[PATCH] PCI: mediatek-gen3: Fix 64-bit type truncation in mtk_pcie_set_trans_table()

[PATCH] PCI: mediatek-gen3: Fix 64-bit type truncation in mtk_pcie_set_trans_table()

[Sreeraj S Kurup]

The variables cpu_addr, pci_addr, and remaining in
mtk_pcie_set_trans_table() are of type resource_size_t, which is 64-bit
on 64-bit architectures.

Using 32-bit helpers fls(), ffs(), and BIT() causes 64-bit integer
truncation when computing window sizes and address alignments above
4GB.

Replace them with fls64(), ffs64(), and BIT_ULL() to ensure correct
64-bit types are used across the address space.

Signed-off-by: Sreeraj S Kurup <sreekuttan2156239@gmail.com>
---
 drivers/pci/controller/pcie-mediatek-gen3.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/pci/controller/pcie-mediatek-gen3.c b/drivers/pci/controller/pcie-mediatek-gen3.c
index bcbd08c82a5c..b1dc18f851d2 100644
--- a/drivers/pci/controller/pcie-mediatek-gen3.c
+++ b/drivers/pci/controller/pcie-mediatek-gen3.c
@@ -334,10 +334,10 @@ static int mtk_pcie_set_trans_table(struct mtk_gen3_pcie *pcie,
 
 	while (remaining && (*num < PCIE_MAX_TRANS_TABLES)) {
 		/* Table size needs to be a power of 2 */
-		table_size = BIT(fls(remaining) - 1);
+		table_size = BIT_ULL(fls64(remaining) - 1);
 
 		if (cpu_addr > 0) {
-			addr_align = BIT(ffs(cpu_addr) - 1);
+			addr_align = BIT_ULL(ffs64(cpu_addr) - 1);
 			table_size = min(table_size, addr_align);
 		}
 
@@ -349,7 +349,8 @@ static int mtk_pcie_set_trans_table(struct mtk_gen3_pcie *pcie,
 		}
 
 		table = pcie->base + PCIE_TRANS_TABLE_BASE_REG + *num * PCIE_ATR_TLB_SET_OFFSET;
-		writel_relaxed(lower_32_bits(cpu_addr) | PCIE_ATR_SIZE(fls(table_size) - 1), table);
+		writel_relaxed(lower_32_bits(cpu_addr) |
+				PCIE_ATR_SIZE(fls64(table_size) - 1), table);
 		writel_relaxed(upper_32_bits(cpu_addr), table + PCIE_ATR_SRC_ADDR_MSB_OFFSET);
 		writel_relaxed(lower_32_bits(pci_addr), table + PCIE_ATR_TRSL_ADDR_LSB_OFFSET);
 		writel_relaxed(upper_32_bits(pci_addr), table + PCIE_ATR_TRSL_ADDR_MSB_OFFSET);
-- 
2.54.0

Re: [PATCH] PCI: mediatek-gen3: Fix 64-bit type truncation in mtk_pcie_set_trans_table()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

New issues:
- [High] The patch replaces a 32-bit ffs() call with an undefined 64-bit function ffs64(), breaking the build. Furthermore, if trivially corrected to use the kernel's __ffs64(), it introduces a severe logic error due to 0-based indexing.

Pre-existing issues:
- [High] Silent failure when available PCIe translation tables are exhausted.
--

--- Patch [1]: [PATCH] PCI: mediatek-gen3: Fix 64-bit type truncation in mtk_pcie_set_trans_table() ---
commit 5abeef37aefeb0da627b6bdbff1cc75a0b1bd361
Author: Sreeraj S Kurup <sreekuttan2156239@gmail.com>

PCI: mediatek-gen3: Fix 64-bit type truncation in mtk_pcie_set_trans_table()

This commit updates address truncation calculations to use 64-bit helpers
like fls64() and BIT_ULL() to prevent truncation above 4GB.

