Re: [PATCH] PCI: cadence: Use cdns_pcie_find_capability() to get PCIe Cap offset in host driver

Re: [PATCH] PCI: cadence: Use cdns_pcie_find_capability() to get PCIe Cap offset in host driver

[Hans Zhang]

On 5/4/26 00:52, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Critical] cdns_pcie_find_capability() searches the wrong register space in Host mode and its return value is not validated, leading to Root Port configuration space corruption.
> --
> 
> commit 09b3c64b8f5892eb365acd13030a8067652a15e8
> Author: Hans Zhang <18255117159@163.com>
> 
> PCI: cadence: Use cdns_pcie_find_capability() to get PCIe Cap offset in host driver
> 
> This commit replaces the hardcoded CDNS_PCIE_RP_CAP_OFFSET with a dynamic
> lookup using cdns_pcie_find_capability() in Cadence PCIe host-related
> functions. The goal is to ensure correct operation across various SoC designs
> where the capability might not reside at offset 0xC0.
> 
>> diff --git a/drivers/pci/controller/cadence/pcie-cadence-host-common.c b/drivers/pci/controller/cadence/pcie-cadence-host-common.c
>> index 2b0211870f02..5013d3fe23b5 100644
>> --- a/drivers/pci/controller/cadence/pcie-cadence-host-common.c
>> +++ b/drivers/pci/controller/cadence/pcie-cadence-host-common.c
>> @@ -26,14 +26,14 @@ EXPORT_SYMBOL_GPL(bar_max_size);
>>   
>>   int cdns_pcie_host_training_complete(struct cdns_pcie *pcie)
>>   {
>> -	u32 pcie_cap_off = CDNS_PCIE_RP_CAP_OFFSET;
>>   	unsigned long end_jiffies;
>>   	u16 lnk_stat;
>> +	u8 cap = cdns_pcie_find_capability(pcie, PCI_CAP_ID_EXP);
> 
> Does this capability search scan the correct register space when operating in
> host mode?
> 
> Looking at the helper function, it uses cdns_pcie_read_cfg() which reads
> directly from the base address without the Root Port offset:
> 
> drivers/pci/controller/cadence/pcie-cadence.c:cdns_pcie_find_capability() {
>      return PCI_FIND_NEXT_CAP(cdns_pcie_read_cfg, PCI_CAPABILITY_LIST,
>                               cap, NULL, pcie);
> }
> 
> However, the Root Port configuration registers are physically located at
> pcie->reg_base + CDNS_PCIE_RP_BASE. Could this cause the search to scan the
> Local Management register space instead, failing to find PCI_CAP_ID_EXP
> and returning 0?

I don't think we need to worry about this issue.

As per PCIe r7.0, sec 7.5.1.1.11, Since all PCI Express Functions

are required to implement the PCI Express Capability structure, which 
must be included somewhere in this linked list;

So, it won't return 0 here.

Best regards,
Hans


> 
> [ ... ]
> 
>> @@ -68,27 +68,26 @@ EXPORT_SYMBOL_GPL(cdns_pcie_host_wait_for_link);
>>   int cdns_pcie_retrain(struct cdns_pcie *pcie,
>>   		      cdns_pcie_linkup_func pcie_link_up)
>>   {
>> -	u32 lnk_cap_sls, pcie_cap_off = CDNS_PCIE_RP_CAP_OFFSET;
>> +	u32 lnk_cap_sls;
>>   	u16 lnk_stat, lnk_ctl;
>>   	int ret = 0;
>> +	u8 cap = cdns_pcie_find_capability(pcie, PCI_CAP_ID_EXP);
>>   
>>   	/*
>>   	 * Set retrain bit if current speed is 2.5 GB/s,
>>   	 * but the PCIe root port support is > 2.5 GB/s.
>>   	 */
>>   
>> -	lnk_cap_sls = cdns_pcie_readl(pcie, (CDNS_PCIE_RP_BASE + pcie_cap_off +
>> +	lnk_cap_sls = cdns_pcie_readl(pcie, (CDNS_PCIE_RP_BASE + cap +
>>   					     PCI_EXP_LNKCAP));
> 
> If the capability is not found and cap evaluates to 0, is it safe to proceed
> without validating the return value?
> 
> Since the fallback value would be 0, evaluating cap + PCI_EXP_LNKCAP will
> result in an offset of 0x0C.
> 
> [ ... ]
> 
>> diff --git a/drivers/pci/controller/cadence/pcie-cadence-host.c b/drivers/pci/controller/cadence/pcie-cadence-host.c
>> index 0bc9e6e90e0e..2a3fd41c1cf4 100644
>> --- a/drivers/pci/controller/cadence/pcie-cadence-host.c
>> +++ b/drivers/pci/controller/cadence/pcie-cadence-host.c
>> @@ -147,12 +148,12 @@ static int cdns_pcie_host_init_root_port(struct cdns_pcie_rc *rc)
>>   	cdns_pcie_rp_writeb(pcie, PCI_CLASS_PROG, 0);
>>   	cdns_pcie_rp_writew(pcie, PCI_CLASS_DEVICE, PCI_CLASS_BRIDGE_PCI);
>>   
>> -	value = cdns_pcie_rp_readl(pcie, CDNS_PCIE_RP_CAP_OFFSET + PCI_EXP_LNKCAP);
>> +	value = cdns_pcie_rp_readl(pcie, cap + PCI_EXP_LNKCAP);
>>   	if (rc->quirk_broken_aspm_l0s)
>>   		value &= ~PCI_EXP_LNKCAP_ASPM_L0S;
>>   	if (rc->quirk_broken_aspm_l1)
>>   		value &= ~PCI_EXP_LNKCAP_ASPM_L1;
>> -	cdns_pcie_rp_writel(pcie, CDNS_PCIE_RP_CAP_OFFSET + PCI_EXP_LNKCAP, value);
>> +	cdns_pcie_rp_writel(pcie, cap + PCI_EXP_LNKCAP, value);
> 
> Will this overwrite the wrong configuration registers if cap is 0?
> 
> The cdns_pcie_rp_writel() function automatically adds CDNS_PCIE_RP_BASE to
> the destination offset. If cap is 0, writing to cap + PCI_EXP_LNKCAP will
> access offset 0x0C.
> 
> Could this regression unintentionally clobber the standard Type 1 PCI header
> registers, such as the Cache Line Size and Latency Timer, and corrupt the
> Root Port hardware state?
> 

Re: [PATCH] PCI: cadence: Use cdns_pcie_find_capability() to get PCIe Cap offset in host driver

[Bjorn Helgaas]

On Mon, May 04, 2026 at 04:22:26PM +0800, Hans Zhang wrote:
> On 5/4/26 00:52, sashiko-bot@kernel.org wrote:
> > Thank you for your contribution! Sashiko AI review found 1
> > potential issue(s) to consider:
> >
> > - [Critical] cdns_pcie_find_capability() searches the wrong
> > register space in Host mode and its return value is not validated,
> > leading to Root Port configuration space corruption.
> > --
> > 
> > commit 09b3c64b8f5892eb365acd13030a8067652a15e8
> > Author: Hans Zhang <18255117159@163.com>
> > 
> > PCI: cadence: Use cdns_pcie_find_capability() to get PCIe Cap offset in host driver
> > 
> > This commit replaces the hardcoded CDNS_PCIE_RP_CAP_OFFSET with a dynamic
> > lookup using cdns_pcie_find_capability() in Cadence PCIe host-related
> > functions. The goal is to ensure correct operation across various SoC designs
> > where the capability might not reside at offset 0xC0.
> > 
> > > diff --git a/drivers/pci/controller/cadence/pcie-cadence-host-common.c b/drivers/pci/controller/cadence/pcie-cadence-host-common.c
> > > index 2b0211870f02..5013d3fe23b5 100644
> > > --- a/drivers/pci/controller/cadence/pcie-cadence-host-common.c
> > > +++ b/drivers/pci/controller/cadence/pcie-cadence-host-common.c
> > > @@ -26,14 +26,14 @@ EXPORT_SYMBOL_GPL(bar_max_size);
> > >   int cdns_pcie_host_training_complete(struct cdns_pcie *pcie)
> > >   {
> > > -	u32 pcie_cap_off = CDNS_PCIE_RP_CAP_OFFSET;
> > >   	unsigned long end_jiffies;
> > >   	u16 lnk_stat;
> > > +	u8 cap = cdns_pcie_find_capability(pcie, PCI_CAP_ID_EXP);
> > 
> > Does this capability search scan the correct register space when
> > operating in host mode?
> > 
> > Looking at the helper function, it uses cdns_pcie_read_cfg() which
> > reads directly from the base address without the Root Port offset:
> > 
> > drivers/pci/controller/cadence/pcie-cadence.c:cdns_pcie_find_capability() {
> >      return PCI_FIND_NEXT_CAP(cdns_pcie_read_cfg, PCI_CAPABILITY_LIST,
> >                               cap, NULL, pcie);
> > }
> > 
> > However, the Root Port configuration registers are physically
> > located at pcie->reg_base + CDNS_PCIE_RP_BASE. Could this cause
> > the search to scan the Local Management register space instead,
> > failing to find PCI_CAP_ID_EXP and returning 0?
> 
> I don't think we need to worry about this issue.
> 
> As per PCIe r7.0, sec 7.5.1.1.11, Since all PCI Express Functions
> are required to implement the PCI Express Capability structure,
> which must be included somewhere in this linked list;
> 
> So, it won't return 0 here.

It's true that all Root Ports must have a PCIe Capability, but 
that's not related to this issue.

cdns_pcie_host_init_root_port() accesses PCI_EXP_LNKCAP at the
address:

  pcie->reg_base + CDNS_PCIE_RP_BASE + CDNS_PCIE_RP_CAP_OFFSET + PCI_EXP_LNKCAP

but when we search with cdns_pcie_find_capability(pcie, PCI_CAP_ID_EXP),
we start reading at:

  pcie->reg_base + PCI_CAPABILITY_LIST

It should be starting at:

  pcie->reg_base + CDNS_PCIE_RP_BASE + PCI_CAPABILITY_LIST

Previously, cdns_pcie_find_capability() and
cdns_pcie_find_ext_capability() were only used for endpoints, and I
assume they work fine there.  There is pcie->is_rc, so there should be
a way to make this work for both endpoints and Root Ports.


Separate issue: I think some of the config accessors ended up being
sub-optimal.  They should all have the same structure, but
cdns_pcie_read_cfg_dword() is different from the rest, I think because
some devices don't support 1- and 2-byte accesses.

  cdns_pcie_read_cfg_byte
    addr = pcie->reg_base + where
    cdns_pcie_read_sz(addr, 0x1)
     readl(addr)

  cdns_pcie_read_cfg_word
    addr = pcie->reg_base + where
    cdns_pcie_read_sz(addr, 0x2)
     readl(addr)

  cdns_pcie_read_cfg_dword
    cdns_pcie_readl
      readl(pcie->reg_base + reg)

I think it would be better to use "cdns_pcie_read_sz(addr, 0x4)"
even for cdns_pcie_read_cfg_dword().

> > [ ... ]
> > 
> > > @@ -68,27 +68,26 @@ EXPORT_SYMBOL_GPL(cdns_pcie_host_wait_for_link);
> > >   int cdns_pcie_retrain(struct cdns_pcie *pcie,
> > >   		      cdns_pcie_linkup_func pcie_link_up)
> > >   {
> > > -	u32 lnk_cap_sls, pcie_cap_off = CDNS_PCIE_RP_CAP_OFFSET;
> > > +	u32 lnk_cap_sls;
> > >   	u16 lnk_stat, lnk_ctl;
> > >   	int ret = 0;
> > > +	u8 cap = cdns_pcie_find_capability(pcie, PCI_CAP_ID_EXP);
> > >   	/*
> > >   	 * Set retrain bit if current speed is 2.5 GB/s,
> > >   	 * but the PCIe root port support is > 2.5 GB/s.
> > >   	 */
> > > -	lnk_cap_sls = cdns_pcie_readl(pcie, (CDNS_PCIE_RP_BASE + pcie_cap_off +
> > > +	lnk_cap_sls = cdns_pcie_readl(pcie, (CDNS_PCIE_RP_BASE + cap +
> > >   					     PCI_EXP_LNKCAP));

Could reduce the size of the diff by keeping the original
"pcie_cap_off" name.

Re: [PATCH] PCI: cadence: Use cdns_pcie_find_capability() to get PCIe Cap offset in host driver

[Hans Zhang]

On 5/6/26 05:23, Bjorn Helgaas wrote:
> On Mon, May 04, 2026 at 04:22:26PM +0800, Hans Zhang wrote:
>> On 5/4/26 00:52, sashiko-bot@kernel.org wrote:
>>> Thank you for your contribution! Sashiko AI review found 1
>>> potential issue(s) to consider:
>>>
>>> - [Critical] cdns_pcie_find_capability() searches the wrong
>>> register space in Host mode and its return value is not validated,
>>> leading to Root Port configuration space corruption.
>>> --
>>>
>>> commit 09b3c64b8f5892eb365acd13030a8067652a15e8
>>> Author: Hans Zhang <18255117159@163.com>
>>>
>>> PCI: cadence: Use cdns_pcie_find_capability() to get PCIe Cap offset in host driver
>>>
>>> This commit replaces the hardcoded CDNS_PCIE_RP_CAP_OFFSET with a dynamic
>>> lookup using cdns_pcie_find_capability() in Cadence PCIe host-related
>>> functions. The goal is to ensure correct operation across various SoC designs
>>> where the capability might not reside at offset 0xC0.
>>>
>>>> diff --git a/drivers/pci/controller/cadence/pcie-cadence-host-common.c b/drivers/pci/controller/cadence/pcie-cadence-host-common.c
>>>> index 2b0211870f02..5013d3fe23b5 100644
>>>> --- a/drivers/pci/controller/cadence/pcie-cadence-host-common.c
>>>> +++ b/drivers/pci/controller/cadence/pcie-cadence-host-common.c
>>>> @@ -26,14 +26,14 @@ EXPORT_SYMBOL_GPL(bar_max_size);
>>>>    int cdns_pcie_host_training_complete(struct cdns_pcie *pcie)
>>>>    {
>>>> -	u32 pcie_cap_off = CDNS_PCIE_RP_CAP_OFFSET;
>>>>    	unsigned long end_jiffies;
>>>>    	u16 lnk_stat;
>>>> +	u8 cap = cdns_pcie_find_capability(pcie, PCI_CAP_ID_EXP);
>>>
>>> Does this capability search scan the correct register space when
>>> operating in host mode?
>>>
>>> Looking at the helper function, it uses cdns_pcie_read_cfg() which
>>> reads directly from the base address without the Root Port offset:
>>>
>>> drivers/pci/controller/cadence/pcie-cadence.c:cdns_pcie_find_capability() {
>>>       return PCI_FIND_NEXT_CAP(cdns_pcie_read_cfg, PCI_CAPABILITY_LIST,
>>>                                cap, NULL, pcie);
>>> }
>>>
>>> However, the Root Port configuration registers are physically
>>> located at pcie->reg_base + CDNS_PCIE_RP_BASE. Could this cause
>>> the search to scan the Local Management register space instead,
>>> failing to find PCI_CAP_ID_EXP and returning 0?
>>
>> I don't think we need to worry about this issue.
>>
>> As per PCIe r7.0, sec 7.5.1.1.11, Since all PCI Express Functions
>> are required to implement the PCI Express Capability structure,
>> which must be included somewhere in this linked list;
>>
>> So, it won't return 0 here.
> 
> It's true that all Root Ports must have a PCIe Capability, but
> that's not related to this issue.
> 
> cdns_pcie_host_init_root_port() accesses PCI_EXP_LNKCAP at the
> address:
> 
>    pcie->reg_base + CDNS_PCIE_RP_BASE + CDNS_PCIE_RP_CAP_OFFSET + PCI_EXP_LNKCAP
> 
> but when we search with cdns_pcie_find_capability(pcie, PCI_CAP_ID_EXP),
> we start reading at:
> 
>    pcie->reg_base + PCI_CAPABILITY_LIST
> 
> It should be starting at:
> 
>    pcie->reg_base + CDNS_PCIE_RP_BASE + PCI_CAPABILITY_LIST
> 
> Previously, cdns_pcie_find_capability() and
> cdns_pcie_find_ext_capability() were only used for endpoints, and I
> assume they work fine there.  There is pcie->is_rc, so there should be
> a way to make this work for both endpoints and Root Ports.
> 

Hi Bjorn,

The reason for using the "is_rc" tag is that for Cadence IP, it is not 
only applicable to the RC or EP mode, but also there are significant 
differences between the LGA and HPA generations of IP. Including 
register offset values, definitions, etc., it fails to achieve good 
compatibility. It is not like Synopsys IP, where compatibility has been 
handled very well. It was truly out of necessity.

> 
> Separate issue: I think some of the config accessors ended up being
> sub-optimal.  They should all have the same structure, but
> cdns_pcie_read_cfg_dword() is different from the rest, I think because
> some devices don't support 1- and 2-byte accesses.


Yes, it has been changed in the following submission.

Commit: d9cf7154deed (PCI: cadence: Use cdns_pcie_read_sz() for byte or 
word read access)

In my submission 18ac51ae9df9 ("PCI: cadence: Implement capability 
search using PCI core APIs"). It works very well for the Root Port. (For 
drivers/pci/controller/cadence/pci-sky1.c, no other upstream code has 
been implemented yet. It is functioning properly in the product.)

> 
>    cdns_pcie_read_cfg_byte
>      addr = pcie->reg_base + where
>      cdns_pcie_read_sz(addr, 0x1)
>       readl(addr)
> 
>    cdns_pcie_read_cfg_word
>      addr = pcie->reg_base + where
>      cdns_pcie_read_sz(addr, 0x2)
>       readl(addr)
> 
>    cdns_pcie_read_cfg_dword
>      cdns_pcie_readl
>        readl(pcie->reg_base + reg)
> 
> I think it would be better to use "cdns_pcie_read_sz(addr, 0x4)"
> even for cdns_pcie_read_cfg_dword().

Agree. I will make some revisions. I've recently found some time to 
conduct a CIX SOC test.

> 
>>> [ ... ]
>>>
>>>> @@ -68,27 +68,26 @@ EXPORT_SYMBOL_GPL(cdns_pcie_host_wait_for_link);
>>>>    int cdns_pcie_retrain(struct cdns_pcie *pcie,
>>>>    		      cdns_pcie_linkup_func pcie_link_up)
>>>>    {
>>>> -	u32 lnk_cap_sls, pcie_cap_off = CDNS_PCIE_RP_CAP_OFFSET;
>>>> +	u32 lnk_cap_sls;
>>>>    	u16 lnk_stat, lnk_ctl;
>>>>    	int ret = 0;
>>>> +	u8 cap = cdns_pcie_find_capability(pcie, PCI_CAP_ID_EXP);
>>>>    	/*
>>>>    	 * Set retrain bit if current speed is 2.5 GB/s,
>>>>    	 * but the PCIe root port support is > 2.5 GB/s.
>>>>    	 */
>>>> -	lnk_cap_sls = cdns_pcie_readl(pcie, (CDNS_PCIE_RP_BASE + pcie_cap_off +
>>>> +	lnk_cap_sls = cdns_pcie_readl(pcie, (CDNS_PCIE_RP_BASE + cap +
>>>>    					     PCI_EXP_LNKCAP));
> 
> Could reduce the size of the diff by keeping the original
> "pcie_cap_off" name.

I would like to refer to:

struct pci_dev {
     ......
     u8			pcie_cap;	/* PCIe capability offset */
     ......
};

Additionally, I have already created a series of patches here locally to 
simplify the DWC driver. This is because each Root Port driver is 
looking at the PCI_CAP_ID_EXP offset.

Best regards,
Hans

Re: [PATCH] PCI: cadence: Use cdns_pcie_find_capability() to get PCIe Cap offset in host driver

[Bjorn Helgaas]

On Thu, May 07, 2026 at 12:04:34AM +0800, Hans Zhang wrote:
> On 5/6/26 05:23, Bjorn Helgaas wrote:
> > On Mon, May 04, 2026 at 04:22:26PM +0800, Hans Zhang wrote:
> > > On 5/4/26 00:52, sashiko-bot@kernel.org wrote:
> > > > Thank you for your contribution! Sashiko AI review found 1
> > > > potential issue(s) to consider:
> > > > 
> > > > - [Critical] cdns_pcie_find_capability() searches the wrong
> > > > register space in Host mode and its return value is not validated,
> > > > leading to Root Port configuration space corruption.
> > > > --
> > > > 
> > > > commit 09b3c64b8f5892eb365acd13030a8067652a15e8
> > > > Author: Hans Zhang <18255117159@163.com>
> > > > 
> > > > PCI: cadence: Use cdns_pcie_find_capability() to get PCIe Cap offset in host driver
> > > > 
> > > > This commit replaces the hardcoded CDNS_PCIE_RP_CAP_OFFSET with a dynamic
> > > > lookup using cdns_pcie_find_capability() in Cadence PCIe host-related
> > > > functions. The goal is to ensure correct operation across various SoC designs
> > > > where the capability might not reside at offset 0xC0.
> > > > 
> > > > > diff --git a/drivers/pci/controller/cadence/pcie-cadence-host-common.c b/drivers/pci/controller/cadence/pcie-cadence-host-common.c
> > > > > index 2b0211870f02..5013d3fe23b5 100644
> > > > > --- a/drivers/pci/controller/cadence/pcie-cadence-host-common.c
> > > > > +++ b/drivers/pci/controller/cadence/pcie-cadence-host-common.c
> > > > > @@ -26,14 +26,14 @@ EXPORT_SYMBOL_GPL(bar_max_size);
> > > > >    int cdns_pcie_host_training_complete(struct cdns_pcie *pcie)
> > > > >    {
> > > > > -	u32 pcie_cap_off = CDNS_PCIE_RP_CAP_OFFSET;
> > > > >    	unsigned long end_jiffies;
> > > > >    	u16 lnk_stat;
> > > > > +	u8 cap = cdns_pcie_find_capability(pcie, PCI_CAP_ID_EXP);
> > > > 
> > > > Does this capability search scan the correct register space when
> > > > operating in host mode?
> > > > 
> > > > Looking at the helper function, it uses cdns_pcie_read_cfg() which
> > > > reads directly from the base address without the Root Port offset:
> > > > 
> > > > drivers/pci/controller/cadence/pcie-cadence.c:cdns_pcie_find_capability() {
> > > >       return PCI_FIND_NEXT_CAP(cdns_pcie_read_cfg, PCI_CAPABILITY_LIST,
> > > >                                cap, NULL, pcie);
> > > > }
> > > > 
> > > > However, the Root Port configuration registers are physically
> > > > located at pcie->reg_base + CDNS_PCIE_RP_BASE. Could this cause
> > > > the search to scan the Local Management register space instead,
> > > > failing to find PCI_CAP_ID_EXP and returning 0?
> > > 
> > > I don't think we need to worry about this issue.
> > > 
> > > As per PCIe r7.0, sec 7.5.1.1.11, Since all PCI Express Functions
> > > are required to implement the PCI Express Capability structure,
> > > which must be included somewhere in this linked list;
> > > 
> > > So, it won't return 0 here.
> > 
> > It's true that all Root Ports must have a PCIe Capability, but
> > that's not related to this issue.
> > 
> > cdns_pcie_host_init_root_port() accesses PCI_EXP_LNKCAP at the
> > address:
> > 
> >    pcie->reg_base + CDNS_PCIE_RP_BASE + CDNS_PCIE_RP_CAP_OFFSET + PCI_EXP_LNKCAP
> > 
> > but when we search with cdns_pcie_find_capability(pcie, PCI_CAP_ID_EXP),
> > we start reading at:
> > 
> >    pcie->reg_base + PCI_CAPABILITY_LIST
> > 
> > It should be starting at:
> > 
> >    pcie->reg_base + CDNS_PCIE_RP_BASE + PCI_CAPABILITY_LIST
> > 
> > Previously, cdns_pcie_find_capability() and
> > cdns_pcie_find_ext_capability() were only used for endpoints, and I
> > assume they work fine there.  There is pcie->is_rc, so there should be
> > a way to make this work for both endpoints and Root Ports.
> 
> The reason for using the "is_rc" tag is that for Cadence IP, it is not only
> applicable to the RC or EP mode, but also there are significant differences
> between the LGA and HPA generations of IP. Including register offset values,
> definitions, etc., it fails to achieve good compatibility. It is not like
> Synopsys IP, where compatibility has been handled very well. It was truly
> out of necessity.

