[PATCH 0/2] Fix amdgpu detection of pci=realloc

[PATCH 0/2] Fix amdgpu detection of pci=realloc

[Mario Limonciello]

amdgpu needs to know the bus number the platform assigned a device to
be able to match firmware images against the right device.

This was previously adjusted to be a soft filter due to
commit 11c141672045f ("drm/amdgpu: Fix VFCT bus number matching with
soft filter") where if everything but the number matched to take a device.

This however fails when there are two identical devices.  Instead save the
initial bus number to the PCI device structure and then match that.

Link: https://lore.kernel.org/linux-pci/20261015124843.203905-1-mario.limonciello@amd.com/
Link: https://lore.kernel.org/amd-gfx/20261019194106.2796150-1-alexander.deucher@amd.com/
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
---
Mario Limonciello (2):
      PCI: Preserve the initial bus number in pci_dev
      drm/amdgpu: Match VFCT using initial PCI bus number

 drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c | 17 +++--------------
 drivers/pci/probe.c                      |  1 +
 include/linux/pci.h                      |  1 +
 3 files changed, 5 insertions(+), 14 deletions(-)
---
base-commit: 87bba57a9f33e2b5e90d4ad70973675333182a2c
change-id: 20261019-vfct-regression-2142fc52852a

Best regards,
--  
Mario Limonciello <mario.limonciello@amd.com>

[PATCH 1/2] PCI: Preserve the initial bus number in pci_dev

[Mario Limonciello]

PCI bus numbers can be reassigned after device discovery, for example
during resource reallocation. Preserve the number seen at allocation
time so drivers can match devices using firmware-visible bus numbers.

Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
---
 drivers/pci/probe.c | 1 +
 include/linux/pci.h | 1 +
 2 files changed, 2 insertions(+)

diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index 27008e2ea5afc..580b288d5c64f 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -2508,6 +2508,7 @@ struct pci_dev *pci_alloc_dev(struct pci_bus *bus)
 	INIT_LIST_HEAD(&dev->bus_list);
 	dev->dev.type = &pci_dev_type;
 	dev->bus = pci_bus_get(bus);
+	dev->initial_bus_number = bus->number;
 	dev->driver_exclusive_resource = (struct resource) {
 		.name = "PCI Exclusive",
 		.start = 0,
diff --git a/include/linux/pci.h b/include/linux/pci.h
index 5ffcf5ce8c966..dae68b28ce051 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -363,6 +363,7 @@ struct pci_dev {
 	struct pci_slot	*slot;		/* Physical slot this device is in */
 
 	unsigned int	devfn;		/* Encoded device & function index */
+	u8		initial_bus_number;	/* Bus number when device was discovered */
 	unsigned short	vendor;
 	unsigned short	device;
 	unsigned short	subsystem_vendor;

-- 
2.43.0

[PATCH 2/2] drm/amdgpu: Match VFCT using initial PCI bus number

[Mario Limonciello]

VFCT records the PCI bus number from BIOS POST. The current bus number
can change after PCI core renumbers the bus, while accepting a mismatch
based only on device identity can select the wrong VFCT image when
matching devices are present. Compare against the bus number captured
when the PCI device was discovered.

Reported-by: Reza Nikzad Chaleshori <rezanikzadch@gmail.com>
Closes: https://lore.kernel.org/amd-gfx/20261014080523.186533-1-rezanikzadch@gmail.com/
Fixes: 11c141672045f ("drm/amdgpu: Fix VFCT bus number matching with soft filter")
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c | 17 +++--------------
 1 file changed, 3 insertions(+), 14 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c
index 08ed1eb695586..2b375e6b39d5f 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c
@@ -386,10 +386,8 @@ static bool amdgpu_read_disabled_bios(struct amdgpu_device *adev)
  * VFCT entries contain the PCI bus number as recorded during BIOS POST.
  * On systems where the kernel renumbers PCI buses (e.g. pci=realloc or
  * resource conflicts), the runtime bus number may differ from the POST
- * value.  Match by device identity (vendor + device + function) and use
- * the bus number as a preference: exact bus match is preferred, but when
- * the bus numbers disagree we accept the entry if the device identity
- * matches.
+ * value.  Match using the bus number captured when the device was
+ * discovered, before any bus renumbering.
  *
  * Returns: 0 on match, -ENODEV on no match
  */
@@ -405,16 +403,7 @@ static int amdgpu_acpi_vfct_match(struct amdgpu_device *adev,
 	    vhdr->PCIFunction != PCI_FUNC(adev->pdev->devfn))
 		return -ENODEV;
 
