From ff8a969f7dc8e79ea6113abcfa983e070b2b585a Mon Sep 17 00:00:00 2001 From: "Maciej W. Rozycki" Date: Sat, 1 Aug 2026 22:11:48 +0200 Subject: [PATCH 1/3] PCI: Skip Target Speed quirk on clamped ports with no link Since commit 72780f796468 ("PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining") the Target Speed quirk lifts a firmware-imposed 2.5GT/s restriction on any downstream port, without checking whether the link is up. Where nothing is plugged in, the retraining that follows can never complete, so each attempt costs PCIE_LINK_RETRAIN_TIMEOUT_MS. The quirk makes two of them -- the initial one and the restore on the error path -- adding a fixed 2 s to every boot. On an MSI PRO Z690-A WIFI DDR4 (Intel 600 Series PCH) with one empty x1 slot, running v7.2-rc5: 0.541 pci 0000:00:1c.0: removing 2.5GT/s downstream link speed restriction 1.541 pci 0000:00:1c.0: retraining failed 2.541 pci 0000:00:1c.2: [8086:7aba] type 01 class 0x060400 Where the Link Speed has already been clamped at 2.5GT/s and no link has been established there is nothing worth doing, which is what the kerneldoc for the quirk already describes: the restriction is to be lifted where firmware arranged it "and the port reports its link already being up". Bail out early in that case, before either the ASM2824 workaround or the removal of the restriction is considered. Ports whose link is up are unaffected, and so is the ASM2824 workaround, which is reached with the Target Link Speed not clamped. With this applied the quirk returns without touching the port: both messages are gone, enumeration proceeds from 0000:00:1c.0 to 0000:00:1c.2 in 1 ms rather than 2 s, and the systemd "kernel" boot phase goes from 3.011 s to 1.036 s. Fixes: 72780f796468 ("PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining") Reported-by: Andreas Wild Closes: https://lore.kernel.org/lkml/20260801092152.5643-1-andiwild@gmail.com/ Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221801 Signed-off-by: Maciej W. Rozycki Signed-off-by: Andreas Wild Signed-off-by: Bjorn Helgaas Tested-by: Andreas Wild Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260801201244.4421-1-andiwild@gmail.com --- drivers/pci/quirks.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c index de9bbccda21f..7cbdbdd5ddc8 100644 --- a/drivers/pci/quirks.c +++ b/drivers/pci/quirks.c @@ -108,7 +108,11 @@ int pcie_failed_link_retrain(struct pci_dev *dev) pcie_capability_read_word(dev, PCI_EXP_LNKSTA, &lnksta); pcie_capability_read_word(dev, PCI_EXP_LNKCTL2, &oldlnkctl2); - if (!(lnksta & PCI_EXP_LNKSTA_DLLLA) && pcie_lbms_seen(dev, lnksta)) { + if (lnksta & PCI_EXP_LNKSTA_DLLLA) { + ; + } else if (PCIE_LNKCTL2_TLS2SPEED(oldlnkctl2) == PCIE_SPEED_2_5GT) { + return ret; + } else if (pcie_lbms_seen(dev, lnksta)) { pci_info(dev, "broken device, retraining non-functional downstream link at 2.5GT/s\n"); ret = pcie_set_target_speed(dev, PCIE_SPEED_2_5GT, false); if (ret) From 5f30217ec296fb5742f6fd306586dbca5b81b4eb Mon Sep 17 00:00:00 2001 From: Imre Kaloz Date: Wed, 30 Sep 2026 21:10:58 +0200 Subject: [PATCH 2/3] PCI: Disable MSI for ULi M1575 EHCI controller With MSI, the ULi M1575 EHCI controller (10b9:5239) intermittently stops executing its asynchronous schedule. Control transfers time out ("device not accepting address", "device descriptor read/64"), the port is handed to the companion OHCI controller, and the device ends up at full speed. On a configured hub the stall shows up as hub descriptor and status read failures. Only re-initializing the controller recovers it. On a Sun Ultra 45, 65 of 800 controller initializations stalled with MSI and none of 200 with INTx. Each initialization is an unbind and bind of ehci-pci on the EHCI function, with MSI or INTx selected through its msi_bus attribute; with this quirk, 0 of 100 cycles of the same loop stalled. The stall reproduces on a kernel that already contains commit 0b60557230ad ("usb: ehci: Prevent missed ehci interrupts with edge-triggered MSI"). The OHCI functions (10b9:5237) keep MSI. They showed no stall, and the hub enumerated through them on MSI during the EHCI failures, so only the EHCI function is quirked. The illumos EHCI driver also disables MSI on this chip, in ehci_register_intrs_and_init_mutex() in usr/src/uts/common/io/usb/hcd/ehci/ehci_util.c. Until USB HCDs started trying MSI first in v5.9, the controller always used INTx. Disable MSI so it uses INTx again on this chipset. Fixes: 306c54d0edb6 ("usb: hcd: Try MSI interrupts on PCI devices") Signed-off-by: Imre Kaloz Signed-off-by: Bjorn Helgaas Reviewed-by: Andy Shevchenko Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260930191100.6127-1-kaloz@kernel.org --- drivers/pci/quirks.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c index 7cbdbdd5ddc8..010822baee34 100644 --- a/drivers/pci/quirks.c +++ b/drivers/pci/quirks.c @@ -1945,6 +1945,8 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x4388, quirk_no_msi); DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x4389, quirk_no_msi); DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x438a, quirk_no_msi); DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x438b, quirk_no_msi); +/* ULi M1575 EHCI (10b9:5239): MSI stalls the async schedule */ +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AL, 0x5239, quirk_no_msi); static void quirk_pcie_mch(struct pci_dev *pdev) { From 6aaa3f42e3410ea8e26c857477260159f724cb1d Mon Sep 17 00:00:00 2001 From: Mohamad Raizudeen Date: Thu, 3 Sep 2026 22:16:15 +0530 Subject: [PATCH 3/3] PCI: Fix out-of-bounds MMIO read in nvme_disable_and_flr() In nvme_disable_and_flr(), the PCI bar is mapped using NVME_REG_CC + sizeof(cfg) which is (0x14 + 4 = 0x18 bytes) However, the function later reads the controller status from NVME_REG_CSTS - offset 0x1C, which is outside the mapped 0x18 byte boundary. This violates the API contract. Fix this by increasing the mapping size to include NVME_REG_CSTS. Also change sizeof(cfg) to sizeof(u32) to make the intent clearer. Fixes: ffb0863426eb9 ("PCI: Disable Samsung SM961/PM961 NVMe before FLR") Signed-off-by: Mohamad Raizudeen Signed-off-by: Bjorn Helgaas Reviewed-by: Alex Williamson Link: https://patch.msgid.link/20260903164615.5744-1-raizudeen.kerneldev@gmail.com --- drivers/pci/quirks.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c index 010822baee34..0256bc15d0d1 100644 --- a/drivers/pci/quirks.c +++ b/drivers/pci/quirks.c @@ -4099,7 +4099,7 @@ static int nvme_disable_and_flr(struct pci_dev *dev, bool probe) if (probe) return 0; - bar = pci_iomap(dev, 0, NVME_REG_CC + sizeof(cfg)); + bar = pci_iomap(dev, 0, NVME_REG_CSTS + sizeof(u32)); if (!bar) return -ENOTTY;