[REGRESSION] PCI: Dynamic OF node creation hangs on invalid bridge configuration

[REGRESSION] PCI: Dynamic OF node creation hangs on invalid bridge configuration

[Angel J]

[-- Attachment #1.1: Type: text/plain, Size: 3820 bytes --]

Hello,

This regression was introduced in v6.17-rc1 and remains in the dynamic
PCI OF node code. Linux 6.18 fails very early during boot on my Dell XPS
8940 when CONFIG_PCI_DYNAMIC_OF_NODES=y. The display goes black before
any useful console or pstore output appears, and the machine remains
hung.

Disabling CONFIG_PCI_DYNAMIC_OF_NODES makes the same kernel boot normally.
Linux v6.19-rc5 also boots because the RP1 driver stopped selecting that
option, not because the dynamic PCI OF node code changed.

Hardware:

  System: Dell XPS 8940, board 0K3CM7, BIOS 2.27.1 (2025-04-03)
  CPU: Intel Core i7-11700 (Rocket Lake)
  Triggering device: 0000:00:00.0, Intel 8086:4c43
  Firmware boot: UEFI, ACPI-based x86_64

Test results:

  Linux 6.12.103: good
  Linux v6.17-rc1: bad
  Linux 6.18.44, CONFIG_PCI_DYNAMIC_OF_NODES=y: bad
  Linux 6.18.44, CONFIG_PCI_DYNAMIC_OF_NODES=n: good
  Linux 6.18.44, CONFIG_PCI_DYNAMIC_OF_NODES=y, skip invalid bridge: good
  Linux v6.19-rc4: bad
  Linux v6.19-rc5: good
  Linux 4621c338d33f: bad
  Linux e55feea3a03a: good

The first-parent boundary between the last two tests is:

  e55feea3a03a ("Merge tag 'soc-fixes-6.19' ...")

That merge contains ce26f588c831 ("misc: rp1: drop overlay support"), which
removes:

  select PCI_DYNAMIC_OF_NODES

from MISC_RP1. The generated configurations differed only by:

  -CONFIG_PCI_DYNAMIC_OF_NODES=y
  +# CONFIG_PCI_DYNAMIC_OF_NODES is not set

CONFIG_MISC_RP1=m in both. The known-bad 4621c338d33f and Linux 6.18.44
both boot after disabling PCI_DYNAMIC_OF_NODES (and MISC_RP1, whose Kconfig
select otherwise forces it on).

There is no RP1 device in this machine, and its driver does not probe.
MISC_RP1 affects this x86 system only because its Kconfig select enables
PCI_DYNAMIC_OF_NODES globally.

I narrowed the hang to dynamic OF node creation for 0000:00:00.0
(8086:4c43), the Intel Rocket Lake-S integrated memory controller. On
this machine it reports PCI class 0604 and header type 1, but it is bound
to icl_uncore and is not a usable forwarding bridge:

  Bus: primary=ff, secondary=ff, subordinate=ff
  I/O and memory bridge windows: invalid/all ones
  kernel: bridge configuration invalid ([bus ff-ff]), reconfiguring

A minimal dynamic node for this device boots. Adding only
device_type="pci" makes it hang. Full PCI dynamic OF node generation also
boots when only 0000:00:00.0 is skipped.

I also tested a generic guard in of_pci_make_dev_node(). It reads
PCI_PRIMARY_BUS and skips node creation if the primary bus does not match
pdev->bus->number, the secondary bus is not greater than the primary bus,
or the secondary bus is greater than the subordinate bus. Linux 6.18.44
boots with CONFIG_PCI_DYNAMIC_OF_NODES=y and logs:

  pci 0000:00:00.0: skipping dynamic OF node for invalid bridge

The regression was introduced by 49d63971f963 in v6.17-rc1. Commit
ce26f588c831 made v6.19-rc5 boot by removing MISC_RP1's select of
PCI_DYNAMIC_OF_NODES. That avoids the failing path in the tested
configuration but does not change of_pci_make_dev_node().

I do not have a log from the failed boots. No output appeared with
earlyprintk=efi,keep, keep_bootcon, ignore_loglevel, loglevel=8,
initcall_debug, and EFI pstore enabled. Blacklisting both GPU drivers and
disabling the Intel IOMMU did not make the bad kernel boot.

Should of_pci_make_dev_node() reject devices with invalid bridge bus
configuration, or should 8086:4c43 use a device-specific quirk? I can
prepare and test a patch for either approach. For Linux 6.18 stable,
would that fix be preferable to backporting ce26f588c831 and its
dependencies?

#regzbot introduced: 49d63971f963
#regzbot title: PCI_DYNAMIC_OF_NODES early boot hang on ACPI x86

Thanks,
Angel J






[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 343 bytes --]

Re: [REGRESSION] PCI: Dynamic OF node creation hangs on invalid bridge configuration

[Angel J]

[-- Attachment #1.1: Type: text/plain, Size: 4423 bytes --]

Hello,

A friendly ping on this regression. It still affects Linux 6.18, and
the tested invalid-bridge guard allows the machine to boot with
CONFIG_PCI_DYNAMIC_OF_NODES=y.

