[PATCH] ARM: expand fixmap region to 3MB

[PATCH] ARM: expand fixmap region to 3MB

[Rob Herring]

From: Rob Herring <robh@kernel.org>

With commit a05e54c103b0b8 "ARM: 8031/2: change fixmap mapping region to
support 32 CPUs", the fixmap region was expanded to 2MB, but it
precluded any other uses of the fixmap region in order to support up to
32 CPUs. In order to support other uses the fixmap region needs to be
expanded beyond 2MB. Fortunately, the adjacent 1MB range
0xffe00000-0xfff00000 is availabe to use.

Remove fixmap_page_table ptr and lookup the page table via the virtual
address so that the fixmap region can span more that one pmd. The 2nd
pmd is already created since it is shared with the vector page.

Cc: Leif Lindholm <leif.lindholm@linaro.org>
Cc: Kees Cook <keescook@chromium.org>
Cc: Russell King <linux@arm.linux.org.uk>
Signed-off-by: Rob Herring <robh@kernel.org>
---

This patch can come before or after the generic fixmap.h. There's a 
single line conflict with the ending address 

This worked for earlycon, but I've not done any highmem specific 
testing. My full series is available here:

git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux.git fixmap

Rob

 Documentation/arm/memory.txt  |  2 +-
 arch/arm/include/asm/fixmap.h |  2 +-
 arch/arm/mm/highmem.c         | 15 ++++++++-------
 arch/arm/mm/mmu.c             |  2 +-
 4 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/Documentation/arm/memory.txt b/Documentation/arm/memory.txt
index 38dc06d..4178ebd 100644
--- a/Documentation/arm/memory.txt
+++ b/Documentation/arm/memory.txt
@@ -41,7 +41,7 @@ fffe8000	fffeffff	DTCM mapping area for platforms with
 fffe0000	fffe7fff	ITCM mapping area for platforms with
 				ITCM mounted inside the CPU.
 
-ffc00000	ffdfffff	Fixmap mapping region.  Addresses provided
+ffc00000	ffefffff	Fixmap mapping region.  Addresses provided
 				by fix_to_virt() will be located here.
 
 fee00000	feffffff	Mapping of PCI I/O space. This is a static
diff --git a/arch/arm/include/asm/fixmap.h b/arch/arm/include/asm/fixmap.h
index 74124b0..cb50cee 100644
--- a/arch/arm/include/asm/fixmap.h
+++ b/arch/arm/include/asm/fixmap.h
@@ -2,7 +2,7 @@
 #define _ASM_FIXMAP_H
 
 #define FIXADDR_START		0xffc00000UL
-#define FIXADDR_TOP		0xffe00000UL
+#define FIXADDR_TOP		0xfff00000UL
 #define FIXADDR_SIZE		(FIXADDR_TOP - FIXADDR_START)
 
 #define FIX_KMAP_NR_PTES	(FIXADDR_SIZE >> PAGE_SHIFT)
diff --git a/arch/arm/mm/highmem.c b/arch/arm/mm/highmem.c
index 45aeaac..ac2938f 100644
--- a/arch/arm/mm/highmem.c
+++ b/arch/arm/mm/highmem.c
@@ -18,19 +18,20 @@
 #include <asm/tlbflush.h>
 #include "mm.h"
 
-pte_t *fixmap_page_table;
-
 static inline void set_fixmap_pte(int idx, pte_t pte)
 {
 	unsigned long vaddr = __fix_to_virt(idx);
-	set_pte_ext(fixmap_page_table + idx, pte, 0);
+	pte_t *ptep = pte_offset_kernel(pmd_off_k(vaddr), vaddr);
+
+	set_pte_ext(ptep, pte, 0);
 	local_flush_tlb_kernel_page(vaddr);
 }
 
 static inline pte_t get_fixmap_pte(unsigned long vaddr)
 {
-	unsigned long idx = __virt_to_fix(vaddr);
-	return *(fixmap_page_table + idx);
+	pte_t *ptep = pte_offset_kernel(pmd_off_k(vaddr), vaddr);
+
+	return *ptep;
 }
 
