaction logic does not have to
+ * have to check a return value on every register touch.  A failed read yields
- * check a return value on every register touch.  A failed read yields all-ones,
+ * all-ones, which no polling loop mistakes for a completed transaction.
 * which no polling loop mistakes for a completed transaction.
 */
 static u32 imc_reg(struct imc_smbus *s, unsigned int off)
 {
 	u32 val;
 	int ret;
-	ret = pci_mmcfg_read_config(s->pdev, off, 4, &val);
+	ret = pci_read_config_dword(s->pdev, off, &val);
 	if (ret) {
-		s->io_err = ret;
+		s->io_err = pcibios_err_to_errno(ret);
 		return ~0U;
 	}
@@ -181,9 +165,9 @@ static void imc_set(struct imc_smbus *s, unsigned int off, u32 val)
 {
 	int ret;
-	ret = pci_mmcfg_write_config(s->pdev, off, 4, val);
+	ret = pci_write_config_dword(s->pdev, off, val);
 	if (ret)
-		s->io_err = ret;
+		s->io_err = pcibios_err_to_errno(ret);
 }
 static u32 imc_busy_mask(struct imc_smbus *s)
@@ -255,7 +239,6 @@ static int imc_wait_transfer(struct imc_smbus *s, const struct imc_chan *c,
 	command = imc_reg(s, c->data);
 	imc_set(s, c->data, command ^ COMMAND_TOGGLE);
 	imc_reg(s, c->data);
 	ret = imc_wait_done(s, c, status);
 	if (ret)
@@ -287,19 +270,21 @@ static int imc_check_status(struct imc_smbus *s, const struct imc_chan *c,
 }
 /*
- * The done bits are latched and the driver has found no way to clear them, so
+ * The done bits are latched and no way to clear them has been found, so a
- * a transaction that is never started at all would otherwise be indistinguish-
+ * command that never reaches the register is indistinguishable from one that
- * able from one that completed: STATUS still shows the previous DONE and the
+ * completed: STATUS still shows the previous DONE, the GO bit of the stale
- * caller would receive the previous transaction's data as valid.
+ * command word is already clear, and the caller would receive the previous
 * transaction's data as valid.
 *
- * Require one of two positive signs that the engine acted on the command: the
+ * Read the command word back and require it to be the one just written.  The
- * GO bit was observed set in the read-back that follows the command write, or
+ * engine only ever clears GO, so that bit is the single permitted difference;
- * STATUS changed during the transfer.  Neither of them appearing means nothing
+ * anything else means the write did not land.  Checking the word rather than
- * happened.
+ * a status transition matters because two identical transfers in a row leave
 * STATUS bit for bit the same.
 */
-static bool imc_engine_responded(bool go_seen, u32 status_pre, u32 status)
+static bool imc_command_landed(u32 command, u32 readback)
 {
-	return go_seen || status != status_pre;
+	return !((command ^ readback) & ~GO_BIT);
 }
 /*
@@ -345,7 +330,6 @@ static void imc_restore_xfer(struct imc_smbus *s,
 		 * transaction that was already in flight when we found it.
