DF-5468 — vga_pci_map_bios() ROM path is dead: lazy pci_alloc_map()

misclassifies ROM BARs whose enable bit survives the sizing readback

vga_pci_map_bios() allocates the expansion-ROM resource with vga_pci_alloc_resource(dev, NULL, SYS_RES_MEMORY, &rid=PCIR_BIOS, 0, ~0, 1, RF_ACTIVE, -1) (sys/bus/pci/vga_pci.c:217). DF, unlike FreeBSD, never pre-reserves the ROM BAR in the device's resource list during enumeration (sys/bus/pci/pci.c:2720-2751 stop at BAR5), so the request falls into the lazy pci_alloc_map() (pci.c:4060), which performs the standard sizing dance:

pci_write_config(child, *rid, 0xffffffff, 4);   /* pci.c:3934 */
testval = pci_read_config(child, *rid, 4);      /* pci.c:3935 */

For a PCI expansion ROM BAR, bit 0 is the decode-enable bit and is RW, so a spec-conformant device (and QEMU's std VGA) reads back base_mask | 0x1 — empirically 0xffff0001 on the guest (see rombar_probe.sh and the DF-5467 serial log). pci_alloc_map() then runs

if (PCI_BAR_MEM(testval)) { ... } else {
    if (type != SYS_RES_IOPORT) { ...goto out; }   /* pci.c:3958-3965 */
}

with PCI_BAR_MEM(x) == ((x & PCIM_BAR_SPACE) == PCIM_BAR_MEM_SPACE) (pcireg.h:170-171) — the enable bit makes the ROM BAR look like an I/O BAR, the SYS_RES_MEMORY request is rejected, and vga_pci_map_bios() prints vga_pci_alloc_resource failed and returns NULL (vga_pci.c:220-223).

Consequences (functional, fails closed — no memory unsafety):

• On any device whose ROM BAR readback preserves bit 0, the ROM path of vga_pci_map_bios() can never succeed. Non-boot-display VBIOS reads by drm drivers (sys/dev/drm/radeon/radeon_bios.c:86 and the amdgpu/i915 equivalents) always fail and must fall back to other BIOS sources; the D3-reset dance and the 1s/3s poll loops in vga_pci_map_bios() are unreachable dead code on such hardware.
• The DF-5467 corruption chain is masked on exactly such hardware (the alloc fails before the map/unmap asymmetry can run); it is live on hardware whose ROM BAR readback masks bit 0 (and whenever the ROM BAR is pre-reserved, e.g. via resource hints).

Empirical proof on the guest: rombar_probe.sh — write 0xffffffff to reg 0x30 of pci0:0:2:0, read back 0xffff0001; restore. The unseeded df5467 KLD run shows vgapci0: vga_pci_alloc_resource failed (see ../DF-5467/serial-full.log lines around the first two run attempts).

Recommended fix

Either pre-reserve the ROM BAR during enumeration like FreeBSD, or make the lazy classifier ignore the ROM BAR's enable bit before testing the space type, e.g. in pci_alloc_map():

--- a/sys/bus/pci/pci.c
+++ b/sys/bus/pci/pci.c
@@
    res = NULL;
    map = pci_read_config(child, *rid, 4);
    pci_write_config(child, *rid, 0xffffffff, 4);
    testval = pci_read_config(child, *rid, 4);
+   if (*rid == PCIR_BIOS || *rid == PCIR_BIOS_1)
+       testval &= ~0x1;    /* ROM BAR bit 0 is decode-enable */
    if (pci_maprange(testval) == 64)

(and the same mask where PCI_BAR_MEM(testval) is evaluated at pci.c:3948).