Is any additional information or testing needed from me?

Thanks,
Angel



On Saturday, August 22nd, 2026 at 19:14, Angel J <iamanaws@httpd.dev> wrote:

> Hello,
> 

> This regression was introduced in v6.17-rc1 and remains in the dynamic
> PCI OF node code. Linux 6.18 fails very early during boot on my Dell XPS
> 8940 when CONFIG_PCI_DYNAMIC_OF_NODES=y. The display goes black before
> any useful console or pstore output appears, and the machine remains
> hung.
> 

> Disabling CONFIG_PCI_DYNAMIC_OF_NODES makes the same kernel boot normally.
> Linux v6.19-rc5 also boots because the RP1 driver stopped selecting that
> option, not because the dynamic PCI OF node code changed.
> 

> Hardware:
> 

>   System: Dell XPS 8940, board 0K3CM7, BIOS 2.27.1 (2025-04-03)
>   CPU: Intel Core i7-11700 (Rocket Lake)
>   Triggering device: 0000:00:00.0, Intel 8086:4c43
>   Firmware boot: UEFI, ACPI-based x86_64
> 

> Test results:
> 

>   Linux 6.12.103: good
>   Linux v6.17-rc1: bad
>   Linux 6.18.44, CONFIG_PCI_DYNAMIC_OF_NODES=y: bad
>   Linux 6.18.44, CONFIG_PCI_DYNAMIC_OF_NODES=n: good
>   Linux 6.18.44, CONFIG_PCI_DYNAMIC_OF_NODES=y, skip invalid bridge: good
>   Linux v6.19-rc4: bad
>   Linux v6.19-rc5: good
>   Linux 4621c338d33f: bad
>   Linux e55feea3a03a: good
> 

> The first-parent boundary between the last two tests is:
> 

>   e55feea3a03a ("Merge tag 'soc-fixes-6.19' ...")
> 

> That merge contains ce26f588c831 ("misc: rp1: drop overlay support"), which
> removes:
> 

>   select PCI_DYNAMIC_OF_NODES
> 

> from MISC_RP1. The generated configurations differed only by:
> 

>   -CONFIG_PCI_DYNAMIC_OF_NODES=y
>   +# CONFIG_PCI_DYNAMIC_OF_NODES is not set
> 

> CONFIG_MISC_RP1=m in both. The known-bad 4621c338d33f and Linux 6.18.44
> both boot after disabling PCI_DYNAMIC_OF_NODES (and MISC_RP1, whose Kconfig
> select otherwise forces it on).
> 

> There is no RP1 device in this machine, and its driver does not probe.
> MISC_RP1 affects this x86 system only because its Kconfig select enables
> PCI_DYNAMIC_OF_NODES globally.
> 

> I narrowed the hang to dynamic OF node creation for 0000:00:00.0
> (8086:4c43), the Intel Rocket Lake-S integrated memory controller. On
> this machine it reports PCI class 0604 and header type 1, but it is bound
> to icl_uncore and is not a usable forwarding bridge:
> 

>   Bus: primary=ff, secondary=ff, subordinate=ff
>   I/O and memory bridge windows: invalid/all ones
>   kernel: bridge configuration invalid ([bus ff-ff]), reconfiguring
> 

> A minimal dynamic node for this device boots. Adding only
> device_type="pci" makes it hang. Full PCI dynamic OF node generation also
> boots when only 0000:00:00.0 is skipped.
> 

> I also tested a generic guard in of_pci_make_dev_node(). It reads
> PCI_PRIMARY_BUS and skips node creation if the primary bus does not match
> pdev->bus->number, the secondary bus is not greater than the primary bus,
> or the secondary bus is greater than the subordinate bus. Linux 6.18.44
> boots with CONFIG_PCI_DYNAMIC_OF_NODES=y and logs:
> 

>   pci 0000:00:00.0: skipping dynamic OF node for invalid bridge
> 

> The regression was introduced by 49d63971f963 in v6.17-rc1. Commit
> ce26f588c831 made v6.19-rc5 boot by removing MISC_RP1's select of
> PCI_DYNAMIC_OF_NODES. That avoids the failing path in the tested
> configuration but does not change of_pci_make_dev_node().
> 

> I do not have a log from the failed boots. No output appeared with
> earlyprintk=efi,keep, keep_bootcon, ignore_loglevel, loglevel=8,
> initcall_debug, and EFI pstore enabled. Blacklisting both GPU drivers and
> disabling the Intel IOMMU did not make the bad kernel boot.
> 

> Should of_pci_make_dev_node() reject devices with invalid bridge bus
> configuration, or should 8086:4c43 use a device-specific quirk? I can
> prepare and test a patch for either approach. For Linux 6.18 stable,
> would that fix be preferable to backporting ce26f588c831 and its
> dependencies?
> 

> #regzbot introduced: 49d63971f963
> #regzbot title: PCI_DYNAMIC_OF_NODES early boot hang on ACPI x86
> 

> Thanks,
> Angel J
> 

> 

> 

> 

> 

> 

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 343 bytes --]

Re: [REGRESSION] PCI: Dynamic OF node creation hangs on invalid bridge configuration

[Thorsten Leemhuis]

On 9/1/26 02:59, Angel J wrote:
> A friendly ping on this regression.