I think cdns_pcie_find_capability(pcie, PCI_CAP_ID_EXP) fails on Root
Ports because it doesn't include the CDNS_PCIE_RP_BASE offset.  Do you
have hardware where you can test that?

Re: [PATCH] PCI: cadence: Use cdns_pcie_find_capability() to get PCIe Cap offset in host driver

[Hans Zhang]

[-- Attachment #1: Type: text/plain, Size: 8576 bytes --]



On 5/7/26 01:12, Bjorn Helgaas wrote:
> On Thu, May 07, 2026 at 12:04:34AM +0800, Hans Zhang wrote:
>> On 5/6/26 05:23, Bjorn Helgaas wrote:
>>> On Mon, May 04, 2026 at 04:22:26PM +0800, Hans Zhang wrote:
>>>> On 5/4/26 00:52, sashiko-bot@kernel.org wrote:
>>>>> Thank you for your contribution! Sashiko AI review found 1
>>>>> potential issue(s) to consider:
>>>>>
>>>>> - [Critical] cdns_pcie_find_capability() searches the wrong
>>>>> register space in Host mode and its return value is not validated,
>>>>> leading to Root Port configuration space corruption.
>>>>> --
>>>>>
>>>>> commit 09b3c64b8f5892eb365acd13030a8067652a15e8
>>>>> Author: Hans Zhang <18255117159@163.com>
>>>>>
>>>>> PCI: cadence: Use cdns_pcie_find_capability() to get PCIe Cap offset in host driver
>>>>>
>>>>> This commit replaces the hardcoded CDNS_PCIE_RP_CAP_OFFSET with a dynamic
>>>>> lookup using cdns_pcie_find_capability() in Cadence PCIe host-related
>>>>> functions. The goal is to ensure correct operation across various SoC designs
>>>>> where the capability might not reside at offset 0xC0.
>>>>>
>>>>>> diff --git a/drivers/pci/controller/cadence/pcie-cadence-host-common.c b/drivers/pci/controller/cadence/pcie-cadence-host-common.c
>>>>>> index 2b0211870f02..5013d3fe23b5 100644
>>>>>> --- a/drivers/pci/controller/cadence/pcie-cadence-host-common.c
>>>>>> +++ b/drivers/pci/controller/cadence/pcie-cadence-host-common.c
>>>>>> @@ -26,14 +26,14 @@ EXPORT_SYMBOL_GPL(bar_max_size);
>>>>>>     int cdns_pcie_host_training_complete(struct cdns_pcie *pcie)
>>>>>>     {
>>>>>> -	u32 pcie_cap_off = CDNS_PCIE_RP_CAP_OFFSET;
>>>>>>     	unsigned long end_jiffies;
>>>>>>     	u16 lnk_stat;
>>>>>> +	u8 cap = cdns_pcie_find_capability(pcie, PCI_CAP_ID_EXP);
>>>>>
>>>>> Does this capability search scan the correct register space when
>>>>> operating in host mode?
>>>>>
>>>>> Looking at the helper function, it uses cdns_pcie_read_cfg() which
>>>>> reads directly from the base address without the Root Port offset:
>>>>>
>>>>> drivers/pci/controller/cadence/pcie-cadence.c:cdns_pcie_find_capability() {
>>>>>        return PCI_FIND_NEXT_CAP(cdns_pcie_read_cfg, PCI_CAPABILITY_LIST,
>>>>>                                 cap, NULL, pcie);
>>>>> }
>>>>>
>>>>> However, the Root Port configuration registers are physically
>>>>> located at pcie->reg_base + CDNS_PCIE_RP_BASE. Could this cause
>>>>> the search to scan the Local Management register space instead,
>>>>> failing to find PCI_CAP_ID_EXP and returning 0?
>>>>
>>>> I don't think we need to worry about this issue.
>>>>
>>>> As per PCIe r7.0, sec 7.5.1.1.11, Since all PCI Express Functions
>>>> are required to implement the PCI Express Capability structure,
>>>> which must be included somewhere in this linked list;
>>>>
>>>> So, it won't return 0 here.
>>>
>>> It's true that all Root Ports must have a PCIe Capability, but
>>> that's not related to this issue.
>>>
>>> cdns_pcie_host_init_root_port() accesses PCI_EXP_LNKCAP at the
>>> address:
>>>
>>>     pcie->reg_base + CDNS_PCIE_RP_BASE + CDNS_PCIE_RP_CAP_OFFSET + PCI_EXP_LNKCAP
>>>
>>> but when we search with cdns_pcie_find_capability(pcie, PCI_CAP_ID_EXP),
>>> we start reading at:
>>>
>>>     pcie->reg_base + PCI_CAPABILITY_LIST
>>>
>>> It should be starting at:
>>>
>>>     pcie->reg_base + CDNS_PCIE_RP_BASE + PCI_CAPABILITY_LIST
>>>
>>> Previously, cdns_pcie_find_capability() and
>>> cdns_pcie_find_ext_capability() were only used for endpoints, and I
>>> assume they work fine there.  There is pcie->is_rc, so there should be
>>> a way to make this work for both endpoints and Root Ports.
>>
>> The reason for using the "is_rc" tag is that for Cadence IP, it is not only
>> applicable to the RC or EP mode, but also there are significant differences
>> between the LGA and HPA generations of IP. Including register offset values,
>> definitions, etc., it fails to achieve good compatibility. It is not like
>> Synopsys IP, where compatibility has been handled very well. It was truly
>> out of necessity.
> 
> I think cdns_pcie_find_capability(pcie, PCI_CAP_ID_EXP) fails on Root
> Ports because it doesn't include the CDNS_PCIE_RP_BASE offset.  Do you
> have hardware where you can test that?

Hi Bjorn,

The attachment contains the dmesg and lspci -vvv log from the test.

Here is the test code:

diff --git a/drivers/pci/controller/cadence/pci-sky1.c 
b/drivers/pci/controller/cadence/pci-sky1.c
index cd55c64e58a9..0d0c42309127 100644
--- a/drivers/pci/controller/cadence/pci-sky1.c
+++ b/drivers/pci/controller/cadence/pci-sky1.c
@@ -130,6 +130,39 @@ static const struct cdns_pcie_ops sky1_pcie_ops = {
  	.link_up = sky1_pcie_link_up,
  };

+void cix_pcie_test_cap(struct sky1_pcie *pcie)
+{
+	u16 offset;
+
+	printk(KERN_EMERG"[HANS] fun = %s, line = %d ........... \n", 
__func__, __LINE__);
+	/* capability */
+	offset = cdns_pcie_find_capability(pcie->cdns_pcie, PCI_CAP_ID_PM);
+	printk(KERN_EMERG"[HANS]pm offset = 0x%x\n", offset);
+	offset = cdns_pcie_find_capability(pcie->cdns_pcie, PCI_CAP_ID_MSI);
+	printk(KERN_EMERG"[HANS]msi offset = 0x%x\n", offset);
+	offset = cdns_pcie_find_capability(pcie->cdns_pcie, PCI_CAP_ID_MSIX);
+	printk(KERN_EMERG"[HANS]msix offset = 0x%x\n", offset);
+	offset = cdns_pcie_find_capability(pcie->cdns_pcie, PCI_CAP_ID_EXP);
+	printk(KERN_EMERG"[HANS]exp offset = 0x%x\n", offset);
+
+	printk(KERN_EMERG"[HANS] fun = %s, line = %d ........... \n", 
__func__, __LINE__);
+	/* extend capability */
+	offset = cdns_pcie_find_ext_capability(pcie->cdns_pcie, 
PCI_EXT_CAP_ID_ERR);
+	printk(KERN_EMERG"[HANS]aer offset = 0x%x\n", offset);
+	offset = cdns_pcie_find_ext_capability(pcie->cdns_pcie, 
PCI_EXT_CAP_ID_VC);
+	printk(KERN_EMERG"[HANS]Virtual Channel offset = 0x%x\n", offset);
+	offset = cdns_pcie_find_ext_capability(pcie->cdns_pcie, 
PCI_EXT_CAP_ID_DSN);
+	printk(KERN_EMERG"[HANS]Device Serial Number offset = 0x%x\n", offset);
+	offset = cdns_pcie_find_ext_capability(pcie->cdns_pcie, 
PCI_EXT_CAP_ID_PWR);
+	printk(KERN_EMERG"[HANS]pwr offset = 0x%x\n", offset);
+	offset = cdns_pcie_find_ext_capability(pcie->cdns_pcie, 
PCI_EXT_CAP_ID_REBAR);
+	printk(KERN_EMERG"[HANS]resize bar offset = 0x%x\n", offset);
+	offset = cdns_pcie_find_ext_capability(pcie->cdns_pcie, 
PCI_EXT_CAP_ID_SECPCI);
+	printk(KERN_EMERG"[HANS]second exp offset = 0x%x\n", offset);
+	offset = cdns_pcie_find_ext_capability(pcie->cdns_pcie, 
PCI_EXT_CAP_ID_L1SS);
+	printk(KERN_EMERG"[HANS]L1ss offset = 0x%x\n", offset);
+}
+
  static int sky1_pcie_probe(struct platform_device *pdev)
  {
  	struct cdns_plat_pcie_of_data *reg_off;
@@ -141,6 +174,7 @@ static int sky1_pcie_probe(struct platform_device *pdev)
  	struct sky1_pcie *pcie;
  	int ret;

+	printk(KERN_EMERG"[HANS] fun = %s, line = %d ........... \n", 
__func__, __LINE__);
  	pcie = devm_kzalloc(dev, sizeof(*pcie), GFP_KERNEL);
  	if (!pcie)
  		return -ENOMEM;
@@ -202,6 +236,8 @@ static int sky1_pcie_probe(struct platform_device *pdev)

  	dev_set_drvdata(dev, pcie);

+	cix_pcie_test_cap(pcie);
+
  	ret = cdns_pcie_hpa_host_setup(rc);
  	if (ret < 0) {
  		pci_ecam_free(pcie->cfg);
@@ -230,7 +266,7 @@ static struct platform_driver sky1_pcie_driver = {
  	.driver = {
  		.name = "sky1-pcie",
  		.of_match_table = of_sky1_pcie_match,
-		.probe_type = PROBE_PREFER_ASYNCHRONOUS,
+		// .probe_type = PROBE_PREFER_ASYNCHRONOUS,
  	},
  };
  module_platform_driver(sky1_pcie_driver);


For the LGA IP, an offset address CDNS_PCIE_RP_BASE needs to be added. 
And the HPA IP requires an offset address of CDNS_PCIE_HPA_RP_BASE, but 
it is equal to 0;

drivers/pci/controller/cadence/pcie-cadence-hpa-regs.h

/* Root Port register base address */
#define CDNS_PCIE_HPA_RP_BASE			0x0

Therefore, for "drivers/pci/controller/cadence/pci-sky1.c", it is normal.



Using the following code for work is also normal. Later, I will re-unify 
it into the same operation.

diff --git a/drivers/pci/controller/cadence/pcie-cadence.h 
b/drivers/pci/controller/cadence/pcie-cadence.h
index 574e9cf4d003..723ea79fb02e 100644
--- a/drivers/pci/controller/cadence/pcie-cadence.h
+++ b/drivers/pci/controller/cadence/pcie-cadence.h
@@ -314,7 +314,9 @@ static inline int cdns_pcie_read_cfg_word(struct 
cdns_pcie *pcie, int where,
  static inline int cdns_pcie_read_cfg_dword(struct cdns_pcie *pcie, int 
where,
                                            u32 *val)
  {
-       *val = cdns_pcie_readl(pcie, where);
+       void __iomem *addr = pcie->reg_base + where;
+
+       *val = cdns_pcie_read_sz(addr, 0x4);
         return PCIBIOS_SUCCESSFUL;
  }


Best regards,
Hans



[-- Attachment #2: dmesg.log --]
[-- Type: text/x-log, Size: 78077 bytes --]

