2010-09-06

Userspace access to PCI memory

Intro

When I start working on a new PCI device driver I generally go through a discovery phase of reading and writing to certain regsiters on the PCI card. Over the years I have written lots of small kernel modules to probe addresses within the PCI memory space, constantly iterating: modify code, recompile, scp to target, load module, unload module, dmesg.


Urk! There has to be a better way - sysfs and mmap() to the rescue.


Sysfs

Let's start at with the PCI files under sysfs:
bash# ls -l /sys/devices/pci0001\:00/0001\:00\:07.0/
total 0
-rw-r--r-- 1 root root     4096 Jul  2 20:13 broken_parity_status
lrwxrwxrwx 1 root root        0 Jul  2 20:13 bus -> ../../../bus/pci
-r--r--r-- 1 root root     4096 Jul  2 20:13 class
-rw-r--r-- 1 root root      256 Jul  2 20:13 config
-r--r--r-- 1 root root     4096 Jul  2 20:13 device
-r--r--r-- 1 root root     4096 Jul  2 20:13 devspec
-rw------- 1 root root     4096 Jul  2 20:13 enable
-r--r--r-- 1 root root     4096 Jul  2 20:13 irq
-r--r--r-- 1 root root     4096 Jul  2 20:13 local_cpus
-r--r--r-- 1 root root     4096 Jul  2 20:13 modalias
-rw-r--r-- 1 root root     4096 Jul  2 20:13 msi_bus
-r--r--r-- 1 root root     4096 Jul  2 20:13 resource
-rw------- 1 root root     4096 Jul  2 20:13 resource0
-rw------- 1 root root    65536 Jul  2 20:13 resource1
-rw------- 1 root root 16777216 Jul  2 20:13 resource2
lrwxrwxrwx 1 root root        0 Jul  2 20:13 subsystem -> ../../../bus/pci
-r--r--r-- 1 root root     4096 Jul  2 20:13 subsystem_device
-r--r--r-- 1 root root     4096 Jul  2 20:13 subsystem_vendor
-rw-r--r-- 1 root root     4096 Jul  2 20:13 uevent
-r--r--r-- 1 root root     4096 Jul  2 20:13 vendor

The vendor and device files report the PCI vendor ID and device ID:
bash# cat device
0x0001

This info is also available from lspci
bash# lspci -v
0001:00:07.0 Class 0680: Unknown device bec0:0001 (rev 01)
    Flags: bus master, 66MHz, medium devsel, latency 128, IRQ 31
    Memory at 8d010000 (32-bit, non-prefetchable) [size=4K]
    Memory at 8d000000 (32-bit, non-prefetchable) [size=64K]
    Memory at 8c000000 (32-bit, non-prefetchable) [size=16M]

This PCI card makes 3 separate regions of memory available to the host computer. The sysfs resource0 file corresponds to the first memory region. The PCI card lets the host computer know about these memory regions using the BAR registers in the PCI config.

mmap()

These sysfs resource can be used with mmap() to map the PCI memory into a userspace applications memory space. The application then has a pointer to the start of the PCI memory region and can read and write values directly. (There is a bit more going on here with respect to memory pointers, but that is all taken care of by the kernel).

fd = open("/sys/devices/pci0001\:00/0001\:00\:07.0/resource0", O_RDWR | O_SYNC);
ptr = mmap(0, 4096, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
printf("PCI BAR0 0x0000 = 0x%4x\n",  *((unsigned short *) ptr);

Utils

The utility application "pcimem" reads and writes single values within the PCI memory space.

bash# ./pcimem /sys/devices/pci0001\:00/0001\:00\:07.0/resource0 0 w

/sys/devices/pci0001:00/0001:00:07.0/resource0 opened.
Target offset is 0x0, page size is 4096
mmap(0, 4096, 0x3, 0x1, 3, 0x0)
PCI Memory mapped to address 0x4801f000.
Value at offset 0x0 (0x4801f000): 0xC0BE0100

Download the source: http://github.com/billfarrow/pcimem

PowerPC

To make this work on a PowerPC architecture you also need to make a small
change to the pci core. My example is from kernel 2.6.34, and hopefully this will be fixed for us in a later kernel version.

bash# vi arch/powerpc/kernel/pci-common.c

    /* If memory, add on the PCI bridge address offset */
     if (mmap_state == pci_mmap_mem) {
-#if 0 /* See comment in pci_resource_to_user() for why this is disabled */
+#if 1 /* See comment in pci_resource_to_user() for why this is disabled */
         *offset += hose->pci_mem_offset;
 #endif
         res_bit = IORESOURCE_MEM;

 
         /* We pass a fully fixed up address to userland for MMIO instead of
         * a BAR value because X is lame and expects to be able to use that
         * to pass to /dev/mem !
         *
         * That means that we'll have potentially 64 bits values where some
         * userland apps only expect 32 (like X itself since it thinks only
         * Sparc has 64 bits MMIO) but if we don't do that, we break it on
         * 32 bits CHRPs :-(
         *
         * Hopefully, the sysfs insterface is immune to that gunk. Once X
         * has been fixed (and the fix spread enough), we can re-enable the
         * 2 lines below and pass down a BAR value to userland. In that case
         * we'll also have to re-enable the matching code in
         * __pci_mmap_make_offset().
         *
         * BenH.
         */
-#if 0
+#if 1
        else if (rsrc->flags & IORESOURCE_MEM)
                offset = hose->pci_mem_offset;
#endif

11 comments:

  1. Very helpful knowledge. Thank you for sharing.

    ReplyDelete
  2. Very helpful knowledge. Thank you for sharing.

    ReplyDelete
  3. I keep getting a Input/Output error when I try to access the resource0 file for a PCI device, even after changing its permissions. Any ideas? thanks.

    ReplyDelete
    Replies
    1. This comment has been removed by the author.

      Delete
    2. Hi,
      Is it solved ? How can we change the permission ?Thanks

      Delete
    3. This I/O error could be due to a number of reasons and would have to be debugged on a case by case basis.

      Delete
  4. Thank you... your utility is exactly what I needed! Great work! Very much appreciated!

    ReplyDelete
  5. 1) Download the zip
    2) Extract and cd into the directory
    3) make
    4) ./pcimem /sys/bus/pci/devices/0000\:02\:00.0/resource0 0 w

    My pcie card is a Xilinx FPGA. Ubuntu put it in a slightly different location in sysfs... but this worked!

    ReplyDelete
  6. Kernel is 64bit and user space is 32bit.
    I have a physical address which is 64bit ( this is basically the
    address of a pci device - obtained by pci_find...).
    I am trying to mmap() this address in the userspace process (32bit).
    But I am getting EINVAL.
    If the process is 64bit then it works.

    Code Snippet

    kern_phy_address - 64bit

    fd = open64("/dev/mem", O_RDWR | O_SYNC);
    retval = mmap64(0, size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, addr);

    Any thoughts?

    ReplyDelete
  7. Hi, would you know how to do through sysfs the equivalent of this :
    setpci -s nn:nn COMMAND.B=0x07
    ?

    ReplyDelete