Re: [RFC PATCH] PCI: Tolerate non-prefetchable 64-bit BARs in prefetchable windows

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Incorrect Bridge Prefetching Check: The condition uses the child device's PCIe capability to infer bus prefetching behavior, allowing unsafe speculative reads on conventional PCI buses.
--

commit c6de2abeab7f85fbfb09d4554945da6aa13b56ac
Author: Ard Biesheuvel <ardb@kernel.org>

PCI: Tolerate non-prefetchable 64-bit BARs in prefetchable windows

This commit updates the PCI core to tolerate firmware allocations of
non-prefetchable 64-bit BARs inside prefetchable bridge windows for PCIe
devices. It bypasses the previous rejection logic by explicitly checking
the device's PCIe capability.

> diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
> index b2879a6be5f80..e33eb9f3a1394 100644
> --- a/drivers/pci/pci.c
> +++ b/drivers/pci/pci.c
> @@ -761,7 +761,8 @@ struct resource *pci_find_parent_resource(const struct pci_dev *dev,
>  			 * not, the allocator made a mistake.
>  			 */
>  			if (r->flags & IORESOURCE_PREFETCH &&
> -			    !(res->flags & IORESOURCE_PREFETCH))
> +			    !(res->flags & IORESOURCE_PREFETCH) &&
> +			    !pci_is_pcie(dev))

[Severity: High]
Could this logic mistakenly expose devices on conventional PCI buses to
unsafe speculative reads?

If a system has a PCI-to-PCIe reverse bridge connected to a conventional
PCI bus, the reverse bridge is the child device and has a PCIe capability. 
In this scenario, wouldn't pci_is_pcie(dev) evaluate to true in
pci_find_parent_resource?

If firmware maps a non-prefetchable resource of this reverse bridge into a
prefetchable window of the upstream conventional PCI bridge, this check
would allow the kernel to successfully claim it.

When the CPU reads from this range, the upstream conventional PCI bridge
will issue speculative burst reads on the conventional PCI bus. 

Could this cause unintended read side-effects like advancing FIFOs or clearing
read-to-clear interrupt registers on non-prefetchable BARs?

>  				return NULL;
>  
>  			/*

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260910143440.3865663-2-ardb+git@google.com?part=1