[PATCH v7 0/2] PCI: of: Remove max-link-speed generation validation

[PATCH v7 0/2] PCI: of: Remove max-link-speed generation validation

[Hans Zhang]

This series removes the hardcoded max-link-speed validation from
of_pci_get_max_link_speed() to avoid updating the kernel for every new
PCIe generation. As pointed out by Bjorn Helgaas, the removal must be
accompanied by proper validation in callers to ensure robustness.
Therefore, this series also adds validation in the DWC controller driver,
which is a primary user of this function.

Patch 1 simplifies of_pci_get_max_link_speed() by returning the raw
property value (including error codes) without imposing an artificial
upper bound. Patch 2 introduces dw_pcie_get_link_speed() in the DWC core
to validate the retrieved speed against the known pcie_link_speed array,
falling back to Gen1 (safe default) if the value is missing or invalid.

---
Changes for v7:
- Add validation in dw_pcie_get_link_speed() (Bjorn)
- Modify it so that two patches constitute one series.

Changes for v6:
https://patchwork.kernel.org/project/linux-pci/patch/20251218132036.308094-1-18255117159@163.com/

- It'd be good to return the actual errno as of_property_read_u32() can return
  -EINVAL, -ENODATA and -EOVERFLOW. (Mani)

Changes for v5:
https://patchwork.kernel.org/project/linux-pci/patch/20251218125909.305300-1-18255117159@163.com/

- Delete the check for speed. (Mani)

Changes for v4:
https://patchwork.kernel.org/project/linux-pci/patch/20251105134701.182795-1-18255117159@163.com/

- Add pcie_max_supported_link_speed.(Ilpo)

Changes for v3:
https://patchwork.kernel.org/project/linux-pci/patch/20251101164132.14145-1-18255117159@163.com/

- Modify the commit message.
- Add Reviewed-by tag.

Changes for v2:
https://patchwork.kernel.org/project/linux-pci/cover/20250529021026.475861-1-18255117159@163.com/
- The following files have been deleted:
  Documentation/devicetree/bindings/pci/pci.txt

  Update to this file again:
  dtschema/schemas/pci/pci-bus-common.yaml
---

Hans Zhang (2):
  PCI: of: Remove max-link-speed generation validation
  PCI: dwc: Validate max-link-speed property

 drivers/pci/controller/dwc/pcie-designware.c | 29 +++++++++++++++++++-
 drivers/pci/of.c                             |  7 +++--
 2 files changed, 32 insertions(+), 4 deletions(-)


base-commit: c23719abc3308df7ed3ad35650ad211fb2d2003d
-- 
2.34.1

[PATCH v7 1/2] PCI: of: Remove max-link-speed generation validation

[Hans Zhang]

The of_pci_get_max_link_speed() function currently validates the
"max-link-speed" DT property to be in the range 1..4 (Gen1..Gen4).
This imposes a maintenance burden because each new PCIe generation
would require updating this validation.

Remove the range check so the function returns the raw property value
(or a negative error code if the property is missing or malformed).
Callers must now validate the returned speed against the range they
support.  A subsequent patch adds such validation to the DWC driver,
which is the primary user of this function.

This change allows future PCIe generations to be supported without
modifying drivers/pci/of.c.

Signed-off-by: Hans Zhang <18255117159@163.com>
Acked-by: Manivannan Sadhasivam <mani@kernel.org>
---
 drivers/pci/of.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/pci/of.c b/drivers/pci/of.c
index 9f8eb5df279e..cff5fd337c2b 100644
--- a/drivers/pci/of.c
+++ b/drivers/pci/of.c
@@ -889,10 +889,11 @@ EXPORT_SYMBOL_GPL(of_pci_supply_present);
 int of_pci_get_max_link_speed(struct device_node *node)
 {
 	u32 max_link_speed;
+	int ret;
 
-	if (of_property_read_u32(node, "max-link-speed", &max_link_speed) ||
-	    max_link_speed == 0 || max_link_speed > 4)
-		return -EINVAL;
+	ret = of_property_read_u32(node, "max-link-speed", &max_link_speed);
+	if (ret)
+		return ret;
 
 	return max_link_speed;
 }
-- 
2.34.1

[PATCH v7 2/2] PCI: dwc: Validate max-link-speed property

[Hans Zhang]

With the removal of hardcoded upper bound in of_pci_get_max_link_speed(),
the DWC driver must now validate the retrieved speed value before using
it as an index into the pcie_link_speed array. Invalid values (missing,
out of range, or mapping to PCI_SPEED_UNKNOWN) could lead to out-of-bounds
access or incorrect link configuration.

Introduce dw_pcie_get_link_speed() to handle the property retrieval and
validation. If the property is missing or invalid, fall back to Gen1 (1)
and issue a warning. This ensures safe operation while allowing future
PCIe generations to be supported without code changes in the validation
logic.