Ideally the problem would be fixed, sure. But by your explanation it was
already in mainline and backporting those changes might be too much
churn. But you could try to submit a backport of ce26f588c831 (if that's
all that's needed) to the stable team (or ask somebody to do that for
you), maybe they will puck it up.

And overall: I not entirely sure if this counts as a regression, as you
(if I understood things properly) enabled something new in your .config
(that caused some other hidden problem to show up). That makes it a
non-regression, as, say, new security restrictions (that block things
that used to work) guarded by a new config option could never be
introduced otherwise in Linux.

Ciao, Thorsten

> It still affects Linux 6.18, and
> the tested invalid-bridge guard allows the machine to boot with
> CONFIG_PCI_DYNAMIC_OF_NODES=y.
> 
> Is any additional information or testing needed from me?
> 
> Thanks,
> Angel
> 
> 
> 
> On Saturday, August 22nd, 2026 at 19:14, Angel J <iamanaws@httpd.dev> wrote:
> 
>> Hello,
>>
> 
>> This regression was introduced in v6.17-rc1 and remains in the dynamic
>> PCI OF node code. Linux 6.18 fails very early during boot on my Dell XPS
>> 8940 when CONFIG_PCI_DYNAMIC_OF_NODES=y. The display goes black before
>> any useful console or pstore output appears, and the machine remains
>> hung.
>>
> 
>> Disabling CONFIG_PCI_DYNAMIC_OF_NODES makes the same kernel boot normally.
>> Linux v6.19-rc5 also boots because the RP1 driver stopped selecting that
>> option, not because the dynamic PCI OF node code changed.
>>
> 
>> Hardware:
>>
> 
>>   System: Dell XPS 8940, board 0K3CM7, BIOS 2.27.1 (2025-04-03)
>>   CPU: Intel Core i7-11700 (Rocket Lake)
>>   Triggering device: 0000:00:00.0, Intel 8086:4c43
>>   Firmware boot: UEFI, ACPI-based x86_64
>>
> 
>> Test results:
>>
> 
>>   Linux 6.12.103: good
>>   Linux v6.17-rc1: bad
>>   Linux 6.18.44, CONFIG_PCI_DYNAMIC_OF_NODES=y: bad
>>   Linux 6.18.44, CONFIG_PCI_DYNAMIC_OF_NODES=n: good
>>   Linux 6.18.44, CONFIG_PCI_DYNAMIC_OF_NODES=y, skip invalid bridge: good
>>   Linux v6.19-rc4: bad
>>   Linux v6.19-rc5: good
>>   Linux 4621c338d33f: bad
>>   Linux e55feea3a03a: good
>>
> 
>> The first-parent boundary between the last two tests is:
>>
> 
>>   e55feea3a03a ("Merge tag 'soc-fixes-6.19' ...")
>>
> 
>> That merge contains ce26f588c831 ("misc: rp1: drop overlay support"), which
>> removes:
>>
> 
>>   select PCI_DYNAMIC_OF_NODES
>>
> 
>> from MISC_RP1. The generated configurations differed only by:
>>
> 
>>   -CONFIG_PCI_DYNAMIC_OF_NODES=y
>>   +# CONFIG_PCI_DYNAMIC_OF_NODES is not set
>>
> 
>> CONFIG_MISC_RP1=m in both. The known-bad 4621c338d33f and Linux 6.18.44
>> both boot after disabling PCI_DYNAMIC_OF_NODES (and MISC_RP1, whose Kconfig
>> select otherwise forces it on).
>>
> 
>> There is no RP1 device in this machine, and its driver does not probe.
>> MISC_RP1 affects this x86 system only because its Kconfig select enables
>> PCI_DYNAMIC_OF_NODES globally.
>>
> 
>> I narrowed the hang to dynamic OF node creation for 0000:00:00.0
>> (8086:4c43), the Intel Rocket Lake-S integrated memory controller. On
>> this machine it reports PCI class 0604 and header type 1, but it is bound
>> to icl_uncore and is not a usable forwarding bridge:
>>
> 
>>   Bus: primary=ff, secondary=ff, subordinate=ff
>>   I/O and memory bridge windows: invalid/all ones
>>   kernel: bridge configuration invalid ([bus ff-ff]), reconfiguring
>>
> 
>> A minimal dynamic node for this device boots. Adding only
>> device_type="pci" makes it hang. Full PCI dynamic OF node generation also
>> boots when only 0000:00:00.0 is skipped.
>>
> 
>> I also tested a generic guard in of_pci_make_dev_node(). It reads
>> PCI_PRIMARY_BUS and skips node creation if the primary bus does not match
>> pdev->bus->number, the secondary bus is not greater than the primary bus,
>> or the secondary bus is greater than the subordinate bus. Linux 6.18.44
>> boots with CONFIG_PCI_DYNAMIC_OF_NODES=y and logs:
>>
> 
>>   pci 0000:00:00.0: skipping dynamic OF node for invalid bridge
>>
> 
>> The regression was introduced by 49d63971f963 in v6.17-rc1. Commit
>> ce26f588c831 made v6.19-rc5 boot by removing MISC_RP1's select of
>> PCI_DYNAMIC_OF_NODES. That avoids the failing path in the tested
>> configuration but does not change of_pci_make_dev_node().
>>
> 
>> I do not have a log from the failed boots. No output appeared with
>> earlyprintk=efi,keep, keep_bootcon, ignore_loglevel, loglevel=8,
>> initcall_debug, and EFI pstore enabled. Blacklisting both GPU drivers and
>> disabling the Intel IOMMU did not make the bad kernel boot.
>>
> 
>> Should of_pci_make_dev_node() reject devices with invalid bridge bus
>> configuration, or should 8086:4c43 use a device-specific quirk? I can
>> prepare and test a patch for either approach. For Linux 6.18 stable,
>> would that fix be preferable to backporting ce26f588c831 and its
>> dependencies?
>>
> 
>> #regzbot introduced: 49d63971f963
>> #regzbot title: PCI_DYNAMIC_OF_NODES early boot hang on ACPI x86
>>
> 
>> Thanks,
>> Angel J
>>
> 
>>
> 
>>
> 
>>
> 
>>
> 
>>