-	/* Exact bus number match - preferred */
-	if (vhdr->PCIBus == adev->pdev->bus->number)
-		return 0;
-
-	/* Bus mismatch but device identity matches (PCI renumbering case) */
-	dev_notice(adev->dev,
-		   "VFCT bus number mismatch: table %u != runtime %u, matching by device identity (vendor 0x%04x device 0x%04x)\n",
-		   vhdr->PCIBus, adev->pdev->bus->number,
-		   adev->pdev->vendor, adev->pdev->device);
-	return 0;
+	return vhdr->PCIBus == adev->pdev->initial_bus_number ? 0 : -ENODEV;
 }
 
 static bool amdgpu_acpi_vfct_bios(struct amdgpu_device *adev)

-- 
2.43.0

Re: [PATCH 1/2] PCI: Preserve the initial bus number in pci_dev

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] PCI: NULL pointer dereference in pci_alloc_dev() when bus is NULL
--

commit 8257f74f7a4f8e2e670cc3291997e9d0a2cd7a56
Author: Mario Limonciello <mario.limonciello@amd.com>

PCI: Preserve the initial bus number in pci_dev

This commit adds an initial_bus_number field to struct pci_dev and populates
it during pci_alloc_dev() so drivers can match devices using their initial
firmware-visible bus number even after bus number reassignment.

> diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
> index 27008e2ea5afc..580b288d5c64f 100644
> --- a/drivers/pci/probe.c
> +++ b/drivers/pci/probe.c
> @@ -2508,6 +2508,7 @@ struct pci_dev *pci_alloc_dev(struct pci_bus *bus)
>  	INIT_LIST_HEAD(&dev->bus_list);
>  	dev->dev.type = &pci_dev_type;
>  	dev->bus = pci_bus_get(bus);
> +	dev->initial_bus_number = bus->number;

[Severity: High]
Can bus be NULL here?

pci_bus_get() in drivers/pci/bus.c explicitly checks if bus is NULL before
dereferencing it:

struct pci_bus *pci_bus_get(struct pci_bus *bus)
{
	if (bus)
		get_device(&bus->dev);
	return bus;
}

There are also several in-tree callers that pass NULL to pci_alloc_dev(),
such as make_local_pdev() in drivers/scsi/megaraid.c, alpha_core_agp_setup()
in drivers/char/agp/alpha-agp.c, and parisc_agp_setup() in
drivers/char/agp/parisc-agp.c:

	*pdev = pci_alloc_dev(NULL);

Wouldn't dereferencing bus->number unconditionally in pci_alloc_dev() cause
a NULL pointer dereference for these callers?

>  	dev->driver_exclusive_resource = (struct resource) {
>  		.name = "PCI Exclusive",
>  		.start = 0,

[ ... ]

>
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261019-vfct-regression-v1-0-5a63ddd378dd@amd.com?part=1

Re: [PATCH 2/2] drm/amdgpu: Match VFCT using initial PCI bus number

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] drm/amdgpu: amdgpu_acpi_vfct_match() uses post-renumbering initial_bus_number
--

commit 1c0de5f9175b6acb9431f78243e7c9f86e945b98
Author: Mario Limonciello <mario.limonciello@amd.com>

drm/amdgpu: Match VFCT using initial PCI bus number

This commit updates amdgpu_acpi_vfct_match() to match the VFCT header's
PCIBus field against adev->pdev->initial_bus_number instead of accepting
bus mismatches based on device identity alone.

> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c
> index f9315e0472fe9..7b66dc2414250 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c
> @@ -436,10 +436,8 @@ static bool amdgpu_read_disabled_bios(struct amdgpu_device *adev)
>   * VFCT entries contain the PCI bus number as recorded during BIOS POST.
>   * On systems where the kernel renumbers PCI buses (e.g. pci=realloc or
>   * resource conflicts), the runtime bus number may differ from the POST
> - * value.  Match by device identity (vendor + device + function) and use
> - * the bus number as a preference: exact bus match is preferred, but when
> - * the bus numbers disagree we accept the entry if the device identity
> - * matches.
> + * value.  Match using the bus number captured when the device was
> + * discovered, before any bus renumbering.
>   *
>   * Returns: 0 on match, -ENODEV on no match
>   */
> @@ -455,16 +453,7 @@ static int amdgpu_acpi_vfct_match(struct amdgpu_device *adev,
>  	    vhdr->PCIFunction != PCI_FUNC(adev->pdev->devfn))
>  		return -ENODEV;
>  
> -	/* Exact bus number match - preferred */
> -	if (vhdr->PCIBus == adev->pdev->bus->number)
> -		return 0;
> -
> -	/* Bus mismatch but device identity matches (PCI renumbering case) */
> -	dev_notice(adev->dev,
> -		   "VFCT bus number mismatch: table %u != runtime %u, matching by device identity (vendor 0x%04x device 0x%04x)\n",
> -		   vhdr->PCIBus, adev->pdev->bus->number,
> -		   adev->pdev->vendor, adev->pdev->device);
> -	return 0;
> +	return vhdr->PCIBus == adev->pdev->initial_bus_number ? 0 : -ENODEV;
>  }

[Severity: High]
Does adev->pdev->initial_bus_number actually hold the BIOS POST bus number
when the PCI core renumbers a bridge?

In drivers/pci/probe.c, pci_alloc_dev() initializes initial_bus_number when
the pci_dev structure is allocated during pci_scan_device():

drivers/pci/probe.c:pci_alloc_dev() {
    ...
    dev->bus = pci_bus_get(bus);
    dev->initial_bus_number = bus->number;
    ...
}

However, when pci_scan_bridge_extend() renumbers a bridge (for example, when
pcibios_assign_all_busses() is true or when the firmware bridge configuration
is broken/conflicting), it skips scanning behind the bridge during pass 0 and
clears the firmware bus numbers in the bridge's PCI_PRIMARY_BUS register:

drivers/pci/probe.c:pci_scan_bridge_extend() {
    ...
        if (!pass) {
            if (pcibios_assign_all_busses() || broken)
                pci_write_config_dword(dev, PCI_PRIMARY_BUS,
                                       buses & PCI_SEC_LATENCY_TIMER_MASK);
            goto out;
        }
    ...
        child = pci_find_bus(pci_domain_nr(bus), next_busnr);
        if (!child) {
            child = pci_add_new_bus(bus, dev, next_busnr);
            ...
        }
        ...
        max = pci_scan_child_bus_extend(child, available_buses);
}

The child pci_bus and its devices are only allocated and scanned in pass 1,
after child->number has already been set to the newly assigned next_busnr in
pci_add_new_bus() -> pci_alloc_child_bus(). Because bus->number is not
changed after child bus creation, pdev->initial_bus_number is always equal to
the post-renumbering runtime pdev->bus->number.

When the kernel renumbers the PCI bus hierarchy leading to the GPU during
amdgpu_device_init() -> amdgpu_get_bios() -> amdgpu_acpi_vfct_bios() ->
amdgpu_acpi_vfct_match(), won't vhdr->PCIBus == adev->pdev->initial_bus_number
evaluate to false and return -ENODEV, causing VFCT VBIOS lookup to fail just
as it did before commit 11c141672045f ("drm/amdgpu: Fix VFCT bus number
matching with soft filter")?

>  
>  static bool amdgpu_acpi_vfct_bios(struct amdgpu_device *adev)

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261019-vfct-regression-v1-0-5a63ddd378dd@amd.com?part=2

Re: [PATCH 0/2] Fix amdgpu detection of pci=realloc

[Mario Limonciello]