Signed-off-by: Hans Zhang <18255117159@163.com>
---
 drivers/pci/controller/dwc/pcie-designware.c | 29 +++++++++++++++++++-
 1 file changed, 28 insertions(+), 1 deletion(-)

diff --git a/drivers/pci/controller/dwc/pcie-designware.c b/drivers/pci/controller/dwc/pcie-designware.c
index 5741c09dde7f..e10cd7a0fee1 100644
--- a/drivers/pci/controller/dwc/pcie-designware.c
+++ b/drivers/pci/controller/dwc/pcie-designware.c
@@ -110,6 +110,33 @@ static int dw_pcie_get_resets(struct dw_pcie *pci)
 	return 0;
 }
 
+static void dw_pcie_get_link_speed(struct dw_pcie *pci)
+{
+	struct device_node *np = dev_of_node(pci->dev);
+	int max_speed;
+
+	max_speed = of_pci_get_max_link_speed(np);
+	if (max_speed < 0) {
+		dev_warn(pci->dev,
+			 "Failed to get max-link-speed, using default (Gen1)\n");
+		pci->max_link_speed = 1;
+		return;
+	}
+
+	/* Validate against known speeds in pcie_link_speed */
+	if (max_speed == 0 ||
+	    max_speed >= ARRAY_SIZE(pcie_link_speed) ||
+	    pcie_link_speed[max_speed] == PCI_SPEED_UNKNOWN) {
+		dev_warn(pci->dev,
+			 "Invalid max-link-speed %d, using default (Gen1)\n",
+			 max_speed);
+		pci->max_link_speed = 1;
+		return;
+	}
+
+	pci->max_link_speed = max_speed;
+}
+
 int dw_pcie_get_resources(struct dw_pcie *pci)
 {
 	struct platform_device *pdev = to_platform_device(pci->dev);
@@ -189,7 +216,7 @@ int dw_pcie_get_resources(struct dw_pcie *pci)
 	}
 
 	if (pci->max_link_speed < 1)
-		pci->max_link_speed = of_pci_get_max_link_speed(np);
+		dw_pcie_get_link_speed(pci);
 
 	of_property_read_u32(np, "num-lanes", &pci->num_lanes);
 
-- 
2.34.1

Re: [PATCH v7 2/2] PCI: dwc: Validate max-link-speed property

[kernel test robot]

Hi Hans,

kernel test robot noticed the following build errors:

[auto build test ERROR on c23719abc3308df7ed3ad35650ad211fb2d2003d]

url:    https://github.com/intel-lab-lkp/linux/commits/Hans-Zhang/PCI-of-Remove-max-link-speed-generation-validation/20260308-223128
base:   c23719abc3308df7ed3ad35650ad211fb2d2003d
patch link:    https://lore.kernel.org/r/20260308142629.75392-3-18255117159%40163.com
patch subject: [PATCH v7 2/2] PCI: dwc: Validate max-link-speed property
config: csky-randconfig-r071-20260308 (https://download.01.org/0day-ci/archive/20260309/202603090252.S3qQ67Kh-lkp@intel.com/config)
compiler: csky-linux-gcc (GCC) 10.5.0
smatch: v0.5.0-9004-gb810ac53
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260309/202603090252.S3qQ67Kh-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202603090252.S3qQ67Kh-lkp@intel.com/

All errors (new ones prefixed by >>):

   In file included from include/linux/kernel.h:16,
                    from include/linux/clk.h:13,
                    from drivers/pci/controller/dwc/pcie-designware.c:13:
   drivers/pci/controller/dwc/pcie-designware.c: In function 'dw_pcie_get_link_speed':
>> include/linux/array_size.h:11:32: error: invalid application of 'sizeof' to incomplete type 'const unsigned char[]'
      11 | #define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]) + __must_be_array(arr))
         |                                ^
   drivers/pci/controller/dwc/pcie-designware.c:128:19: note: in expansion of macro 'ARRAY_SIZE'
     128 |      max_speed >= ARRAY_SIZE(pcie_link_speed) ||
         |                   ^~~~~~~~~~


vim +11 include/linux/array_size.h

3cd39bc3b11b8d Alejandro Colomar 2023-10-03   6  
3cd39bc3b11b8d Alejandro Colomar 2023-10-03   7  /**
3cd39bc3b11b8d Alejandro Colomar 2023-10-03   8   * ARRAY_SIZE - get the number of elements in array @arr
3cd39bc3b11b8d Alejandro Colomar 2023-10-03   9   * @arr: array to be sized
3cd39bc3b11b8d Alejandro Colomar 2023-10-03  10   */
3cd39bc3b11b8d Alejandro Colomar 2023-10-03 @11  #define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]) + __must_be_array(arr))
3cd39bc3b11b8d Alejandro Colomar 2023-10-03  12  

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH v7 1/2] PCI: of: Remove max-link-speed generation validation

[Shawn Lin]

