[PATCH RFC 1/2] drivers: pci: fix pci_mmap_fits() implementation for procfs mmap

[Lorenzo Pieralisi]

The addresses stored in PCI device resources for memory spaces
correspond to CPU physical addresses, which do not necessarily
map 1:1 to PCI bus addresses as programmed in PCI devices configuration
spaces.

Therefore, the changes applied by commits:

8c05cd08a7504b855c26526
3b519e4ea618b6943a82931

imply that the sanity checks carried out in pci_mmap_fits() to
ensure that the user executes an mmap of a "real" pci resource are
erroneous when executed through procfs. Some platforms (ie SPARC)
expect the offset value to be passed in (procfs mapping) to be the
PCI BAR configuration value as read from the PCI device configuration
space, not the fixed-up CPU physical address that is present in PCI
device resources.

The required pgoff (offset in mmap syscall) value passed from userspace
is supposed to represent the resource value exported through
/proc/bus/pci/devices when the resource is mmapped though procfs (and 0
when the mapping is carried out through sysfs resource files), which
corresponds to the PCI resource filtered through the pci_resource_to_user()
API.

This patch converts the PCI resource to the expected "user visible"
value through pci_resource_to_user() before carrying out sanity checks
in pci_mmap_fits() so that the check is carried out on the resource
values as expected from the userspace mmap API.

Cc: Arnd Bergmann <***@arndb.de>
Cc: Bjorn Helgaas <***@google.com>
Cc: Benjamin Herrenschmidt <***@kernel.crashing.org>
Cc: Russell King <***@arm.linux.org.uk>
Cc: David S. Miller <***@davemloft.net>
Cc: Michal Simek <***@monstr.eu>
Cc: Martin Wilck <***@ts.fujitsu.com>
Cc: Derrick J. Wong <***@us.ibm.com>
Signed-off-by: Lorenzo Pieralisi <***@arm.com>
---
drivers/pci/pci-sysfs.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index 92b6d9a..777d8bc 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -963,17 +963,20 @@ void pci_remove_legacy_files(struct pci_bus *b)
int pci_mmap_fits(struct pci_dev *pdev, int resno, struct vm_area_struct *vma,
enum pci_mmap_api mmap_api)
{
- unsigned long nr, start, size, pci_start;
+ unsigned long nr, start, size, pci_offset;
+ resource_size_t pci_start, pci_end;

if (pci_resource_len(pdev, resno) == 0)
return 0;
nr = vma_pages(vma);
start = vma->vm_pgoff;
+ pci_resource_to_user(pdev, resno, &pdev->resource[resno],
+ &pci_start, &pci_end);
size = ((pci_resource_len(pdev, resno) - 1) >> PAGE_SHIFT) + 1;
- pci_start = (mmap_api == PCI_MMAP_PROCFS) ?
- pci_resource_start(pdev, resno) >> PAGE_SHIFT : 0;
- if (start >= pci_start && start < pci_start + size &&
- start + nr <= pci_start + size)
+ pci_offset = (mmap_api == PCI_MMAP_PROCFS) ?
+ pci_start >> PAGE_SHIFT : 0;
+ if (start >= pci_offset && start < pci_offset + size &&
+ start + nr <= pci_offset + size)
return 1;
return 0;
}

[Lorenzo Pieralisi]

The pci_mmap_page_range() API should be written to expect offset
values representing PCI memory resource addresses as seen by user space,
through the pci_resource_to_user() API.

ARM relies on the standard implementation of pci_resource_to_user()
which actually is an identity map and exports to user space
PCI memory resources as they are stored in PCI devices resources (ie BARs)
which represent CPU physical addresses (fixed-up using BUS to CPU
address conversions) not PCI bus addresses.

On platforms where the mapping between CPU and BUS address is not a 1:1
mapping this is erroneous, in that an additional shift is applied to
an already fixed-up offset passed from userspace.

Hence, this patch removes the mem_offset from the pgoff calculation
since the offset as passed from user space already represents
the CPU physical address corresponding to the resource to be mapped,
ie no additional offset should be applied.