> diff --git a/drivers/pci/controller/pcie-mediatek-gen3.c b/drivers/pci/controller/pcie-mediatek-gen3.c
> --- a/drivers/pci/controller/pcie-mediatek-gen3.c
> +++ b/drivers/pci/controller/pcie-mediatek-gen3.c

[ ... ]

> @@ -334,10 +334,10 @@ static int mtk_pcie_set_trans_table(struct mtk_gen3_pcie *pcie,
>  
>  	while (remaining && (*num < PCIE_MAX_TRANS_TABLES)) {
>  		/* Table size needs to be a power of 2 */
> -		table_size = BIT(fls(remaining) - 1);
> +		table_size = BIT_ULL(fls64(remaining) - 1);
>  
>  		if (cpu_addr > 0) {
> -			addr_align = BIT(ffs(cpu_addr) - 1);
> +			addr_align = BIT_ULL(ffs64(cpu_addr) - 1);

[Severity: High]
Does this introduce a build failure and a potential logic error?

The kernel does not provide an ffs64() macro, which seems like it will
cause an immediate build failure.

If this is trivially fixed by using the kernel's __ffs64(), wouldn't the 
0-based return value cause issues here? 

The original ffs() is 1-based, meaning ffs(cpu_addr) - 1 correctly calculates
the alignment shift.

With a 0-based __ffs64(cpu_addr) - 1, the shift could result in undefined
behavior by shifting by -1 if the first set bit is bit 0, or it could halve
the intended alignment requirement.

[ ... ]

>  		cpu_addr += table_size;
>  		pci_addr += table_size;
>  		remaining -= table_size;
>  		(*num)++;
>  	}
>  
>  	if (remaining)
>  		dev_warn(pcie->dev, "not enough translate table for addr: %#llx, limited to [%d]\n",
>  			 (unsigned long long)cpu_addr, PCIE_MAX_TRANS_TABLES);
>  
>  	return 0;
>  }

[Severity: High]
This is a pre-existing issue, but does this function silently fail when
translation tables are exhausted?

If remaining is greater than 0 and *num reaches PCIE_MAX_TRANS_TABLES,
the loop exits and a warning is printed, but the function returns 0.

Could this leave the hardware in a partially unmapped state, leading to
subsequent synchronous aborts when the unmapped PCIe windows are accessed?

Should this return an error code like -ENOMEM instead of 0 on resource
exhaustion?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260728101413.4575-1-sreekuttan2156239@gmail.com?part=1

Re: [PATCH] PCI: mediatek-gen3: Fix 64-bit type truncation in mtk_pcie_set_trans_table()

[kernel test robot]

Hi Sreeraj,

kernel test robot noticed the following build errors:

[auto build test ERROR on pci/next]
[also build test ERROR on pci/for-linus linus/master v7.2-rc6 next-20260803]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Sreeraj-S-Kurup/PCI-mediatek-gen3-Fix-64-bit-type-truncation-in-mtk_pcie_set_trans_table/20260728-183948
base:   https://git.kernel.org/pub/scm/linux/kernel/git/pci/pci.git next
patch link:    https://lore.kernel.org/r/20260728101413.4575-1-sreekuttan2156239%40gmail.com
patch subject: [PATCH] PCI: mediatek-gen3: Fix 64-bit type truncation in mtk_pcie_set_trans_table()
config: csky-allmodconfig (https://download.01.org/0day-ci/archive/20260805/202608050123.GZC7hug7-lkp@intel.com/config)
compiler: csky-linux-gcc (GCC) 16.1.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260805/202608050123.GZC7hug7-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202608050123.GZC7hug7-lkp@intel.com/

All errors (new ones prefixed by >>):

