LKML Archive on
help / color / mirror / Atom feed
From: Lorenzo Pieralisi <>
Cc: Lorenzo Pieralisi <>,
	Arnd Bergmann <>,
	Jesse Barnes <>,
	Bjorn Helgaas <>,
	Benjamin Herrenschmidt <>,
	Russell King <>,
	"David S. Miller" <>,
	Michal Simek <>,
	Martin Wilck <>,
	Linux PCI <>
Subject: [RFC PATCH v3 1/2] drivers: pci: fix pci_mmap_fits() implementation for procfs mmap
Date: Thu, 13 Nov 2014 11:19:15 +0000	[thread overview]
Message-ID: <> (raw)
In-Reply-To: <>

The introduction of pci_mmap_fits() in commit:

"Check mapped ranges on sysfs resource files"

allowed to check for valid range mappings of PCI resources to user space
when mapping PCI resources through the sysfs filesystem.

The mapping of resources through the sysfs expects the offset passed
by the user through the mmap syscall to be 0, and the pgoff is adjusted
by the kernel to memory map the resource to the CPU physical address
corresponding to the PCI resource in question.

The usage of procfs mapping of PCI resources (/proc/bus/pci files)
is more controversial in that userspace programs mapping PCI resources
are expected to pass in the mmap offset field either a CPU physical address
or a PCI bar value, depending on the architecture.

By the time pci_mmap_fits() was used to check PCI resource ranges for
procfs PCI resources mapping in commit:

"PCI: check mmap range of /proc/bus/pci files too"

the procfs interface for mmapping resources to user space broke, since
pci_mmap_fits() expected the offset passed from user space in the mmap
call to be 0, not the CPU physical address or PCI BAR value of the
resource in question.

Subsequent attempts at fixing the pci_mmap_fits() implementation failed
to fix the issue (or fixed the issue in some architectures but not for
all of them, ARM and SPARC procfs interface PCI resources mapping stayed
broken throughout) in particular commits:

"PCI: fix offset check for sysfs mmapped files"


"PCI: fix size checks for mmap() on /proc/bus/pci files"

fixed procfs PCI resources mapping checks in pci_mmap_fits for some
architectures, but not for architectures like SPARC that expects
the offset value passed from user space through the mmap syscall
(when mapping through procfs) to represent the PCI BAR value of the
resource to be mapped.

The reason behind the breakage is the following. The addresses stored
in PCI device resources for memory spaces correspond to CPU physical
addresses, which do not necessarily map 1:1 to PCI bus addresses as
programmed in PCI devices configuration spaces.

This implies that the sanity checks carried out in pci_mmap_fits() to
ensure that the user executes an mmap of a "real" pci resource are
erroneous when executed through procfs. Some platforms (ie SPARC)
expect the offset value to be passed in (procfs mapping) to be the
PCI BAR configuration value as read from the PCI device configuration
space, not the fixed-up CPU physical address that is present in PCI
device resources.

The required pgoff (offset in mmap syscall) value passed from userspace
is supposed to represent the resource value exported through
/proc/bus/pci/devices when the resource is mmapped though procfs (and 0
when the mapping is carried out through sysfs resource files), which
corresponds to the PCI resource filtered through the pci_resource_to_user()

This patch converts the PCI resource to the expected "user visible"
value through pci_resource_to_user() before carrying out sanity checks
in pci_mmap_fits() so that the check is carried out on the resource
values as expected from the userspace mmap API.

Cc: Arnd Bergmann <>
Cc: Jesse Barnes <>
Cc: Bjorn Helgaas <>
Cc: Benjamin Herrenschmidt <>
Cc: Russell King <>
Cc: David S. Miller <>
Cc: Michal Simek <>
Cc: Martin Wilck <>
Signed-off-by: Lorenzo Pieralisi <>
 drivers/pci/pci-sysfs.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index 2c6643f..e4634e3 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -963,17 +963,20 @@ void pci_remove_legacy_files(struct pci_bus *b)
 int pci_mmap_fits(struct pci_dev *pdev, int resno, struct vm_area_struct *vma,
 		  enum pci_mmap_api mmap_api)
-	unsigned long nr, start, size, pci_start;
+	unsigned long nr, start, size, pci_offset;
+	resource_size_t pci_start, pci_end;
 	if (pci_resource_len(pdev, resno) == 0)
 		return 0;
 	nr = vma_pages(vma);
 	start = vma->vm_pgoff;
+	pci_resource_to_user(pdev, resno, &pdev->resource[resno],
+			     &pci_start, &pci_end);
 	size = ((pci_resource_len(pdev, resno) - 1) >> PAGE_SHIFT) + 1;
-	pci_start = (mmap_api == PCI_MMAP_PROCFS) ?
-			pci_resource_start(pdev, resno) >> PAGE_SHIFT : 0;
-	if (start >= pci_start && start < pci_start + size &&
-			start + nr <= pci_start + size)
+	pci_offset = (mmap_api == PCI_MMAP_PROCFS) ?
+			pci_start >> PAGE_SHIFT : 0;
+	if (start >= pci_offset && start < pci_offset + size &&
+			start + nr <= pci_offset + size)
 		return 1;
 	return 0;

  reply	other threads:[~2014-11-13 11:19 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2014-11-13 11:19 [RFC PATCH v3 0/2] Fix procfs PCI resources mmap Lorenzo Pieralisi
2014-11-13 11:19 ` Lorenzo Pieralisi [this message]
2014-11-21 17:51   ` [RFC PATCH v3 1/2] drivers: pci: fix pci_mmap_fits() implementation for procfs mmap Bjorn Helgaas
2014-11-25 10:03     ` Lorenzo Pieralisi
2014-11-25 23:10     ` Benjamin Herrenschmidt
2015-01-21 18:44     ` Lorenzo Pieralisi
2015-01-23 23:58       ` Bjorn Helgaas
2014-11-13 11:19 ` [RFC PATCH v3 2/2] arm: kernel: fix pci_mmap_page_range() offset calculation Lorenzo Pieralisi
2015-01-23 23:59   ` Bjorn Helgaas
2015-01-26  9:57     ` Lorenzo Pieralisi
2014-11-19  9:57 ` [RFC PATCH v3 0/2] Fix procfs PCI resources mmap Lorenzo Pieralisi

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \ \ \ \ \ \ \
    --subject='Re: [RFC PATCH v3 1/2] drivers: pci: fix pci_mmap_fits() implementation for procfs mmap' \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).