[    0.000000] Booting Linux on physical CPU 0x0000000a00 [0x410fd811]
[    0.000000] Linux version 7.1.0-rc2-00076-g74fe02ce122a-dirty (power@Precision-7960) (aarch64-none-linux-gnu-gcc (Arm GNU Toolchain 12.3.Rel1 (Build arm-12.35)) 12.3.1 20230626, GNU ld (Arm GNU Toolchain 12.3.Rel1 (Build arm-12.35)) 2.40.0.20230627) #39 SMP PREEMPT Thu May  7 10:43:29 CST 2026
[    0.000000] KASLR enabled
[    0.000000] Machine model: Xunlong,OrangePi 6 Plus
[    0.000000] earlycon: pl11 at MMIO 0x00000000040d0000 (options '')
[    0.000000] printk: legacy bootconsole [pl11] enabled
[    0.000000] efi: EFI v2.7 by EDK II
[    0.000000] efi: ACPI 2.0=0x479880018 SMBIOS 3.0=0x47e820000 MEMATTR=0x47b64b018 RNG=0x47988fe18 MEMRESERVE=0x4743b3a18 
[    0.000000] random: crng init done
[    0.000000] Reserved memory: created CMA memory pool at 0x0000000448e00000, size 640 MiB
[    0.000000] OF: reserved mem: initialized node linux,cma, compatible id shared-dma-pool
[    0.000000] OF: reserved mem: 0x0000000448e00000..0x0000000470dfffff (655360 KiB) map reusable linux,cma
[    0.000000] NUMA: Faking a node at [mem 0x0000000080000000-0x000000047fffffff]
[    0.000000] NODE_DATA(0) allocated [mem 0x47d751f00-0x47d7545ff]
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.1 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: Trusted OS migration not required
[    0.000000] psci: SMC Calling Convention v1.2
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000080000000-0x00000000ffffffff]
[    0.000000]   DMA32    empty
[    0.000000]   Normal   [mem 0x0000000100000000-0x000000047fffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000080000000-0x00000000843fffff]
[    0.000000]   node   0: [mem 0x0000000084400000-0x00000000845fffff]
[    0.000000]   node   0: [mem 0x0000000085000000-0x0000000085efffff]
[    0.000000]   node   0: [mem 0x0000000085f00000-0x0000000085ffffff]
[    0.000000]   node   0: [mem 0x0000000086000000-0x000000009fffffff]
[    0.000000]   node   0: [mem 0x00000000a0000000-0x00000000a7ffffff]
[    0.000000]   node   0: [mem 0x00000000a8000000-0x00000000fffdffff]
[    0.000000]   node   0: [mem 0x00000000fffe0000-0x00000000fffeffff]
[    0.000000]   node   0: [mem 0x00000000ffff0000-0x00000000ffffdfff]
[    0.000000]   node   0: [mem 0x00000000ffffe000-0x00000000ffffffff]
[    0.000000]   node   0: [mem 0x0000000100000000-0x000000047e13ffff]
[    0.000000]   node   0: [mem 0x000000047e140000-0x000000047ea3ffff]
[    0.000000]   node   0: [mem 0x000000047ea40000-0x000000047fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000080000000-0x000000047fffffff]
[    0.000000] On node 0, zone DMA: 2560 pages in unavailable ranges
[    0.000000] percpu: Embedded 26 pages/cpu s66584 r8192 d31720 u106496
[    0.000000] pcpu-alloc: s66584 r8192 d31720 u106496 alloc=26*4096
[    0.000000] pcpu-alloc: [0] 00 [0] 01 [0] 02 [0] 03 [0] 04 [0] 05 [0] 06 [0] 07 
[    0.000000] pcpu-alloc: [0] 08 [0] 09 [0] 10 [0] 11 
[    0.000000] Detected PIPT I-cache on CPU0
[    0.000000] CPU features: detected: Address authentication (architected QARMA3 algorithm)
[    0.000000] CPU features: detected: GICv3 CPU interface
[    0.000000] CPU features: detected: HCRX_EL2 register
[    0.000000] CPU features: detected: Virtualization Host Extensions
[    0.000000] CPU features: detected: Memory Tagging Extension
[    0.000000] CPU features: detected: Asymmetric MTE Tag Check Fault
[    0.000000] CPU features: detected: Spectre-v4
[    0.000000] CPU features: detected: Spectre-BHB
[    0.000000] CPU features: detected: SSBS not fully self-synchronizing
[    0.000000] alternatives: applying boot alternatives
[    0.000000] Kernel command line: BOOT_IMAGE=/Image-xcp console=ttyAMA2,115200 efi=noruntime earlycon=pl011,0x040d0000 arm-smmu-v3.disable_bypass=0 acpi=off clk_ignore_unused=1 loglevel=7 pcie_aspm=off root=PARTUUID=228a6699-98b9-4e75-b31c-149ccf1bbc9d rootwait rw
[    0.000000] PCIe ASPM is disabled
[    0.000000] printk: log buffer data + meta data: 131072 + 458752 = 589824 bytes
[    0.000000] Dentry cache hash table entries: 2097152 (order: 12, 16777216 bytes, linear)
[    0.000000] Inode-cache hash table entries: 1048576 (order: 11, 8388608 bytes, linear)
[    0.000000] software IO TLB: area num 16.
[    0.000000] software IO TLB: mapped [mem 0x00000000fbfe0000-0x00000000fffe0000] (64MB)
[    0.000000] Fallback order for Node 0: 0 
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 4191744
[    0.000000] Policy zone: Normal
[    0.000000] mem auto-init: stack:all(zero), heap alloc:off, heap free:off
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=12, Nodes=1
[    0.000000] rcu: Preemptible hierarchical RCU implementation.
[    0.000000] rcu: 	RCU event tracing is enabled.
[    0.000000] rcu: 	RCU restricting CPUs from NR_CPUS=512 to nr_cpu_ids=12.
[    0.000000] 	Trampoline variant of Tasks RCU enabled.
[    0.000000] 	Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 25 jiffies.
[    0.000000] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=12
[    0.000000] RCU Tasks: Setting shift to 4 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=12.
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] GICv3: GIC: Using split EOI/Deactivate mode
[    0.000000] GIC: enabling workaround for GICv3: ARM64 erratum 2941627
[    0.000000] GICv3: 512 SPIs implemented
[    0.000000] GICv3: 0 Extended SPIs implemented
[    0.000000] Root IRQ handler: gic_handle_irq
[    0.000000] GICv3: GICv3 features: 16 PPIs, DirectLPI
[    0.000000] GICv3: GICv4 features: DirectLPI RVPEID Valid+Dirty 
[    0.000000] GICv3: GICD_CTLR.DS=0, SCR_EL3.FIQ=1
[    0.000000] GICv3: CPU0: found redistributor a00 region 0:0x000000000e310000
[    0.000000] ITS [mem 0x0e050000-0x0e07ffff]
[    0.000000] ITS@0x000000000e050000: Single VMOVP capable
[    0.000000] ITS@0x000000000e050000: Using GICv4.1 mode 00000000 00000001
[    0.000000] ITS@0x000000000e050000: allocated 8192 Devices @1000f0000 (indirect, esz 8, psz 64K, shr 1)
[    0.000000] ITS@0x000000000e050000: allocated 32768 Interrupt Collections @100100000 (flat, esz 2, psz 64K, shr 1)
[    0.000000] ITS@0x000000000e050000: allocated 8192 Virtual CPUs @100110000 (flat, esz 8, psz 64K, shr 1)
[    0.000000] GICv3: using LPI property table @0x0000000100120000
[    0.000000] ITS: Using DirectLPI for VPE invalidation
[    0.000000] ITS: Enabling GICv4 support
[    0.000000] GICv3: CPU0: using allocated LPI pending table @0x0000000100130000
[    0.000000] GICv3: GIC: PPI partition interrupt-partition-0[0] { /cpus/cpu@0[1] /cpus/cpu@100[2] /cpus/cpu@200[3] /cpus/cpu@300[4] }
[    0.000000] GICv3: GIC: PPI partition interrupt-partition-1[1] { /cpus/cpu@400[5] /cpus/cpu@500[6] /cpus/cpu@600[7] /cpus/cpu@700[8] /cpus/cpu@800[9] /cpus/cpu@900[10] /cpus/cpu@a00[0] /cpus/cpu@b00[11] }
[    0.000000] rcu: srcu_init: Setting srcu_struct sizes based on contention.
[    0.000000] arch_timer: cp15 timer running at 1000.00MHz (phys).
[    0.000000] clocksource: arch_sys_counter: mask: 0x1fffffffffffffff max_cycles: 0x1cd42e4dffb, max_idle_ns: 881590591483 ns
[    0.000000] sched_clock: 61 bits at 1000MHz, resolution 1ns, wraps every 4398046511103ns
[    0.008310] Console: colour dummy device 80x25
[    0.012831] Calibrating delay loop (skipped), value calculated using timer frequency.. 2000.00 BogoMIPS (lpj=4000000)
[    0.023559] pid_max: default: 32768 minimum: 301
[    0.028339] Mount-cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[    0.035999] Mountpoint-cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[    0.044174] VFS: Finished mounting rootfs on nullfs
[    0.049443] cacheinfo: Unable to detect cache hierarchy for CPU 0
[    0.055826] rcu: Hierarchical SRCU implementation.
[    0.060667] rcu: 	Max phase no-delay instances is 1000.
[    0.065983] Timer migration: 2 hierarchy levels; 8 children per group; 2 crossnode level
[    0.074210] fsl-mc MSI: msi-controller@e050000 domain created
[    0.080155] EFI runtime services will be disabled.
[    0.085093] smp: Bringing up secondary CPUs ...
[    0.089873] CPU features: detected: ARM errata 2966298, 3117295
[    0.089884] Detected PIPT I-cache on CPU1
[    0.089899] CPU features: SANITY CHECK: Unexpected variation in SYS_ID_AA64MMFR1_EL1. Boot CPU: 0x1001111010312122, CPU1: 0x1001111011312122
[    0.089910] CPU features: Unsupported CPU feature variation detected.
[    0.089927] GICv3: CPU1: found redistributor 0 region 0:0x000000000e090000
[    0.089939] GICv3: CPU1: using allocated LPI pending table @0x0000000100140000
[    0.089969] CPU1: Booted secondary processor 0x0000000000 [0x410fd801]
[    0.090281] Detected PIPT I-cache on CPU2
[    0.090295] CPU features: SANITY CHECK: Unexpected variation in SYS_ID_AA64MMFR1_EL1. Boot CPU: 0x1001111010312122, CPU2: 0x1001111011312122
[    0.090318] GICv3: CPU2: found redistributor 100 region 0:0x000000000e0d0000
[    0.090330] GICv3: CPU2: using allocated LPI pending table @0x0000000100150000
[    0.090358] CPU2: Booted secondary processor 0x0000000100 [0x410fd801]
[    0.090653] Detected PIPT I-cache on CPU3
[    0.090667] CPU features: SANITY CHECK: Unexpected variation in SYS_ID_AA64MMFR1_EL1. Boot CPU: 0x1001111010312122, CPU3: 0x1001111011312122
[    0.090693] GICv3: CPU3: found redistributor 200 region 0:0x000000000e110000
[    0.090706] GICv3: CPU3: using allocated LPI pending table @0x0000000100160000
[    0.090734] CPU3: Booted secondary processor 0x0000000200 [0x410fd801]
[    0.091042] Detected PIPT I-cache on CPU4
[    0.091056] CPU features: SANITY CHECK: Unexpected variation in SYS_ID_AA64MMFR1_EL1. Boot CPU: 0x1001111010312122, CPU4: 0x1001111011312122
[    0.091083] GICv3: CPU4: found redistributor 300 region 0:0x000000000e150000
[    0.091096] GICv3: CPU4: using allocated LPI pending table @0x0000000100170000
[    0.091124] CPU4: Booted secondary processor 0x0000000300 [0x410fd801]
[    0.091375] Detected PIPT I-cache on CPU5
[    0.091394] GICv3: CPU5: found redistributor 400 region 0:0x000000000e190000
[    0.091401] GICv3: CPU5: using allocated LPI pending table @0x0000000100180000
[    0.091417] CPU5: Booted secondary processor 0x0000000400 [0x410fd811]
[    0.091605] Detected PIPT I-cache on CPU6
[    0.091629] GICv3: CPU6: found redistributor 500 region 0:0x000000000e1d0000
[    0.091636] GICv3: CPU6: using allocated LPI pending table @0x0000000100190000
[    0.091655] CPU6: Booted secondary processor 0x0000000500 [0x410fd811]
[    0.091840] Detected PIPT I-cache on CPU7
[    0.091864] GICv3: CPU7: found redistributor 600 region 0:0x000000000e210000
[    0.091871] GICv3: CPU7: using allocated LPI pending table @0x00000001001a0000
[    0.091890] CPU7: Booted secondary processor 0x0000000600 [0x410fd811]
[    0.092069] Detected PIPT I-cache on CPU8
[    0.092095] GICv3: CPU8: found redistributor 700 region 0:0x000000000e250000
[    0.092102] GICv3: CPU8: using allocated LPI pending table @0x00000001001b0000
[    0.092120] CPU8: Booted secondary processor 0x0000000700 [0x410fd811]
[    0.092298] Detected PIPT I-cache on CPU9
[    0.092323] GICv3: CPU9: found redistributor 800 region 0:0x000000000e290000
[    0.092329] GICv3: CPU9: using allocated LPI pending table @0x00000001001c0000
[    0.092347] CPU9: Booted secondary processor 0x0000000800 [0x410fd811]
[    0.092523] Detected PIPT I-cache on CPU10
[    0.092549] GICv3: CPU10: found redistributor 900 region 0:0x000000000e2d0000
[    0.092556] GICv3: CPU10: using allocated LPI pending table @0x00000001001d0000
[    0.092575] CPU10: Booted secondary processor 0x0000000900 [0x410fd811]
[    0.092751] Detected PIPT I-cache on CPU11
[    0.092778] GICv3: CPU11: found redistributor b00 region 0:0x000000000e350000
[    0.092785] GICv3: CPU11: using allocated LPI pending table @0x00000001001e0000
[    0.092803] CPU11: Booted secondary processor 0x0000000b00 [0x410fd811]
[    0.092896] smp: Brought up 1 node, 12 CPUs
[    0.436740] SMP: Total of 12 processors activated.
[    0.441577] CPU: All CPU(s) started at EL2
[    0.445717] CPU features: detected: Branch Target Identification
[    0.451787] CPU features: detected: ARMv8.4 Translation Table Level
[    0.458121] CPU features: detected: Data cache clean to the PoU not required for I/D coherence
[    0.466826] CPU features: detected: Common not Private translations
[    0.473160] CPU features: detected: CRC32 instructions
[    0.478349] CPU features: detected: Data independent timing control (DIT)
[    0.485208] CPU features: detected: E0PD
[    0.489164] CPU features: detected: Enhanced Counter Virtualization
[    0.495496] CPU features: detected: Enhanced Counter Virtualization (CNTPOFF)
[    0.502705] CPU features: detected: Enhanced Privileged Access Never
[    0.509123] CPU features: detected: Enhanced Virtualization Traps
[    0.515278] CPU features: detected: Fine Grained Traps
[    0.520467] CPU features: detected: Generic authentication (architected QARMA3 algorithm)
[    0.528732] CPU features: detected: RCpc load-acquire (LDAPR)
[    0.534535] CPU features: detected: LSE atomic instructions
[    0.540163] CPU features: detected: Privileged Access Never
[    0.545790] CPU features: detected: PMUv3
[    0.549836] CPU features: detected: RAS Extension Support
[    0.555287] CPU features: detected: RASv1p1 Extension Support
[    0.561090] CPU features: detected: Speculation barrier (SB)
[    0.566805] CPU features: detected: Stage-2 Force Write-Back
[    0.572521] CPU features: detected: TLB range maintenance instructions
[    0.579115] CPU features: detected: WFx with timeout
[    0.584127] CPU features: detected: XNX
[    0.587996] CPU features: detected: Memory Partitioning And Monitoring
[    0.594590] CPU features: detected: Memory Partitioning And Monitoring Virtualisation
[    0.602502] CPU features: detected: Speculative Store Bypassing Safe (SSBS)
[    0.609535] CPU features: detected: Scalable Vector Extension
[    0.615380] alternatives: applying system-wide alternatives
[    0.622608] CPU features: detected: Activity Monitors Unit (AMU) on CPU0-11
[    0.629650] CPU features: detected: ICV_DIR_EL1 trapping
[    0.635014] CPU features: detected: Hardware dirty bit management on CPU0-11
[    0.642138] SVE: maximum available vector length 16 bytes per vector
[    0.648557] SVE: default vector length 16 bytes per vector
[    0.654682] Memory: 15451052K/16766976K available (18816K kernel code, 4970K rwdata, 14208K rodata, 12288K init, 723K bss, 649308K reserved, 655360K cma-reserved)
[    0.669889] devtmpfs: initialized
[    0.675701] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns
[    0.685566] posixtimers hash table entries: 8192 (order: 5, 131072 bytes, linear)
[    0.693164] futex hash table entries: 4096 (262144 bytes on 1 NUMA nodes, total 256 KiB, linear).
[    0.703234] 2G module region forced by RANDOMIZE_MODULE_REGION_FULL
[    0.709574] 0 pages in range for non-PLT usage
[    0.709576] 511472 pages in range for PLT usage
[    0.714600] DMI: SMBIOS 3.6.0 present.
[    0.722966] DMI: Cix Technology Group Co., Ltd. CIX Phecda Board/CIX Phecda Board, BIOS 1.3 11/13/2025
[    0.732396] DMI: Memory slots populated: 4/4
[    0.737668] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.744117] DMA: preallocated 2048 KiB GFP_KERNEL pool for atomic allocations
[    0.751396] DMA: preallocated 2048 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[    0.759320] audit: initializing netlink subsys (disabled)
[    0.764863] audit: type=2000 audit(0.452:1): state=initialized audit_enabled=0 res=1
[    0.765154] thermal_sys: Registered thermal governor 'step_wise'
[    0.772698] thermal_sys: Registered thermal governor 'power_allocator'
[    0.778836] cpuidle: using governor menu
[    0.789442] hw-breakpoint: found 6 breakpoint and 4 watchpoint registers.
[    0.796466] ASID allocator initialised with 65536 entries
[    0.802428] Serial: AMBA PL011 UART driver
[    0.807260] /soc@0/interrupt-controller@e010000: Fixed dependency cycle(s) with /soc@0/interrupt-controller@e010000
[    0.818030] /soc@0/pinctrl@4170000: Fixed dependency cycle(s) with /soc@0/pinctrl@4170000/hog-cfg
[    0.828138] /soc@0/pinctrl@16007000: Fixed dependency cycle(s) with /soc@0/pinctrl@16007000/hog-s5-cfg
[    0.838156] HugeTLB: registered 1.00 GiB page size, pre-allocated 0 pages
[    0.845025] HugeTLB: 0 KiB vmemmap can be freed for a 1.00 GiB page
[    0.851359] HugeTLB: registered 32.0 MiB page size, pre-allocated 0 pages
[    0.858217] HugeTLB: 0 KiB vmemmap can be freed for a 32.0 MiB page
[    0.864548] HugeTLB: registered 2.00 MiB page size, pre-allocated 0 pages
[    0.871407] HugeTLB: 0 KiB vmemmap can be freed for a 2.00 MiB page
[    0.877739] HugeTLB: registered 64.0 KiB page size, pre-allocated 0 pages
[    0.884596] HugeTLB: 0 KiB vmemmap can be freed for a 64.0 KiB page
[    0.891837] ACPI: Interpreter disabled.
[    0.896203] iommu: Default domain type: Translated
[    0.901047] iommu: DMA domain TLB invalidation policy: strict mode
[    0.907814] SCSI subsystem initialized
[    0.911709] libata version 3.00 loaded.
[    0.911775] usbcore: registered new interface driver usbfs
[    0.917325] usbcore: registered new interface driver hub
[    0.922701] usbcore: registered new device driver usb
[    0.927922] pps_core: LinuxPPS API ver. 1 registered
[    0.932937] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
[    0.942171] PTP clock support registered
[    0.946157] EDAC MC: Ver: 3.0.0
[    0.949474] scmi_core: SCMI protocol bus registered
[    0.954634] FPGA manager framework
[    0.958450] vgaarb: loaded
[    0.961336] clocksource: Switched to clocksource arch_sys_counter
[    0.967577] VFS: Disk quotas dquot_6.6.0
[    0.971544] VFS: Dquot-cache hash table entries: 512 (order 0, 4096 bytes)
[    0.978659] pnp: PnP ACPI: disabled
[    0.986516] NET: Registered PF_INET protocol family
[    0.991572] IP idents hash table entries: 262144 (order: 9, 2097152 bytes, linear)
[    1.002729] tcp_listen_portaddr_hash hash table entries: 8192 (order: 5, 131072 bytes, linear)
[    1.011463] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    1.019295] TCP established hash table entries: 131072 (order: 8, 1048576 bytes, linear)
[    1.027588] TCP bind hash table entries: 65536 (order: 9, 2097152 bytes, linear)
[    1.035294] TCP: Hash tables configured (established 131072 bind 65536)
[    1.042020] UDP hash table entries: 8192 (order: 7, 524288 bytes, linear)
[    1.048988] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    1.054946] RPC: Registered named UNIX socket transport module.
[    1.060933] RPC: Registered udp transport module.
[    1.065686] RPC: Registered tcp transport module.
[    1.070436] RPC: Registered tcp-with-tls transport module.
[    1.075977] RPC: Registered tcp NFSv4.1 backchannel transport module.
[    1.082487] PCI: CLS 0 bytes, default 64
[    1.087604] kvm [1]: nv: 570 coarse grained trap handlers
[    1.093199] kvm [1]: nv: 710 fine grained trap handlers
[    1.098568] kvm [1]: IPA Size Limit: 40 bits
[    1.102896] kvm [1]: GICv4 support disabled
[    1.107122] kvm [1]: GICv3: no GICV resource entry
[    1.111961] kvm [1]: disabling GICv2 emulation
[    1.116475] kvm [1]: GIC system register CPU interface enabled
[    1.122381] kvm [1]: vgic interrupt IRQ9
[    1.126363] kvm [1]: VHE mode initialized successfully
[    1.132264] Initialise system trusted keyrings
[    1.136913] workingset: timestamp_bits=42 (anon: 38) max_order=22 bucket_order=0 (anon: 0)
[    1.145440] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    1.151489] NFS: Registering the id_resolver key type
[    1.156600] Key type id_resolver registered
[    1.160824] Key type id_legacy registered
[    1.164876] nfs4filelayout_init: NFSv4 File Layout Driver Registering...
[    1.171649] nfs4flexfilelayout_init: NFSv4 Flexfile Layout Driver Registering...
[    1.179239] 9p: Installing v9fs 9p2000 file system support
[    1.198319] Key type asymmetric registered
[    1.202457] Asymmetric key parser 'x509' registered
[    1.207402] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 244)
[    1.214880] io scheduler mq-deadline registered
[    1.219456] io scheduler kyber registered
[    1.223517] io scheduler bfq registered
[    1.229604] ledtrig-cpu: registered to indicate activity on CPUs
[    1.235835] [HANS] fun = sky1_pcie_probe, line = 177 ........... 
[    1.242007] sky1-pcie a0c0000.pcie: host bridge /soc@0/pcie@a0c0000 ranges:
[    1.249052] sky1-pcie a0c0000.pcie:       IO 0x0040100000..0x00401fffff -> 0x0040100000
[    1.257149] sky1-pcie a0c0000.pcie:      MEM 0x0040200000..0x004fffffff -> 0x0040200000
[    1.265247] sky1-pcie a0c0000.pcie:      MEM 0x1000000000..0x13ffffffff -> 0x1000000000
[    1.273373] sky1-pcie a0c0000.pcie: ECAM at [mem 0x26000000-0x28ffffff] for [bus 60-8f]
[    1.281469] [HANS] fun = cix_pcie_test_cap, line = 137 ........... 
[    1.287803] [HANS]pm offset = 0x80
[    1.291238] [HANS]msi offset = 0x90
[    1.294758] [HANS]msix offset = 0xb0
[    1.298370] [HANS]exp offset = 0xc0
[    1.301890] [HANS] fun = cix_pcie_test_cap, line = 148 ........... 
[    1.308225] [HANS]aer offset = 0x100
[    1.311834] [HANS]Virtual Channel offset = 0x4c0
[    1.316499] [HANS]Device Serial Number offset = 0x150
[    1.321605] [HANS]pwr offset = 0x0
[    1.325036] [HANS]resize bar offset = 0x0
[    1.329084] [HANS]second exp offset = 0x300
[    1.333310] [HANS]L1ss offset = 0x900
[    1.337010] sky1-pcie a0c0000.pcie: Link up
[    1.341287] sky1-pcie a0c0000.pcie: PCI host bridge to bus 0000:60
[    1.347539] pci_bus 0000:60: root bus resource [bus 60-8f]
[    1.353084] pci_bus 0000:60: root bus resource [io  0x0000-0xfffff] (bus address [0x40100000-0x401fffff])
[    1.362758] pci_bus 0000:60: root bus resource [mem 0x40200000-0x4fffffff]
[    1.369706] pci_bus 0000:60: root bus resource [mem 0x1000000000-0x13ffffffff pref]
[    1.377465] pci 0000:60:00.0: [1f6c:0001] type 01 class 0x060400 PCIe Root Port
[    1.384863] pci 0000:60:00.0: PCI bridge to [bus 61]
[    1.389880] pci 0000:60:00.0:   bridge window [io  0x0000-0x0fff]
[    1.396037] pci 0000:60:00.0:   bridge window [mem 0x40000000-0x400fffff]
[    1.402945] pci 0000:60:00.0: supports D1
[    1.406992] pci 0000:60:00.0: PME# supported from D0 D1 D3hot
[    1.413079] pci 0000:61:00.0: [10ec:8126] type 00 class 0x020000 PCIe Endpoint
[    1.420431] pci 0000:61:00.0: BAR 0: initial BAR value 0x00000000 invalid
[    1.427292] pci 0000:61:00.0: BAR 0 [io  size 0x0100]
[    1.432398] pci 0000:61:00.0: BAR 2 [mem 0x40000000-0x4000ffff 64bit]
[    1.438912] pci 0000:61:00.0: BAR 4 [mem 0x40010000-0x40013fff 64bit]
[    1.445536] pci 0000:61:00.0: supports D1 D2
[    1.449848] pci 0000:61:00.0: PME# supported from D0 D1 D2 D3hot D3cold
[    1.456700] pci 0000:60:00.0: bridge window [mem 0x40200000-0x402fffff]: assigned
[    1.464268] pci 0000:60:00.0: bridge window [io  0x1000-0x1fff]: assigned
[    1.471129] pci 0000:61:00.0: BAR 2 [mem 0x40200000-0x4020ffff 64bit]: assigned
[    1.478527] pci 0000:61:00.0: BAR 4 [mem 0x40210000-0x40213fff 64bit]: assigned
[    1.485923] pci 0000:61:00.0: BAR 0 [io  0x1000-0x10ff]: assigned
[    1.492084] pci 0000:60:00.0: PCI bridge to [bus 61]
[    1.497099] pci 0000:60:00.0:   bridge window [io  0x1000-0x1fff]
[    1.503256] pci 0000:60:00.0:   bridge window [mem 0x40200000-0x402fffff]
[    1.510119] pci_bus 0000:60: resource 4 [io  0x0000-0xfffff]
[    1.515836] pci_bus 0000:60: resource 5 [mem 0x40200000-0x4fffffff]
[    1.522168] pci_bus 0000:60: resource 6 [mem 0x1000000000-0x13ffffffff pref]
[    1.529290] pci_bus 0000:61: resource 0 [io  0x1000-0x1fff]
[    1.534918] pci_bus 0000:61: resource 1 [mem 0x40200000-0x402fffff]
[    1.542148] pcieport 0000:60:00.0: PME: Signaling with IRQ 22
[    1.548040] pcieport 0000:60:00.0: AER: enabled with IRQ 22
[    1.553819] [HANS] fun = sky1_pcie_probe, line = 177 ........... 
[    1.559980] sky1-pcie a0e0000.pcie: host bridge /soc@0/pcie@a0e0000 ranges:
[    1.567022] sky1-pcie a0e0000.pcie:       IO 0x0038100000..0x00381fffff -> 0x0038100000
[    1.575124] sky1-pcie a0e0000.pcie:      MEM 0x0038200000..0x003fffffff -> 0x0038200000
[    1.583219] sky1-pcie a0e0000.pcie:      MEM 0x0c00000000..0x0fffffffff -> 0x0c00000000
[    1.591333] sky1-pcie a0e0000.pcie: ECAM at [mem 0x23000000-0x25ffffff] for [bus 30-5f]
[    1.599428] [HANS] fun = cix_pcie_test_cap, line = 137 ........... 
[    1.605762] [HANS]pm offset = 0x80
[    1.609192] [HANS]msi offset = 0x90
[    1.612712] [HANS]msix offset = 0xb0
[    1.616322] [HANS]exp offset = 0xc0
[    1.619841] [HANS] fun = cix_pcie_test_cap, line = 148 ........... 
[    1.626175] [HANS]aer offset = 0x100
[    1.629783] [HANS]Virtual Channel offset = 0x4c0
[    1.634447] [HANS]Device Serial Number offset = 0x150
[    1.639550] [HANS]pwr offset = 0x0
[    1.642985] [HANS]resize bar offset = 0x0
[    1.647034] [HANS]second exp offset = 0x300
[    1.651259] [HANS]L1ss offset = 0x900
[    1.654956] sky1-pcie a0e0000.pcie: Link up
[    1.659215] sky1-pcie a0e0000.pcie: PCI host bridge to bus 0001:30
[    1.665498] pci_bus 0001:30: root bus resource [bus 30-5f]
[    1.671041] pci_bus 0001:30: root bus resource [io  0x100000-0x1fffff] (bus address [0x38100000-0x381fffff])
[    1.680977] pci_bus 0001:30: root bus resource [mem 0x38200000-0x3fffffff]
[    1.687925] pci_bus 0001:30: root bus resource [mem 0xc00000000-0xfffffffff pref]
[    1.695505] pci 0001:30:00.0: [1f6c:0001] type 01 class 0x060400 PCIe Root Port
[    1.702906] pci 0001:30:00.0: PCI bridge to [bus 31]
[    1.707922] pci 0001:30:00.0:   bridge window [io  0x0000-0x0fff]
[    1.714079] pci 0001:30:00.0:   bridge window [mem 0x38000000-0x380fffff]
[    1.720994] pci 0001:30:00.0: supports D1
[    1.725041] pci 0001:30:00.0: PME# supported from D0 D1 D3hot
[    1.731118] pci 0001:31:00.0: [10ec:8126] type 00 class 0x020000 PCIe Endpoint
[    1.738470] pci 0001:31:00.0: BAR 0 [io  0x1000-0x10ff]
[    1.743752] pci 0001:31:00.0: BAR 2 [mem 0x38000000-0x3800ffff 64bit]
[    1.750265] pci 0001:31:00.0: BAR 4 [mem 0x38010000-0x38013fff 64bit]
[    1.756899] pci 0001:31:00.0: supports D1 D2
[    1.761209] pci 0001:31:00.0: PME# supported from D0 D1 D2 D3hot D3cold
[    1.768063] pci 0001:30:00.0: bridge window [mem 0x38200000-0x382fffff]: assigned
[    1.775627] pci 0001:30:00.0: bridge window [io  0x100000-0x100fff]: assigned
[    1.782840] pci 0001:31:00.0: BAR 2 [mem 0x38200000-0x3820ffff 64bit]: assigned
[    1.790236] pci 0001:31:00.0: BAR 4 [mem 0x38210000-0x38213fff 64bit]: assigned
[    1.797638] pci 0001:31:00.0: BAR 0 [io  0x100000-0x1000ff]: assigned
[    1.804150] pci 0001:30:00.0: PCI bridge to [bus 31]
[    1.809164] pci 0001:30:00.0:   bridge window [io  0x100000-0x100fff]
[    1.815673] pci 0001:30:00.0:   bridge window [mem 0x38200000-0x382fffff]
[    1.822535] pci_bus 0001:30: resource 4 [io  0x100000-0x1fffff]
[    1.828516] pci_bus 0001:30: resource 5 [mem 0x38200000-0x3fffffff]
[    1.834848] pci_bus 0001:30: resource 6 [mem 0xc00000000-0xfffffffff pref]
[    1.841797] pci_bus 0001:31: resource 0 [io  0x100000-0x100fff]
[    1.847776] pci_bus 0001:31: resource 1 [mem 0x38200000-0x382fffff]
[    1.854954] pcieport 0001:30:00.0: PME: Signaling with IRQ 24
[    1.860841] pcieport 0001:30:00.0: AER: enabled with IRQ 24
[    1.873646] Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled
[    1.881109] msm_serial: driver initialized
[    1.885404] SuperH (H)SCI(F) driver initialized
[    1.890013] STM32 USART driver initialized
[    1.897332] loop: module loaded
[    1.900747] megasas: 07.734.00.00-rc1
[    1.906183] tun: Universal TUN/TAP device driver, 1.6
[    1.911546] thunder_xcv, ver 1.0
[    1.914822] thunder_bgx, ver 1.0
[    1.918090] nicpf, ver 1.0
[    1.921128] e1000: Intel(R) PRO/1000 Network Driver
[    1.926068] e1000: Copyright (c) 1999-2006 Intel Corporation.
[    1.931890] e1000e: Intel(R) PRO/1000 Network Driver
[    1.936907] e1000e: Copyright(c) 1999 - 2015 Intel Corporation.
[    1.942901] igb: Intel(R) Gigabit Ethernet Network Driver
[    1.948355] igb: Copyright (c) 2007-2014 Intel Corporation.
[    1.953997] igbvf: Intel(R) Gigabit Virtual Function Network Driver
[    1.960329] igbvf: Copyright (c) 2009 - 2012 Intel Corporation.
[    1.966385] sky2: driver version 1.30
[    1.970136] r8169 0000:61:00.0: enabling device (0000 -> 0003)
[    1.986464] r8169 0000:61:00.0 eth0: RTL8126A, c0:74:2b:fa:f5:bd, XID 64a, IRQ 25
[    1.994045] r8169 0000:61:00.0 eth0: jumbo features [frames: 16362 bytes, tx checksumming: ko]
[    2.002807] r8169 0001:31:00.0: enabling device (0000 -> 0003)
[    2.018329] r8169 0001:31:00.0 eth1: RTL8126A, c0:74:2b:fa:f5:be, XID 64a, IRQ 26
[    2.025905] r8169 0001:31:00.0 eth1: jumbo features [frames: 16362 bytes, tx checksumming: ko]
[    2.035125] VFIO - User Level meta-driver version: 0.3
[    2.041084] usbcore: registered new interface driver usb-storage
[    2.047923] i2c_dev: i2c /dev entries driver
[    2.055027] arm-scmi arm-scmi.0.auto: Using scmi_smc_transport
[    2.060933] arm-scmi arm-scmi.0.auto: SCMI max-rx-timeout: 30ms / max-msg-size: 104bytes / max-msg: 20
[    2.070386] scmi_protocol scmi_dev.1: Enabled polling mode TX channel - prot_id:16
[    2.078095] arm-scmi arm-scmi.0.auto: SCMI Notifications - Core Enabled.
[    2.084896] arm-scmi arm-scmi.0.auto: Malformed reply - real_sz:8  calc_sz:4  (loop_num_ret:1)
[    2.093603] arm-scmi arm-scmi.0.auto: SCMI Protocol v2.0 'CIX:' Firmware version 0x0
[    2.101451] arm-scmi arm-scmi.0.auto: Enabling SCMI Quirk [quirk_clock_rates_triplet_out_of_spec]
[    2.111015] scmi-power-domain scmi_dev.3: Initialized 22 power domains
[    2.117655] arm-scmi arm-scmi.1.auto: Using scmi_mailbox_transport
[    2.123902] arm-scmi arm-scmi.1.auto: SCMI max-rx-timeout: 30ms / max-msg-size: 104bytes / max-msg: 20
[    2.133448] arm-scmi arm-scmi.1.auto: SCMI Notifications - Core Enabled.
[    2.140595] arm-scmi arm-scmi.1.auto: SCMI Protocol v2.0 'cix:cix' Firmware version 0x20b0000
[    2.242227] SMCCC: SOC_ID: ARCH_SOC_ID not implemented, skipping ....
[    2.249107] usbcore: registered new interface driver usbhid
[    2.254750] usbhid: USB HID core driver
[    2.259987] hw perfevents: enabled with armv9_cortex_a520 PMU driver, 7 (0,8000003f) counters available
[    2.260321] hw perfevents: enabled with armv9_cortex_a720 PMU driver, 21 (0,800fffff) counters available
[    2.261431] NET: Registered PF_INET6 protocol family
[    2.261926] Segment Routing with IPv6
[    2.261965] In-situ OAM (IOAM) with IPv6
[    2.262018] NET: Registered PF_PACKET protocol family
[    2.262090] 9pnet: Installing 9P2000 support
[    2.262144] Key type dns_resolver registered
[    2.265678] registered taskstats version 1
[    2.265798] Loading compiled-in X.509 certificates
[    2.268428] Demotion targets for Node 0: null
[    2.271794] 40d0000.serial: ttyAMA2 at MMIO 0x40d0000 (irq = 28, base_baud = 0) is a PL011 rev3
[    2.280749] printk: console [ttyAMA2] enabled
[    2.289507] printk: legacy bootconsole [pl11] disabled
[    2.300255] [HANS] fun = sky1_pcie_probe, line = 177 ........... 
[    2.300267] sky1-pcie a010000.pcie: host bridge /soc@0/pcie@a010000 ranges:
[    2.300277] sky1-pcie a010000.pcie:       IO 0x0060100000..0x00601fffff -> 0x0060100000
[    2.300283] sky1-pcie a010000.pcie:      MEM 0x0060200000..0x007fffffff -> 0x0060200000
[    2.300286] sky1-pcie a010000.pcie:      MEM 0x1800000000..0x1bffffffff -> 0x1800000000
[    2.300316] sky1-pcie a010000.pcie: ECAM at [mem 0x2c000000-0x2fffffff] for [bus c0-ff]
[    2.300319] [HANS] fun = cix_pcie_test_cap, line = 137 ........... 
[    2.300321] [HANS]pm offset = 0x80
[    2.300322] [HANS]msi offset = 0x90
[    2.300324] [HANS]msix offset = 0xb0
[    2.300326] [HANS]exp offset = 0xc0
[    2.300327] [HANS] fun = cix_pcie_test_cap, line = 148 ........... 
[    2.300328] [HANS]aer offset = 0x100
[    2.300330] [HANS]Virtual Channel offset = 0x4c0
[    2.300331] [HANS]Device Serial Number offset = 0x150
[    2.300335] [HANS]pwr offset = 0x0
[    2.300338] [HANS]resize bar offset = 0x0
[    2.300340] [HANS]second exp offset = 0x300
[    2.300342] [HANS]L1ss offset = 0x900
[    2.300344] sky1-pcie a010000.pcie: Link up
[    2.300396] sky1-pcie a010000.pcie: PCI host bridge to bus 0002:c0
[    2.300399] pci_bus 0002:c0: root bus resource [bus c0-ff]
[    2.300401] pci_bus 0002:c0: root bus resource [io  0x200000-0x2fffff] (bus address [0x60100000-0x601fffff])
[    2.300402] pci_bus 0002:c0: root bus resource [mem 0x60200000-0x7fffffff]
[    2.300404] pci_bus 0002:c0: root bus resource [mem 0x1800000000-0x1bffffffff pref]
[    2.300418] pci 0002:c0:00.0: [1f6c:0001] type 01 class 0x060400 PCIe Root Port
[    2.300429] pci 0002:c0:00.0: PCI bridge to [bus c1]
[    2.300431] pci 0002:c0:00.0:   bridge window [io  0x0000-0x0fff]
[    2.300434] pci 0002:c0:00.0:   bridge window [mem 0x60000000-0x600fffff]
[    2.300440] pci 0002:c0:00.0: enabling Extended Tags
[    2.300473] pci 0002:c0:00.0: supports D1
[    2.300474] pci 0002:c0:00.0: PME# supported from D0 D1 D3hot
[    2.300708] pci 0002:c1:00.0: [2646:501d] type 00 class 0x010802 PCIe Endpoint
[    2.300735] pci 0002:c1:00.0: BAR 0 [mem 0x60000000-0x60003fff 64bit]
[    2.300801] pci 0002:c1:00.0: PME# supported from D0 D3hot D3cold
[    2.300913] pci 0002:c0:00.0: bridge window [mem 0x60200000-0x602fffff]: assigned
[    2.300916] pci 0002:c1:00.0: BAR 0 [mem 0x60200000-0x60203fff 64bit]: assigned
[    2.300923] pci 0002:c0:00.0: PCI bridge to [bus c1]
[    2.300925] pci 0002:c0:00.0:   bridge window [mem 0x60200000-0x602fffff]
[    2.300929] pci_bus 0002:c0: resource 4 [io  0x200000-0x2fffff]
[    2.300930] pci_bus 0002:c0: resource 5 [mem 0x60200000-0x7fffffff]
[    2.300932] pci_bus 0002:c0: resource 6 [mem 0x1800000000-0x1bffffffff pref]
[    2.300933] pci_bus 0002:c1: resource 1 [mem 0x60200000-0x602fffff]
[    2.301804] pcieport 0002:c0:00.0: PME: Signaling with IRQ 30
[    2.301951] pcieport 0002:c0:00.0: AER: enabled with IRQ 30
[    2.302207] clk: Not disabling unused clocks
[    2.302212] PM: genpd: Disabling unused power domains
[    2.302212] nvme nvme0: pci function 0002:c1:00.0
[    2.400248] nvme nvme0: allocated 64 MiB host memory buffer (16 segments).
[    2.584675] nvme nvme0: 12/0/0 default/read/poll queues
[    2.589278] GPT:disk_guids don't match.
[    2.589281] GPT: Use GNU Parted to correct GPT errors.
[    2.589287]  nvme0n1: p1 p2
[    2.594496] EXT4-fs (nvme0n1p2): mounted filesystem 72e3f572-295f-487a-abdc-a3448f22a2ed r/w with ordered data mode. Quota mode: none.
[    2.594518] VFS: Mounted root (ext4 filesystem) on device 259:2.
[    2.594762] devtmpfs: mounted
[    2.598881] VFS: Pivoted into new rootfs
[    2.600331] Freeing unused kernel memory: 12288K
[    2.600396] Run /sbin/init as init process
[    2.600398]   with arguments:
[    2.600399]     /sbin/init
[    2.600399]   with environment:
[    2.600400]     HOME=/
[    2.600401]     TERM=linux
[    2.641276] systemd[1]: System time before build time, advancing clock.
[    2.660511] systemd[1]: systemd 255.4-1ubuntu8.12 running in system mode (+PAM +AUDIT +SELINUX +APPARMOR +IMA +SMACK +SECCOMP +GCRYPT -GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 -IDN +IPTC +KMOD +LIBCRYPTSETUP +LIBFDISK +PCRE2 -PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD -BPF_FRAMEWORK -XKBCOMMON +UTMP +SYSVINIT default-hierarchy=unified)
[    2.660527] systemd[1]: Detected architecture arm64.
[    2.705540] systemd[1]: Hostname set to <orangepi6plus>.
[    2.856732] systemd[1]: Configuration file /usr/lib/systemd/system/isp-daemon.service is marked executable. Please remove executable permission bits. Proceeding anyway.
[    2.865135] systemd[1]: Queued start job for default target graphical.target.
[    2.906456] systemd[1]: Created slice system-modprobe.slice - Slice /system/modprobe.
[    2.925802] systemd[1]: Created slice system-serial\x2dgetty.slice - Slice /system/serial-getty.
[    2.949675] systemd[1]: Created slice user.slice - User and Session Slice.
[    2.973457] systemd[1]: Started systemd-ask-password-wall.path - Forward Password Requests to Wall Directory Watch.
[    2.997442] systemd[1]: proc-sys-fs-binfmt_misc.automount - Arbitrary Executable File Formats File System Automount Point was skipped because of an unmet condition check (ConditionPathExists=/proc/sys/fs/binfmt_misc).
[    2.997477] systemd[1]: Expecting device dev-ttyAMA2.device - /dev/ttyAMA2...
[    3.033388] systemd[1]: Reached target integritysetup.target - Local Integrity Protected Volumes.
[    3.053416] systemd[1]: Reached target slices.target - Slice Units.
[    3.069386] systemd[1]: Reached target swap.target - Swaps.
[    3.085380] systemd[1]: Reached target time-set.target - System Time Set.
[    3.105403] systemd[1]: Reached target veritysetup.target - Local Verity Protected Volumes.
[    3.136347] systemd[1]: Listening on rpcbind.socket - RPCbind Server Activation Socket.
[    3.157557] systemd[1]: syslog.socket: SO_PASSSEC failed: Operation not supported
[    3.157585] systemd[1]: Listening on syslog.socket - Syslog Socket.
[    3.181480] systemd[1]: Listening on systemd-initctl.socket - initctl Compatibility Named Pipe.
[    3.201505] systemd[1]: systemd-journald-dev-log.socket: SO_PASSSEC failed: Operation not supported
[    3.201549] systemd[1]: Listening on systemd-journald-dev-log.socket - Journal Socket (/dev/log).
[    3.233498] systemd[1]: systemd-journald.socket: SO_PASSSEC failed: Operation not supported
[    3.233546] systemd[1]: systemd-journald.socket: SO_PASSSEC failed: Operation not supported
[    3.233565] systemd[1]: Listening on systemd-journald.socket - Journal Socket.
[    3.269422] systemd[1]: systemd-pcrextend.socket - TPM2 PCR Extension (Varlink) was skipped because of an unmet condition check (ConditionSecurity=measured-uki).
[    3.269643] systemd[1]: Listening on systemd-udevd-control.socket - udev Control Socket.
[    3.305500] systemd[1]: Listening on systemd-udevd-kernel.socket - udev Kernel Socket.
[    3.337420] systemd[1]: Mounting dev-hugepages.mount - Huge Pages File System...
[    3.354252] systemd[1]: Mounting dev-mqueue.mount - POSIX Message Queue File System...
[    3.374241] systemd[1]: Mounting sys-kernel-debug.mount - Kernel Debug File System...
[    3.393467] systemd[1]: sys-kernel-tracing.mount - Kernel Trace File System was skipped because of an unmet condition check (ConditionPathExists=/sys/kernel/tracing).
[    3.393540] systemd[1]: auth-rpcgss-module.service - Kernel Module supporting RPCSEC_GSS was skipped because of an unmet condition check (ConditionPathExists=/etc/krb5.keytab).
[    3.394654] systemd[1]: Starting fake-hwclock-load.service - Restore the current clock...
[    3.424701] (-hwclock)[166]: fake-hwclock-load.service: Referenced but unset environment variable evaluates to an empty string: FORCE
[    3.458334] systemd[1]: Starting keyboard-setup.service - Set the console keyboard layout...
[    3.477390] systemd[1]: kmod-static-nodes.service - Create List of Static Device Nodes was skipped because of an unmet condition check (ConditionFileNotEmpty=/lib/modules/7.1.0-rc2-00076-g74fe02ce122a-dirty/modules.devname).
[    3.478409] systemd[1]: Starting modprobe@configfs.service - Load Kernel Module configfs...
[    3.506669] systemd[1]: Starting modprobe@dm_mod.service - Load Kernel Module dm_mod...
[    3.526557] systemd[1]: Starting modprobe@drm.service - Load Kernel Module drm...
[    3.550399] systemd[1]: Starting modprobe@efi_pstore.service - Load Kernel Module efi_pstore...
[    3.582329] systemd[1]: Starting modprobe@fuse.service - Load Kernel Module fuse...
[    3.602338] systemd[1]: Starting modprobe@loop.service - Load Kernel Module loop...
[    3.622752] systemd[1]: Starting systemd-modules-load.service - Load Kernel Modules...
[    3.641380] systemd[1]: systemd-pcrmachine.service - TPM2 PCR Machine ID Measurement was skipped because of an unmet condition check (ConditionSecurity=measured-uki).
[    3.642323] systemd[1]: Starting systemd-remount-fs.service - Remount Root and Kernel File Systems...
[    3.666429] systemd[1]: Starting systemd-tmpfiles-setup-dev-early.service - Create Static Device Nodes in /dev gracefully...
[    3.705403] systemd[1]: systemd-tpm2-setup-early.service - TPM2 SRK Setup (Early) was skipped because of an unmet condition check (ConditionSecurity=measured-uki).
[    3.706310] systemd[1]: Starting systemd-udev-trigger.service - Coldplug All udev Devices...
[    3.730079] systemd[1]: Mounted dev-hugepages.mount - Huge Pages File System.
[    3.761525] systemd[1]: Mounted dev-mqueue.mount - POSIX Message Queue File System.
[    3.781526] systemd[1]: Mounted sys-kernel-debug.mount - Kernel Debug File System.
[    3.801673] systemd[1]: fake-hwclock-load.service: Deactivated successfully.
[    3.801880] systemd[1]: Finished fake-hwclock-load.service - Restore the current clock.
[    3.829821] systemd[1]: Finished keyboard-setup.service - Set the console keyboard layout.
[    3.849684] systemd[1]: modprobe@configfs.service: Deactivated successfully.
[    3.849886] systemd[1]: Finished modprobe@configfs.service - Load Kernel Module configfs.
[    3.877696] systemd[1]: modprobe@dm_mod.service: Deactivated successfully.
[    3.877899] systemd[1]: Finished modprobe@dm_mod.service - Load Kernel Module dm_mod.
[    3.905685] systemd[1]: modprobe@drm.service: Deactivated successfully.
[    3.905891] systemd[1]: Finished modprobe@drm.service - Load Kernel Module drm.
[    3.929746] systemd[1]: modprobe@efi_pstore.service: Deactivated successfully.
[    3.929918] systemd[1]: Finished modprobe@efi_pstore.service - Load Kernel Module efi_pstore.
[    3.961667] systemd[1]: modprobe@fuse.service: Deactivated successfully.
[    3.961839] systemd[1]: Finished modprobe@fuse.service - Load Kernel Module fuse.
[    3.993626] systemd[1]: modprobe@loop.service: Deactivated successfully.
[    3.993790] systemd[1]: Finished modprobe@loop.service - Load Kernel Module loop.
[    4.021715] systemd[1]: Finished systemd-modules-load.service - Load Kernel Modules.
[    4.045672] systemd[1]: Finished systemd-remount-fs.service - Remount Root and Kernel File Systems.
[    4.073663] systemd[1]: Finished systemd-tmpfiles-setup-dev-early.service - Create Static Device Nodes in /dev gracefully.
[    4.097654] systemd[1]: Finished systemd-udev-trigger.service - Coldplug All udev Devices.
[    4.117846] systemd[1]: sys-fs-fuse-connections.mount - FUSE Control File System was skipped because of an unmet condition check (ConditionPathExists=/sys/fs/fuse/connections).
[    4.161422] systemd[1]: Mounting sys-kernel-config.mount - Kernel Configuration File System...
[    4.182536] systemd[1]: Starting ifupdown-pre.service - Helper to synchronize boot up for ifupdown...
[    4.201676] systemd[1]: systemd-hwdb-update.service - Rebuild Hardware Database was skipped because of an unmet condition check (ConditionNeedsUpdate=/etc).
[    4.201733] systemd[1]: systemd-pstore.service - Platform Persistent Storage Archival was skipped because of an unmet condition check (ConditionDirectoryNotEmpty=/sys/fs/pstore).
[    4.202680] systemd[1]: Starting systemd-random-seed.service - Load/Save OS Random Seed...
[    4.253397] systemd[1]: systemd-repart.service - Repartition Root Disk was skipped because no trigger condition checks were met.
[    4.254335] systemd[1]: Starting systemd-sysctl.service - Apply Kernel Variables...
[    4.272707] systemd[1]: systemd-sysusers.service - Create System Users was skipped because no trigger condition checks were met.
[    4.273672] systemd[1]: Starting systemd-tmpfiles-setup-dev.service - Create Static Device Nodes in /dev...
[    4.305432] systemd[1]: systemd-tpm2-setup.service - TPM2 SRK Setup was skipped because of an unmet condition check (ConditionSecurity=measured-uki).
[    4.306077] systemd[1]: Mounted sys-kernel-config.mount - Kernel Configuration File System.
[    4.353671] systemd[1]: Finished ifupdown-pre.service - Helper to synchronize boot up for ifupdown.
[    4.365621] systemd[1]: Finished systemd-random-seed.service - Load/Save OS Random Seed.
[    4.377614] systemd[1]: Finished systemd-sysctl.service - Apply Kernel Variables.
[    4.389612] systemd[1]: Finished systemd-tmpfiles-setup-dev.service - Create Static Device Nodes in /dev.
[    4.401520] systemd[1]: Reached target local-fs-pre.target - Preparation for Local File Systems.
[    4.413375] systemd[1]: Reached target local-fs.target - Local File Systems.
[    4.426334] systemd[1]: Listening on systemd-sysext.socket - System Extension Image Management (Varlink).
[    4.457527] systemd[1]: Starting console-setup.service - Set console font and keymap...
[    4.469427] systemd[1]: ldconfig.service - Rebuild Dynamic Linker Cache was skipped because no trigger condition checks were met.
[    4.470379] systemd[1]: Starting networking.service - Raise network interfaces...
[    4.482260] systemd[1]: Starting orangepi-zram-config.service - Orange Pi ZRAM config...
[    4.494142] systemd[1]: Starting plymouth-read-write.service - Tell Plymouth To Write Out Runtime Data...
[    4.505391] systemd[1]: selinux-autorelabel-mark.service - Mark the need to relabel after reboot was skipped because of an unmet condition check (ConditionPathExists=!/.autorelabel).
[    4.505677] systemd[1]: systemd-binfmt.service - Set Up Additional Binary Formats was skipped because of an unmet condition check (ConditionPathIsMountPoint=/proc/sys/fs/binfmt_misc).
[    4.506853] systemd[1]: Starting systemd-udevd.service - Rule-based Manager for Device Events and Files...
[    4.517848] systemd[1]: Finished console-setup.service - Set console font and keymap.
[    4.529673] systemd[1]: Finished orangepi-zram-config.service - Orange Pi ZRAM config.
[    4.541632] systemd[1]: Finished plymouth-read-write.service - Tell Plymouth To Write Out Runtime Data.
[    4.553596] systemd[1]: Started systemd-udevd.service - Rule-based Manager for Device Events and Files.
[    4.578486] r8169 0001:31:00.0 enP1p49s0: renamed from eth1
[    4.580688] r8169 0000:61:00.0 enp97s0: renamed from eth0
[    4.609854] systemd[1]: Starting orangepi-ramlog.service - Orange Pi memory supported logging...
[    4.625516] systemd[1]: plymouth-start.service - Show Plymouth Boot Screen was skipped because of an unmet condition check (ConditionKernelCommandLine=splash).
[    4.625572] systemd[1]: bootsplash-ask-password-console.path - Dispatch Password Requests to Console Directory Watch when bootsplash is active was skipped because of an unmet condition check (ConditionPathExists=/sys/devices/platform/bootsplash.0/enabled).
[    4.625600] systemd[1]: systemd-ask-password-plymouth.path - Forward Password Requests to Plymouth Directory Watch was skipped because of an unmet condition check (ConditionPathExists=/run/plymouth/pid).
[    4.625630] systemd[1]: Reached target cryptsetup.target - Local Encrypted Volumes.
[    4.637442] systemd[1]: Reached target paths.target - Path Units.
[    4.661779] systemd[1]: Finished networking.service - Raise network interfaces.
[    4.678351] systemd[1]: Found device dev-ttyAMA2.device - /dev/ttyAMA2.
[    4.919657] systemd[1]: Finished orangepi-ramlog.service - Orange Pi memory supported logging.
[    4.977516] systemd[1]: Starting systemd-journald.service - Journal Service...
[    4.988741] systemd-journald[432]: Collecting audit messages is disabled.
[    5.007618] systemd[1]: Started systemd-journald.service - Journal Service.
[    5.053182] systemd-journald[432]: Received client request to flush runtime journal.
[    6.379470] r8169 0001:31:00.0: Unable to load firmware rtl_nic/rtl8126a-3.fw (-2)
[    6.401343] Realtek Internal NBASE-T PHY r8169-1-3100:00: attached PHY driver (mii_bus:phy_addr=r8169-1-3100:00, irq=MAC)
[    6.517509] r8169 0001:31:00.0 enP1p49s0: Link is Down
[    6.523067] r8169 0000:61:00.0: Unable to load firmware rtl_nic/rtl8126a-3.fw (-2)
[    6.549344] Realtek Internal NBASE-T PHY r8169-0-6100:00: attached PHY driver (mii_bus:phy_addr=r8169-0-6100:00, irq=MAC)
[    6.661505] r8169 0000:61:00.0 enp97s0: Link is Down
[    9.582945] r8169 0000:61:00.0 enp97s0: Link is Up - 1Gbps/Full - flow control rx/tx
[   10.711134] r8169 0000:61:00.0 enp97s0: Link is Down
[   13.718481] r8169 0000:61:00.0 enp97s0: Link is Up - 1Gbps/Full - flow control rx/tx
[   14.847022] r8169 0000:61:00.0 enp97s0: Link is Down
[   17.901444] r8169 0000:61:00.0 enp97s0: Link is Up - 1Gbps/Full - flow control rx/tx
[   19.033238] r8169 0000:61:00.0 enp97s0: Link is Down
[   22.018807] r8169 0000:61:00.0 enp97s0: Link is Up - 100Mbps/Full - flow control rx/tx
-[0000:60]---00.0-[61]----00.0
-[0001:30]---00.0-[31]----00.0
-[0002:c0]---00.0-[c1]----00.0
0000:60:00.0 PCI bridge: Device 1f6c:0001 (prog-if 00 [Normal decode])
	Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin A routed to IRQ 22
	Bus: primary=60, secondary=61, subordinate=61, sec-latency=0
	I/O behind bridge: 1000-1fff [size=4K] [16-bit]
	Memory behind bridge: 40200000-402fffff [size=1M] [32-bit]
	Prefetchable memory behind bridge: 00000000fff00000-00000000000fffff [disabled] [64-bit]
	Secondary status: 66MHz- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- <SERR- <PERR-
	BridgeCtl: Parity- SERR+ NoISA- VGA- VGA16- MAbort- >Reset- FastB2B-
		PriDiscTmr- SecDiscTmr- DiscTmrStat- DiscTmrSERREn-
	Capabilities: [80] Power Management version 3
		Flags: PMEClk- DSI- D1+ D2- AuxCurrent=0mA PME(D0+,D1+,D2-,D3hot+,D3cold-)
		Status: D0 NoSoftRst+ PME-Enable- DSel=0 DScale=0 PME-
	Capabilities: [90] MSI: Enable+ Count=1/32 Maskable+ 64bit+
		Address: 000000000e060040  Data: 0000
		Masking: fffffffe  Pending: 00000000
	Capabilities: [b0] MSI-X: Enable- Count=2 Masked-
		Vector table: BAR=0 offset=00000040
		PBA: BAR=0 offset=00000040
	Capabilities: [c0] Express (v2) Root Port (Slot-), MSI 00
		DevCap:	MaxPayload 512 bytes, PhantFunc 0
			ExtTag- RBE+
		DevCtl:	CorrErr+ NonFatalErr+ FatalErr+ UnsupReq+
			RlxdOrd+ ExtTag- PhantFunc- AuxPwr- NoSnoop+
			MaxPayload 512 bytes, MaxReadReq 1024 bytes
		DevSta:	CorrErr- NonFatalErr- FatalErr- UnsupReq- AuxPwr- TransPend-
		LnkCap:	Port #0, Speed 16GT/s, Width x1, ASPM L0s L1, Exit Latency L0s <256ns, L1 <8us
			ClockPM- Surprise- LLActRep+ BwNot- ASPMOptComp+
		LnkCtl:	ASPM Disabled; RCB 64 bytes, Disabled- CommClk-
			ExtSynch- ClockPM- AutWidDis- BWInt- AutBWInt-
		LnkSta:	Speed 8GT/s, Width x1
			TrErr- Train- SlotClk+ DLActive+ BWMgmt- ABWMgmt-
		RootCap: CRSVisible-
		RootCtl: ErrCorrectable- ErrNon-Fatal- ErrFatal- PMEIntEna+ CRSVisible-
		RootSta: PME ReqID 0000, PMEStatus- PMEPending-
		DevCap2: Completion Timeout: Range ABCD, TimeoutDis+ NROPrPrP- LTR+
			 10BitTagComp+ 10BitTagReq- OBFF Via message, ExtFmt+ EETLPPrefix+, MaxEETLPPrefixes 1
			 EmergencyPowerReduction Not Supported, EmergencyPowerReductionInit-
			 FRS- LN System CLS Not Supported, TPHComp- ExtTPHComp- ARIFwd-
			 AtomicOpsCap: Routing+ 32bit+ 64bit+ 128bitCAS+
		DevCtl2: Completion Timeout: 50us to 50ms, TimeoutDis- LTR+ 10BitTagReq- OBFF Disabled, ARIFwd-
			 AtomicOpsCtl: ReqEn- EgressBlck-
		LnkCap2: Supported Link Speeds: 2.5-16GT/s, Crosslink- Retimer+ 2Retimers+ DRS-
		LnkCtl2: Target Link Speed: 16GT/s, EnterCompliance- SpeedDis-
			 Transmit Margin: Normal Operating Range, EnterModifiedCompliance- ComplianceSOS-
			 Compliance Preset/De-emphasis: -6dB de-emphasis, 0dB preshoot
		LnkSta2: Current De-emphasis Level: -6dB, EqualizationComplete+ EqualizationPhase1+
			 EqualizationPhase2+ EqualizationPhase3+ LinkEqualizationRequest-
			 Retimer- 2Retimers- CrosslinkRes: unsupported
	Capabilities: [100 v2] Advanced Error Reporting
		UESta:	DLP- SDES- TLP- FCP- CmpltTO- CmpltAbrt- UnxCmplt- RxOF- MalfTLP- ECRC- UnsupReq- ACSViol-
		UEMsk:	DLP- SDES- TLP- FCP- CmpltTO- CmpltAbrt- UnxCmplt- RxOF- MalfTLP- ECRC- UnsupReq- ACSViol-
		UESvrt:	DLP+ SDES- TLP- FCP+ CmpltTO- CmpltAbrt- UnxCmplt- RxOF+ MalfTLP+ ECRC- UnsupReq- ACSViol-
		CESta:	RxErr- BadTLP- BadDLLP- Rollover- Timeout- AdvNonFatalErr-
		CEMsk:	RxErr- BadTLP- BadDLLP- Rollover- Timeout- AdvNonFatalErr+
		AERCap:	First Error Pointer: 01, ECRCGenCap+ ECRCGenEn- ECRCChkCap+ ECRCChkEn-
			MultHdrRecCap- MultHdrRecEn- TLPPfxPres- HdrLogCap-
		HeaderLog: 00000000 00000000 00000000 00000000
		RootCmd: CERptEn+ NFERptEn+ FERptEn+
		RootSta: CERcvd- MultCERcvd- UERcvd- MultUERcvd-
			 FirstFatal- NonFatalMsg- FatalMsg- IntMsg 0
		ErrorSrc: ERR_COR: 0000 ERR_FATAL/NONFATAL: 0000
	Capabilities: [150 v1] Device Serial Number 00-00-00-00-00-00-00-00
	Capabilities: [300 v1] Secondary PCI Express
		LnkCtl3: LnkEquIntrruptEn- PerformEqu-
		LaneErrStat: 0
	Capabilities: [4c0 v1] Virtual Channel
		Caps:	LPEVC=0 RefClk=100ns PATEntryBits=1
		Arb:	Fixed- WRR32- WRR64- WRR128-
		Ctrl:	ArbSelect=Fixed
		Status:	InProgress-
		VC0:	Caps:	PATOffset=00 MaxTimeSlots=1 RejSnoopTrans-
			Arb:	Fixed- WRR32- WRR64- WRR128- TWRR128- WRR256-
			Ctrl:	Enable+ ID=0 ArbSelect=Fixed TC/VC=ff
			Status:	NegoPending- InProgress-
	Capabilities: [900 v1] L1 PM Substates
		L1SubCap: PCI-PM_L1.2+ PCI-PM_L1.1+ ASPM_L1.2+ ASPM_L1.1+ L1_PM_Substates+
			  PortCommonModeRestoreTime=0us PortTPowerOnTime=10us
		L1SubCtl1: PCI-PM_L1.2- PCI-PM_L1.1- ASPM_L1.2- ASPM_L1.1-
			   T_CommonMode=0us LTR1.2_Threshold=0ns
		L1SubCtl2: T_PwrOn=10us
	Capabilities: [910 v1] Data Link Feature <?>
	Capabilities: [920 v1] Lane Margining at the Receiver <?>
	Capabilities: [9c0 v1] Physical Layer 16.0 GT/s <?>
	Capabilities: [a20 v1] Precision Time Measurement
		PTMCap: Requester:- Responder:+ Root:+
		PTMClockGranularity: 2ns
		PTMControl: Enabled:- RootSelected:-
		PTMEffectiveGranularity: Unknown
	Capabilities: [a90 v1] Extended Capability ID 0x2f
	Kernel driver in use: pcieport