 void *kmap(struct page *page)
@@ -84,7 +85,7 @@ void *kmap_atomic(struct page *page)
 	 * With debugging enabled, kunmap_atomic forces that entry to 0.
 	 * Make sure it was indeed properly unmapped.
 	 */
-	BUG_ON(!pte_none(*(fixmap_page_table + idx)));
+	BUG_ON(!pte_none(*get_fixmap_pte(vaddr)));
 #endif
 	/*
 	 * When debugging is off, kunmap_atomic leaves the previous mapping
@@ -134,7 +135,7 @@ void *kmap_atomic_pfn(unsigned long pfn)
 	idx = type + KM_TYPE_NR * smp_processor_id();
 	vaddr = __fix_to_virt(idx);
 #ifdef CONFIG_DEBUG_HIGHMEM
-	BUG_ON(!pte_none(*(fixmap_page_table + idx)));
+	BUG_ON(!pte_none(*get_fixmap_pte(vaddr)));
 #endif
 	set_fixmap_pte(idx, pfn_pte(pfn, kmap_prot));
 
diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index 8348ed6..5e5d0ba 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -1327,7 +1327,7 @@ static void __init kmap_init(void)
 	pkmap_page_table = early_pte_alloc(pmd_off_k(PKMAP_BASE),
 		PKMAP_BASE, _PAGE_KERNEL_TABLE);
 
-	fixmap_page_table = early_pte_alloc(pmd_off_k(FIXADDR_START),
+	early_pte_alloc(pmd_off_k(FIXADDR_START),
 		FIXADDR_START, _PAGE_KERNEL_TABLE);
 #endif
 }
-- 
1.9.1

[PATCH] ARM: expand fixmap region to 3MB

[Nicolas Pitre]

On Fri, 8 Aug 2014, Rob Herring wrote:

> From: Rob Herring <robh@kernel.org>
> 
> With commit a05e54c103b0b8 "ARM: 8031/2: change fixmap mapping region to
> support 32 CPUs", the fixmap region was expanded to 2MB, but it
> precluded any other uses of the fixmap region in order to support up to
> 32 CPUs. In order to support other uses the fixmap region needs to be
> expanded beyond 2MB. Fortunately, the adjacent 1MB range
> 0xffe00000-0xfff00000 is availabe to use.
> 
> Remove fixmap_page_table ptr and lookup the page table via the virtual
> address so that the fixmap region can span more that one pmd. The 2nd
> pmd is already created since it is shared with the vector page.
> 
> Cc: Leif Lindholm <leif.lindholm@linaro.org>
> Cc: Kees Cook <keescook@chromium.org>
> Cc: Russell King <linux@arm.linux.org.uk>
> Signed-off-by: Rob Herring <robh@kernel.org>