Re: [REGRESSION] PCI: Dynamic OF node creation hangs on invalid bridge configuration

[Bjorn Helgaas]

[+to Herve, Lizhi for PCI dynamic OF node stuff]

On Sun, Aug 23, 2026 at 02:14:25AM +0000, Angel J wrote:
> Hello,
> 
> This regression was introduced in v6.17-rc1 and remains in the dynamic
> PCI OF node code. Linux 6.18 fails very early during boot on my Dell XPS
> 8940 when CONFIG_PCI_DYNAMIC_OF_NODES=y. The display goes black before
> any useful console or pstore output appears, and the machine remains
> hung.

Oof, sorry, that's a terrible failure to debug.  Thanks for your
persistence in chasing it.

I don't think 49d63971f963 ("misc: rp1: RaspberryPi RP1 misc driver")
is a likely culprit by itself because there's just nothing there that
looks like it would relate to a Dell XPS 8940.

> Disabling CONFIG_PCI_DYNAMIC_OF_NODES makes the same kernel boot normally.
> Linux v6.19-rc5 also boots because the RP1 driver stopped selecting that
> option, not because the dynamic PCI OF node code changed.
> 
> Hardware:
> 
>   System: Dell XPS 8940, board 0K3CM7, BIOS 2.27.1 (2025-04-03)
>   CPU: Intel Core i7-11700 (Rocket Lake)
>   Triggering device: 0000:00:00.0, Intel 8086:4c43
>   Firmware boot: UEFI, ACPI-based x86_64
> 
> Test results:
> 
>   Linux 6.12.103: good
>   Linux v6.17-rc1: bad
>   Linux 6.18.44, CONFIG_PCI_DYNAMIC_OF_NODES=y: bad
>   Linux 6.18.44, CONFIG_PCI_DYNAMIC_OF_NODES=n: good
>   Linux 6.18.44, CONFIG_PCI_DYNAMIC_OF_NODES=y, skip invalid bridge: good
>   Linux v6.19-rc4: bad
>   Linux v6.19-rc5: good
>   Linux 4621c338d33f: bad
>   Linux e55feea3a03a: good
> 
> The first-parent boundary between the last two tests is:
> 
>   e55feea3a03a ("Merge tag 'soc-fixes-6.19' ...")
> 
> That merge contains ce26f588c831 ("misc: rp1: drop overlay support"), which
> removes:
> 
>   select PCI_DYNAMIC_OF_NODES
> 
> from MISC_RP1. The generated configurations differed only by:
> 
>   -CONFIG_PCI_DYNAMIC_OF_NODES=y
>   +# CONFIG_PCI_DYNAMIC_OF_NODES is not set
> 
> CONFIG_MISC_RP1=m in both. The known-bad 4621c338d33f and Linux 6.18.44
> both boot after disabling PCI_DYNAMIC_OF_NODES (and MISC_RP1, whose Kconfig
> select otherwise forces it on).
> 
> There is no RP1 device in this machine, and its driver does not probe.
> MISC_RP1 affects this x86 system only because its Kconfig select enables
> PCI_DYNAMIC_OF_NODES globally.
> 
> I narrowed the hang to dynamic OF node creation for 0000:00:00.0
> (8086:4c43), the Intel Rocket Lake-S integrated memory controller. On
> this machine it reports PCI class 0604 and header type 1, but it is bound
> to icl_uncore and is not a usable forwarding bridge:
> 
>   Bus: primary=ff, secondary=ff, subordinate=ff
>   I/O and memory bridge windows: invalid/all ones
>   kernel: bridge configuration invalid ([bus ff-ff]), reconfiguring
> 
> A minimal dynamic node for this device boots. Adding only
> device_type="pci" makes it hang. Full PCI dynamic OF node generation also
> boots when only 0000:00:00.0 is skipped.
> 
> I also tested a generic guard in of_pci_make_dev_node(). It reads
> PCI_PRIMARY_BUS and skips node creation if the primary bus does not match
> pdev->bus->number, the secondary bus is not greater than the primary bus,
> or the secondary bus is greater than the subordinate bus. Linux 6.18.44
> boots with CONFIG_PCI_DYNAMIC_OF_NODES=y and logs:
> 
>   pci 0000:00:00.0: skipping dynamic OF node for invalid bridge
> 
> The regression was introduced by 49d63971f963 in v6.17-rc1. Commit
> ce26f588c831 made v6.19-rc5 boot by removing MISC_RP1's select of
> PCI_DYNAMIC_OF_NODES. That avoids the failing path in the tested
> configuration but does not change of_pci_make_dev_node().
> 
> I do not have a log from the failed boots. No output appeared with