On 10/19/26 20:44, Mario Limonciello wrote:
> amdgpu needs to know the bus number the platform assigned a device to
> be able to match firmware images against the right device.
> 
> This was previously adjusted to be a soft filter due to
> commit 11c141672045f ("drm/amdgpu: Fix VFCT bus number matching with
> soft filter") where if everything but the number matched to take a device.
> 
> This however fails when there are two identical devices.  Instead save the
> initial bus number to the PCI device structure and then match that.
> 
> Link: https://lore.kernel.org/linux-pci/20261015124843.203905-1-mario.limonciello@amd.com/
> Link: https://lore.kernel.org/amd-gfx/20261019194106.2796150-1-alexander.deucher@amd.com/
> Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
> ---
> Mario Limonciello (2):
>        PCI: Preserve the initial bus number in pci_dev
>        drm/amdgpu: Match VFCT using initial PCI bus number
> 
>   drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c | 17 +++--------------
>   drivers/pci/probe.c                      |  1 +
>   include/linux/pci.h                      |  1 +
>   3 files changed, 5 insertions(+), 14 deletions(-)
> ---
> base-commit: 87bba57a9f33e2b5e90d4ad70973675333182a2c
> change-id: 20261019-vfct-regression-2142fc52852a
> 
> Best regards,
> --
> Mario Limonciello <mario.limonciello@amd.com>

I think Sashiko is right on the feedback.  I'll iterate further on it.

RE: [PATCH 2/2] drm/amdgpu: Match VFCT using initial PCI bus number

[Deucher, Alexander]

Public

> -----Original Message-----
> From: Limonciello, Mario <Mario.Limonciello@amd.com>
> Sent: Monday, October 19, 2026 9:45 PM
> To: Bjorn Helgaas <helgaas@kernel.org>; Deucher, Alexander
> <Alexander.Deucher@amd.com>
> Cc: Oz Tiram <oz@shift-computing.de>; linux-pci@vger.kernel.org; linux-
> kernel@vger.kernel.org; amd-gfx@lists.freedesktop.org; dri-
> devel@lists.freedesktop.org; Limonciello, Mario
> <Mario.Limonciello@amd.com>; Reza Nikzad Chaleshori
> <rezanikzadch@gmail.com>
> Subject: [PATCH 2/2] drm/amdgpu: Match VFCT using initial PCI bus number
>
> VFCT records the PCI bus number from BIOS POST. The current bus number
> can change after PCI core renumbers the bus, while accepting a mismatch
> based only on device identity can select the wrong VFCT image when matching
> devices are present. Compare against the bus number captured when the PCI
> device was discovered.
>
> Reported-by: Reza Nikzad Chaleshori <rezanikzadch@gmail.com>
> Closes: https://lore.kernel.org/amd-gfx/20261014080523.186533-1-
> rezanikzadch@gmail.com/
> Fixes: 11c141672045f ("drm/amdgpu: Fix VFCT bus number matching with
> soft filter")
> Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>

Radeon needs a similar fix.

Alex

> ---
>  drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c | 17 +++--------------
>  1 file changed, 3 insertions(+), 14 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c
> b/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c
> index 08ed1eb695586..2b375e6b39d5f 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c
> @@ -386,10 +386,8 @@ static bool amdgpu_read_disabled_bios(struct
> amdgpu_device *adev)
>   * VFCT entries contain the PCI bus number as recorded during BIOS POST.
>   * On systems where the kernel renumbers PCI buses (e.g. pci=realloc or
>   * resource conflicts), the runtime bus number may differ from the POST
> - * value.  Match by device identity (vendor + device + function) and use
> - * the bus number as a preference: exact bus match is preferred, but when
> - * the bus numbers disagree we accept the entry if the device identity
> - * matches.
> + * value.  Match using the bus number captured when the device was
> + * discovered, before any bus renumbering.
>   *
>   * Returns: 0 on match, -ENODEV on no match
>   */
> @@ -405,16 +403,7 @@ static int amdgpu_acpi_vfct_match(struct
> amdgpu_device *adev,
>           vhdr->PCIFunction != PCI_FUNC(adev->pdev->devfn))
>               return -ENODEV;
>
> -     /* Exact bus number match - preferred */
> -     if (vhdr->PCIBus == adev->pdev->bus->number)
> -             return 0;
> -
> -     /* Bus mismatch but device identity matches (PCI renumbering case)
> */
> -     dev_notice(adev->dev,
> -                "VFCT bus number mismatch: table %u != runtime %u,
> matching by device identity (vendor 0x%04x device 0x%04x)\n",
> -                vhdr->PCIBus, adev->pdev->bus->number,
> -                adev->pdev->vendor, adev->pdev->device);
> -     return 0;
> +     return vhdr->PCIBus == adev->pdev->initial_bus_number ? 0 : -
> ENODEV;
>  }
>
>  static bool amdgpu_acpi_vfct_bios(struct amdgpu_device *adev)
>
> --
> 2.43.0