 		 */
 		imc_set(s, imc_chans[i].data, state->command[i] & ~GO_BIT);
 		imc_reg(s, imc_chans[i].data);
 	}
 }
@@ -367,7 +351,6 @@ static int imc_prepare_xfer(struct imc_smbus *s, const struct imc_chan *c,
 		imc_set(s, imc_chans[i].data,
 			state->command[i] & COMMAND_KEEP_MASK);
 		imc_reg(s, imc_chans[i].data);
 		ret = imc_wait_go_clear(s, &imc_chans[i]);
 		if (ret) {
 			imc_restore_xfer(s, state);
@@ -382,8 +365,7 @@ static int imc_access(struct imc_smbus *s, const struct imc_chan *c, u8 addr,
 		      u8 reg, char read_write, int size, u16 *value)
 {
 	struct imc_xfer_state state = {};
-	u32 command, expected, raw, status_pre, status = 0;
+	u32 command, expected, raw, readback, status = 0;
 	bool go_seen;
 	int ret;
 	ret = imc_prepare_xfer(s, c, &state);
@@ -397,27 +379,23 @@ static int imc_access(struct imc_smbus *s, const struct imc_chan *c, u8 addr,
 	if (read_write == I2C_SMBUS_WRITE) {
 		raw = size == I2C_SMBUS_WORD_DATA ? swab16(*value) : *value;
 		imc_set(s, c->ctrl, raw << 16);
 		imc_reg(s, c->ctrl);
 		command |= WRITE_OPERATION;
 	}
 	status_pre = imc_reg(s, c->stat);
 	imc_set(s, c->data, command);
-	/* read back to flush the write and to see whether GO was accepted */
+	readback = imc_reg(s, c->data);
-	go_seen = imc_reg(s, c->data) & GO_BIT;
+	if (!imc_command_landed(command, readback)) {
 		dev_warn_ratelimited(s->dev,
 				     "ch%d command 0x%08x did not reach the register (read back 0x%08x)\n",
 				     c->idx, command, readback);
 		ret = -EIO;
 		goto restore_command;
 	}
 	ret = imc_wait_transfer(s, c, &status);
 	if (ret)
 		goto restore_command;
 	if (!imc_engine_responded(go_seen, status_pre, status)) {
 		dev_warn_ratelimited(s->dev,
 				     "ch%d command not accepted for addr 0x%02x reg 0x%02x (stat 0x%08x unchanged, GO never seen)\n",
 				     c->idx, addr, reg, status);
 		ret = -ETIMEDOUT;
 		goto restore_command;
 	}
 	expected = read_write == I2C_SMBUS_WRITE ?
 		   STAT_WRITE_DONE : STAT_READ_DONE;
 	ret = imc_check_status(s, c, status, expected, addr, reg);
@@ -549,8 +527,6 @@ static DEFINE_SIMPLE_DEV_PM_OPS(imc_pm_ops, imc_suspend, imc_resume);
 static int imc_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 {
 	struct imc_smbus *s;
 	u8 imc_bus_hw;
 	u32 cfg0, cc;
 	int ret, i;
 	if (!allow_unsafe_access) {
@@ -575,40 +551,6 @@ static int imc_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 	if (ret)
 		return ret;
 	ret = pci_mmcfg_read_config(pdev, CFG_VENDOR_DEV, 4, &cfg0);
 	if (ret) {
 		dev_err(&pdev->dev,
 			"no memory-mapped path to config space: %d\n", ret);
 		return ret;
 	}
 	if (cfg0 != PCU_ID) {
 		dev_err(&pdev->dev, "wrong device through ECAM (cfg[0]=0x%08x)\n",
 			cfg0);
 		return -ENODEV;
 	}
 	/*
 	 * Cross-check the iMC bus number against the configuration register
 	 * value: cfg[0xCC] bits[15:8] = the iMC SMBus bus number as seen by
 	 * the PCU.  On all known Skylake-X / Cascade Lake-X boards this matches
 	 * the probed bus number.
 	 * A mismatch means the accessor landed on the wrong function - warn but
 	 * continue; the binding is already locked to 8086:2085.
 	 */
 	ret = pci_mmcfg_read_config(pdev, CFG_IMC_BUS, 4, &cc);
 	if (ret)
 		return ret;
 	imc_bus_hw = (cc >> 8) & 0xFF;
 	if (imc_bus_hw && imc_bus_hw != (u8)pdev->bus->number)
 		dev_warn(&pdev->dev,
 			 "cfg[0xCC] reports iMC bus 0x%02x but probed bus=0x%02x\n",
 			 imc_bus_hw, (u8)pdev->bus->number);
 	else
 		dev_dbg(&pdev->dev,
 			"cfg[0xCC]=0x%08x iMC bus 0x%02x confirmed\n",
 			cc, imc_bus_hw);
 	/*
 	 * Lifetime safety: the I2C core guarantees that smbus_xfer callbacks
 	 * are not invoked after i2c_del_adapter() returns. Since we use
@@ -240,12 +240,13 @@ else
 	_ok "no foreign master detected during the test"
 fi
-# Likewise for a command the engine never accepted: that path exists because
+# Likewise for a command that never reached the register: that path exists
-# the done bits are latched and must not be mistaken for a fresh completion.