0000:61:00.0 Ethernet controller: Realtek Semiconductor Co., Ltd. Device 8126 (rev 01)
	Subsystem: Realtek Semiconductor Co., Ltd. Device 0123
	Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0, Cache Line Size: 64 bytes
	Interrupt: pin A routed to IRQ 21
	Region 0: I/O ports at 1000 [size=256]
	Region 2: Memory at 40200000 (64-bit, non-prefetchable) [size=64K]
	Region 4: Memory at 40210000 (64-bit, non-prefetchable) [size=16K]
	Capabilities: [40] Power Management version 3
		Flags: PMEClk- DSI- D1+ D2+ AuxCurrent=375mA PME(D0+,D1+,D2+,D3hot+,D3cold+)
		Status: D0 NoSoftRst+ PME-Enable- DSel=0 DScale=0 PME-
	Capabilities: [50] MSI: Enable- Count=1/1 Maskable+ 64bit+
		Address: 0000000000000000  Data: 0000
		Masking: 00000000  Pending: 00000000
	Capabilities: [70] Express (v2) Endpoint, MSI 01
		DevCap:	MaxPayload 512 bytes, PhantFunc 0, Latency L0s <512ns, L1 <64us
			ExtTag- AttnBtn- AttnInd- PwrInd- RBE+ FLReset- SlotPowerLimit 0W
		DevCtl:	CorrErr+ NonFatalErr+ FatalErr+ UnsupReq+
			RlxdOrd+ ExtTag- PhantFunc- AuxPwr- NoSnoop-
			MaxPayload 512 bytes, MaxReadReq 4096 bytes
		DevSta:	CorrErr- NonFatalErr- FatalErr- UnsupReq- AuxPwr+ TransPend-
		LnkCap:	Port #0, Speed 8GT/s, Width x1, ASPM L0s L1, Exit Latency L0s unlimited, L1 <64us
			ClockPM+ Surprise- LLActRep- BwNot- ASPMOptComp+
		LnkCtl:	ASPM Disabled; RCB 64 bytes, Disabled- CommClk-
			ExtSynch- ClockPM- AutWidDis- BWInt- AutBWInt-
		LnkSta:	Speed 8GT/s, Width x1
			TrErr- Train- SlotClk+ DLActive- BWMgmt- ABWMgmt-
		DevCap2: Completion Timeout: Range ABCD, TimeoutDis+ NROPrPrP- LTR+
			 10BitTagComp- 10BitTagReq- OBFF Via message/WAKE#, ExtFmt- EETLPPrefix-
			 EmergencyPowerReduction Not Supported, EmergencyPowerReductionInit-
			 FRS- TPHComp+ ExtTPHComp-
			 AtomicOpsCap: 32bit- 64bit- 128bitCAS-
		DevCtl2: Completion Timeout: 50us to 50ms, TimeoutDis- LTR+ 10BitTagReq- OBFF Disabled,
			 AtomicOpsCtl: ReqEn-
		LnkCap2: Supported Link Speeds: 2.5-8GT/s, Crosslink- Retimer- 2Retimers- DRS-
		LnkCtl2: Target Link Speed: 8GT/s, EnterCompliance- SpeedDis-
			 Transmit Margin: Normal Operating Range, EnterModifiedCompliance- ComplianceSOS-
			 Compliance Preset/De-emphasis: -6dB de-emphasis, 0dB preshoot
		LnkSta2: Current De-emphasis Level: -6dB, EqualizationComplete+ EqualizationPhase1+
			 EqualizationPhase2+ EqualizationPhase3+ LinkEqualizationRequest-
			 Retimer- 2Retimers- CrosslinkRes: unsupported
	Capabilities: [b0] MSI-X: Enable+ Count=32 Masked-
		Vector table: BAR=4 offset=00000000
		PBA: BAR=4 offset=00000800
	Capabilities: [d0] Vital Product Data
		Not readable
	Capabilities: [100 v2] Advanced Error Reporting
		UESta:	DLP- SDES- TLP- FCP- CmpltTO- CmpltAbrt- UnxCmplt- RxOF- MalfTLP- ECRC- UnsupReq- ACSViol-
		UEMsk:	DLP- SDES- TLP- FCP- CmpltTO- CmpltAbrt- UnxCmplt- RxOF- MalfTLP- ECRC- UnsupReq- ACSViol-
		UESvrt:	DLP+ SDES+ TLP- FCP+ CmpltTO- CmpltAbrt- UnxCmplt- RxOF+ MalfTLP+ ECRC- UnsupReq- ACSViol-
		CESta:	RxErr- BadTLP- BadDLLP- Rollover- Timeout- AdvNonFatalErr-
		CEMsk:	RxErr- BadTLP- BadDLLP- Rollover- Timeout- AdvNonFatalErr+
		AERCap:	First Error Pointer: 00, ECRCGenCap+ ECRCGenEn- ECRCChkCap+ ECRCChkEn-
			MultHdrRecCap- MultHdrRecEn- TLPPfxPres- HdrLogCap-
		HeaderLog: 00000000 00000000 00000000 00000000
	Capabilities: [148 v1] Virtual Channel
		Caps:	LPEVC=0 RefClk=100ns PATEntryBits=1
		Arb:	Fixed- WRR32- WRR64- WRR128-
		Ctrl:	ArbSelect=Fixed
		Status:	InProgress-
		VC0:	Caps:	PATOffset=00 MaxTimeSlots=1 RejSnoopTrans-
			Arb:	Fixed- WRR32- WRR64- WRR128- TWRR128- WRR256-
			Ctrl:	Enable+ ID=0 ArbSelect=Fixed TC/VC=ff
			Status:	NegoPending- InProgress-
	Capabilities: [170 v1] Device Serial Number 01-00-00-00-68-4c-e0-00
	Capabilities: [180 v1] Secondary PCI Express
		LnkCtl3: LnkEquIntrruptEn- PerformEqu-
		LaneErrStat: 0
	Capabilities: [190 v1] Transaction Processing Hints
		No steering table available
	Capabilities: [21c v1] Latency Tolerance Reporting
		Max snoop latency: 0ns
		Max no snoop latency: 0ns
	Capabilities: [224 v1] L1 PM Substates
		L1SubCap: PCI-PM_L1.2+ PCI-PM_L1.1+ ASPM_L1.2+ ASPM_L1.1+ L1_PM_Substates+
			  PortCommonModeRestoreTime=150us PortTPowerOnTime=150us
		L1SubCtl1: PCI-PM_L1.2- PCI-PM_L1.1- ASPM_L1.2- ASPM_L1.1-
			   T_CommonMode=0us LTR1.2_Threshold=0ns
		L1SubCtl2: T_PwrOn=10us
	Capabilities: [234 v1] Vendor Specific Information: ID=0002 Rev=4 Len=100 <?>
	Kernel driver in use: r8169

