Simone
88a8b7eb27
v2 said firmware filters CF8/CFC config writes to this function and that
the registers are reachable only through ECAM. That was never tested; the
only evidence was the boot line "PCI: Using configuration type 1", which
names the accessor and says nothing about a write failing.
Measured on the board, driver unloaded:
# setpci -s 16:1e.5 9c.L=20085002 # read SPD 0x50 register 0x02
# setpci -s 16:1e.5 9c.L
20005002 # GO consumed by the engine
# setpci -s 16:1e.5 a8.L
0000500c # READ_DONE, no error
# setpci -s 16:1e.5 b4.L
0000000c # SPD byte 2, DDR4 type code
The command executes and returns correct data through the ordinary
accessors, and MSR_SMI_COUNT does not move across it. So the driver now
uses pci_read_config_dword() and pci_write_config_dword(), the submission
is a single patch again, and nothing in it touches the PCI core. The
cover letter retracts the claim explicitly rather than dropping it
quietly, because v2 was posted with it.
Correctness work in the same pass:
- the completion bits are latched, so a command word that never reaches
the register is indistinguishable from a completed transfer and the
caller gets the previous transaction's data. Read the command word
back and require it to be the one just written; the engine only ever
clears GO, which the measurement above shows directly;
- compare the command registers after every transfer against what the
driver left in them and fail with -EAGAIN on a mismatch. The original
iMC driver had this check and it is what makes an unarbitrated system
detectable instead of silently wrong;
- use the i2c core's suspended-adapter mechanism rather than a private
flag and -EHOSTDOWN;
- use devm_mutex_init(), drop the unnecessary pci_enable_device(), and
return -ENODEV rather than -EPERM from the default-off gate, which was
printing a driver-core error on every boot;
- mask GO when restoring a saved command word.
An earlier version of the latched-DONE check required the GO bit to be
seen set or the status word to change. That was wrong: repeated transfers
with the same outcome leave STATUS bit for bit identical, and GO is
consumed faster than a config read-back can observe it. It produced false
positives on 3 of 15 smoke-test items before being replaced.
Add Documentation/i2c/busses/i2c-imc-skylake.rst, which every other PC
SMBus driver has and which was asked for on the 2020 iMC thread, and the
tools/ scripts for the hardware measurements: probe-cf8-write.sh and
probe-cf8-transaction.sh produced the result above, dump-pcu-config.sh is
the search for a TSOD polling control, watch-engine.sh is the firmware
activity measurement.
Smoke test on the X299 system with the current module: 15 checks, 0
failures, dmesg clean.
Hardware measurements still owed to the submission
Three scripts, meant to be run by hand on an X299 (or Cascade Lake-X) system
with the PCU function 8086:2085. None of them is run by CI and none is run by
make test.
Output of all three belongs in the cover letter or in a reply on the list, as raw numbers. Do not paraphrase them.
| Script | Answers | Writes to hardware |
|---|---|---|
watch-engine.sh |
Is firmware using the engine on this system? | no |
dump-pcu-config.sh |
Which PCU registers move on their own? Is there a TSOD polling control? | no |
probe-cf8-write.sh |
Is the CF8/CFC write really dropped, and does it raise an SMI? | yes, requires --i-understand |
1. watch-engine.sh — foreign activity (read-only)
Samples the six per-channel registers and reports every change that this system's Linux side did not cause. Run it with the driver unloaded, so that anything observed is firmware.
sudo ./tools/watch-engine.sh --seconds 3600
What the cover letter needs: a run of at least one hour, ideally across a suspend/resume cycle, with the observed change count. A non-zero count on a system means the driver must not be loaded there, and is itself a result worth reporting.
2. dump-pcu-config.sh — register survey (read-only)
Dumps the function's 4 KB config space twice and diffs them, then prints the neighbourhood of the offsets that matter.
sudo ./tools/dump-pcu-config.sh --settle 10
This is the search for the open item F2: the Broadwell-E iMC driver stops the
PCU's TSOD polling for the duration of a transfer by writing 0 to TSODCNTL
at offset 0xe0 of its PCU function, waiting 10 ms for in-flight transactions
to drain, and restoring the value afterwards. No equivalent register has been
identified on 8086:2085. A field that changes on its own with a fixed cadence
is the first candidate.
3. probe-cf8-write.sh — the dropped write (WRITES TO HARDWARE)
This is the only script that writes. It changes the register/offset field of a
command register while the GO bit is clear, which does not start an SMBus
transaction, then reads it back and reports whether the write stuck. It also
reads MSR_SMI_COUNT (0x34) on every CPU before and after.
sudo ./tools/probe-cf8-write.sh --i-understand
Two results matter:
- the value does not read back → the claim "CF8/CFC writes to this function do not take effect" is confirmed on the tested board;
- the SMI delta is 0 → the behaviour is not System Management Mode, and the driver's comments and the cover letter must not say it is.
Requirements: msr-tools (rdmsr), pciutils (setpci, lspci), and the
msr module (modprobe msr).