+# because the done bits are latched and a stale DONE must not be mistaken for
-if grep -q 'command not accepted' <<< "$NEW_DMESG"; then
+# a fresh completion.
-	_fail "engine did not accept a command; config access path is unreliable"
+if grep -q 'did not reach the register' <<< "$NEW_DMESG"; then
 	_fail "a command never reached the register; config access is unreliable"
 else
-	_ok "every command was accepted by the engine"
+	_ok "every command reached the register"
 fi
 echo "=== result: $PASS passed, $FAIL failed ==="
@@ -58,8 +58,10 @@ echo "=== engine registers ==="
 snapshot_regs "$BDF"
 echo
 # lspci -xxxx prints two-digit offsets for the first 256 bytes and three or
 # more digits above that, so anchor on the short form here.
 echo "=== neighbourhood of the Broadwell TSODCNTL offset (0xe0) ==="
-awk '/^0[cdef]0:/ { print }' "$second"
+awk '/^[cdef]0:/ { print }' "$second"
 echo
 echo "=== the driver's register window (0x90-0xbf) ==="
-awk '/^0[9ab]0:/ { print }' "$second"
+awk '/^[9ab]0:/ { print }' "$second"
@@ -0,0 +1,151 @@
 #!/usr/bin/env bash
 #
 # WRITES TO HARDWARE. Settles the question patch 1/2 of the series exists for:
 # does a command written through CF8/CFC actually start an SMBus transaction,
 # or only land in the register?
 #
 # tools/probe-cf8-write.sh already showed that the register itself is writable
 # through CF8/CFC. This issues a full command with the GO bit set and watches
 # whether the engine acts on it.
 #
 # The target defaults to a read of address 0x77, which is not populated, so the
 # only thing that can happen on the bus is an address NACK - the same operation
 # test-smoke.sh already performs through the driver. The original DATA value is
 # restored with GO masked on every exit path.
 #
 set -euo pipefail
 # shellcheck source=tools/common.sh
 source "$(dirname "$(readlink -f "$0")")/common.sh"
 COMMAND_TOGGLE=$((1 << 29))
 GO_BIT=$((1 << 19))
 TSOD_ACTIVE_BIT=$((1 << 20))
 STAT_BUSY=1
 STAT_ERROR=2
 STAT_READ_DONE=4
 STAT_WRITE_DONE=8
 ADDR=0x77
 REG=0x00
 CHANNEL=0
 CONFIRMED=false
 while (($#)); do
 	case $1 in
 	--i-understand) CONFIRMED=true; shift ;;
 	--addr) ADDR=$2; shift 2 ;;
 	--reg) REG=$2; shift 2 ;;
 	--channel) CHANNEL=$2; shift 2 ;;
 	-h|--help)
 		sed -n '3,15p' "$0"
 		echo "usage: $0 --i-understand [--addr 0xNN] [--reg 0xNN] [--channel 0|1]"
 		exit 0
 		;;
 	*) die "unknown argument: $1" ;;
 	esac
 done
 $CONFIRMED || {
 	echo "This issues an SMBus read transaction from userspace. Re-run with --i-understand." >&2
 	exit 2
 }
 require_root
 require_cmd lspci setpci awk
 case $CHANNEL in
 0) REG_DATA=$REG_CH0_DATA; REG_STAT=$REG_CH0_STAT; REG_CTRL=$REG_CH0_CTRL ;;
 1) REG_DATA=$REG_CH1_DATA; REG_STAT=$REG_CH1_STAT; REG_CTRL=$REG_CH1_CTRL ;;
 *) die "channel must be 0 or 1" ;;
 esac
 driver_is_loaded && die "unload i2c-imc-skylake first"
 BDF=$(find_pcu)
 original=$(read_reg "$BDF" "$REG_DATA")
 status0=$(read_reg "$BDF" "$REG_STAT")
 ctrl0=$(read_reg "$BDF" "$REG_CTRL")
 echo "device:  $BDF, channel $CHANNEL"
 echo "target:  read address $ADDR register $REG"
 echo "DATA   before: $original"
 echo "STATUS before: $status0"