> earlyprintk=efi,keep, keep_bootcon, ignore_loglevel, loglevel=8,
> initcall_debug, and EFI pstore enabled. Blacklisting both GPU drivers and
> disabling the Intel IOMMU did not make the bad kernel boot.
> 
> Should of_pci_make_dev_node() reject devices with invalid bridge bus
> configuration, or should 8086:4c43 use a device-specific quirk? I can
> prepare and test a patch for either approach. For Linux 6.18 stable,
> would that fix be preferable to backporting ce26f588c831 and its
> dependencies?

A quirk doesn't sound right because AFAICS there isn't any hardware
defect with the 00:00.0 bridge.

> #regzbot introduced: 49d63971f963
> #regzbot title: PCI_DYNAMIC_OF_NODES early boot hang on ACPI x86
> 
> Thanks,
> Angel J
> 
> 
> 
> 
> 

Re: [REGRESSION] PCI: Dynamic OF node creation hangs on invalid bridge configuration

[Herve Codina]

Hi Angel, Bjorn,

On Thu, 3 Sep 2026 18:17:44 -0500
Bjorn Helgaas <helgaas@kernel.org> wrote:

> [+to Herve, Lizhi for PCI dynamic OF node stuff]
> 
> On Sun, Aug 23, 2026 at 02:14:25AM +0000, Angel J wrote:
> > Hello,
> > 
> > This regression was introduced in v6.17-rc1 and remains in the dynamic
> > PCI OF node code. Linux 6.18 fails very early during boot on my Dell XPS
> > 8940 when CONFIG_PCI_DYNAMIC_OF_NODES=y. The display goes black before
> > any useful console or pstore output appears, and the machine remains
> > hung.  
> 
> Oof, sorry, that's a terrible failure to debug.  Thanks for your
> persistence in chasing it.
> 
> I don't think 49d63971f963 ("misc: rp1: RaspberryPi RP1 misc driver")
> is a likely culprit by itself because there's just nothing there that
> looks like it would relate to a Dell XPS 8940.
> 
> > Disabling CONFIG_PCI_DYNAMIC_OF_NODES makes the same kernel boot normally.
> > Linux v6.19-rc5 also boots because the RP1 driver stopped selecting that
> > option, not because the dynamic PCI OF node code changed.
> > 
> > Hardware:
> > 
> >   System: Dell XPS 8940, board 0K3CM7, BIOS 2.27.1 (2025-04-03)
> >   CPU: Intel Core i7-11700 (Rocket Lake)
> >   Triggering device: 0000:00:00.0, Intel 8086:4c43
> >   Firmware boot: UEFI, ACPI-based x86_64
> > 
> > Test results:
> > 
> >   Linux 6.12.103: good
> >   Linux v6.17-rc1: bad
> >   Linux 6.18.44, CONFIG_PCI_DYNAMIC_OF_NODES=y: bad
> >   Linux 6.18.44, CONFIG_PCI_DYNAMIC_OF_NODES=n: good
> >   Linux 6.18.44, CONFIG_PCI_DYNAMIC_OF_NODES=y, skip invalid bridge: good
> >   Linux v6.19-rc4: bad
> >   Linux v6.19-rc5: good
> >   Linux 4621c338d33f: bad
> >   Linux e55feea3a03a: good
> > 
> > The first-parent boundary between the last two tests is:
> > 
> >   e55feea3a03a ("Merge tag 'soc-fixes-6.19' ...")
> > 
> > That merge contains ce26f588c831 ("misc: rp1: drop overlay support"), which
> > removes:
> > 
> >   select PCI_DYNAMIC_OF_NODES
> > 
> > from MISC_RP1. The generated configurations differed only by:
> > 
> >   -CONFIG_PCI_DYNAMIC_OF_NODES=y
> >   +# CONFIG_PCI_DYNAMIC_OF_NODES is not set
> > 
> > CONFIG_MISC_RP1=m in both. The known-bad 4621c338d33f and Linux 6.18.44
> > both boot after disabling PCI_DYNAMIC_OF_NODES (and MISC_RP1, whose Kconfig
> > select otherwise forces it on).
> > 
> > There is no RP1 device in this machine, and its driver does not probe.
> > MISC_RP1 affects this x86 system only because its Kconfig select enables
> > PCI_DYNAMIC_OF_NODES globally.
> > 
> > I narrowed the hang to dynamic OF node creation for 0000:00:00.0
> > (8086:4c43), the Intel Rocket Lake-S integrated memory controller. On
> > this machine it reports PCI class 0604 and header type 1, but it is bound
> > to icl_uncore and is not a usable forwarding bridge:
> > 
> >   Bus: primary=ff, secondary=ff, subordinate=ff
> >   I/O and memory bridge windows: invalid/all ones
> >   kernel: bridge configuration invalid ([bus ff-ff]), reconfiguring

