Project

General

Profile

Actions

Bug #612

open

coreboot blocks PCIe root port: reg_script_run_step / P.m CAP (Baytrail)

Added by Walter Sonius 23 days ago. Updated 15 days ago.

Status:
New
Priority:
Normal
Assignee:
-
Category:
chipset configuration
Target version:
Start date:
10/13/2025
Due date:
% Done:

0%

Estimated time:
Affected versions:
Needs backport to:
Affected hardware:
ZOTAC ZBOX-CI320NANO series
Affected OS:

Description

The ZBOX-CI320NANO series from ZOTAC see code CB:89528 behaves different
concerning enabling PCIe root ports via devicetree.cb compared to earlier
Baytrail ports from Lenovo H500s CB:89170 and Jetway NF9N-2930 CB:89279.

Although devicetree.cb lists all PCIe root ports for enabling 1c.0, 1c.1
1c.2, and 1c.3, coreboot first enables each device during early init:

...
[SPEW ]  PCI: 00:00:1c.0: enabled 1
[SPEW ]  PCI: 00:00:1c.1: enabled 1
[SPEW ]  PCI: 00:00:1c.2: enabled 1
[SPEW ]  PCI: 00:00:1c.3: enabled 1
...
[SPEW ]    PCI: 00:00:1c.0: enabled 1
[SPEW ]     PCI: 00:00:00.0: enabled 1	#force eth as builtin also tried without it?
[SPEW ]    PCI: 00:00:1c.1: enabled 1
[SPEW ]    PCI: 00:00:1c.2: enabled 1
[SPEW ]    PCI: 00:00:1c.3: enabled 1
...

Later on disables each device except 1c.2 which contains miniPCIe wifi:

...
[SPEW ]  PCI: 00:00:1c.0 [8086/0000] bus ops
[DEBUG]  No PCIe device present.
[WARN ]  reg_script_run_step: POLL timeout waiting for 0x328 to be 0x1000000, got 0x0
[DEBUG]  PCI: 00:00:1c.0: Disabling device: 1c.0
[DEBUG]  Power management CAP offset 0xa0.
[DEBUG]  PCI: 00:00:1c.0 [8086/0f48] disabled

[SPEW ]  PCI: 00:00:1c.1 [8086/0000] bus ops
[DEBUG]  No PCIe device present.
[WARN ]  reg_script_run_step: POLL timeout waiting for 0x328 to be 0x1000000, got 0x0
[DEBUG]  PCI: 00:00:1c.1: Disabling device: 1c.1
[DEBUG]  Power management CAP offset 0xa0.
[DEBUG]  PCI: 00:00:1c.1 [8086/0f4a] disabled

[SPEW ]  PCI: 00:00:1c.2 [8086/0000] bus ops
[DEBUG]  PCI: 00:00:1c.2 [8086/0f4c] enabled

[SPEW ]  PCI: 00:00:1c.3 [8086/0000] bus ops
[DEBUG]  No PCIe device present.
[WARN ]  reg_script_run_step: POLL timeout waiting for 0x328 to be 0x1000000, got 0x0
[DEBUG]  PCI: 00:00:1c.3: Disabling device: 1c.3
[DEBUG]  Power management CAP offset 0xa0.
[DEBUG]  PCI: 00:00:1c.3 [8086/0f4e] disabled
...
[SPEW ]  PCI: 00:00:1c.0: enabled 0
[SPEW ]  PCI: 00:00:1c.1: enabled 0
[SPEW ]  PCI: 00:00:1c.2: enabled 1
[SPEW ]  PCI: 00:00:1c.3: enabled 0
...

While the 1c.2 root port stays enabled it is not listed in the OS using
lspci, however the miniPCIe WIFI device behind it does list and works.
A Realtek RTL8111F Gb NIC on the PCIe 1c.0 root port remains undetected!

This only misbehaves on the ZBOX, Lenovo and Jetway boards enable and
do list their PCIe root ports including the devices on those root ports.

The coreboot log mentions the following lines while unintentionally
disabling a PCIe root port:

[WARN ]  reg_script_run_step: POLL timeout waiting for 0x328 to be 0x1000000, got 0x0
[DEBUG]  Power management CAP offset 0xa0.

Besides using devicetree.cb as a method to enable / disable devices, are
there special GPIO values that may override this or Power management CAP
offset values that I haven't yet set up correctly?

Could this be an issue with the Realtek Gb adapter that needs a special
gpio/reset pin and Kconfig option like the Asrock H110M-DVS (which also
doesn't seem to have a working NIC)?

Tried two coreboot code revisions including a older one that works fine
on the earlier Baytrail Lenovo and Jetway ports and different EDK2 revs:

coreboot-25.06-77-g812d0e2f626d
coreboot-25.09-70-g98a54453284e-dirty
EDK2 (MrChromebox-2502/2505/2508)

Also tried disabling libgfxinit, removing VBT and following options:

CONFIG_RESOURCE_ALLOCATION_TOP_DOWN=n
CONFIG_PCIEXP_COMMON_CLOCK=n
CONFIG_PCIEXP_ASPM=n
CONFIG_PCIEXP_L1_SUB_STATE=n
CONFIG_PCIEXP_CLK_PM=n

It doesn't make a difference except that disabling TOP_DOWN breaks the
miniPCIe which contradicts this recent patchCB:89464 and BUG 611.

