Simone
637717dad0
A conf1 access is two I/O instructions (index on 0xCF8, data on 0xCFC) serialised against the kernel but not against SMM: an SMI landing between them, whose handler runs its own CF8/CFC dialogue without restoring the index, redirects our data phase to whatever register the firmware addressed last. The CMD write is covered by the landing check, but the DATA-register write has no readback, so its payload would land unnoticed in a foreign config register. Suspected (not proven) trigger of the ws1 poweroff hang: the wedge sits in the firmware's S5 path and the poison channel must be invisible to the driver, which this one is. Map the function's ECAM page from the ACPI MCFG table at probe and route every register touch through a single MMIO access, which no SMI can split. use_ecam=0 (load-time) restores the config-cycle baseline for A/B; MCFG lookup failure falls back automatically.
2 lines
13 B
Plaintext
2 lines
13 B
Plaintext
1.0.5-guard1
|