Acked-by: Nicolas Pitre <nico@linaro.org>


> ---
> 
> This patch can come before or after the generic fixmap.h. There's a 
> single line conflict with the ending address 
> 
> This worked for earlycon, but I've not done any highmem specific 
> testing. My full series is available here:
> 
> git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux.git fixmap
> 
> Rob
> 
>  Documentation/arm/memory.txt  |  2 +-
>  arch/arm/include/asm/fixmap.h |  2 +-
>  arch/arm/mm/highmem.c         | 15 ++++++++-------
>  arch/arm/mm/mmu.c             |  2 +-
>  4 files changed, 11 insertions(+), 10 deletions(-)
> 
> diff --git a/Documentation/arm/memory.txt b/Documentation/arm/memory.txt
> index 38dc06d..4178ebd 100644
> --- a/Documentation/arm/memory.txt
> +++ b/Documentation/arm/memory.txt
> @@ -41,7 +41,7 @@ fffe8000	fffeffff	DTCM mapping area for platforms with
>  fffe0000	fffe7fff	ITCM mapping area for platforms with
>  				ITCM mounted inside the CPU.
>  
> -ffc00000	ffdfffff	Fixmap mapping region.  Addresses provided
> +ffc00000	ffefffff	Fixmap mapping region.  Addresses provided
>  				by fix_to_virt() will be located here.
>  
>  fee00000	feffffff	Mapping of PCI I/O space. This is a static
> diff --git a/arch/arm/include/asm/fixmap.h b/arch/arm/include/asm/fixmap.h
> index 74124b0..cb50cee 100644
> --- a/arch/arm/include/asm/fixmap.h
> +++ b/arch/arm/include/asm/fixmap.h
> @@ -2,7 +2,7 @@
>  #define _ASM_FIXMAP_H
>  
>  #define FIXADDR_START		0xffc00000UL
> -#define FIXADDR_TOP		0xffe00000UL
> +#define FIXADDR_TOP		0xfff00000UL
>  #define FIXADDR_SIZE		(FIXADDR_TOP - FIXADDR_START)
>  
>  #define FIX_KMAP_NR_PTES	(FIXADDR_SIZE >> PAGE_SHIFT)
> diff --git a/arch/arm/mm/highmem.c b/arch/arm/mm/highmem.c
> index 45aeaac..ac2938f 100644
> --- a/arch/arm/mm/highmem.c
> +++ b/arch/arm/mm/highmem.c
> @@ -18,19 +18,20 @@
>  #include <asm/tlbflush.h>
>  #include "mm.h"
>  
> -pte_t *fixmap_page_table;
> -
>  static inline void set_fixmap_pte(int idx, pte_t pte)
>  {
>  	unsigned long vaddr = __fix_to_virt(idx);
> -	set_pte_ext(fixmap_page_table + idx, pte, 0);
> +	pte_t *ptep = pte_offset_kernel(pmd_off_k(vaddr), vaddr);
> +
> +	set_pte_ext(ptep, pte, 0);
>  	local_flush_tlb_kernel_page(vaddr);
>  }
>  
>  static inline pte_t get_fixmap_pte(unsigned long vaddr)
>  {
> -	unsigned long idx = __virt_to_fix(vaddr);
> -	return *(fixmap_page_table + idx);
> +	pte_t *ptep = pte_offset_kernel(pmd_off_k(vaddr), vaddr);
> +
> +	return *ptep;
>  }
>  
>  void *kmap(struct page *page)
> @@ -84,7 +85,7 @@ void *kmap_atomic(struct page *page)
>  	 * With debugging enabled, kunmap_atomic forces that entry to 0.
>  	 * Make sure it was indeed properly unmapped.
>  	 */
> -	BUG_ON(!pte_none(*(fixmap_page_table + idx)));
> +	BUG_ON(!pte_none(*get_fixmap_pte(vaddr)));
>  #endif
>  	/*
>  	 * When debugging is off, kunmap_atomic leaves the previous mapping
> @@ -134,7 +135,7 @@ void *kmap_atomic_pfn(unsigned long pfn)
>  	idx = type + KM_TYPE_NR * smp_processor_id();
>  	vaddr = __fix_to_virt(idx);
>  #ifdef CONFIG_DEBUG_HIGHMEM
> -	BUG_ON(!pte_none(*(fixmap_page_table + idx)));
> +	BUG_ON(!pte_none(*get_fixmap_pte(vaddr)));
>  #endif
>  	set_fixmap_pte(idx, pfn_pte(pfn, kmap_prot));
>  
> diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
> index 8348ed6..5e5d0ba 100644
> --- a/arch/arm/mm/mmu.c
> +++ b/arch/arm/mm/mmu.c
> @@ -1327,7 +1327,7 @@ static void __init kmap_init(void)
>  	pkmap_page_table = early_pte_alloc(pmd_off_k(PKMAP_BASE),
>  		PKMAP_BASE, _PAGE_KERNEL_TABLE);
>  
> -	fixmap_page_table = early_pte_alloc(pmd_off_k(FIXADDR_START),
> +	early_pte_alloc(pmd_off_k(FIXADDR_START),
>  		FIXADDR_START, _PAGE_KERNEL_TABLE);
>  #endif
>  }
> -- 
> 1.9.1
> 
> 

[PATCH] ARM: expand fixmap region to 3MB

[Leif Lindholm]

On Fri, Aug 08, 2014 at 10:23:24AM -0500, Rob Herring wrote:
> From: Rob Herring <robh@kernel.org>
> 
> With commit a05e54c103b0b8 "ARM: 8031/2: change fixmap mapping region to
> support 32 CPUs", the fixmap region was expanded to 2MB, but it
> precluded any other uses of the fixmap region in order to support up to
> 32 CPUs. In order to support other uses the fixmap region needs to be
> expanded beyond 2MB. Fortunately, the adjacent 1MB range
> 0xffe00000-0xfff00000 is availabe to use.
> 
> Remove fixmap_page_table ptr and lookup the page table via the virtual
> address so that the fixmap region can span more that one pmd. The 2nd
> pmd is already created since it is shared with the vector page.
> 
> Cc: Leif Lindholm <leif.lindholm@linaro.org>
> Cc: Kees Cook <keescook@chromium.org>
> Cc: Russell King <linux@arm.linux.org.uk>
> Signed-off-by: Rob Herring <robh@kernel.org>
> ---
> 
> This patch can come before or after the generic fixmap.h. There's a 
> single line conflict with the ending address 

Tested-by: Leif Lindholm <leif.lindholm@linaro.org>
For Kees' set with this addition + generic fixmap + early_ioremap +
UEFI.
 
