Re: [PATCH] PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608]

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Unchecked cross-device configuration space write to upstream bridge
--

--- Patch [1]: [PATCH] PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] ---
commit 675033e8622336b73d3cde73c4a110a428c76dc5
Author: Tim Harvey <tharvey@gateworks.com>

PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608]

This commit adds a PCI ACS quirk for the Pericom PI7C9X2G608 switch to
address erratum E2. It applies the existing store-forward workaround to
device ID 0x2608.

> diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
> index b09f27f7846fc..27f7d56c9ac39 100644
> --- a/drivers/pci/quirks.c
> +++ b/drivers/pci/quirks.c
> @@ -6263,6 +6263,10 @@ DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_PERICOM, 0xb404,
>  			 pci_fixup_pericom_acs_store_forward);
>  DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_PERICOM, 0xb404,
>  			 pci_fixup_pericom_acs_store_forward);
> +DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_PERICOM, 0x2608,
> +			 pci_fixup_pericom_acs_store_forward);
> +DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_PERICOM, 0x2608,
> +			 pci_fixup_pericom_acs_store_forward);

[Severity: High]
This is a pre-existing issue, but does pci_fixup_pericom_acs_store_forward()
safely verify its upstream bridge?

Looking at the callback:

drivers/pci/quirks.c:pci_fixup_pericom_acs_store_forward() {
        ...
        upstream = pci_upstream_bridge(pdev);
        if (!upstream)
                return;

        pci_read_config_word(upstream, PI7C9X2Gxxx_MODE_REG, &val);
        if (!(val & PI7C9X2Gxxx_STORE_FORWARD_MODE)) {
                pci_write_config_word(upstream, PI7C9X2Gxxx_MODE_REG, val |
                                      PI7C9X2Gxxx_STORE_FORWARD_MODE);
        }
}

Because it finds the upstream bridge and unconditionally writes to offset
0x74 (PI7C9X2Gxxx_MODE_REG) without checking if the upstream bridge is
actually a Pericom device, could this corrupt standard PCI capabilities
such as MSI-X tables?

If a Pericom switch is passed through to a guest via VFIO, the upstream
bridge in the guest's virtual topology might be a generic virtual Root Port
rather than a Pericom device, exposing the guest kernel to configuration
space corruption.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260720215718.2139510-1-tharvey@gateworks.com?part=1