0001:30:00.0 PCI bridge: Device 1f6c:0001 (prog-if 00 [Normal decode])
	Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin A routed to IRQ 24
	Bus: primary=30, secondary=31, subordinate=31, sec-latency=0
	I/O behind bridge: 100000-100fff [size=4K] [16-bit]
	Memory behind bridge: 38200000-382fffff [size=1M] [32-bit]
	Prefetchable memory behind bridge: 00000000fff00000-00000000000fffff [disabled] [64-bit]
	Secondary status: 66MHz- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- <SERR- <PERR-
	BridgeCtl: Parity- SERR+ NoISA- VGA- VGA16- MAbort- >Reset- FastB2B-
		PriDiscTmr- SecDiscTmr- DiscTmrStat- DiscTmrSERREn-
	Capabilities: [80] Power Management version 3
		Flags: PMEClk- DSI- D1+ D2- AuxCurrent=0mA PME(D0+,D1+,D2-,D3hot+,D3cold-)
		Status: D0 NoSoftRst+ PME-Enable- DSel=0 DScale=0 PME-
	Capabilities: [90] MSI: Enable+ Count=1/32 Maskable+ 64bit+
		Address: 000000000e060040  Data: 0000
		Masking: fffffffe  Pending: 00000000
	Capabilities: [b0] MSI-X: Enable- Count=2 Masked-
		Vector table: BAR=0 offset=00000040
		PBA: BAR=0 offset=00000040
	Capabilities: [c0] Express (v2) Root Port (Slot-), MSI 00
		DevCap:	MaxPayload 512 bytes, PhantFunc 0
			ExtTag- RBE+
		DevCtl:	CorrErr+ NonFatalErr+ FatalErr+ UnsupReq+
			RlxdOrd+ ExtTag- PhantFunc- AuxPwr- NoSnoop+
			MaxPayload 512 bytes, MaxReadReq 1024 bytes
		DevSta:	CorrErr- NonFatalErr- FatalErr- UnsupReq- AuxPwr- TransPend-
		LnkCap:	Port #0, Speed 16GT/s, Width x1, ASPM L0s L1, Exit Latency L0s <256ns, L1 <8us
			ClockPM- Surprise- LLActRep+ BwNot- ASPMOptComp+
		LnkCtl:	ASPM Disabled; RCB 64 bytes, Disabled- CommClk-
			ExtSynch- ClockPM- AutWidDis- BWInt- AutBWInt-
		LnkSta:	Speed 8GT/s, Width x1
			TrErr- Train- SlotClk+ DLActive+ BWMgmt- ABWMgmt-
		RootCap: CRSVisible-
		RootCtl: ErrCorrectable- ErrNon-Fatal- ErrFatal- PMEIntEna+ CRSVisible-
		RootSta: PME ReqID 0000, PMEStatus- PMEPending-
		DevCap2: Completion Timeout: Range ABCD, TimeoutDis+ NROPrPrP- LTR+
			 10BitTagComp+ 10BitTagReq- OBFF Via message, ExtFmt+ EETLPPrefix+, MaxEETLPPrefixes 1
			 EmergencyPowerReduction Not Supported, EmergencyPowerReductionInit-
			 FRS- LN System CLS Not Supported, TPHComp- ExtTPHComp- ARIFwd-
			 AtomicOpsCap: Routing+ 32bit+ 64bit+ 128bitCAS+
		DevCtl2: Completion Timeout: 50us to 50ms, TimeoutDis- LTR+ 10BitTagReq- OBFF Disabled, ARIFwd-
			 AtomicOpsCtl: ReqEn- EgressBlck-
		LnkCap2: Supported Link Speeds: 2.5-16GT/s, Crosslink- Retimer+ 2Retimers+ DRS-
		LnkCtl2: Target Link Speed: 16GT/s, EnterCompliance- SpeedDis-
			 Transmit Margin: Normal Operating Range, EnterModifiedCompliance- ComplianceSOS-
			 Compliance Preset/De-emphasis: -6dB de-emphasis, 0dB preshoot
		LnkSta2: Current De-emphasis Level: -6dB, EqualizationComplete+ EqualizationPhase1+
			 EqualizationPhase2+ EqualizationPhase3+ LinkEqualizationRequest-
			 Retimer- 2Retimers- CrosslinkRes: unsupported
	Capabilities: [100 v2] Advanced Error Reporting
		UESta:	DLP- SDES- TLP- FCP- CmpltTO- CmpltAbrt- UnxCmplt- RxOF- MalfTLP- ECRC- UnsupReq- ACSViol-
		UEMsk:	DLP- SDES- TLP- FCP- CmpltTO- CmpltAbrt- UnxCmplt- RxOF- MalfTLP- ECRC- UnsupReq- ACSViol-
		UESvrt:	DLP+ SDES- TLP- FCP+ CmpltTO- CmpltAbrt- UnxCmplt- RxOF+ MalfTLP+ ECRC- UnsupReq- ACSViol-
		CESta:	RxErr- BadTLP- BadDLLP- Rollover- Timeout- AdvNonFatalErr-
		CEMsk:	RxErr- BadTLP- BadDLLP- Rollover- Timeout- AdvNonFatalErr+
		AERCap:	First Error Pointer: 01, ECRCGenCap+ ECRCGenEn- ECRCChkCap+ ECRCChkEn-
			MultHdrRecCap- MultHdrRecEn- TLPPfxPres- HdrLogCap-
		HeaderLog: 00000000 00000000 00000000 00000000
		RootCmd: CERptEn+ NFERptEn+ FERptEn+
		RootSta: CERcvd- MultCERcvd- UERcvd- MultUERcvd-
			 FirstFatal- NonFatalMsg- FatalMsg- IntMsg 0
		ErrorSrc: ERR_COR: 0000 ERR_FATAL/NONFATAL: 0000
	Capabilities: [150 v1] Device Serial Number 00-00-00-00-00-00-00-00
	Capabilities: [300 v1] Secondary PCI Express
		LnkCtl3: LnkEquIntrruptEn- PerformEqu-
		LaneErrStat: 0
	Capabilities: [4c0 v1] Virtual Channel
		Caps:	LPEVC=0 RefClk=100ns PATEntryBits=1
		Arb:	Fixed- WRR32- WRR64- WRR128-
		Ctrl:	ArbSelect=Fixed
		Status:	InProgress-
		VC0:	Caps:	PATOffset=00 MaxTimeSlots=1 RejSnoopTrans-
			Arb:	Fixed- WRR32- WRR64- WRR128- TWRR128- WRR256-
			Ctrl:	Enable+ ID=0 ArbSelect=Fixed TC/VC=ff
			Status:	NegoPending- InProgress-
	Capabilities: [900 v1] L1 PM Substates
		L1SubCap: PCI-PM_L1.2+ PCI-PM_L1.1+ ASPM_L1.2+ ASPM_L1.1+ L1_PM_Substates+
			  PortCommonModeRestoreTime=0us PortTPowerOnTime=10us
		L1SubCtl1: PCI-PM_L1.2- PCI-PM_L1.1- ASPM_L1.2- ASPM_L1.1-
			   T_CommonMode=0us LTR1.2_Threshold=0ns
		L1SubCtl2: T_PwrOn=10us
	Capabilities: [910 v1] Data Link Feature <?>
	Capabilities: [920 v1] Lane Margining at the Receiver <?>
	Capabilities: [9c0 v1] Physical Layer 16.0 GT/s <?>
	Capabilities: [a20 v1] Precision Time Measurement
		PTMCap: Requester:- Responder:+ Root:+
		PTMClockGranularity: 2ns
		PTMControl: Enabled:- RootSelected:-
		PTMEffectiveGranularity: Unknown
	Capabilities: [a90 v1] Extended Capability ID 0x2f
	Kernel driver in use: pcieport