Is this PCI logs reported with PCI_DYNAMIC_OF_NODES=y or PCI_DYNAMIC_OF_NODES=n
or always whatever the PCI_DYNAMIC_OF_NODES Kconfig value ?

A PCI class 0604 is a PCI-to-PCI bridge.

Something in kernel code prevent the scan of this PCI-to-PCI bridge even if the
kernel tries to reconfigure it. Indeed, the device is "Intel Rocket Lake-S
integrated memory controller" and not a PCI-to-PCI bridge

The of_pci_make_dev_node() is called by the PCI core [1] to create OF node for
bridges.

of_pci_make_dev_node() will set (device_type = "pci" in the created node).

But if the device it is not a bridge, this is obviously wrong (even if I don't
understand why it hangs the system).

Maybe the test done at [1] should be improved to detect those wrong bridges.
and skip the of_pci_make_dev_node() call when a wrong bridge is detected.

[1] https://elixir.bootlin.com/linux/v7.2/source/drivers/pci/bus.c#L355


Best regards,
Hervé

Re: [REGRESSION] PCI: Dynamic OF node creation hangs on invalid bridge configuration

[Andrea della Porta]

Hi,

On 10:57 Fri 04 Sep     , Herve Codina wrote:
> Hi Angel, Bjorn,
> 
> On Thu, 3 Sep 2026 18:17:44 -0500
> Bjorn Helgaas <helgaas@kernel.org> wrote:
> 
> > [+to Herve, Lizhi for PCI dynamic OF node stuff]
> > 
> > On Sun, Aug 23, 2026 at 02:14:25AM +0000, Angel J wrote:
> > > Hello,
> > > 
> > > This regression was introduced in v6.17-rc1 and remains in the dynamic
> > > PCI OF node code. Linux 6.18 fails very early during boot on my Dell XPS
> > > 8940 when CONFIG_PCI_DYNAMIC_OF_NODES=y. The display goes black before
> > > any useful console or pstore output appears, and the machine remains
> > > hung.  
> > 
> > Oof, sorry, that's a terrible failure to debug.  Thanks for your
> > persistence in chasing it.
> > 
> > I don't think 49d63971f963 ("misc: rp1: RaspberryPi RP1 misc driver")
> > is a likely culprit by itself because there's just nothing there that
> > looks like it would relate to a Dell XPS 8940.
> > 
> > > Disabling CONFIG_PCI_DYNAMIC_OF_NODES makes the same kernel boot normally.
> > > Linux v6.19-rc5 also boots because the RP1 driver stopped selecting that
> > > option, not because the dynamic PCI OF node code changed.
> > > 
> > > Hardware:
> > > 
> > >   System: Dell XPS 8940, board 0K3CM7, BIOS 2.27.1 (2025-04-03)
> > >   CPU: Intel Core i7-11700 (Rocket Lake)
> > >   Triggering device: 0000:00:00.0, Intel 8086:4c43
> > >   Firmware boot: UEFI, ACPI-based x86_64
> > > 
> > > Test results:
> > > 
> > >   Linux 6.12.103: good
> > >   Linux v6.17-rc1: bad
> > >   Linux 6.18.44, CONFIG_PCI_DYNAMIC_OF_NODES=y: bad
> > >   Linux 6.18.44, CONFIG_PCI_DYNAMIC_OF_NODES=n: good
> > >   Linux 6.18.44, CONFIG_PCI_DYNAMIC_OF_NODES=y, skip invalid bridge: good
> > >   Linux v6.19-rc4: bad
> > >   Linux v6.19-rc5: good
> > >   Linux 4621c338d33f: bad
> > >   Linux e55feea3a03a: good
> > > 
> > > The first-parent boundary between the last two tests is:
> > > 
> > >   e55feea3a03a ("Merge tag 'soc-fixes-6.19' ...")
> > > 
> > > That merge contains ce26f588c831 ("misc: rp1: drop overlay support"), which
> > > removes:
> > > 
> > >   select PCI_DYNAMIC_OF_NODES
> > > 
> > > from MISC_RP1. The generated configurations differed only by:
> > > 