Cc: Arnd Bergmann <***@arndb.de>
Cc: Russell King <***@arm.linux.org.uk>
Signed-off-by: Lorenzo Pieralisi <***@arm.com>
---
arch/arm/kernel/bios32.c | 10 ++--------
1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/arch/arm/kernel/bios32.c b/arch/arm/kernel/bios32.c
index 17a26c1..b56fa2d 100644
--- a/arch/arm/kernel/bios32.c
+++ b/arch/arm/kernel/bios32.c
@@ -626,21 +626,15 @@ int pcibios_enable_device(struct pci_dev *dev, int mask)
int pci_mmap_page_range(struct pci_dev *dev, struct vm_area_struct *vma,
enum pci_mmap_state mmap_state, int write_combine)
{
- struct pci_sys_data *root = dev->sysdata;
- unsigned long phys;
-
- if (mmap_state == pci_mmap_io) {
+ if (mmap_state == pci_mmap_io)
return -EINVAL;
- } else {
- phys = vma->vm_pgoff + (root->mem_offset >> PAGE_SHIFT);
- }

/*
* Mark this as IO
*/
vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);

- if (remap_pfn_range(vma, vma->vm_start, phys,
+ if (remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff,
vma->vm_end - vma->vm_start,
vma->vm_page_prot))
return -EAGAIN;

[Russell King - ARM Linux]

Post by Lorenzo Pieralisi
ARM relies on the standard implementation of pci_resource_to_user()
which actually is an identity map and exports to user space
PCI memory resources as they are stored in PCI devices resources (ie BARs)
which represent CPU physical addresses (fixed-up using BUS to CPU
address conversions) not PCI bus addresses.

This paragraph seems wrong.

It first says that PCI memory resources contain the same values that the
PCI device has in its BAR. It then goes on to say that they are CPU
physical addresses. That is not true.

For example, DC21285 systems always have done this as: the PCI bars
contain the _bus_ addresses, which tend to be in the range 0 to
0x7fffffff. These correspond with a CPU physical address of
0x80000000 to 0xffffffff. The PCI bus resources for IOMEM resources
contains the CPU physical address of the mapping.

Post by Lorenzo Pieralisi
On platforms where the mapping between CPU and BUS address is not a 1:1
mapping this is erroneous, in that an additional shift is applied to
an already fixed-up offset passed from userspace.

Yes, I think this is a correct patch inspite of the description. :)

[Lorenzo Pieralisi]

Hi Russell,

thanks for having a look.

Post by Russell King - ARM Linux

Post by Lorenzo Pieralisi
ARM relies on the standard implementation of pci_resource_to_user()
which actually is an identity map and exports to user space
PCI memory resources as they are stored in PCI devices resources (ie BARs)
which represent CPU physical addresses (fixed-up using BUS to CPU
address conversions) not PCI bus addresses.

This paragraph seems wrong.
It first says that PCI memory resources contain the same values that the
PCI device has in its BAR. It then goes on to say that they are CPU
physical addresses. That is not true.
For example, DC21285 systems always have done this as: the PCI bars
contain the _bus_ addresses, which tend to be in the range 0 to
0x7fffffff. These correspond with a CPU physical address of
0x80000000 to 0xffffffff. The PCI bus resources for IOMEM resources
contains the CPU physical address of the mapping.

It is a commit log wording problem, I exactly meant what you said, I
will reword it (or remove "ie BARs" from it, since it is misleading).

I think that the word "BAR" is a bit misused in helpers function like:

pci_resource_{start/end/len}

too but as long as we all know what that means (and I write proper
commit logs :)) it is all fine.

Post by Russell King - ARM Linux

Post by Lorenzo Pieralisi
On platforms where the mapping between CPU and BUS address is not a 1:1
mapping this is erroneous, in that an additional shift is applied to
an already fixed-up offset passed from userspace.

Yes, I think this is a correct patch inspite of the description. :)

Great, I will reword it and wait for comments on patch 1 that changes
pci_mmap_fits() (it does not affect ARM, but would like to get both changes
in coherently - ie if I am asked to change patch 1 I will probably have
to change this patch too).

Thanks,
Lorenzo