0001:31:00.0 Ethernet controller: Realtek Semiconductor Co., Ltd. Device 8126 (rev 01)
	Subsystem: Realtek Semiconductor Co., Ltd. Device 0123
	Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0, Cache Line Size: 64 bytes
	Interrupt: pin A routed to IRQ 23
	Region 0: I/O ports at 100000 [size=256]
	Region 2: Memory at 38200000 (64-bit, non-prefetchable) [size=64K]
	Region 4: Memory at 38210000 (64-bit, non-prefetchable) [size=16K]
	Capabilities: [40] Power Management version 3
		Flags: PMEClk- DSI- D1+ D2+ AuxCurrent=375mA PME(D0+,D1+,D2+,D3hot+,D3cold+)
		Status: D0 NoSoftRst+ PME-Enable- DSel=0 DScale=0 PME-
	Capabilities: [50] MSI: Enable- Count=1/1 Maskable+ 64bit+
		Address: 0000000000000000  Data: 0000
		Masking: 00000000  Pending: 00000000
	Capabilities: [70] Express (v2) Endpoint, MSI 01
		DevCap:	MaxPayload 512 bytes, PhantFunc 0, Latency L0s <512ns, L1 <64us
			ExtTag- AttnBtn- AttnInd- PwrInd- RBE+ FLReset- SlotPowerLimit 0W
		DevCtl:	CorrErr+ NonFatalErr+ FatalErr+ UnsupReq+
			RlxdOrd+ ExtTag- PhantFunc- AuxPwr- NoSnoop-
			MaxPayload 512 bytes, MaxReadReq 4096 bytes
		DevSta:	CorrErr- NonFatalErr- FatalErr- UnsupReq- AuxPwr+ TransPend-
		LnkCap:	Port #0, Speed 8GT/s, Width x1, ASPM L0s L1, Exit Latency L0s unlimited, L1 <64us
			ClockPM+ Surprise- LLActRep- BwNot- ASPMOptComp+
		LnkCtl:	ASPM Disabled; RCB 64 bytes, Disabled- CommClk-
			ExtSynch- ClockPM- AutWidDis- BWInt- AutBWInt-
		LnkSta:	Speed 8GT/s, Width x1
			TrErr- Train- SlotClk+ DLActive- BWMgmt- ABWMgmt-
		DevCap2: Completion Timeout: Range ABCD, TimeoutDis+ NROPrPrP- LTR+
			 10BitTagComp- 10BitTagReq- OBFF Via message/WAKE#, ExtFmt- EETLPPrefix-
			 EmergencyPowerReduction Not Supported, EmergencyPowerReductionInit-
			 FRS- TPHComp+ ExtTPHComp-
			 AtomicOpsCap: 32bit- 64bit- 128bitCAS-
		DevCtl2: Completion Timeout: 50us to 50ms, TimeoutDis- LTR+ 10BitTagReq- OBFF Disabled,
			 AtomicOpsCtl: ReqEn-
		LnkCap2: Supported Link Speeds: 2.5-8GT/s, Crosslink- Retimer- 2Retimers- DRS-
		LnkCtl2: Target Link Speed: 8GT/s, EnterCompliance- SpeedDis-
			 Transmit Margin: Normal Operating Range, EnterModifiedCompliance- ComplianceSOS-
			 Compliance Preset/De-emphasis: -6dB de-emphasis, 0dB preshoot
		LnkSta2: Current De-emphasis Level: -6dB, EqualizationComplete+ EqualizationPhase1+
			 EqualizationPhase2+ EqualizationPhase3+ LinkEqualizationRequest-
			 Retimer- 2Retimers- CrosslinkRes: unsupported
	Capabilities: [b0] MSI-X: Enable+ Count=32 Masked-
		Vector table: BAR=4 offset=00000000
		PBA: BAR=4 offset=00000800
	Capabilities: [d0] Vital Product Data
		Not readable
	Capabilities: [100 v2] Advanced Error Reporting
		UESta:	DLP- SDES- TLP- FCP- CmpltTO- CmpltAbrt- UnxCmplt- RxOF- MalfTLP- ECRC- UnsupReq- ACSViol-
		UEMsk:	DLP- SDES- TLP- FCP- CmpltTO- CmpltAbrt- UnxCmplt- RxOF- MalfTLP- ECRC- UnsupReq- ACSViol-
		UESvrt:	DLP+ SDES+ TLP- FCP+ CmpltTO- CmpltAbrt- UnxCmplt- RxOF+ MalfTLP+ ECRC- UnsupReq- ACSViol-
		CESta:	RxErr- BadTLP- BadDLLP- Rollover- Timeout- AdvNonFatalErr-
		CEMsk:	RxErr- BadTLP- BadDLLP- Rollover- Timeout- AdvNonFatalErr+
		AERCap:	First Error Pointer: 00, ECRCGenCap+ ECRCGenEn- ECRCChkCap+ ECRCChkEn-
			MultHdrRecCap- MultHdrRecEn- TLPPfxPres- HdrLogCap-
		HeaderLog: 00000000 00000000 00000000 00000000
	Capabilities: [148 v1] Virtual Channel
		Caps:	LPEVC=0 RefClk=100ns PATEntryBits=1
		Arb:	Fixed- WRR32- WRR64- WRR128-
		Ctrl:	ArbSelect=Fixed
		Status:	InProgress-
		VC0:	Caps:	PATOffset=00 MaxTimeSlots=1 RejSnoopTrans-
			Arb:	Fixed- WRR32- WRR64- WRR128- TWRR128- WRR256-
			Ctrl:	Enable+ ID=0 ArbSelect=Fixed TC/VC=ff
			Status:	NegoPending- InProgress-
	Capabilities: [170 v1] Device Serial Number 01-00-00-00-68-4c-e0-00
	Capabilities: [180 v1] Secondary PCI Express
		LnkCtl3: LnkEquIntrruptEn- PerformEqu-
		LaneErrStat: 0
	Capabilities: [190 v1] Transaction Processing Hints
		No steering table available
	Capabilities: [21c v1] Latency Tolerance Reporting
		Max snoop latency: 0ns
		Max no snoop latency: 0ns
	Capabilities: [224 v1] L1 PM Substates
		L1SubCap: PCI-PM_L1.2+ PCI-PM_L1.1+ ASPM_L1.2+ ASPM_L1.1+ L1_PM_Substates+
			  PortCommonModeRestoreTime=150us PortTPowerOnTime=150us
		L1SubCtl1: PCI-PM_L1.2- PCI-PM_L1.1- ASPM_L1.2- ASPM_L1.1-
			   T_CommonMode=0us LTR1.2_Threshold=0ns
		L1SubCtl2: T_PwrOn=10us
	Capabilities: [234 v1] Vendor Specific Information: ID=0002 Rev=4 Len=100 <?>
	Kernel driver in use: r8169

0002:c0:00.0 PCI bridge: Device 1f6c:0001 (prog-if 00 [Normal decode])
	Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin A routed to IRQ 30
	Bus: primary=c0, secondary=c1, subordinate=c1, sec-latency=0
	I/O behind bridge: 0000f000-00000fff [disabled] [32-bit]
	Memory behind bridge: 60200000-602fffff [size=1M] [32-bit]
	Prefetchable memory behind bridge: 00000000fff00000-00000000000fffff [disabled] [64-bit]
	Secondary status: 66MHz- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- <SERR- <PERR-
	BridgeCtl: Parity- SERR+ NoISA- VGA- VGA16- MAbort- >Reset- FastB2B-
		PriDiscTmr- SecDiscTmr- DiscTmrStat- DiscTmrSERREn-
	Capabilities: [80] Power Management version 3
		Flags: PMEClk- DSI- D1+ D2- AuxCurrent=0mA PME(D0+,D1+,D2-,D3hot+,D3cold-)
		Status: D0 NoSoftRst+ PME-Enable- DSel=0 DScale=0 PME-
	Capabilities: [90] MSI: Enable+ Count=1/32 Maskable+ 64bit+
		Address: 000000000e060040  Data: 0000
		Masking: fffffffe  Pending: 00000000
	Capabilities: [b0] MSI-X: Enable- Count=2 Masked-
		Vector table: BAR=0 offset=00000040
		PBA: BAR=0 offset=00000040
	Capabilities: [c0] Express (v2) Root Port (Slot-), MSI 00
		DevCap:	MaxPayload 512 bytes, PhantFunc 0
			ExtTag+ RBE+
		DevCtl:	CorrErr+ NonFatalErr+ FatalErr+ UnsupReq+
			RlxdOrd+ ExtTag+ PhantFunc- AuxPwr- NoSnoop+
			MaxPayload 256 bytes, MaxReadReq 1024 bytes
		DevSta:	CorrErr- NonFatalErr- FatalErr- UnsupReq- AuxPwr- TransPend-
		LnkCap:	Port #0, Speed 16GT/s, Width x4, ASPM L0s L1, Exit Latency L0s <256ns, L1 <8us
			ClockPM- Surprise- LLActRep+ BwNot- ASPMOptComp+
		LnkCtl:	ASPM Disabled; RCB 64 bytes, Disabled- CommClk-
			ExtSynch- ClockPM- AutWidDis- BWInt- AutBWInt-
		LnkSta:	Speed 16GT/s, Width x4
			TrErr- Train- SlotClk+ DLActive+ BWMgmt- ABWMgmt-
		RootCap: CRSVisible-
		RootCtl: ErrCorrectable- ErrNon-Fatal- ErrFatal- PMEIntEna+ CRSVisible-
		RootSta: PME ReqID 0000, PMEStatus- PMEPending-
		DevCap2: Completion Timeout: Range ABCD, TimeoutDis+ NROPrPrP- LTR+
			 10BitTagComp+ 10BitTagReq- OBFF Via message, ExtFmt+ EETLPPrefix+, MaxEETLPPrefixes 1
			 EmergencyPowerReduction Not Supported, EmergencyPowerReductionInit-
			 FRS- LN System CLS Not Supported, TPHComp- ExtTPHComp- ARIFwd-
			 AtomicOpsCap: Routing+ 32bit+ 64bit+ 128bitCAS+
		DevCtl2: Completion Timeout: 50us to 50ms, TimeoutDis- LTR+ 10BitTagReq- OBFF Disabled, ARIFwd-
			 AtomicOpsCtl: ReqEn- EgressBlck-
		LnkCap2: Supported Link Speeds: 2.5-16GT/s, Crosslink- Retimer+ 2Retimers+ DRS-
		LnkCtl2: Target Link Speed: 16GT/s, EnterCompliance- SpeedDis-
			 Transmit Margin: Normal Operating Range, EnterModifiedCompliance- ComplianceSOS-
			 Compliance Preset/De-emphasis: -6dB de-emphasis, 0dB preshoot
		LnkSta2: Current De-emphasis Level: -6dB, EqualizationComplete+ EqualizationPhase1+
			 EqualizationPhase2+ EqualizationPhase3+ LinkEqualizationRequest-
			 Retimer- 2Retimers- CrosslinkRes: unsupported
	Capabilities: [100 v2] Advanced Error Reporting
		UESta:	DLP- SDES- TLP- FCP- CmpltTO- CmpltAbrt- UnxCmplt- RxOF- MalfTLP- ECRC- UnsupReq- ACSViol-
		UEMsk:	DLP- SDES- TLP- FCP- CmpltTO- CmpltAbrt- UnxCmplt- RxOF- MalfTLP- ECRC- UnsupReq- ACSViol-
		UESvrt:	DLP+ SDES- TLP- FCP+ CmpltTO- CmpltAbrt- UnxCmplt- RxOF+ MalfTLP+ ECRC- UnsupReq- ACSViol-
		CESta:	RxErr- BadTLP- BadDLLP- Rollover- Timeout- AdvNonFatalErr-
		CEMsk:	RxErr- BadTLP- BadDLLP- Rollover- Timeout- AdvNonFatalErr+
		AERCap:	First Error Pointer: 01, ECRCGenCap+ ECRCGenEn- ECRCChkCap+ ECRCChkEn-
			MultHdrRecCap- MultHdrRecEn- TLPPfxPres- HdrLogCap-
		HeaderLog: 00000000 00000000 00000000 00000000
		RootCmd: CERptEn+ NFERptEn+ FERptEn+
		RootSta: CERcvd- MultCERcvd- UERcvd- MultUERcvd-
			 FirstFatal- NonFatalMsg- FatalMsg- IntMsg 0
		ErrorSrc: ERR_COR: 0000 ERR_FATAL/NONFATAL: 0000
	Capabilities: [150 v1] Device Serial Number 00-00-00-00-00-00-00-00
	Capabilities: [300 v1] Secondary PCI Express
		LnkCtl3: LnkEquIntrruptEn- PerformEqu-
		LaneErrStat: 0
	Capabilities: [4c0 v1] Virtual Channel
		Caps:	LPEVC=0 RefClk=100ns PATEntryBits=1
		Arb:	Fixed- WRR32- WRR64- WRR128-
		Ctrl:	ArbSelect=Fixed
		Status:	InProgress-
		VC0:	Caps:	PATOffset=00 MaxTimeSlots=1 RejSnoopTrans-
			Arb:	Fixed- WRR32- WRR64- WRR128- TWRR128- WRR256-
			Ctrl:	Enable+ ID=0 ArbSelect=Fixed TC/VC=ff
			Status:	NegoPending- InProgress-
	Capabilities: [900 v1] L1 PM Substates
		L1SubCap: PCI-PM_L1.2+ PCI-PM_L1.1+ ASPM_L1.2+ ASPM_L1.1+ L1_PM_Substates+
			  PortCommonModeRestoreTime=0us PortTPowerOnTime=10us
		L1SubCtl1: PCI-PM_L1.2- PCI-PM_L1.1- ASPM_L1.2- ASPM_L1.1-
			   T_CommonMode=0us LTR1.2_Threshold=0ns
		L1SubCtl2: T_PwrOn=10us
	Capabilities: [910 v1] Data Link Feature <?>
	Capabilities: [920 v1] Lane Margining at the Receiver <?>
	Capabilities: [9c0 v1] Physical Layer 16.0 GT/s <?>
	Capabilities: [a20 v1] Precision Time Measurement
		PTMCap: Requester:- Responder:+ Root:+
		PTMClockGranularity: 2ns
		PTMControl: Enabled:- RootSelected:-
		PTMEffectiveGranularity: Unknown
	Capabilities: [a90 v1] Extended Capability ID 0x2f
	Kernel driver in use: pcieport

0002:c1:00.0 Non-Volatile memory controller: Kingston Technology Company, Inc. NV2 NVMe SSD TC2200 (DRAM-less) (prog-if 02 [NVM Express])
	Subsystem: Kingston Technology Company, Inc. NV2 NVMe SSD TC2200
	Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
	Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
	Latency: 0
	Interrupt: pin A routed to IRQ 29
	Region 0: Memory at 60200000 (64-bit, non-prefetchable) [size=16K]
	Capabilities: [40] Power Management version 3
		Flags: PMEClk- DSI- D1- D2- AuxCurrent=0mA PME(D0+,D1-,D2-,D3hot+,D3cold+)
		Status: D0 NoSoftRst+ PME-Enable- DSel=0 DScale=0 PME-
	Capabilities: [50] MSI: Enable- Count=1/32 Maskable- 64bit+
		Address: 0000000000000000  Data: 0000
	Capabilities: [70] Express (v2) Endpoint, MSI 00
		DevCap:	MaxPayload 256 bytes, PhantFunc 0, Latency L0s unlimited, L1 unlimited
			ExtTag+ AttnBtn- AttnInd- PwrInd- RBE+ FLReset+ SlotPowerLimit 0W
		DevCtl:	CorrErr+ NonFatalErr+ FatalErr+ UnsupReq+
			RlxdOrd+ ExtTag+ PhantFunc- AuxPwr- NoSnoop- FLReset-
			MaxPayload 256 bytes, MaxReadReq 512 bytes
		DevSta:	CorrErr- NonFatalErr- FatalErr- UnsupReq- AuxPwr+ TransPend-
		LnkCap:	Port #0, Speed 16GT/s, Width x4, ASPM L1, Exit Latency L1 <64us
			ClockPM- Surprise- LLActRep- BwNot- ASPMOptComp+
		LnkCtl:	ASPM Disabled; RCB 64 bytes, Disabled- CommClk-
			ExtSynch- ClockPM- AutWidDis- BWInt- AutBWInt-
		LnkSta:	Speed 16GT/s, Width x4
			TrErr- Train- SlotClk+ DLActive- BWMgmt- ABWMgmt-
		DevCap2: Completion Timeout: Range ABCD, TimeoutDis+ NROPrPrP- LTR+
			 10BitTagComp+ 10BitTagReq- OBFF Via message/WAKE#, ExtFmt- EETLPPrefix-
			 EmergencyPowerReduction Not Supported, EmergencyPowerReductionInit-
			 FRS- TPHComp- ExtTPHComp-
			 AtomicOpsCap: 32bit- 64bit- 128bitCAS-
		DevCtl2: Completion Timeout: 50us to 50ms, TimeoutDis- LTR+ 10BitTagReq- OBFF Disabled,
			 AtomicOpsCtl: ReqEn-
		LnkCap2: Supported Link Speeds: 2.5-16GT/s, Crosslink- Retimer+ 2Retimers+ DRS+
		LnkCtl2: Target Link Speed: 16GT/s, EnterCompliance- SpeedDis-
			 Transmit Margin: Normal Operating Range, EnterModifiedCompliance- ComplianceSOS-
			 Compliance Preset/De-emphasis: -6dB de-emphasis, 0dB preshoot
		LnkSta2: Current De-emphasis Level: -6dB, EqualizationComplete+ EqualizationPhase1+
			 EqualizationPhase2+ EqualizationPhase3+ LinkEqualizationRequest-
			 Retimer- 2Retimers- CrosslinkRes: Upstream Port
	Capabilities: [b0] MSI-X: Enable+ Count=32 Masked-
		Vector table: BAR=0 offset=00002000
		PBA: BAR=0 offset=00003000
	Capabilities: [100 v2] Advanced Error Reporting
		UESta:	DLP- SDES- TLP- FCP- CmpltTO- CmpltAbrt- UnxCmplt- RxOF- MalfTLP- ECRC- UnsupReq- ACSViol-
		UEMsk:	DLP- SDES- TLP- FCP- CmpltTO- CmpltAbrt- UnxCmplt- RxOF- MalfTLP- ECRC- UnsupReq- ACSViol-
		UESvrt:	DLP+ SDES+ TLP- FCP+ CmpltTO- CmpltAbrt- UnxCmplt- RxOF+ MalfTLP+ ECRC- UnsupReq- ACSViol-
		CESta:	RxErr- BadTLP- BadDLLP- Rollover- Timeout- AdvNonFatalErr-
		CEMsk:	RxErr- BadTLP- BadDLLP- Rollover- Timeout- AdvNonFatalErr+
		AERCap:	First Error Pointer: 00, ECRCGenCap+ ECRCGenEn- ECRCChkCap+ ECRCChkEn-
			MultHdrRecCap+ MultHdrRecEn- TLPPfxPres- HdrLogCap-
		HeaderLog: 00000000 00000000 00000000 00000000
	Capabilities: [148 v1] Secondary PCI Express
		LnkCtl3: LnkEquIntrruptEn- PerformEqu-
		LaneErrStat: 0
	Capabilities: [168 v1] Physical Layer 16.0 GT/s <?>
	Capabilities: [18c v1] Lane Margining at the Receiver <?>
	Capabilities: [1a4 v1] Latency Tolerance Reporting
		Max snoop latency: 5242880ns
		Max no snoop latency: 5242880ns
	Capabilities: [1ac v1] L1 PM Substates
		L1SubCap: PCI-PM_L1.2+ PCI-PM_L1.1+ ASPM_L1.2+ ASPM_L1.1+ L1_PM_Substates+
			  PortCommonModeRestoreTime=90us PortTPowerOnTime=200us
		L1SubCtl1: PCI-PM_L1.2- PCI-PM_L1.1- ASPM_L1.2- ASPM_L1.1-
			   T_CommonMode=0us LTR1.2_Threshold=0ns
		L1SubCtl2: T_PwrOn=10us
	Capabilities: [1bc v1] Vendor Specific Information: ID=0002 Rev=4 Len=100 <?>
	Capabilities: [2bc v1] Vendor Specific Information: ID=0001 Rev=1 Len=038 <?>
	Capabilities: [2f4 v1] Data Link Feature <?>
	Kernel driver in use: nvme

Re: [PATCH] PCI: cadence: Use cdns_pcie_find_capability() to get PCIe Cap offset in host driver

[Hans Zhang]

On 5/7/26 11:31, Hans Zhang wrote:
> 
> 
> On 5/7/26 01:12, Bjorn Helgaas wrote:
>> On Thu, May 07, 2026 at 12:04:34AM +0800, Hans Zhang wrote:
>>> On 5/6/26 05:23, Bjorn Helgaas wrote:
>>>> On Mon, May 04, 2026 at 04:22:26PM +0800, Hans Zhang wrote:
>>>>> On 5/4/26 00:52, sashiko-bot@kernel.org wrote:
>>>>>> Thank you for your contribution! Sashiko AI review found 1
>>>>>> potential issue(s) to consider:
>>>>>>
>>>>>> - [Critical] cdns_pcie_find_capability() searches the wrong
>>>>>> register space in Host mode and its return value is not validated,
>>>>>> leading to Root Port configuration space corruption.
>>>>>> -- 
>>>>>>
>>>>>> commit 09b3c64b8f5892eb365acd13030a8067652a15e8
>>>>>> Author: Hans Zhang <18255117159@163.com>
>>>>>>
>>>>>> PCI: cadence: Use cdns_pcie_find_capability() to get PCIe Cap 
>>>>>> offset in host driver
>>>>>>
>>>>>> This commit replaces the hardcoded CDNS_PCIE_RP_CAP_OFFSET with a 
>>>>>> dynamic
>>>>>> lookup using cdns_pcie_find_capability() in Cadence PCIe host-related
>>>>>> functions. The goal is to ensure correct operation across various 
>>>>>> SoC designs
>>>>>> where the capability might not reside at offset 0xC0.
>>>>>>
>>>>>>> diff --git a/drivers/pci/controller/cadence/pcie-cadence-host- 
>>>>>>> common.c b/drivers/pci/controller/cadence/pcie-cadence-host-common.c
>>>>>>> index 2b0211870f02..5013d3fe23b5 100644
>>>>>>> --- a/drivers/pci/controller/cadence/pcie-cadence-host-common.c
>>>>>>> +++ b/drivers/pci/controller/cadence/pcie-cadence-host-common.c
>>>>>>> @@ -26,14 +26,14 @@ EXPORT_SYMBOL_GPL(bar_max_size);
>>>>>>>     int cdns_pcie_host_training_complete(struct cdns_pcie *pcie)
>>>>>>>     {
>>>>>>> -    u32 pcie_cap_off = CDNS_PCIE_RP_CAP_OFFSET;
>>>>>>>         unsigned long end_jiffies;
>>>>>>>         u16 lnk_stat;
>>>>>>> +    u8 cap = cdns_pcie_find_capability(pcie, PCI_CAP_ID_EXP);
>>>>>>
>>>>>> Does this capability search scan the correct register space when
>>>>>> operating in host mode?
>>>>>>
>>>>>> Looking at the helper function, it uses cdns_pcie_read_cfg() which
>>>>>> reads directly from the base address without the Root Port offset:
>>>>>>
>>>>>> drivers/pci/controller/cadence/pcie- 
>>>>>> cadence.c:cdns_pcie_find_capability() {
>>>>>>        return PCI_FIND_NEXT_CAP(cdns_pcie_read_cfg, 
>>>>>> PCI_CAPABILITY_LIST,
>>>>>>                                 cap, NULL, pcie);
>>>>>> }
>>>>>>
>>>>>> However, the Root Port configuration registers are physically
>>>>>> located at pcie->reg_base + CDNS_PCIE_RP_BASE. Could this cause
>>>>>> the search to scan the Local Management register space instead,
>>>>>> failing to find PCI_CAP_ID_EXP and returning 0?
>>>>>
>>>>> I don't think we need to worry about this issue.
>>>>>
>>>>> As per PCIe r7.0, sec 7.5.1.1.11, Since all PCI Express Functions
>>>>> are required to implement the PCI Express Capability structure,
>>>>> which must be included somewhere in this linked list;
>>>>>
>>>>> So, it won't return 0 here.
>>>>
>>>> It's true that all Root Ports must have a PCIe Capability, but
>>>> that's not related to this issue.
>>>>
>>>> cdns_pcie_host_init_root_port() accesses PCI_EXP_LNKCAP at the
>>>> address:
>>>>
>>>>     pcie->reg_base + CDNS_PCIE_RP_BASE + CDNS_PCIE_RP_CAP_OFFSET + 
>>>> PCI_EXP_LNKCAP
>>>>
>>>> but when we search with cdns_pcie_find_capability(pcie, 
>>>> PCI_CAP_ID_EXP),
>>>> we start reading at:
>>>>
>>>>     pcie->reg_base + PCI_CAPABILITY_LIST
>>>>
>>>> It should be starting at:
>>>>
>>>>     pcie->reg_base + CDNS_PCIE_RP_BASE + PCI_CAPABILITY_LIST
>>>>
>>>> Previously, cdns_pcie_find_capability() and
>>>> cdns_pcie_find_ext_capability() were only used for endpoints, and I
>>>> assume they work fine there.  There is pcie->is_rc, so there should be
>>>> a way to make this work for both endpoints and Root Ports.
>>>
>>> The reason for using the "is_rc" tag is that for Cadence IP, it is 
>>> not only
>>> applicable to the RC or EP mode, but also there are significant 
>>> differences
>>> between the LGA and HPA generations of IP. Including register offset 
>>> values,
>>> definitions, etc., it fails to achieve good compatibility. It is not 
>>> like
>>> Synopsys IP, where compatibility has been handled very well. It was 
>>> truly
>>> out of necessity.
>>
>> I think cdns_pcie_find_capability(pcie, PCI_CAP_ID_EXP) fails on Root
>> Ports because it doesn't include the CDNS_PCIE_RP_BASE offset.  Do you
>> have hardware where you can test that?