   In file included from include/linux/bits.h:5,
                    from include/linux/bitops.h:6,
                    from include/linux/kernel.h:23,
                    from include/linux/clk.h:13,
                    from drivers/pci/controller/pcie-mediatek-gen3.c:10:
   drivers/pci/controller/pcie-mediatek-gen3.c: In function 'mtk_pcie_set_trans_table':
>> drivers/pci/controller/pcie-mediatek-gen3.c:340:46: error: implicit declaration of function 'ffs64'; did you mean 'fls64'? [-Wimplicit-function-declaration]
     340 |                         addr_align = BIT_ULL(ffs64(cpu_addr) - 1);
         |                                              ^~~~~
   include/vdso/bits.h:8:45: note: in definition of macro 'BIT_ULL'
       8 | #define BIT_ULL(nr)             (ULL(1) << (nr))
         |                                             ^~


vim +340 drivers/pci/controller/pcie-mediatek-gen3.c

   321	
   322	static int mtk_pcie_set_trans_table(struct mtk_gen3_pcie *pcie,
   323					    resource_size_t cpu_addr,
   324					    resource_size_t pci_addr,
   325					    resource_size_t size,
   326					    unsigned long type, int *num)
   327	{
   328		resource_size_t remaining = size;
   329		resource_size_t table_size;
   330		resource_size_t addr_align;
   331		const char *range_type;
   332		void __iomem *table;
   333		u32 val;
   334	
   335		while (remaining && (*num < PCIE_MAX_TRANS_TABLES)) {
   336			/* Table size needs to be a power of 2 */
   337			table_size = BIT_ULL(fls64(remaining) - 1);
   338	
   339			if (cpu_addr > 0) {
 > 340				addr_align = BIT_ULL(ffs64(cpu_addr) - 1);
   341				table_size = min(table_size, addr_align);
   342			}
   343	
   344			/* Minimum size of translate table is 4KiB */
   345			if (table_size < 0x1000) {
   346				dev_err(pcie->dev, "illegal table size %#llx\n",
   347					(unsigned long long)table_size);
   348				return -EINVAL;
   349			}
   350	
   351			table = pcie->base + PCIE_TRANS_TABLE_BASE_REG + *num * PCIE_ATR_TLB_SET_OFFSET;
   352			writel_relaxed(lower_32_bits(cpu_addr) |
   353					PCIE_ATR_SIZE(fls64(table_size) - 1), table);
   354			writel_relaxed(upper_32_bits(cpu_addr), table + PCIE_ATR_SRC_ADDR_MSB_OFFSET);
   355			writel_relaxed(lower_32_bits(pci_addr), table + PCIE_ATR_TRSL_ADDR_LSB_OFFSET);
   356			writel_relaxed(upper_32_bits(pci_addr), table + PCIE_ATR_TRSL_ADDR_MSB_OFFSET);
   357	
   358			if (type == IORESOURCE_IO) {
   359				val = PCIE_ATR_TYPE_IO | PCIE_ATR_TLP_TYPE_IO;
   360				range_type = "IO";
   361			} else {
   362				val = PCIE_ATR_TYPE_MEM | PCIE_ATR_TLP_TYPE_MEM;
   363				range_type = "MEM";
   364			}
   365	
   366			writel_relaxed(val, table + PCIE_ATR_TRSL_PARAM_OFFSET);
   367	
   368			dev_dbg(pcie->dev, "set %s trans window[%d]: cpu_addr = %#llx, pci_addr = %#llx, size = %#llx\n",
   369				range_type, *num, (unsigned long long)cpu_addr,
   370				(unsigned long long)pci_addr,
   371				(unsigned long long)table_size);
   372	
   373			cpu_addr += table_size;
   374			pci_addr += table_size;
   375			remaining -= table_size;
   376			(*num)++;
   377		}
   378	
   379		if (remaining)
   380			dev_warn(pcie->dev, "not enough translate table for addr: %#llx, limited to [%d]\n",
   381				 (unsigned long long)cpu_addr, PCIE_MAX_TRANS_TABLES);
   382	
   383		return 0;
   384	}
   385	

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH] PCI: mediatek-gen3: Fix 64-bit type truncation in mtk_pcie_set_trans_table()

[Sreeraj S Kurup]

Hi,

Thanks for the report. This build error was caused by an invalid function call in v1 and has been fixed in v3:
https://lore.kernel.org/all/20260728122810.3475-1-sreekuttan2156239@gmail.com/

Thanks,
Sreeraj