在 2026/03/08 星期日 22:26, Hans Zhang 写道:
> The of_pci_get_max_link_speed() function currently validates the
> "max-link-speed" DT property to be in the range 1..4 (Gen1..Gen4).
> This imposes a maintenance burden because each new PCIe generation
> would require updating this validation.
> 
> Remove the range check so the function returns the raw property value
> (or a negative error code if the property is missing or malformed).
> Callers must now validate the returned speed against the range they
> support.  A subsequent patch adds such validation to the DWC driver,
> which is the primary user of this function.
> 
> This change allows future PCIe generations to be supported without
> modifying drivers/pci/of.c.
> 
> Signed-off-by: Hans Zhang <18255117159@163.com>
> Acked-by: Manivannan Sadhasivam <mani@kernel.org>
> ---
>   drivers/pci/of.c | 7 ++++---
>   1 file changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/pci/of.c b/drivers/pci/of.c
> index 9f8eb5df279e..cff5fd337c2b 100644
> --- a/drivers/pci/of.c
> +++ b/drivers/pci/of.c
> @@ -889,10 +889,11 @@ EXPORT_SYMBOL_GPL(of_pci_supply_present);
>   int of_pci_get_max_link_speed(struct device_node *node)
>   {
>   	u32 max_link_speed;
> +	int ret;
>   

Should update the comment of this function, as it states:
"-EINVAL    - Invalid "max-link-speed" property value...
a negative value if the * required property is not found or is invalid."

So it won't validate the speed after this patch. Perhaps it's even
better to note the caller to take the responsiblity to validate it.

> -	if (of_property_read_u32(node, "max-link-speed", &max_link_speed) ||
> -	    max_link_speed == 0 || max_link_speed > 4)
> -		return -EINVAL;
> +	ret = of_property_read_u32(node, "max-link-speed", &max_link_speed);
> +	if (ret)
> +		return ret;
>   
>   	return max_link_speed;
>   }
> 

Re: [PATCH v7 2/2] PCI: dwc: Validate max-link-speed property

[kernel test robot]

Hi Hans,

kernel test robot noticed the following build warnings:

[auto build test WARNING on c23719abc3308df7ed3ad35650ad211fb2d2003d]

url:    https://github.com/intel-lab-lkp/linux/commits/Hans-Zhang/PCI-of-Remove-max-link-speed-generation-validation/20260308-223128
base:   c23719abc3308df7ed3ad35650ad211fb2d2003d
patch link:    https://lore.kernel.org/r/20260308142629.75392-3-18255117159%40163.com
patch subject: [PATCH v7 2/2] PCI: dwc: Validate max-link-speed property
config: i386-randconfig-004-20260308 (https://download.01.org/0day-ci/archive/20260309/202603091845.8xKRO6rW-lkp@intel.com/config)
compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260309/202603091845.8xKRO6rW-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202603091845.8xKRO6rW-lkp@intel.com/

All warnings (new ones prefixed by >>):

   drivers/pci/controller/dwc/pcie-designware.c:128:19: error: invalid application of 'sizeof' to an incomplete type 'const unsigned char[]'
     128 |             max_speed >= ARRAY_SIZE(pcie_link_speed) ||
         |                          ^~~~~~~~~~~~~~~~~~~~~~~~~~~
   include/linux/array_size.h:11:32: note: expanded from macro 'ARRAY_SIZE'
      11 | #define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]) + __must_be_array(arr))
         |                                ^~~~~
>> drivers/pci/controller/dwc/pcie-designware.c:255:9: warning: indirection of non-volatile null pointer will be deleted, not trap [-Wnull-dereference]
     255 |         return PCI_FIND_NEXT_CAP(dw_pcie_read_cfg, PCI_CAPABILITY_LIST, cap,
         |                ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     256 |                                  NULL, pci);
         |                                  ~~~~~~~~~~
   drivers/pci/controller/dwc/../../pci.h:159:5: note: expanded from macro 'PCI_FIND_NEXT_CAP'
     159 |                                 *(u8 *)prev_ptr = __prev_pos;           \
         |                                 ^~~~~~~~~~~~~~~
   drivers/pci/controller/dwc/pcie-designware.c:255:9: note: consider using __builtin_trap() or qualifying pointer with 'volatile'
   drivers/pci/controller/dwc/../../pci.h:159:5: note: expanded from macro 'PCI_FIND_NEXT_CAP'
     159 |                                 *(u8 *)prev_ptr = __prev_pos;           \
         |                                 ^
   drivers/pci/controller/dwc/pcie-designware.c:262:9: warning: indirection of non-volatile null pointer will be deleted, not trap [-Wnull-dereference]
     262 |         return PCI_FIND_NEXT_EXT_CAP(dw_pcie_read_cfg, 0, cap, NULL, pci);
         |                ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/pci/controller/dwc/../../pci.h:207:5: note: expanded from macro 'PCI_FIND_NEXT_EXT_CAP'
     207 |                                 *(u16 *)prev_ptr = __prev_pos;          \
         |                                 ^~~~~~~~~~~~~~~~
   drivers/pci/controller/dwc/pcie-designware.c:262:9: note: consider using __builtin_trap() or qualifying pointer with 'volatile'
   drivers/pci/controller/dwc/../../pci.h:207:5: note: expanded from macro 'PCI_FIND_NEXT_EXT_CAP'
     207 |                                 *(u16 *)prev_ptr = __prev_pos;          \
         |                                 ^
   drivers/pci/controller/dwc/pcie-designware.c:329:17: warning: indirection of non-volatile null pointer will be deleted, not trap [-Wnull-dereference]
     329 |         while ((vsec = PCI_FIND_NEXT_EXT_CAP(dw_pcie_read_cfg, vsec,
         |                        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     330 |                                              PCI_EXT_CAP_ID_VNDR, NULL, pci))) {
         |                                              ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/pci/controller/dwc/../../pci.h:207:5: note: expanded from macro 'PCI_FIND_NEXT_EXT_CAP'
     207 |                                 *(u16 *)prev_ptr = __prev_pos;          \
         |                                 ^~~~~~~~~~~~~~~~
   drivers/pci/controller/dwc/pcie-designware.c:329:17: note: consider using __builtin_trap() or qualifying pointer with 'volatile'
   drivers/pci/controller/dwc/../../pci.h:207:5: note: expanded from macro 'PCI_FIND_NEXT_EXT_CAP'
     207 |                                 *(u16 *)prev_ptr = __prev_pos;          \
         |                                 ^
   3 warnings and 1 error generated.