Hi Siddharth,

Could you please test the functions mentioned above? It would be great 
if you could help test it and give us your feedback. (pci-j721e.c)

I guess the following changes might need to be made.

diff --git a/drivers/pci/controller/cadence/pcie-cadence.h 
b/drivers/pci/controller/cadence/pcie-cadence.h
index 574e9cf4d003..bb01761749f1 100644
--- a/drivers/pci/controller/cadence/pcie-cadence.h
+++ b/drivers/pci/controller/cadence/pcie-cadence.h
@@ -298,6 +298,9 @@ static inline int cdns_pcie_read_cfg_byte(struct 
cdns_pcie *pcie, int where,
  {
         void __iomem *addr = pcie->reg_base + where;

+       if ((pcie->is_rc) && (!pcie->is_hpa))
+               addr += CDNS_PCIE_RP_BASE;
+
         *val = cdns_pcie_read_sz(addr, 0x1);
         return PCIBIOS_SUCCESSFUL;
  }
@@ -307,6 +310,9 @@ static inline int cdns_pcie_read_cfg_word(struct 
cdns_pcie *pcie, int where,
  {
         void __iomem *addr = pcie->reg_base + where;

+       if ((pcie->is_rc) && (!pcie->is_hpa))
+               addr += CDNS_PCIE_RP_BASE;
+
         *val = cdns_pcie_read_sz(addr, 0x2);
         return PCIBIOS_SUCCESSFUL;
  }
@@ -314,7 +320,12 @@ static inline int cdns_pcie_read_cfg_word(struct 
cdns_pcie *pcie, int where,
  static inline int cdns_pcie_read_cfg_dword(struct cdns_pcie *pcie, int 
where,
                                            u32 *val)
  {
-       *val = cdns_pcie_readl(pcie, where);
+       void __iomem *addr = pcie->reg_base + where;
+
+       if ((pcie->is_rc) && (!pcie->is_hpa))
+               addr += CDNS_PCIE_RP_BASE;
+
+       *val = cdns_pcie_read_sz(addr, 0x4);
         return PCIBIOS_SUCCESSFUL;
  }


"is_hpa" flag I added it in another series. As mentioned before, the 
compatibility of Cadence IP is not very good. It is divided into LGA and 
HPA IP. And there are many differences between the Root Port and the 
Endpoint.

https://patchwork.kernel.org/project/linux-pci/patch/20260406103237.1203127-2-18255117159@163.com/

Best regards,
Hans

> 
> Hi Bjorn,
> 
> The attachment contains the dmesg and lspci -vvv log from the test.
> 
> Here is the test code:
> 
> diff --git a/drivers/pci/controller/cadence/pci-sky1.c b/drivers/pci/ 
> controller/cadence/pci-sky1.c
> index cd55c64e58a9..0d0c42309127 100644
> --- a/drivers/pci/controller/cadence/pci-sky1.c
> +++ b/drivers/pci/controller/cadence/pci-sky1.c
> @@ -130,6 +130,39 @@ static const struct cdns_pcie_ops sky1_pcie_ops = {
>       .link_up = sky1_pcie_link_up,
>   };
> 
> +void cix_pcie_test_cap(struct sky1_pcie *pcie)
> +{
> +    u16 offset;
> +
> +    printk(KERN_EMERG"[HANS] fun = %s, line = %d ........... \n", 
> __func__, __LINE__);
> +    /* capability */
> +    offset = cdns_pcie_find_capability(pcie->cdns_pcie, PCI_CAP_ID_PM);
> +    printk(KERN_EMERG"[HANS]pm offset = 0x%x\n", offset);
> +    offset = cdns_pcie_find_capability(pcie->cdns_pcie, PCI_CAP_ID_MSI);
> +    printk(KERN_EMERG"[HANS]msi offset = 0x%x\n", offset);
> +    offset = cdns_pcie_find_capability(pcie->cdns_pcie, PCI_CAP_ID_MSIX);
> +    printk(KERN_EMERG"[HANS]msix offset = 0x%x\n", offset);
> +    offset = cdns_pcie_find_capability(pcie->cdns_pcie, PCI_CAP_ID_EXP);
> +    printk(KERN_EMERG"[HANS]exp offset = 0x%x\n", offset);
> +
> +    printk(KERN_EMERG"[HANS] fun = %s, line = %d ........... \n", 
> __func__, __LINE__);
> +    /* extend capability */
> +    offset = cdns_pcie_find_ext_capability(pcie->cdns_pcie, 
> PCI_EXT_CAP_ID_ERR);
> +    printk(KERN_EMERG"[HANS]aer offset = 0x%x\n", offset);
> +    offset = cdns_pcie_find_ext_capability(pcie->cdns_pcie, 
> PCI_EXT_CAP_ID_VC);
> +    printk(KERN_EMERG"[HANS]Virtual Channel offset = 0x%x\n", offset);
> +    offset = cdns_pcie_find_ext_capability(pcie->cdns_pcie, 
> PCI_EXT_CAP_ID_DSN);
> +    printk(KERN_EMERG"[HANS]Device Serial Number offset = 0x%x\n", 
> offset);
> +    offset = cdns_pcie_find_ext_capability(pcie->cdns_pcie, 
> PCI_EXT_CAP_ID_PWR);
> +    printk(KERN_EMERG"[HANS]pwr offset = 0x%x\n", offset);
> +    offset = cdns_pcie_find_ext_capability(pcie->cdns_pcie, 
> PCI_EXT_CAP_ID_REBAR);
> +    printk(KERN_EMERG"[HANS]resize bar offset = 0x%x\n", offset);
> +    offset = cdns_pcie_find_ext_capability(pcie->cdns_pcie, 
> PCI_EXT_CAP_ID_SECPCI);
> +    printk(KERN_EMERG"[HANS]second exp offset = 0x%x\n", offset);
> +    offset = cdns_pcie_find_ext_capability(pcie->cdns_pcie, 
> PCI_EXT_CAP_ID_L1SS);
> +    printk(KERN_EMERG"[HANS]L1ss offset = 0x%x\n", offset);
> +}
> +
>   static int sky1_pcie_probe(struct platform_device *pdev)
>   {
>       struct cdns_plat_pcie_of_data *reg_off;
> @@ -141,6 +174,7 @@ static int sky1_pcie_probe(struct platform_device 
> *pdev)
>       struct sky1_pcie *pcie;
>       int ret;
> 
> +    printk(KERN_EMERG"[HANS] fun = %s, line = %d ........... \n", 
> __func__, __LINE__);
>       pcie = devm_kzalloc(dev, sizeof(*pcie), GFP_KERNEL);
>       if (!pcie)
>           return -ENOMEM;
> @@ -202,6 +236,8 @@ static int sky1_pcie_probe(struct platform_device 
> *pdev)
> 
>       dev_set_drvdata(dev, pcie);
> 
> +    cix_pcie_test_cap(pcie);
> +
>       ret = cdns_pcie_hpa_host_setup(rc);
>       if (ret < 0) {
>           pci_ecam_free(pcie->cfg);
> @@ -230,7 +266,7 @@ static struct platform_driver sky1_pcie_driver = {
>       .driver = {
>           .name = "sky1-pcie",
>           .of_match_table = of_sky1_pcie_match,
> -        .probe_type = PROBE_PREFER_ASYNCHRONOUS,
> +        // .probe_type = PROBE_PREFER_ASYNCHRONOUS,
>       },
>   };
>   module_platform_driver(sky1_pcie_driver);
> 
> 
> For the LGA IP, an offset address CDNS_PCIE_RP_BASE needs to be added. 
> And the HPA IP requires an offset address of CDNS_PCIE_HPA_RP_BASE, but 
> it is equal to 0;
> 
> drivers/pci/controller/cadence/pcie-cadence-hpa-regs.h
> 
> /* Root Port register base address */
> #define CDNS_PCIE_HPA_RP_BASE            0x0
> 
> Therefore, for "drivers/pci/controller/cadence/pci-sky1.c", it is normal.
> 
> 
> 
> Using the following code for work is also normal. Later, I will re-unify 
> it into the same operation.
> 
> diff --git a/drivers/pci/controller/cadence/pcie-cadence.h b/drivers/ 
> pci/controller/cadence/pcie-cadence.h
> index 574e9cf4d003..723ea79fb02e 100644
> --- a/drivers/pci/controller/cadence/pcie-cadence.h
> +++ b/drivers/pci/controller/cadence/pcie-cadence.h
> @@ -314,7 +314,9 @@ static inline int cdns_pcie_read_cfg_word(struct 
> cdns_pcie *pcie, int where,
>   static inline int cdns_pcie_read_cfg_dword(struct cdns_pcie *pcie, int 
> where,
>                                             u32 *val)
>   {
> -       *val = cdns_pcie_readl(pcie, where);
> +       void __iomem *addr = pcie->reg_base + where;
> +
> +       *val = cdns_pcie_read_sz(addr, 0x4);
>          return PCIBIOS_SUCCESSFUL;
>   }
> 
> 
> Best regards,
> Hans
> 
> 

Re: [PATCH] PCI: cadence: Use cdns_pcie_find_capability() to get PCIe Cap offset in host driver

[Aksh Garg]

On 07/05/26 09:18, Hans Zhang wrote:
> 
> 
> On 5/7/26 11:31, Hans Zhang wrote:
>>
>>
>> On 5/7/26 01:12, Bjorn Helgaas wrote:
>>> On Thu, May 07, 2026 at 12:04:34AM +0800, Hans Zhang wrote:
>>>> On 5/6/26 05:23, Bjorn Helgaas wrote:
>>>>> On Mon, May 04, 2026 at 04:22:26PM +0800, Hans Zhang wrote:
>>>>>> On 5/4/26 00:52, sashiko-bot@kernel.org wrote:
>>>>>>> Thank you for your contribution! Sashiko AI review found 1
>>>>>>> potential issue(s) to consider:
>>>>>>>
>>>>>>> - [Critical] cdns_pcie_find_capability() searches the wrong
>>>>>>> register space in Host mode and its return value is not validated,
>>>>>>> leading to Root Port configuration space corruption.
>>>>>>> -- 
>>>>>>>
>>>>>>> commit 09b3c64b8f5892eb365acd13030a8067652a15e8
>>>>>>> Author: Hans Zhang <18255117159@163.com>
>>>>>>>
>>>>>>> PCI: cadence: Use cdns_pcie_find_capability() to get PCIe Cap 
>>>>>>> offset in host driver
>>>>>>>
>>>>>>> This commit replaces the hardcoded CDNS_PCIE_RP_CAP_OFFSET with a 
>>>>>>> dynamic
>>>>>>> lookup using cdns_pcie_find_capability() in Cadence PCIe host- 
>>>>>>> related
>>>>>>> functions. The goal is to ensure correct operation across various 
>>>>>>> SoC designs
>>>>>>> where the capability might not reside at offset 0xC0.
>>>>>>>
>>>>>>>> diff --git a/drivers/pci/controller/cadence/pcie-cadence-host- 
>>>>>>>> common.c b/drivers/pci/controller/cadence/pcie-cadence-host- 
>>>>>>>> common.c
>>>>>>>> index 2b0211870f02..5013d3fe23b5 100644
>>>>>>>> --- a/drivers/pci/controller/cadence/pcie-cadence-host-common.c
>>>>>>>> +++ b/drivers/pci/controller/cadence/pcie-cadence-host-common.c
>>>>>>>> @@ -26,14 +26,14 @@ EXPORT_SYMBOL_GPL(bar_max_size);
>>>>>>>>     int cdns_pcie_host_training_complete(struct cdns_pcie *pcie)
>>>>>>>>     {
>>>>>>>> -    u32 pcie_cap_off = CDNS_PCIE_RP_CAP_OFFSET;
>>>>>>>>         unsigned long end_jiffies;
>>>>>>>>         u16 lnk_stat;
>>>>>>>> +    u8 cap = cdns_pcie_find_capability(pcie, PCI_CAP_ID_EXP);
>>>>>>>
>>>>>>> Does this capability search scan the correct register space when
>>>>>>> operating in host mode?
>>>>>>>
>>>>>>> Looking at the helper function, it uses cdns_pcie_read_cfg() which
>>>>>>> reads directly from the base address without the Root Port offset:
>>>>>>>
>>>>>>> drivers/pci/controller/cadence/pcie- 
>>>>>>> cadence.c:cdns_pcie_find_capability() {
>>>>>>>        return PCI_FIND_NEXT_CAP(cdns_pcie_read_cfg, 
>>>>>>> PCI_CAPABILITY_LIST,
>>>>>>>                                 cap, NULL, pcie);
>>>>>>> }
>>>>>>>
>>>>>>> However, the Root Port configuration registers are physically
>>>>>>> located at pcie->reg_base + CDNS_PCIE_RP_BASE. Could this cause
>>>>>>> the search to scan the Local Management register space instead,
>>>>>>> failing to find PCI_CAP_ID_EXP and returning 0?
>>>>>>
>>>>>> I don't think we need to worry about this issue.
>>>>>>
>>>>>> As per PCIe r7.0, sec 7.5.1.1.11, Since all PCI Express Functions
>>>>>> are required to implement the PCI Express Capability structure,
>>>>>> which must be included somewhere in this linked list;
>>>>>>
>>>>>> So, it won't return 0 here.
>>>>>
>>>>> It's true that all Root Ports must have a PCIe Capability, but
>>>>> that's not related to this issue.
>>>>>
>>>>> cdns_pcie_host_init_root_port() accesses PCI_EXP_LNKCAP at the
>>>>> address:
>>>>>
>>>>>     pcie->reg_base + CDNS_PCIE_RP_BASE + CDNS_PCIE_RP_CAP_OFFSET + 
>>>>> PCI_EXP_LNKCAP
>>>>>
>>>>> but when we search with cdns_pcie_find_capability(pcie, 
>>>>> PCI_CAP_ID_EXP),
>>>>> we start reading at:
>>>>>
>>>>>     pcie->reg_base + PCI_CAPABILITY_LIST
>>>>>
>>>>> It should be starting at:
>>>>>
>>>>>     pcie->reg_base + CDNS_PCIE_RP_BASE + PCI_CAPABILITY_LIST
>>>>>
>>>>> Previously, cdns_pcie_find_capability() and
>>>>> cdns_pcie_find_ext_capability() were only used for endpoints, and I
>>>>> assume they work fine there.  There is pcie->is_rc, so there should be
>>>>> a way to make this work for both endpoints and Root Ports.
>>>>
>>>> The reason for using the "is_rc" tag is that for Cadence IP, it is 
>>>> not only
>>>> applicable to the RC or EP mode, but also there are significant 
>>>> differences
>>>> between the LGA and HPA generations of IP. Including register offset 
>>>> values,
>>>> definitions, etc., it fails to achieve good compatibility. It is not 
>>>> like
>>>> Synopsys IP, where compatibility has been handled very well. It was 
>>>> truly
>>>> out of necessity.
>>>
>>> I think cdns_pcie_find_capability(pcie, PCI_CAP_ID_EXP) fails on Root
>>> Ports because it doesn't include the CDNS_PCIE_RP_BASE offset.  Do you
>>> have hardware where you can test that?
> 
> Hi Siddharth,
> 
> Could you please test the functions mentioned above? It would be great 
> if you could help test it and give us your feedback. (pci-j721e.c)
> 
> I guess the following changes might need to be made.
> 
> diff --git a/drivers/pci/controller/cadence/pcie-cadence.h b/drivers/ 
> pci/controller/cadence/pcie-cadence.h
> index 574e9cf4d003..bb01761749f1 100644
> --- a/drivers/pci/controller/cadence/pcie-cadence.h
> +++ b/drivers/pci/controller/cadence/pcie-cadence.h
> @@ -298,6 +298,9 @@ static inline int cdns_pcie_read_cfg_byte(struct 
> cdns_pcie *pcie, int where,
>   {
>          void __iomem *addr = pcie->reg_base + where;
> 
> +       if ((pcie->is_rc) && (!pcie->is_hpa))
> +               addr += CDNS_PCIE_RP_BASE;
> +
>          *val = cdns_pcie_read_sz(addr, 0x1);
>          return PCIBIOS_SUCCESSFUL;
>   }
> @@ -307,6 +310,9 @@ static inline int cdns_pcie_read_cfg_word(struct 
> cdns_pcie *pcie, int where,
>   {
>          void __iomem *addr = pcie->reg_base + where;
> 
> +       if ((pcie->is_rc) && (!pcie->is_hpa))
> +               addr += CDNS_PCIE_RP_BASE;
> +
>          *val = cdns_pcie_read_sz(addr, 0x2);
>          return PCIBIOS_SUCCESSFUL;
>   }
> @@ -314,7 +320,12 @@ static inline int cdns_pcie_read_cfg_word(struct 
> cdns_pcie *pcie, int where,
>   static inline int cdns_pcie_read_cfg_dword(struct cdns_pcie *pcie, int 
> where,
>                                             u32 *val)
>   {
> -       *val = cdns_pcie_readl(pcie, where);
> +       void __iomem *addr = pcie->reg_base + where;
> +
> +       if ((pcie->is_rc) && (!pcie->is_hpa))
> +               addr += CDNS_PCIE_RP_BASE;
> +
> +       *val = cdns_pcie_read_sz(addr, 0x4);
>          return PCIBIOS_SUCCESSFUL;
>   }
> 
> 
> "is_hpa" flag I added it in another series. As mentioned before, the 
> compatibility of Cadence IP is not very good. It is divided into LGA and 
> HPA IP. And there are many differences between the Root Port and the 
> Endpoint.
> 
> https://patchwork.kernel.org/project/linux-pci/ 
> patch/20260406103237.1203127-2-18255117159@163.com/
> 
> Best regards,
> Hans
> 

Hi Hans,

I have tested this on J7200 and J721E SoCs, which uses pci-j721e.c
driver for their PCIe controllers. The patch alone fails to find the
capabilities using cdns_pcie_find_capability() for Root Port.

With the "is_hpa" flag patch, and the patch "PCI: cadence: Use
cdns_pcie_find_capability() to get PCIe Cap offset in host driver" along
with the diff suggested above:

Tested-by: Aksh Garg <a-garg7@ti.com>


I would also like me to be included in the CC list for future
correspondence regarding Cadence PCIe Controller patches.