Comparing the build .config of the Jetway with this ZOTAC only reveals
this obvious difference which I still need to rule out, besides some
uart/serial/sio options:

< CONFIG_USE_DDR3=y
> CONFIG_DRAM_SUPPORT_DDR3=y
#both boards use DDR3L SODIMM(s) (Jetway uses 2)

More and complete logs are available in the attachment zotac_zbox-ci320nano.zip.


Files

zotac_zbox-ci320nano.zip (179 KB) zotac_zbox-ci320nano.zip oem and coreboot logs Walter Sonius, 10/13/2025 04:53 PM
zbox-ci320nano-mmio-pm02-patch.zip (79.6 KB) zbox-ci320nano-mmio-pm02-patch.zip cbmem-dmesg-lspci-interrupts-logs-w-wo-mmio4Gpatch Walter Sonius, 10/17/2025 04:49 PM
ONE_PAGE_SUMMARY.md (4.24 KB) ONE_PAGE_SUMMARY.md Matt DeVillier, 10/18/2025 12:16 AM
zbox-ci320nano-mmio-pm02-patch-no000.zip (59.8 KB) zbox-ci320nano-mmio-pm02-patch-no000.zip cbmem-dmesg-lspci-interrupts-logs-mmio4G-patch-minus000 Walter Sonius, 10/18/2025 11:09 AM
zbox-ci320nano-mmio-pm02-patch-force-pciec.zip (41.3 KB) zbox-ci320nano-mmio-pm02-patch-force-pciec.zip logs after forcing rootport in pcie.c Walter Sonius, 10/18/2025 07:54 PM
Actions #1

Updated by Walter Sonius 19 days ago · Edited

Current Baytrail missing MMIO window below 4GB patch has a contradicting effect on the ZBOX because it disables the only working (mini)PCIe rootport so it breaks the Intel Wifi adapter.

See zbox-ci320nano-mmio-pm02-patch.zip for "cbmem/dmesg/lspci/interrupts" logs before and after patching mmio using CONFIG_RESOURCE_ALLOCATION_TOP_DOWN=y.

Actions #2

Updated by Matt DeVillier 19 days ago

Walter Sonius wrote in #note-1:

Current Baytrail missing MMIO window below 4GB patch has a contradicting effect on the ZBOX because it disables the only working (mini)PCIe rootport so it breaks the Intel Wifi adapter.

See zbox-ci320nano-mmio-pm02-patch.zip for cbmem/dmesg/lspci/interrupts logs before and after patching mmio using CONFIG_RESOURCE_ALLOCATION_TOP_DOWN=y.

thanks for the logs, they explain things perfectly. I've attached a Cursor-generated summary, but the TLDR is that the resource assignments without the MMIO patch are all invalid, so Linux reassigns everything. With the patch, only the WiFi assignment is invalid, so that's what is broken.

Why is the WiFi assignment valid? Why does it work on my Baytrail device and not yours?
Because your devicetree is wrong:

device pci 1c.0 on	# PCI-e #1 (Onboard Realtek Gb LAN) missing... reset pin???	CPU3?
	device pci 00.0 on end
end

This is incorrect - you don't have a separate PCI root (peer) bus under the root port, you have a bridge device with a subordinate bus. When you declare it this way, you're saying this PCI bus is separate from the host bridge (00.0), and therefore cannot share any resources. Linux sees PCI 01:00.0 as completely separate, and says that coreboot's resource assignment for the whole bus is invalid.

Delete this device under the PCIe root ports on this board (and your others) and the problem will be resolved.
device pci 1c.0 on end # PCI-e #1 (Onboard Realtek Gb LAN)
is all you need.

1c.0 is the actual problem, but because the device is not found, the WiFi on 1c.2 is assigned its declared bus (1:00.0) and it inherits the problem.

Actions #3

Updated by Walter Sonius 18 days ago

Thanks for the comprehensive report, a fraction can be understood where Bus 01 claims a unlimited big space while it overlaps with part of Bus 00 already claimed MMIO space.

While I'm trying to understand the rest of the report I made another log set zbox-ci320nano-mmio-pm02-patch-no000.zip in which the 00.0 device was removed from devicetree.cb, can you spot anything obvious there since it still gives the wifi PCI bus 0xfffffff issue and blocks the driver from loading?

Are the following tips/hacks applied to devicetree.cb and or *.asl files within the port its source code?

Ensure bridge 00:1c.2 is properly declared with subordinate bus
Define bridge window in _CRS method

The dsdt grep values PNP/RP are 1 and 4, which are the same as for the OEM dsdt. Is it allowed to post the OEM BIOS dsdt.dsl for further analysis?

Actions #4

Updated by Matt DeVillier 18 days ago

Walter Sonius wrote in #note-3:

Thanks for the comprehensive report, a fraction can be understood where Bus 01 claims a unlimited big space while it overlaps with part of Bus 00 already claimed MMIO space.