vim +255 drivers/pci/controller/dwc/pcie-designware.c

13e9d3900c2024 Serge Semin 2022-06-24  252  
7a6854f6874ff4 Vidya Sagar 2019-08-13  253  u8 dw_pcie_find_capability(struct dw_pcie *pci, u8 cap)
7a6854f6874ff4 Vidya Sagar 2019-08-13  254  {
8ffc9f234fdf33 Hans Zhang  2025-08-13 @255  	return PCI_FIND_NEXT_CAP(dw_pcie_read_cfg, PCI_CAPABILITY_LIST, cap,
a2582e05e39adf Qiang Yu    2025-11-09  256  				 NULL, pci);
7a6854f6874ff4 Vidya Sagar 2019-08-13  257  }
7a6854f6874ff4 Vidya Sagar 2019-08-13  258  EXPORT_SYMBOL_GPL(dw_pcie_find_capability);
7a6854f6874ff4 Vidya Sagar 2019-08-13  259  

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH v7 1/2] PCI: of: Remove max-link-speed generation validation

[Manivannan Sadhasivam]

On Sun, Mar 08, 2026 at 10:26:28PM +0800, Hans Zhang wrote:
> The of_pci_get_max_link_speed() function currently validates the
> "max-link-speed" DT property to be in the range 1..4 (Gen1..Gen4).
> This imposes a maintenance burden because each new PCIe generation
> would require updating this validation.
> 
> Remove the range check so the function returns the raw property value
> (or a negative error code if the property is missing or malformed).
> Callers must now validate the returned speed against the range they
> support.  A subsequent patch adds such validation to the DWC driver,
> which is the primary user of this function.
> 
> This change allows future PCIe generations to be supported without
> modifying drivers/pci/of.c.
> 
> Signed-off-by: Hans Zhang <18255117159@163.com>
> Acked-by: Manivannan Sadhasivam <mani@kernel.org>

I take my Ack back. If we decide to go with validating DTS properties (which is
fine though for non-resources such as clocks), then we should make sure that it
happens in a single patch.

Right now, you remove the check in one patch and add it back in another. That
leaves a window...

- Mani

-- 
மணிவண்ணன் சதாசிவம்

Re: [PATCH v7 1/2] PCI: of: Remove max-link-speed generation validation

[Hans Zhang]

On 2026/3/9 08:38, Shawn Lin wrote:
> 在 2026/03/08 星期日 22:26, Hans Zhang 写道:
>> The of_pci_get_max_link_speed() function currently validates the
>> "max-link-speed" DT property to be in the range 1..4 (Gen1..Gen4).
>> This imposes a maintenance burden because each new PCIe generation
>> would require updating this validation.
>>
>> Remove the range check so the function returns the raw property value
>> (or a negative error code if the property is missing or malformed).
>> Callers must now validate the returned speed against the range they
>> support.  A subsequent patch adds such validation to the DWC driver,
>> which is the primary user of this function.
>>
>> This change allows future PCIe generations to be supported without
>> modifying drivers/pci/of.c.
>>
>> Signed-off-by: Hans Zhang <18255117159@163.com>
>> Acked-by: Manivannan Sadhasivam <mani@kernel.org>
>> ---
>>   drivers/pci/of.c | 7 ++++---
>>   1 file changed, 4 insertions(+), 3 deletions(-)
>>
>> diff --git a/drivers/pci/of.c b/drivers/pci/of.c
>> index 9f8eb5df279e..cff5fd337c2b 100644
>> --- a/drivers/pci/of.c
>> +++ b/drivers/pci/of.c
>> @@ -889,10 +889,11 @@ EXPORT_SYMBOL_GPL(of_pci_supply_present);
>>   int of_pci_get_max_link_speed(struct device_node *node)
>>   {
>>       u32 max_link_speed;
>> +    int ret;
> 
> Should update the comment of this function, as it states:
> "-EINVAL    - Invalid "max-link-speed" property value...
> a negative value if the * required property is not found or is invalid."
> 
> So it won't validate the speed after this patch. Perhaps it's even
> better to note the caller to take the responsiblity to validate it.
> 

Hi Shawn,

I plan to modify it as follows. If there are any mistakes, please point 
them out. Thank you very much.