Regards,
Aksh Garg

>>
>> Hi Bjorn,
>>
>> The attachment contains the dmesg and lspci -vvv log from the test.
>>
>> Here is the test code:
>>
>> diff --git a/drivers/pci/controller/cadence/pci-sky1.c b/drivers/pci/ 
>> controller/cadence/pci-sky1.c
>> index cd55c64e58a9..0d0c42309127 100644
>> --- a/drivers/pci/controller/cadence/pci-sky1.c
>> +++ b/drivers/pci/controller/cadence/pci-sky1.c
>> @@ -130,6 +130,39 @@ static const struct cdns_pcie_ops sky1_pcie_ops = {
>>       .link_up = sky1_pcie_link_up,
>>   };
>>
>> +void cix_pcie_test_cap(struct sky1_pcie *pcie)
>> +{
>> +    u16 offset;
>> +
>> +    printk(KERN_EMERG"[HANS] fun = %s, line = %d ........... \n", 
>> __func__, __LINE__);
>> +    /* capability */
>> +    offset = cdns_pcie_find_capability(pcie->cdns_pcie, PCI_CAP_ID_PM);
>> +    printk(KERN_EMERG"[HANS]pm offset = 0x%x\n", offset);
>> +    offset = cdns_pcie_find_capability(pcie->cdns_pcie, PCI_CAP_ID_MSI);
>> +    printk(KERN_EMERG"[HANS]msi offset = 0x%x\n", offset);
>> +    offset = cdns_pcie_find_capability(pcie->cdns_pcie, 
>> PCI_CAP_ID_MSIX);
>> +    printk(KERN_EMERG"[HANS]msix offset = 0x%x\n", offset);
>> +    offset = cdns_pcie_find_capability(pcie->cdns_pcie, PCI_CAP_ID_EXP);
>> +    printk(KERN_EMERG"[HANS]exp offset = 0x%x\n", offset);
>> +
>> +    printk(KERN_EMERG"[HANS] fun = %s, line = %d ........... \n", 
>> __func__, __LINE__);
>> +    /* extend capability */
>> +    offset = cdns_pcie_find_ext_capability(pcie->cdns_pcie, 
>> PCI_EXT_CAP_ID_ERR);
>> +    printk(KERN_EMERG"[HANS]aer offset = 0x%x\n", offset);
>> +    offset = cdns_pcie_find_ext_capability(pcie->cdns_pcie, 
>> PCI_EXT_CAP_ID_VC);
>> +    printk(KERN_EMERG"[HANS]Virtual Channel offset = 0x%x\n", offset);
>> +    offset = cdns_pcie_find_ext_capability(pcie->cdns_pcie, 
>> PCI_EXT_CAP_ID_DSN);
>> +    printk(KERN_EMERG"[HANS]Device Serial Number offset = 0x%x\n", 
>> offset);
>> +    offset = cdns_pcie_find_ext_capability(pcie->cdns_pcie, 
>> PCI_EXT_CAP_ID_PWR);
>> +    printk(KERN_EMERG"[HANS]pwr offset = 0x%x\n", offset);
>> +    offset = cdns_pcie_find_ext_capability(pcie->cdns_pcie, 
>> PCI_EXT_CAP_ID_REBAR);
>> +    printk(KERN_EMERG"[HANS]resize bar offset = 0x%x\n", offset);
>> +    offset = cdns_pcie_find_ext_capability(pcie->cdns_pcie, 
>> PCI_EXT_CAP_ID_SECPCI);
>> +    printk(KERN_EMERG"[HANS]second exp offset = 0x%x\n", offset);
>> +    offset = cdns_pcie_find_ext_capability(pcie->cdns_pcie, 
>> PCI_EXT_CAP_ID_L1SS);
>> +    printk(KERN_EMERG"[HANS]L1ss offset = 0x%x\n", offset);
>> +}
>> +
>>   static int sky1_pcie_probe(struct platform_device *pdev)
>>   {
>>       struct cdns_plat_pcie_of_data *reg_off;
>> @@ -141,6 +174,7 @@ static int sky1_pcie_probe(struct platform_device 
>> *pdev)
>>       struct sky1_pcie *pcie;
>>       int ret;
>>
>> +    printk(KERN_EMERG"[HANS] fun = %s, line = %d ........... \n", 
>> __func__, __LINE__);
>>       pcie = devm_kzalloc(dev, sizeof(*pcie), GFP_KERNEL);
>>       if (!pcie)
>>           return -ENOMEM;
>> @@ -202,6 +236,8 @@ static int sky1_pcie_probe(struct platform_device 
>> *pdev)
>>
>>       dev_set_drvdata(dev, pcie);
>>
>> +    cix_pcie_test_cap(pcie);
>> +
>>       ret = cdns_pcie_hpa_host_setup(rc);
>>       if (ret < 0) {
>>           pci_ecam_free(pcie->cfg);
>> @@ -230,7 +266,7 @@ static struct platform_driver sky1_pcie_driver = {
>>       .driver = {
>>           .name = "sky1-pcie",
>>           .of_match_table = of_sky1_pcie_match,
>> -        .probe_type = PROBE_PREFER_ASYNCHRONOUS,
>> +        // .probe_type = PROBE_PREFER_ASYNCHRONOUS,
>>       },
>>   };
>>   module_platform_driver(sky1_pcie_driver);
>>
>>
>> For the LGA IP, an offset address CDNS_PCIE_RP_BASE needs to be added. 
>> And the HPA IP requires an offset address of CDNS_PCIE_HPA_RP_BASE, 
>> but it is equal to 0;
>>
>> drivers/pci/controller/cadence/pcie-cadence-hpa-regs.h
>>
>> /* Root Port register base address */
>> #define CDNS_PCIE_HPA_RP_BASE            0x0
>>
>> Therefore, for "drivers/pci/controller/cadence/pci-sky1.c", it is normal.
>>
>>
>>
>> Using the following code for work is also normal. Later, I will re- 
>> unify it into the same operation.
>>
>> diff --git a/drivers/pci/controller/cadence/pcie-cadence.h b/drivers/ 
>> pci/controller/cadence/pcie-cadence.h
>> index 574e9cf4d003..723ea79fb02e 100644
>> --- a/drivers/pci/controller/cadence/pcie-cadence.h
>> +++ b/drivers/pci/controller/cadence/pcie-cadence.h
>> @@ -314,7 +314,9 @@ static inline int cdns_pcie_read_cfg_word(struct 
>> cdns_pcie *pcie, int where,
>>   static inline int cdns_pcie_read_cfg_dword(struct cdns_pcie *pcie, 
>> int where,
>>                                             u32 *val)
>>   {
>> -       *val = cdns_pcie_readl(pcie, where);
>> +       void __iomem *addr = pcie->reg_base + where;
>> +
>> +       *val = cdns_pcie_read_sz(addr, 0x4);
>>          return PCIBIOS_SUCCESSFUL;
>>   }
>>
>>
>> Best regards,
>> Hans
>>
>>
> 

Re: [PATCH] PCI: cadence: Use cdns_pcie_find_capability() to get PCIe Cap offset in host driver

[Hans Zhang]

On 5/7/26 20:31, Aksh Garg wrote:
> 
> 
> On 07/05/26 09:18, Hans Zhang wrote:
>>
>>
>> On 5/7/26 11:31, Hans Zhang wrote:
>>>
>>>
>>> On 5/7/26 01:12, Bjorn Helgaas wrote:
>>>> On Thu, May 07, 2026 at 12:04:34AM +0800, Hans Zhang wrote:
>>>>> On 5/6/26 05:23, Bjorn Helgaas wrote:
>>>>>> On Mon, May 04, 2026 at 04:22:26PM +0800, Hans Zhang wrote:
>>>>>>> On 5/4/26 00:52, sashiko-bot@kernel.org wrote:
>>>>>>>> Thank you for your contribution! Sashiko AI review found 1
>>>>>>>> potential issue(s) to consider:
>>>>>>>>
>>>>>>>> - [Critical] cdns_pcie_find_capability() searches the wrong
>>>>>>>> register space in Host mode and its return value is not validated,
>>>>>>>> leading to Root Port configuration space corruption.
>>>>>>>> -- 
>>>>>>>>
>>>>>>>> commit 09b3c64b8f5892eb365acd13030a8067652a15e8
>>>>>>>> Author: Hans Zhang <18255117159@163.com>
>>>>>>>>
>>>>>>>> PCI: cadence: Use cdns_pcie_find_capability() to get PCIe Cap 
>>>>>>>> offset in host driver
>>>>>>>>
>>>>>>>> This commit replaces the hardcoded CDNS_PCIE_RP_CAP_OFFSET with 
>>>>>>>> a dynamic
>>>>>>>> lookup using cdns_pcie_find_capability() in Cadence PCIe host- 
>>>>>>>> related
>>>>>>>> functions. The goal is to ensure correct operation across 
>>>>>>>> various SoC designs
>>>>>>>> where the capability might not reside at offset 0xC0.
>>>>>>>>
>>>>>>>>> diff --git a/drivers/pci/controller/cadence/pcie-cadence-host- 
>>>>>>>>> common.c b/drivers/pci/controller/cadence/pcie-cadence-host- 
>>>>>>>>> common.c
>>>>>>>>> index 2b0211870f02..5013d3fe23b5 100644
>>>>>>>>> --- a/drivers/pci/controller/cadence/pcie-cadence-host-common.c
>>>>>>>>> +++ b/drivers/pci/controller/cadence/pcie-cadence-host-common.c
>>>>>>>>> @@ -26,14 +26,14 @@ EXPORT_SYMBOL_GPL(bar_max_size);
>>>>>>>>>     int cdns_pcie_host_training_complete(struct cdns_pcie *pcie)
>>>>>>>>>     {
>>>>>>>>> -    u32 pcie_cap_off = CDNS_PCIE_RP_CAP_OFFSET;
>>>>>>>>>         unsigned long end_jiffies;
>>>>>>>>>         u16 lnk_stat;
>>>>>>>>> +    u8 cap = cdns_pcie_find_capability(pcie, PCI_CAP_ID_EXP);
>>>>>>>>
>>>>>>>> Does this capability search scan the correct register space when
>>>>>>>> operating in host mode?
>>>>>>>>
>>>>>>>> Looking at the helper function, it uses cdns_pcie_read_cfg() which
>>>>>>>> reads directly from the base address without the Root Port offset:
>>>>>>>>
>>>>>>>> drivers/pci/controller/cadence/pcie- 
>>>>>>>> cadence.c:cdns_pcie_find_capability() {
>>>>>>>>        return PCI_FIND_NEXT_CAP(cdns_pcie_read_cfg, 
>>>>>>>> PCI_CAPABILITY_LIST,
>>>>>>>>                                 cap, NULL, pcie);
>>>>>>>> }
>>>>>>>>
>>>>>>>> However, the Root Port configuration registers are physically
>>>>>>>> located at pcie->reg_base + CDNS_PCIE_RP_BASE. Could this cause
>>>>>>>> the search to scan the Local Management register space instead,
>>>>>>>> failing to find PCI_CAP_ID_EXP and returning 0?
>>>>>>>
>>>>>>> I don't think we need to worry about this issue.
>>>>>>>
>>>>>>> As per PCIe r7.0, sec 7.5.1.1.11, Since all PCI Express Functions
>>>>>>> are required to implement the PCI Express Capability structure,
>>>>>>> which must be included somewhere in this linked list;
>>>>>>>
>>>>>>> So, it won't return 0 here.
>>>>>>
>>>>>> It's true that all Root Ports must have a PCIe Capability, but
>>>>>> that's not related to this issue.
>>>>>>
>>>>>> cdns_pcie_host_init_root_port() accesses PCI_EXP_LNKCAP at the
>>>>>> address:
>>>>>>
>>>>>>     pcie->reg_base + CDNS_PCIE_RP_BASE + CDNS_PCIE_RP_CAP_OFFSET + 
>>>>>> PCI_EXP_LNKCAP
>>>>>>
>>>>>> but when we search with cdns_pcie_find_capability(pcie, 
>>>>>> PCI_CAP_ID_EXP),
>>>>>> we start reading at:
>>>>>>
>>>>>>     pcie->reg_base + PCI_CAPABILITY_LIST
>>>>>>
>>>>>> It should be starting at:
>>>>>>
>>>>>>     pcie->reg_base + CDNS_PCIE_RP_BASE + PCI_CAPABILITY_LIST
>>>>>>
>>>>>> Previously, cdns_pcie_find_capability() and
>>>>>> cdns_pcie_find_ext_capability() were only used for endpoints, and I
>>>>>> assume they work fine there.  There is pcie->is_rc, so there 
>>>>>> should be
>>>>>> a way to make this work for both endpoints and Root Ports.
>>>>>
>>>>> The reason for using the "is_rc" tag is that for Cadence IP, it is 
>>>>> not only
>>>>> applicable to the RC or EP mode, but also there are significant 
>>>>> differences
>>>>> between the LGA and HPA generations of IP. Including register 
>>>>> offset values,
>>>>> definitions, etc., it fails to achieve good compatibility. It is 
>>>>> not like
>>>>> Synopsys IP, where compatibility has been handled very well. It was 
>>>>> truly
>>>>> out of necessity.
>>>>
>>>> I think cdns_pcie_find_capability(pcie, PCI_CAP_ID_EXP) fails on Root
>>>> Ports because it doesn't include the CDNS_PCIE_RP_BASE offset.  Do you
>>>> have hardware where you can test that?
>>
>> Hi Siddharth,
>>
>> Could you please test the functions mentioned above? It would be great 
>> if you could help test it and give us your feedback. (pci-j721e.c)
>>
>> I guess the following changes might need to be made.
>>
>> diff --git a/drivers/pci/controller/cadence/pcie-cadence.h b/drivers/ 
>> pci/controller/cadence/pcie-cadence.h
>> index 574e9cf4d003..bb01761749f1 100644
>> --- a/drivers/pci/controller/cadence/pcie-cadence.h
>> +++ b/drivers/pci/controller/cadence/pcie-cadence.h
>> @@ -298,6 +298,9 @@ static inline int cdns_pcie_read_cfg_byte(struct 
>> cdns_pcie *pcie, int where,
>>   {
>>          void __iomem *addr = pcie->reg_base + where;
>>
>> +       if ((pcie->is_rc) && (!pcie->is_hpa))
>> +               addr += CDNS_PCIE_RP_BASE;
>> +
>>          *val = cdns_pcie_read_sz(addr, 0x1);
>>          return PCIBIOS_SUCCESSFUL;
>>   }
>> @@ -307,6 +310,9 @@ static inline int cdns_pcie_read_cfg_word(struct 
>> cdns_pcie *pcie, int where,
>>   {
>>          void __iomem *addr = pcie->reg_base + where;
>>
>> +       if ((pcie->is_rc) && (!pcie->is_hpa))
>> +               addr += CDNS_PCIE_RP_BASE;
>> +
>>          *val = cdns_pcie_read_sz(addr, 0x2);
>>          return PCIBIOS_SUCCESSFUL;
>>   }
>> @@ -314,7 +320,12 @@ static inline int cdns_pcie_read_cfg_word(struct 
>> cdns_pcie *pcie, int where,
>>   static inline int cdns_pcie_read_cfg_dword(struct cdns_pcie *pcie, 
>> int where,
>>                                             u32 *val)
>>   {
>> -       *val = cdns_pcie_readl(pcie, where);
>> +       void __iomem *addr = pcie->reg_base + where;
>> +
>> +       if ((pcie->is_rc) && (!pcie->is_hpa))
>> +               addr += CDNS_PCIE_RP_BASE;
>> +
>> +       *val = cdns_pcie_read_sz(addr, 0x4);
>>          return PCIBIOS_SUCCESSFUL;
>>   }
>>
>>
>> "is_hpa" flag I added it in another series. As mentioned before, the 
>> compatibility of Cadence IP is not very good. It is divided into LGA 
>> and HPA IP. And there are many differences between the Root Port and 
>> the Endpoint.
>>
>> https://patchwork.kernel.org/project/linux-pci/ 
>> patch/20260406103237.1203127-2-18255117159@163.com/
>>
>> Best regards,
>> Hans
>>
> 
> Hi Hans,
> 
> I have tested this on J7200 and J721E SoCs, which uses pci-j721e.c
> driver for their PCIe controllers. The patch alone fails to find the
> capabilities using cdns_pcie_find_capability() for Root Port.
> 
> With the "is_hpa" flag patch, and the patch "PCI: cadence: Use
> cdns_pcie_find_capability() to get PCIe Cap offset in host driver" along
> with the diff suggested above:

Thank you very much for your test. We need to wait for Bjorn's approval.

> 
> Tested-by: Aksh Garg <a-garg7@ti.com>

When the future patch is sent to the PCI mailing list, if you test it at 
that time, please reply to this tag again.

> 
> 
> I would also like me to be included in the CC list for future
> correspondence regarding Cadence PCIe Controller patches.
> 

Sure. In the future, when I send the patch, I will CC it to you in the 
email.

Best regards,
Hans

> Regards,
> Aksh Garg
> 
>>>
>>> Hi Bjorn,
>>>
>>> The attachment contains the dmesg and lspci -vvv log from the test.
>>>
>>> Here is the test code:
>>>
>>> diff --git a/drivers/pci/controller/cadence/pci-sky1.c b/drivers/pci/ 
>>> controller/cadence/pci-sky1.c
>>> index cd55c64e58a9..0d0c42309127 100644
>>> --- a/drivers/pci/controller/cadence/pci-sky1.c
>>> +++ b/drivers/pci/controller/cadence/pci-sky1.c
>>> @@ -130,6 +130,39 @@ static const struct cdns_pcie_ops sky1_pcie_ops = {
>>>       .link_up = sky1_pcie_link_up,
>>>   };
>>>
>>> +void cix_pcie_test_cap(struct sky1_pcie *pcie)
>>> +{
>>> +    u16 offset;
>>> +
>>> +    printk(KERN_EMERG"[HANS] fun = %s, line = %d ........... \n", 
>>> __func__, __LINE__);
>>> +    /* capability */
>>> +    offset = cdns_pcie_find_capability(pcie->cdns_pcie, PCI_CAP_ID_PM);
>>> +    printk(KERN_EMERG"[HANS]pm offset = 0x%x\n", offset);
>>> +    offset = cdns_pcie_find_capability(pcie->cdns_pcie, 
>>> PCI_CAP_ID_MSI);
>>> +    printk(KERN_EMERG"[HANS]msi offset = 0x%x\n", offset);
>>> +    offset = cdns_pcie_find_capability(pcie->cdns_pcie, 
>>> PCI_CAP_ID_MSIX);
>>> +    printk(KERN_EMERG"[HANS]msix offset = 0x%x\n", offset);
>>> +    offset = cdns_pcie_find_capability(pcie->cdns_pcie, 
>>> PCI_CAP_ID_EXP);
>>> +    printk(KERN_EMERG"[HANS]exp offset = 0x%x\n", offset);
>>> +
>>> +    printk(KERN_EMERG"[HANS] fun = %s, line = %d ........... \n", 
>>> __func__, __LINE__);
>>> +    /* extend capability */
>>> +    offset = cdns_pcie_find_ext_capability(pcie->cdns_pcie, 
>>> PCI_EXT_CAP_ID_ERR);
>>> +    printk(KERN_EMERG"[HANS]aer offset = 0x%x\n", offset);
>>> +    offset = cdns_pcie_find_ext_capability(pcie->cdns_pcie, 
>>> PCI_EXT_CAP_ID_VC);
>>> +    printk(KERN_EMERG"[HANS]Virtual Channel offset = 0x%x\n", offset);
>>> +    offset = cdns_pcie_find_ext_capability(pcie->cdns_pcie, 
>>> PCI_EXT_CAP_ID_DSN);
>>> +    printk(KERN_EMERG"[HANS]Device Serial Number offset = 0x%x\n", 
>>> offset);
>>> +    offset = cdns_pcie_find_ext_capability(pcie->cdns_pcie, 
>>> PCI_EXT_CAP_ID_PWR);
>>> +    printk(KERN_EMERG"[HANS]pwr offset = 0x%x\n", offset);
>>> +    offset = cdns_pcie_find_ext_capability(pcie->cdns_pcie, 
>>> PCI_EXT_CAP_ID_REBAR);
>>> +    printk(KERN_EMERG"[HANS]resize bar offset = 0x%x\n", offset);
>>> +    offset = cdns_pcie_find_ext_capability(pcie->cdns_pcie, 
>>> PCI_EXT_CAP_ID_SECPCI);
>>> +    printk(KERN_EMERG"[HANS]second exp offset = 0x%x\n", offset);
>>> +    offset = cdns_pcie_find_ext_capability(pcie->cdns_pcie, 
>>> PCI_EXT_CAP_ID_L1SS);
>>> +    printk(KERN_EMERG"[HANS]L1ss offset = 0x%x\n", offset);
>>> +}
>>> +
>>>   static int sky1_pcie_probe(struct platform_device *pdev)
>>>   {
>>>       struct cdns_plat_pcie_of_data *reg_off;
>>> @@ -141,6 +174,7 @@ static int sky1_pcie_probe(struct platform_device 
>>> *pdev)
>>>       struct sky1_pcie *pcie;
>>>       int ret;
>>>
>>> +    printk(KERN_EMERG"[HANS] fun = %s, line = %d ........... \n", 
>>> __func__, __LINE__);
>>>       pcie = devm_kzalloc(dev, sizeof(*pcie), GFP_KERNEL);
>>>       if (!pcie)
>>>           return -ENOMEM;
>>> @@ -202,6 +236,8 @@ static int sky1_pcie_probe(struct platform_device 
>>> *pdev)
>>>
>>>       dev_set_drvdata(dev, pcie);
>>>
>>> +    cix_pcie_test_cap(pcie);
>>> +
>>>       ret = cdns_pcie_hpa_host_setup(rc);
>>>       if (ret < 0) {
>>>           pci_ecam_free(pcie->cfg);
>>> @@ -230,7 +266,7 @@ static struct platform_driver sky1_pcie_driver = {
>>>       .driver = {
>>>           .name = "sky1-pcie",
>>>           .of_match_table = of_sky1_pcie_match,
>>> -        .probe_type = PROBE_PREFER_ASYNCHRONOUS,
>>> +        // .probe_type = PROBE_PREFER_ASYNCHRONOUS,
>>>       },
>>>   };
>>>   module_platform_driver(sky1_pcie_driver);
>>>
>>>
>>> For the LGA IP, an offset address CDNS_PCIE_RP_BASE needs to be 
>>> added. And the HPA IP requires an offset address of 
>>> CDNS_PCIE_HPA_RP_BASE, but it is equal to 0;
>>>
>>> drivers/pci/controller/cadence/pcie-cadence-hpa-regs.h
>>>
>>> /* Root Port register base address */
>>> #define CDNS_PCIE_HPA_RP_BASE            0x0
>>>
>>> Therefore, for "drivers/pci/controller/cadence/pci-sky1.c", it is 
>>> normal.
>>>
>>>
>>>
>>> Using the following code for work is also normal. Later, I will re- 
>>> unify it into the same operation.
>>>
>>> diff --git a/drivers/pci/controller/cadence/pcie-cadence.h b/drivers/ 
>>> pci/controller/cadence/pcie-cadence.h
>>> index 574e9cf4d003..723ea79fb02e 100644
>>> --- a/drivers/pci/controller/cadence/pcie-cadence.h
>>> +++ b/drivers/pci/controller/cadence/pcie-cadence.h
>>> @@ -314,7 +314,9 @@ static inline int cdns_pcie_read_cfg_word(struct 
>>> cdns_pcie *pcie, int where,
>>>   static inline int cdns_pcie_read_cfg_dword(struct cdns_pcie *pcie, 
>>> int where,
>>>                                             u32 *val)
>>>   {
>>> -       *val = cdns_pcie_readl(pcie, where);
>>> +       void __iomem *addr = pcie->reg_base + where;
>>> +
>>> +       *val = cdns_pcie_read_sz(addr, 0x4);
>>>          return PCIBIOS_SUCCESSFUL;
>>>   }
>>>
>>>
>>> Best regards,
>>> Hans
>>>
>>>
>>

Re: [PATCH] PCI: cadence: Use cdns_pcie_find_capability() to get PCIe Cap offset in host driver

[Bjorn Helgaas]

On Thu, May 07, 2026 at 11:21:39PM +0800, Hans Zhang wrote:
> On 5/7/26 20:31, Aksh Garg wrote:
> ...

> > I have tested this on J7200 and J721E SoCs, which uses pci-j721e.c
> > driver for their PCIe controllers. The patch alone fails to find the
> > capabilities using cdns_pcie_find_capability() for Root Port.
> > 
> > With the "is_hpa" flag patch, and the patch "PCI: cadence: Use
> > cdns_pcie_find_capability() to get PCIe Cap offset in host driver" along
> > with the diff suggested above:
> 
> Thank you very much for your test. We need to wait for Bjorn's approval.

Just post a revised series incorporating the fix.

Thanks for the testing, Aksh!

Bjorn