 echo "CTRL   before: $ctrl0"
 echo
 ((original & GO_BIT)) && die "GO already set, refusing"
 ((original & TSOD_ACTIVE_BIT)) && die "TSOD_ACTIVE set, refusing"
 ((status0 & STAT_BUSY)) && die "engine BUSY, refusing"
 restore()
 {
 	setpci -s "$BDF" "$REG_DATA.L=$(printf '%08x' "$((original & ~GO_BIT))")" || true
 	echo
 	echo "DATA restored to $(read_reg "$BDF" "$REG_DATA")"
 }
 trap restore EXIT
 issue()
 {
 	local command=$1 label=$2
 	local i data status ctrl go_seen=no changed=no
 	printf '=== %s: writing 0x%08x ===\n' "$label" "$command"
 	setpci -s "$BDF" "$REG_DATA.L=$(printf '%08x' "$command")"
 	for i in $(seq 1 40); do
 		data=$(read_reg "$BDF" "$REG_DATA")
 		status=$(read_reg "$BDF" "$REG_STAT")
 		((data & GO_BIT)) && go_seen=yes
 		[[ "$status" != "$status0" ]] && changed=yes
 		if ((i <= 3)) || [[ "$changed" == yes ]]; then
 			printf '  poll %-2d DATA=%s STATUS=%s\n' "$i" "$data" "$status"
 		fi
 		((data & GO_BIT)) || break
 		sleep 0.005
 	done
 	data=$(read_reg "$BDF" "$REG_DATA")
 	status=$(read_reg "$BDF" "$REG_STAT")
 	ctrl=$(read_reg "$BDF" "$REG_CTRL")
 	echo "  final DATA=$data STATUS=$status CTRL=$ctrl"
 	echo "  GO observed set: $go_seen"
 	echo "  STATUS changed:  $changed  (baseline $status0)"
 	if ((status & STAT_ERROR)); then
 		echo "  -> ERROR/NACK bit set: the engine ran the transaction and the"
 		echo "     device did not answer, which is the expected result here."
 	fi
 	echo
 }
 # 1: exactly what the driver writes - toggle bit forced to 1.
 issue $((COMMAND_TOGGLE | GO_BIT | (ADDR << 8) | REG)) "same toggle as the driver"
 # 2: the toggle bit inverted relative to what is in the register now, in case
 #    the engine latches a command on a change of that bit rather than on GO.
 issue $(( ((original ^ COMMAND_TOGGLE) & COMMAND_TOGGLE) | GO_BIT | (ADDR << 8) | REG )) \
 	"toggle bit inverted"
 echo "=== verdict ==="
 final_status=$(read_reg "$BDF" "$REG_STAT")
 if [[ "$final_status" != "$status0" ]]; then
 	cat <<-EOF
 	CF8/CFC STARTED A TRANSACTION.
 	STATUS moved from $status0 to $final_status without any ECAM access.
 	The premise of the ECAM patch does not hold: the driver can use
 	pci_read_config_dword() and pci_write_config_dword() like any other
 	driver, and patch 1/2 of the series is unnecessary.
 	EOF
 else
 	cat <<-EOF
 	NO TRANSACTION.
 	The register accepted the write (probe-cf8-write.sh proved that) but the
 	engine did not act on it: STATUS never moved from $status0. This is the
 	evidence patch 1/2 needs - the failure is not a filtered write, it is a
 	command the engine ignores when it arrives this way.
 	Re-run the same command through the driver's ECAM path to complete the
 	comparison.
 	EOF
 fi
@@ -46,13 +46,13 @@ deadline=$((SECONDS + SECONDS_TOTAL))
 while ((SECONDS < deadline)); do
 	sleep "$INTERVAL"
 	mapfile -t current < <(snapshot_regs "$BDF")
-	((samples++))
+	samples=$((samples + 1))
 	for i in "${!current[@]}"; do
 		if [[ "${current[i]}" != "${previous[i]}" ]]; then
 			printf '%s CHANGE %s -> %s\n' \
 				"$(date -Is)" "${previous[i]}" "${current[i]}"
-			((changes++))
+			changes=$((changes + 1))
 		fi
 	done
 	previous=("${current[@]}")