diff --git a/drivers/pci/of.c b/drivers/pci/of.c
index 9f8eb5df279e..fbb779a94202 100644
--- a/drivers/pci/of.c
+++ b/drivers/pci/of.c
@@ -875,8 +875,9 @@ EXPORT_SYMBOL_GPL(of_pci_supply_present);
   * of_pci_get_max_link_speed - Find the maximum link speed of the 
given device node.
   * @node: Device tree node with the maximum link speed information.
   *
- * This function will try to find the limitation of link speed by finding
- * a property called "max-link-speed" of the given device node.
+ * This function will try to read the "max-link-speed" property of the 
given
+ * device tree node. It does NOT validate the value of the property (e.g.,
+ * range checks for PCIe generations).
   *
   * Return:
   * * > 0	- On success, a maximum link speed.
@@ -889,10 +890,11 @@ EXPORT_SYMBOL_GPL(of_pci_supply_present);
  int of_pci_get_max_link_speed(struct device_node *node)
  {
  	u32 max_link_speed;
+	int ret;

-	if (of_property_read_u32(node, "max-link-speed", &max_link_speed) ||
-	    max_link_speed == 0 || max_link_speed > 4)
-		return -EINVAL;
+	ret = of_property_read_u32(node, "max-link-speed", &max_link_speed);
+	if (ret)
+		return ret;

  	return max_link_speed;
  }


Best regards,
Hans

>> -    if (of_property_read_u32(node, "max-link-speed", &max_link_speed) ||
>> -        max_link_speed == 0 || max_link_speed > 4)
>> -        return -EINVAL;
>> +    ret = of_property_read_u32(node, "max-link-speed", &max_link_speed);
>> +    if (ret)
>> +        return ret;
>>       return max_link_speed;
>>   }
>>

Re: [PATCH v7 2/2] PCI: dwc: Validate max-link-speed property

[Hans Zhang]

On 2026/3/9 02:10, kernel test robot wrote:
> Hi Hans,
> 
> kernel test robot noticed the following build errors:
> 
> [auto build test ERROR on c23719abc3308df7ed3ad35650ad211fb2d2003d]
> 
> url:    https://github.com/intel-lab-lkp/linux/commits/Hans-Zhang/PCI-of-Remove-max-link-speed-generation-validation/20260308-223128
> base:   c23719abc3308df7ed3ad35650ad211fb2d2003d
> patch link:    https://lore.kernel.org/r/20260308142629.75392-3-18255117159%40163.com
> patch subject: [PATCH v7 2/2] PCI: dwc: Validate max-link-speed property
> config: csky-randconfig-r071-20260308 (https://download.01.org/0day-ci/archive/20260309/202603090252.S3qQ67Kh-lkp@intel.com/config)
> compiler: csky-linux-gcc (GCC) 10.5.0
> smatch: v0.5.0-9004-gb810ac53
> reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260309/202603090252.S3qQ67Kh-lkp@intel.com/reproduce)
> 
> If you fix the issue in a separate patch/commit (i.e. not just a new version of
> the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <lkp@intel.com>
> | Closes: https://lore.kernel.org/oe-kbuild-all/202603090252.S3qQ67Kh-lkp@intel.com/
> 
> All errors (new ones prefixed by >>):
> 
>     In file included from include/linux/kernel.h:16,
>                      from include/linux/clk.h:13,
>                      from drivers/pci/controller/dwc/pcie-designware.c:13:
>     drivers/pci/controller/dwc/pcie-designware.c: In function 'dw_pcie_get_link_speed':
>>> include/linux/array_size.h:11:32: error: invalid application of 'sizeof' to incomplete type 'const unsigned char[]'
>        11 | #define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]) + __must_be_array(arr))
>           |                                ^
>     drivers/pci/controller/dwc/pcie-designware.c:128:19: note: in expansion of macro 'ARRAY_SIZE'
>       128 |      max_speed >= ARRAY_SIZE(pcie_link_speed) ||
>           |                   ^~~~~~~~~~
> 
Hi Bjorn and Mani,

I am currently working on a patch series aimed at removing the range 
check in the of_pci_get_max_link_speed() function and adding validation 
functionality in the DWC driver.

In patch 2 of v7, I used ARRAY_SIZE(pcie_link_speed) in the DWC driver 
to validate the "max-link-speed" attribute. However, the kernel test 
robot reported a build error [2] because pcie_link_speed is an 
incomplete type (only an external declaration) in the pcie-designware.c 
file, so ARRAY_SIZE cannot be used.

To solve this problem, I suggest adding a macro named "#define 
PCIE_LINK_SPEED_COUNT 16" in the <linux/pci.h> file to represent the 
fixed size of the pcie_link_speed array (with 16 entries according to 
the 4-bit field of the PCIe standard). Then use this macro in the DWC 
driver instead of using ARRAY_SIZE.

The reason for adding the macro instead of using the fixed value "16" is 
to make the code more self-explanatory and this array size can be used 
for many years in 16 cases.

Do you agree with this approach? Please let me know. Perhaps there are 
any other better methods?