While I'm trying to understand the rest of the report I made another log set zbox-ci320nano-mmio-pm02-patch-no000.zip in which the 00.0 device was removed from devicetree.cb, can you spot anything obvious there since it still gives the wifi PCI bus 0xfffffff issue and blocks the driver from loading?

for some reason Linux doesn't see the PCIe RP on 1c.2 at all, which causes PCI bus 01 to not have a parent bridge, and the resources to conflict (since Linux is treating it as a peer rather than a subordinate). If I had to guess, it's because 1c.0 is being disabled, and you're not supposed to disable function 0 if there are other enabled functions (normally, you would remap 1c.2 to 1c.0).
I would probably add some more debug output to src/soc/intel/baytrail/pcie.c so we can see exactly what paths are being taken for each PCIe root port. definitely print the strap output and ensure that the PCIe bifurcation matches the layout of your board. It could be that the vendor BIOS was ignoring/overriding that strapping

Are the following tips/hacks applied to devicetree.cb and or *.asl files within the port its source code?

Ensure bridge 00:1c.2 is properly declared with subordinate bus
Define bridge window in _CRS method

those are addressed simply by removing the static declaration for the PCI bus in DT.

The dsdt grep values PNP/RP are 1 and 4, which are the same as for the OEM dsdt. Is it allowed to post the OEM BIOS dsdt.dsl for further analysis?

I don't believe this is an ACPI issue

Actions #5

Updated by Walter Sonius 18 days ago · Edited

Thanks for hinting this file src/soc/intel/baytrail/pcie.c, by looking at line 125 I now understand what you mend with bifurcation there are just 4 lanes available... it could be setup in a way by the vendor that its not using the original bus names/locations for each of the 4 root ports using 1 lane, so other options are available that may block other slots because of the use of more lanes for one slot...etc etc

After searching for reg_script_run I edited line 182 and 186 dev->enabled = 0; to dev->enabled = 1;. Now in the OS the 4 Rootports 1c.0-3 are listed with lspci and miniPCIe 1c.2 intel wifi works again and is correctly listed as PCI device 3 (with your recent MMIO 4G PM02 patch included).

However the onboard Realtek NIC is still not listed... but this is offcourse just still a hack. Besides these PCIe bus setup issue I'm starting to think the Realtek may also has some GPIO / resetpin issue itself?

Uploaded some more zbox-ci320nano-mmio-pm02-patch-force-pciec.zip logs to show this forced rootport enabling.

Actions #6

Updated by Matt DeVillier 18 days ago

After searching for reg_script_run I edited line 182 and 186 dev->enabled = 0; to dev->enabled = 1;. Now in the OS the 4 Rootports 1c.0-3 are listed with lspci and miniPCIe 1c.2 intel wifi works again and is correctly listed as PCI device 3 (with your recent MMIO 4G PM02 patch included).

that's great!

However the onboard Realtek NIC is still not listed... but this is of course just still a hack. Besides these PCIe bus setup issue I'm starting to think the Realtek may also has some GPIO / resetpin issue itself?

possibly, or a misconfigured CLK_REQ line. I see you have all 4 configured with 20k PU, try without - just use GPIO_FUNC1, for all 4

Actions #7

Updated by Walter Sonius 15 days ago · Edited

Altering the SCORE GPIO values 3-6 for CLK_REQ didn't make a difference, however I found some interesting logs on www.linux-hardware.org which remembered me of a BIOS update long long ago which may have altered the PCIe device numbering to its current location or maybe its a revision thing?

#device 16 see url
  SysFS ID: /devices/pci0000:00/0000:00:1c.0/0000:01:00.0
  SysFS BusID: 0000:01:00.0
  Hardware Class: network
  Model: "Realtek RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller"
  Vendor: pci 0x10ec "Realtek Semiconductor Co., Ltd."
  Device: pci 0x8168 "RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller"
  SubVendor: pci 0x19da "ZOTAC International (MCO) Ltd."
  SubDevice: pci 0x8168 
  Revision: 0x07
  Driver: "r8169"
  Driver Modules: "r8169"
  Device File: enp1s0

#device 15 see url
  SysFS ID: /devices/pci0000:00/0000:00:1c.1/0000:02:00.0
  SysFS BusID: 0000:02:00.0
  Hardware Class: network
  Model: "Realtek RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller"
  Vendor: pci 0x10ec "Realtek Semiconductor Co., Ltd."
  Device: pci 0x8168 "RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller"
  SubVendor: pci 0x19da "ZOTAC International (MCO) Ltd."
  SubDevice: pci 0x8168 
  Revision: 0x07
  Driver: "r8169"
  Driver Modules: "r8169"
  Device File: enp2s0

device 16
device 15

The coreboot Asrock H110M-DVS port has the SuperIO nuvoton GPIOs under suspicion for keeping the Realtek NIC in a permanent reset state. I know my port reuses the nct6776 code since the nct5577d share the same id but is really a smaller chip with less features. May try to alter those GPIO's and do some more superiotool logging to match it up with OEM values.

Actions

Also available in: Atom PDF