> This worked for earlycon, but I've not done any highmem specific 
> testing. My full series is available here:
> 
> git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux.git fixmap

I was hoping to be able to give you a tested-by for that series on
next-20140811 with the UEFI patches, but that setup fails to boot
right now. Looking into why.

/
    Leif

[PATCH] ARM: expand fixmap region to 3MB

[Rob Herring]

On Mon, Aug 11, 2014 at 11:14 AM, Leif Lindholm
<leif.lindholm@linaro.org> wrote:
> On Fri, Aug 08, 2014 at 10:23:24AM -0500, Rob Herring wrote:
>> From: Rob Herring <robh@kernel.org>
>>
>> With commit a05e54c103b0b8 "ARM: 8031/2: change fixmap mapping region to
>> support 32 CPUs", the fixmap region was expanded to 2MB, but it
>> precluded any other uses of the fixmap region in order to support up to
>> 32 CPUs. In order to support other uses the fixmap region needs to be
>> expanded beyond 2MB. Fortunately, the adjacent 1MB range
>> 0xffe00000-0xfff00000 is availabe to use.
>>
>> Remove fixmap_page_table ptr and lookup the page table via the virtual
>> address so that the fixmap region can span more that one pmd. The 2nd
>> pmd is already created since it is shared with the vector page.
>>
>> Cc: Leif Lindholm <leif.lindholm@linaro.org>
>> Cc: Kees Cook <keescook@chromium.org>
>> Cc: Russell King <linux@arm.linux.org.uk>
>> Signed-off-by: Rob Herring <robh@kernel.org>
>> ---
>>
>> This patch can come before or after the generic fixmap.h. There's a
>> single line conflict with the ending address
>
> Tested-by: Leif Lindholm <leif.lindholm@linaro.org>
> For Kees' set with this addition + generic fixmap + early_ioremap +
> UEFI.
>
>> This worked for earlycon, but I've not done any highmem specific
>> testing. My full series is available here:
>>
>> git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux.git fixmap
>
> I was hoping to be able to give you a tested-by for that series on
> next-20140811 with the UEFI patches, but that setup fails to boot
> right now. Looking into why.

Doing early ioremap as well I guess? It may be that 2 page tables are
not getting setup early as earlycon would use one end of the region
and early_ioremap uses the other end.

Rob

[PATCH] ARM: expand fixmap region to 3MB

[Kees Cook]

On Mon, Aug 11, 2014 at 9:14 AM, Leif Lindholm <leif.lindholm@linaro.org> wrote:
> On Fri, Aug 08, 2014 at 10:23:24AM -0500, Rob Herring wrote:
>> From: Rob Herring <robh@kernel.org>
>>
>> With commit a05e54c103b0b8 "ARM: 8031/2: change fixmap mapping region to
>> support 32 CPUs", the fixmap region was expanded to 2MB, but it
>> precluded any other uses of the fixmap region in order to support up to
>> 32 CPUs. In order to support other uses the fixmap region needs to be
>> expanded beyond 2MB. Fortunately, the adjacent 1MB range
>> 0xffe00000-0xfff00000 is availabe to use.
>>
>> Remove fixmap_page_table ptr and lookup the page table via the virtual
>> address so that the fixmap region can span more that one pmd. The 2nd
>> pmd is already created since it is shared with the vector page.
>>
>> Cc: Leif Lindholm <leif.lindholm@linaro.org>
>> Cc: Kees Cook <keescook@chromium.org>
>> Cc: Russell King <linux@arm.linux.org.uk>
>> Signed-off-by: Rob Herring <robh@kernel.org>
>> ---
>>
>> This patch can come before or after the generic fixmap.h. There's a
>> single line conflict with the ending address
>
> Tested-by: Leif Lindholm <leif.lindholm@linaro.org>
> For Kees' set with this addition + generic fixmap + early_ioremap +
> UEFI.
>
>> This worked for earlycon, but I've not done any highmem specific
>> testing. My full series is available here:
>>
>> git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux.git fixmap
>
> I was hoping to be able to give you a tested-by for that series on
> next-20140811 with the UEFI patches, but that setup fails to boot
> right now. Looking into why.