Best regards,
Hans

> 
> vim +11 include/linux/array_size.h
> 
> 3cd39bc3b11b8d Alejandro Colomar 2023-10-03   6
> 3cd39bc3b11b8d Alejandro Colomar 2023-10-03   7  /**
> 3cd39bc3b11b8d Alejandro Colomar 2023-10-03   8   * ARRAY_SIZE - get the number of elements in array @arr
> 3cd39bc3b11b8d Alejandro Colomar 2023-10-03   9   * @arr: array to be sized
> 3cd39bc3b11b8d Alejandro Colomar 2023-10-03  10   */
> 3cd39bc3b11b8d Alejandro Colomar 2023-10-03 @11  #define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]) + __must_be_array(arr))
> 3cd39bc3b11b8d Alejandro Colomar 2023-10-03  12
> 

Re: [PATCH v7 1/2] PCI: of: Remove max-link-speed generation validation

[Hans Zhang]

On 2026/3/9 19:47, Manivannan Sadhasivam wrote:
> On Sun, Mar 08, 2026 at 10:26:28PM +0800, Hans Zhang wrote:
>> The of_pci_get_max_link_speed() function currently validates the
>> "max-link-speed" DT property to be in the range 1..4 (Gen1..Gen4).
>> This imposes a maintenance burden because each new PCIe generation
>> would require updating this validation.
>>
>> Remove the range check so the function returns the raw property value
>> (or a negative error code if the property is missing or malformed).
>> Callers must now validate the returned speed against the range they
>> support.  A subsequent patch adds such validation to the DWC driver,
>> which is the primary user of this function.
>>
>> This change allows future PCIe generations to be supported without
>> modifying drivers/pci/of.c.
>>
>> Signed-off-by: Hans Zhang <18255117159@163.com>
>> Acked-by: Manivannan Sadhasivam <mani@kernel.org>
> 
> I take my Ack back. If we decide to go with validating DTS properties (which is
> fine though for non-resources such as clocks), then we should make sure that it
> happens in a single patch.
> 
> Right now, you remove the check in one patch and add it back in another. That
> leaves a window...
> 

Hi Mani,

For the second patch in this series, I made the changes based on Bjorn's 
comments. Maybe I misunderstood something.

Bjorn's reply:
https://lore.kernel.org/linux-pci/20260306170856.GA107733@bhelgaas/

May I ask if I should place the second patch on top of the first one? Is 
it just a matter of swapping the order of the two patches? Do you have 
any good methods?

Best regards,
Hans

> - Mani
> 

Re: [PATCH v7 2/2] PCI: dwc: Validate max-link-speed property

[kernel test robot]

Hi Hans,

kernel test robot noticed the following build errors:

[auto build test ERROR on c23719abc3308df7ed3ad35650ad211fb2d2003d]

url:    https://github.com/intel-lab-lkp/linux/commits/Hans-Zhang/PCI-of-Remove-max-link-speed-generation-validation/20260308-223128
base:   c23719abc3308df7ed3ad35650ad211fb2d2003d
patch link:    https://lore.kernel.org/r/20260308142629.75392-3-18255117159%40163.com
patch subject: [PATCH v7 2/2] PCI: dwc: Validate max-link-speed property
config: i386-randconfig-004-20260308 (https://download.01.org/0day-ci/archive/20260309/202603092301.uROFb9mn-lkp@intel.com/config)
compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260309/202603092301.uROFb9mn-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202603092301.uROFb9mn-lkp@intel.com/

All errors (new ones prefixed by >>):

>> drivers/pci/controller/dwc/pcie-designware.c:128:19: error: invalid application of 'sizeof' to an incomplete type 'const unsigned char[]'
     128 |             max_speed >= ARRAY_SIZE(pcie_link_speed) ||
         |                          ^~~~~~~~~~~~~~~~~~~~~~~~~~~
   include/linux/array_size.h:11:32: note: expanded from macro 'ARRAY_SIZE'
      11 | #define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]) + __must_be_array(arr))
         |                                ^~~~~
   drivers/pci/controller/dwc/pcie-designware.c:255:9: warning: indirection of non-volatile null pointer will be deleted, not trap [-Wnull-dereference]
     255 |         return PCI_FIND_NEXT_CAP(dw_pcie_read_cfg, PCI_CAPABILITY_LIST, cap,
         |                ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     256 |                                  NULL, pci);
         |                                  ~~~~~~~~~~
   drivers/pci/controller/dwc/../../pci.h:159:5: note: expanded from macro 'PCI_FIND_NEXT_CAP'
     159 |                                 *(u8 *)prev_ptr = __prev_pos;           \
         |                                 ^~~~~~~~~~~~~~~
   drivers/pci/controller/dwc/pcie-designware.c:255:9: note: consider using __builtin_trap() or qualifying pointer with 'volatile'
   drivers/pci/controller/dwc/../../pci.h:159:5: note: expanded from macro 'PCI_FIND_NEXT_CAP'
     159 |                                 *(u8 *)prev_ptr = __prev_pos;           \
         |                                 ^
   drivers/pci/controller/dwc/pcie-designware.c:262:9: warning: indirection of non-volatile null pointer will be deleted, not trap [-Wnull-dereference]
     262 |         return PCI_FIND_NEXT_EXT_CAP(dw_pcie_read_cfg, 0, cap, NULL, pci);
         |                ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/pci/controller/dwc/../../pci.h:207:5: note: expanded from macro 'PCI_FIND_NEXT_EXT_CAP'
     207 |                                 *(u16 *)prev_ptr = __prev_pos;          \
         |                                 ^~~~~~~~~~~~~~~~
   drivers/pci/controller/dwc/pcie-designware.c:262:9: note: consider using __builtin_trap() or qualifying pointer with 'volatile'
   drivers/pci/controller/dwc/../../pci.h:207:5: note: expanded from macro 'PCI_FIND_NEXT_EXT_CAP'
     207 |                                 *(u16 *)prev_ptr = __prev_pos;          \
         |                                 ^
   drivers/pci/controller/dwc/pcie-designware.c:329:17: warning: indirection of non-volatile null pointer will be deleted, not trap [-Wnull-dereference]
     329 |         while ((vsec = PCI_FIND_NEXT_EXT_CAP(dw_pcie_read_cfg, vsec,
         |                        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     330 |                                              PCI_EXT_CAP_ID_VNDR, NULL, pci))) {
         |                                              ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/pci/controller/dwc/../../pci.h:207:5: note: expanded from macro 'PCI_FIND_NEXT_EXT_CAP'
     207 |                                 *(u16 *)prev_ptr = __prev_pos;          \
         |                                 ^~~~~~~~~~~~~~~~
   drivers/pci/controller/dwc/pcie-designware.c:329:17: note: consider using __builtin_trap() or qualifying pointer with 'volatile'
   drivers/pci/controller/dwc/../../pci.h:207:5: note: expanded from macro 'PCI_FIND_NEXT_EXT_CAP'
     207 |                                 *(u16 *)prev_ptr = __prev_pos;          \
         |                                 ^
   3 warnings and 1 error generated.