> > >   -CONFIG_PCI_DYNAMIC_OF_NODES=y
> > >   +# CONFIG_PCI_DYNAMIC_OF_NODES is not set
> > > 
> > > CONFIG_MISC_RP1=m in both. The known-bad 4621c338d33f and Linux 6.18.44
> > > both boot after disabling PCI_DYNAMIC_OF_NODES (and MISC_RP1, whose Kconfig
> > > select otherwise forces it on).
> > > 
> > > There is no RP1 device in this machine, and its driver does not probe.
> > > MISC_RP1 affects this x86 system only because its Kconfig select enables
> > > PCI_DYNAMIC_OF_NODES globally.
> > > 
> > > I narrowed the hang to dynamic OF node creation for 0000:00:00.0
> > > (8086:4c43), the Intel Rocket Lake-S integrated memory controller. On
> > > this machine it reports PCI class 0604 and header type 1, but it is bound
> > > to icl_uncore and is not a usable forwarding bridge:
> > > 
> > >   Bus: primary=ff, secondary=ff, subordinate=ff
> > >   I/O and memory bridge windows: invalid/all ones
> > >   kernel: bridge configuration invalid ([bus ff-ff]), reconfiguring
> 
> Is this PCI logs reported with PCI_DYNAMIC_OF_NODES=y or PCI_DYNAMIC_OF_NODES=n
> or always whatever the PCI_DYNAMIC_OF_NODES Kconfig value ?
> 
> A PCI class 0604 is a PCI-to-PCI bridge.
> 
> Something in kernel code prevent the scan of this PCI-to-PCI bridge even if the
> kernel tries to reconfigure it. Indeed, the device is "Intel Rocket Lake-S
> integrated memory controller" and not a PCI-to-PCI bridge

Indeed, a Host-bridge should have 0600 class and Header 0 (or 80, if it's multi
function as it seems). Angel, could you please provide the following output:

lspci -nn
setpci -s 00:00.0 HEADER_TYPE

from a running (i.e. with CONFIG_PCI_DYNAMIC_OF_NODES=n) system? Just to make
sure we're talking about the correct device and that the hw is 'lying' to us...

Many thanks,
Andrea

> 
> The of_pci_make_dev_node() is called by the PCI core [1] to create OF node for
> bridges.
> 
> of_pci_make_dev_node() will set (device_type = "pci" in the created node).
> 
> But if the device it is not a bridge, this is obviously wrong (even if I don't
> understand why it hangs the system).
> 
> Maybe the test done at [1] should be improved to detect those wrong bridges.
> and skip the of_pci_make_dev_node() call when a wrong bridge is detected.
> 
> [1] https://elixir.bootlin.com/linux/v7.2/source/drivers/pci/bus.c#L355
> 
> 
> Best regards,
> Hervé

Re: [REGRESSION] PCI: Dynamic OF node creation hangs on invalid bridge configuration

[Angel J]

[-- Attachment #1.1: Type: text/plain, Size: 4203 bytes --]

Hi Andrea, Hervé, Bjorn, Thorsten,

Thanks for the guidance, it was very useful. I went back through the tests
and got some more insight into the hang.

Andrea wrote:
> Angel, could you please provide the following output:
>
> lspci -nn
> setpci -s 00:00.0 HEADER_TYPE
>
> from a running (i.e. with CONFIG_PCI_DYNAMIC_OF_NODES=n) system?

On Linux 6.12.109, with CONFIG_PCI_DYNAMIC_OF_NODES disabled, the relevant
output is:

  $ lspci -nn
  00:00.0 PCI bridge [0604]: Intel Corporation Device [8086:4c43] (rev 01)

  $ setpci -s 00:00.0 HEADER_TYPE
  01

  $ setpci -s 00:00.0 PRIMARY_BUS SECONDARY_BUS SUBORDINATE_BUS
  ff
  ff
  ff

The device is bound to icl_uncore. I get the same values on the patched
kernel with CONFIG_PCI_DYNAMIC_OF_NODES=y.