For me, the 3MB change doesn't work. It acts like the PTE isn't there:

lkdtm: Performing direct entry WRITE_KERN
lkdtm: attempting 52 byte write at 804331cc
lkdtm: 804331cc mapped RW via ffe7f1cc
Unable to handle kernel paging request at virtual address ffe7f1cc
pgd = 9ea40000
[ffe7f1cc] *pgd=9fffd821, *pte=00000000, *ppte=00000000

And it weirdly leaves this hanging around in
/sys/kernel/debug/kernel_page_tables:

0xffc7f000-0xffc80000           4K     RW NX SHD MEM/CACHED/WBWA

If I use all the other changes to clean up the code, everything is
fine. The only change I have been the trees now is just this:

-#define FIXADDR_END            0xffe00000UL
+#define FIXADDR_END            0xfff00000UL

I think my build isn't catching this extra area via the vector table pmd.

So, instead of continuing to beat my head against this, I've changed
my series around to use NR_CPUS as Rob was doing, and added
BUILD_BUG_ON to check the fixmap size. The result is that there will
be a build-time limit on the number of CPUs, rather than surprising
run-time problems.

I will repost the series in a moment.

-- 
Kees Cook
Chrome OS Security

[PATCH] ARM: expand fixmap region to 3MB

[Rob Herring]

On Tue, Aug 12, 2014 at 12:55 PM, Kees Cook <keescook@chromium.org> wrote:
> On Mon, Aug 11, 2014 at 9:14 AM, Leif Lindholm <leif.lindholm@linaro.org> wrote:
>> On Fri, Aug 08, 2014 at 10:23:24AM -0500, Rob Herring wrote:
>>> From: Rob Herring <robh@kernel.org>
>>>
>>> With commit a05e54c103b0b8 "ARM: 8031/2: change fixmap mapping region to
>>> support 32 CPUs", the fixmap region was expanded to 2MB, but it
>>> precluded any other uses of the fixmap region in order to support up to
>>> 32 CPUs. In order to support other uses the fixmap region needs to be
>>> expanded beyond 2MB. Fortunately, the adjacent 1MB range
>>> 0xffe00000-0xfff00000 is availabe to use.
>>>
>>> Remove fixmap_page_table ptr and lookup the page table via the virtual
>>> address so that the fixmap region can span more that one pmd. The 2nd
>>> pmd is already created since it is shared with the vector page.
>>>
>>> Cc: Leif Lindholm <leif.lindholm@linaro.org>
>>> Cc: Kees Cook <keescook@chromium.org>
>>> Cc: Russell King <linux@arm.linux.org.uk>
>>> Signed-off-by: Rob Herring <robh@kernel.org>
>>> ---
>>>
>>> This patch can come before or after the generic fixmap.h. There's a
>>> single line conflict with the ending address
>>
>> Tested-by: Leif Lindholm <leif.lindholm@linaro.org>
>> For Kees' set with this addition + generic fixmap + early_ioremap +
>> UEFI.
>>
>>> This worked for earlycon, but I've not done any highmem specific
>>> testing. My full series is available here:
>>>
>>> git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux.git fixmap
>>
>> I was hoping to be able to give you a tested-by for that series on
>> next-20140811 with the UEFI patches, but that setup fails to boot
>> right now. Looking into why.
>
> For me, the 3MB change doesn't work. It acts like the PTE isn't there:
>
> lkdtm: Performing direct entry WRITE_KERN
> lkdtm: attempting 52 byte write at 804331cc
> lkdtm: 804331cc mapped RW via ffe7f1cc
> Unable to handle kernel paging request at virtual address ffe7f1cc
> pgd = 9ea40000
> [ffe7f1cc] *pgd=9fffd821, *pte=00000000, *ppte=00000000
>
> And it weirdly leaves this hanging around in
> /sys/kernel/debug/kernel_page_tables:
>
> 0xffc7f000-0xffc80000           4K     RW NX SHD MEM/CACHED/WBWA
>
> If I use all the other changes to clean up the code, everything is
> fine. The only change I have been the trees now is just this:
>
> -#define FIXADDR_END            0xffe00000UL
> +#define FIXADDR_END            0xfff00000UL
>
> I think my build isn't catching this extra area via the vector table pmd.

I commented in patch 3 of your series where the problem is.

> So, instead of continuing to beat my head against this, I've changed
> my series around to use NR_CPUS as Rob was doing, and added

My use of NR_CPUS was not intentional, but rather it was just based on
the older versions of the patch. I don't have a strong opinion either
way.

Rob