vim +128 drivers/pci/controller/dwc/pcie-designware.c

   112	
   113	static void dw_pcie_get_link_speed(struct dw_pcie *pci)
   114	{
   115		struct device_node *np = dev_of_node(pci->dev);
   116		int max_speed;
   117	
   118		max_speed = of_pci_get_max_link_speed(np);
   119		if (max_speed < 0) {
   120			dev_warn(pci->dev,
   121				 "Failed to get max-link-speed, using default (Gen1)\n");
   122			pci->max_link_speed = 1;
   123			return;
   124		}
   125	
   126		/* Validate against known speeds in pcie_link_speed */
   127		if (max_speed == 0 ||
 > 128		    max_speed >= ARRAY_SIZE(pcie_link_speed) ||
   129		    pcie_link_speed[max_speed] == PCI_SPEED_UNKNOWN) {
   130			dev_warn(pci->dev,
   131				 "Invalid max-link-speed %d, using default (Gen1)\n",
   132				 max_speed);
   133			pci->max_link_speed = 1;
   134			return;
   135		}
   136	
   137		pci->max_link_speed = max_speed;
   138	}
   139	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH v7 1/2] PCI: of: Remove max-link-speed generation validation

[Bjorn Helgaas]

On Sun, Mar 08, 2026 at 10:26:28PM +0800, Hans Zhang wrote:
> The of_pci_get_max_link_speed() function currently validates the
> "max-link-speed" DT property to be in the range 1..4 (Gen1..Gen4).
> This imposes a maintenance burden because each new PCIe generation
> would require updating this validation.
> 
> Remove the range check so the function returns the raw property value
> (or a negative error code if the property is missing or malformed).
> Callers must now validate the returned speed against the range they
> support.  A subsequent patch adds such validation to the DWC driver,
> which is the primary user of this function.
> 
> This change allows future PCIe generations to be supported without
> modifying drivers/pci/of.c.
> 
> Signed-off-by: Hans Zhang <18255117159@163.com>
> Acked-by: Manivannan Sadhasivam <mani@kernel.org>

Mani's right that we shouldn't have a window without any validation.
I hope I didn't otherwise.

> ---
>  drivers/pci/of.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/pci/of.c b/drivers/pci/of.c
> index 9f8eb5df279e..cff5fd337c2b 100644
> --- a/drivers/pci/of.c
> +++ b/drivers/pci/of.c
> @@ -889,10 +889,11 @@ EXPORT_SYMBOL_GPL(of_pci_supply_present);
>  int of_pci_get_max_link_speed(struct device_node *node)
>  {
>  	u32 max_link_speed;
> +	int ret;
>  
> -	if (of_property_read_u32(node, "max-link-speed", &max_link_speed) ||
> -	    max_link_speed == 0 || max_link_speed > 4)
> -		return -EINVAL;
> +	ret = of_property_read_u32(node, "max-link-speed", &max_link_speed);
> +	if (ret)
> +		return ret;
>  
>  	return max_link_speed;
>  }

From AI review (gemini/gemini-3.1-pro-preview):

  By removing the upper bounds check here, the returned max_link_speed
  value can now be arbitrarily large if configured incorrectly in the
  device tree. While the commit message notes that a subsequent patch
  adds validation to the DWC driver, there are several other callers
  in the tree that assume the returned value is bounded. These drivers
  remain vulnerable to out-of-bounds accesses and hardware
  misconfiguration at the end of this patch series.