Hervé wrote:
> Is this PCI logs reported with PCI_DYNAMIC_OF_NODES=y or PCI_DYNAMIC_OF_NODES=n
> or always whatever the PCI_DYNAMIC_OF_NODES Kconfig value ?

The messages appear on successful boots with either setting:

  pci 0000:00:00.0: [8086:4c43] type 01 class 0x060400 conventional PCI bridge
  pci 0000:00:00.0: bridge configuration invalid ([bus ff-ff]), reconfiguring

I confirmed this on 6.12.107 with the option disabled and 6.12.108 with it
enabled. They also appear on the patched 6.18.44 kernel.

Bjorn wrote:
> I don't think 49d63971f963 ("misc: rp1: RaspberryPi RP1 misc driver")
> is a likely culprit by itself because there's just nothing there that
> looks like it would relate to a Dell XPS 8940.

That change exposed the problem by enabling PCI_DYNAMIC_OF_NODES in my
configuration. I bisected again with the option enabled throughout and
found an earlier boundary:

  3dc8adeeefa0  PCI: of_property: Constify parameter in of_pci_get_addr_flags()
  1f340724419e  PCI: of: Create device tree PCI host bridge node

The first is the direct parent of the second. I boot-tested both without
any guard, changing only the source commit; their generated kernel
configurations are identical.

All of these tests have CONFIG_PCI_DYNAMIC_OF_NODES=y:

  Source         Change             Result
  3dc8adeeefa0    None               Boots
  1f340724419e    None               Hangs
  1f340724419e    Subordinate guard  Boots
  6.18.44        None               Hangs
  6.18.44        Subordinate guard  Boots

Hervé wrote:
> Maybe the test done at [1] should be improved to detect those wrong bridges.
> and skip the of_pci_make_dev_node() call when a wrong bridge is detected.

I added logging to the first bad commit to check the bridge scan. It shows
that 00:00.0 has no subordinate bus after either pass, despite satisfying
pci_is_bridge():

  pci 0000:00:00.0: PCI OF debug: scan pass 0, buses ff/ff/ff
  pci 0000:00:00.0: PCI OF debug: scan pass 0 done, subordinate bus absent
  pci 0000:00:00.0: PCI OF debug: scan pass 1, buses ff/ff/ff
  pci 0000:00:00.0: PCI OF debug: scan pass 1 done, subordinate bus absent

of_pci_prop_bus_range() dereferences pdev->subordinate without checking it.
of_pci_prop_intr_map() also uses that pointer. Before 1f340724419e,
of_pci_make_dev_node() returns because the parent OF node is missing on
this ACPI system. That commit creates the parent node, allowing property
generation to reach the unchecked access.

My earlier report overstated the device_type="pci" result. The minimal-node
test that hung added device_type, bus-range and interrupt-map together;
I haven't confirmed a hang with device_type alone.

I tested this guard in of_pci_make_dev_node(), before node creation:

  if (pci_is_bridge(pdev) && !pdev->subordinate)
          return;

Both the first bad commit and 6.18.44 boot with it. The 6.18.44 test uses
only the guard, without diagnostic logging. The host OF node and the nodes
for bridges 00:01.0 and 00:1c.0 are still created; 00:00.0 is skipped.

This points to the NULL subordinate pointer as the cause of the hang,
although I still don't have a crash trace from an unguarded boot. I'll
send the patch as a reply to this email. Is of_pci_make_dev_node() the
right place for this check?

#regzbot introduced: 1f340724419eda8ab07a20edcaf5ec8f70134231

Thanks,
Angel J

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 343 bytes --]

[PATCH] PCI: of: Skip dynamic nodes for bridges without a subordinate bus

[Angel J]

A device can satisfy pci_is_bridge() without having a subordinate bus.
The dynamic OF helpers for bus-range and interrupt-map dereference
pdev->subordinate without checking it.

On a Dell XPS 8940, device 0000:00:00.0 [8086:4c43] has no subordinate
bus, and enabling CONFIG_PCI_DYNAMIC_OF_NODES causes an early boot hang.

Skip dynamic OF node creation for bridges without a subordinate bus.
This allows the machine to boot while preserving node creation for the
other bridges.

Fixes: 407d1a51921e ("PCI: Create device tree node for bridge")
Cc: stable@vger.kernel.org
Signed-off-by: Angel J <iamanaws@httpd.dev>
---
 drivers/pci/of.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/pci/of.c b/drivers/pci/of.c
index a51dff91b..971c79c2a 100644
--- a/drivers/pci/of.c
+++ b/drivers/pci/of.c
@@ -765,6 +765,10 @@ void of_pci_make_dev_node(struct pci_dev *pdev)
 	if (!ppnode)
 		return;
 
+	/* Bridge properties require a subordinate bus. */
+	if (pci_is_bridge(pdev) && !pdev->subordinate)
+		return;
+
 	if (pci_is_bridge(pdev))
 		pci_type = "pci";
 	else
-- 
2.54.0