  For example, in drivers/pci/controller/pcie-rzg3s-host.c, the
  returned value is used directly as an array index. Could this cause
  an out-of-bounds read on pcie_link_speed[]?

I think this is a valid concern, and I think we should protect
pcie_link_speed[] by making it static and accessing it via a function
that validates the index.  It's too hard to enforce validation at
every place that uses it.

I think you're going to have to:

  - Validate every use of dw_pcie.max_link_speed (set from
    of_pci_get_max_link_speed()) in the dwc glue drivers

  - Validate the return from of_pci_get_max_link_speed() at every
    other caller.  It looks like j721e_pcie_set_link_speed(),
    brcm_pcie_probe(), mtk_pcie_setup(), rzg3s_pcie_probe() would need
    that.

Right now we validate inside of_pci_get_max_link_speed(), which can
help avoid generic problems like indexing pcie_link_speed[], but it
can't account for individual driver restrictions.  So I do still think
you're right to move it from drivers/pci/of.c to the individual
drivers because those drivers are where it's really important, and it
avoids changing a common place for driver-specific reasons.  We're
just going to have to strictly enforce it in those drivers.

Re: [PATCH v7 1/2] PCI: of: Remove max-link-speed generation validation

[Hans Zhang]

On 2026/3/11 06:37, Bjorn Helgaas wrote:
> On Sun, Mar 08, 2026 at 10:26:28PM +0800, Hans Zhang wrote:
>> The of_pci_get_max_link_speed() function currently validates the
>> "max-link-speed" DT property to be in the range 1..4 (Gen1..Gen4).
>> This imposes a maintenance burden because each new PCIe generation
>> would require updating this validation.
>>
>> Remove the range check so the function returns the raw property value
>> (or a negative error code if the property is missing or malformed).
>> Callers must now validate the returned speed against the range they
>> support.  A subsequent patch adds such validation to the DWC driver,
>> which is the primary user of this function.
>>
>> This change allows future PCIe generations to be supported without
>> modifying drivers/pci/of.c.
>>
>> Signed-off-by: Hans Zhang <18255117159@163.com>
>> Acked-by: Manivannan Sadhasivam <mani@kernel.org>
> 
> Mani's right that we shouldn't have a window without any validation.
> I hope I didn't otherwise.
> 
>> ---
>>   drivers/pci/of.c | 7 ++++---
>>   1 file changed, 4 insertions(+), 3 deletions(-)
>>
>> diff --git a/drivers/pci/of.c b/drivers/pci/of.c
>> index 9f8eb5df279e..cff5fd337c2b 100644
>> --- a/drivers/pci/of.c
>> +++ b/drivers/pci/of.c
>> @@ -889,10 +889,11 @@ EXPORT_SYMBOL_GPL(of_pci_supply_present);
>>   int of_pci_get_max_link_speed(struct device_node *node)
>>   {
>>   	u32 max_link_speed;
>> +	int ret;
>>   
>> -	if (of_property_read_u32(node, "max-link-speed", &max_link_speed) ||
>> -	    max_link_speed == 0 || max_link_speed > 4)
>> -		return -EINVAL;
>> +	ret = of_property_read_u32(node, "max-link-speed", &max_link_speed);
>> +	if (ret)
>> +		return ret;
>>   
>>   	return max_link_speed;
>>   }
> 
>  From AI review (gemini/gemini-3.1-pro-preview):
> 
>    By removing the upper bounds check here, the returned max_link_speed
>    value can now be arbitrarily large if configured incorrectly in the
>    device tree. While the commit message notes that a subsequent patch
>    adds validation to the DWC driver, there are several other callers
>    in the tree that assume the returned value is bounded. These drivers
>    remain vulnerable to out-of-bounds accesses and hardware
>    misconfiguration at the end of this patch series.
> 
>    For example, in drivers/pci/controller/pcie-rzg3s-host.c, the
>    returned value is used directly as an array index. Could this cause
>    an out-of-bounds read on pcie_link_speed[]?
> 
> I think this is a valid concern, and I think we should protect
> pcie_link_speed[] by making it static and accessing it via a function
> that validates the index.  It's too hard to enforce validation at
> every place that uses it.
> 
> I think you're going to have to:
> 
>    - Validate every use of dw_pcie.max_link_speed (set from
>      of_pci_get_max_link_speed()) in the dwc glue drivers
> 
>    - Validate the return from of_pci_get_max_link_speed() at every
>      other caller.  It looks like j721e_pcie_set_link_speed(),
>      brcm_pcie_probe(), mtk_pcie_setup(), rzg3s_pcie_probe() would need
>      that.
> 
> Right now we validate inside of_pci_get_max_link_speed(), which can
> help avoid generic problems like indexing pcie_link_speed[], but it
> can't account for individual driver restrictions.  So I do still think
> you're right to move it from drivers/pci/of.c to the individual
> drivers because those drivers are where it's really important, and it
> avoids changing a common place for driver-specific reasons.  We're
> just going to have to strictly enforce it in those drivers.

Hi Bjorn,

Thank you very much for your reply. The V8 series will be sent to you 
for review shortly. If there are any issues, I will make the corrections 
again.

Best regards,
Hans