ARM: mm: support big-endian page tables

PATCH Superseded Jianguo Wu 3 participants 7 messages Feb 17, 2014 – Apr 17, 2014

Subsystems (2)

Memory management Arm (32-bit)

lore

Share & tools

lore

Jianguo Wu

author

2014-02-17 07:05 UTC #0 lore raw

PATCH v2 1/1 ARM: mm: support big-endian page tables

When enable LPAE and big-endian in a hisilicon board, while specify mem=384M mem=512M at 7680M, will get bad page state:

Freeing unused kernel memory: 180K (c0466000 - c0493000)

BUG: Bad page state in process init  pfn:fa442
page:c7749840 count:0 mapcount:-1 mapping:  (null) index:0x0
page flags: 0x40000400(reserved)
Modules linked in:
CPU: 0 PID: 1 Comm: init Not tainted 3.10.27+ #66
[<c000f5f0>] (unwind_backtrace+0x0/0x11c) from [<c000cbc4>] (show_stack+0x10/0x14)
[<c000cbc4>] (show_stack+0x10/0x14) from [<c009e448>] (bad_page+0xd4/0x104)
[<c009e448>] (bad_page+0xd4/0x104) from [<c009e520>] (free_pages_prepare+0xa8/0x14c)
[<c009e520>] (free_pages_prepare+0xa8/0x14c) from [<c009f8ec>] (free_hot_cold_page+0x18/0xf0)
[<c009f8ec>] (free_hot_cold_page+0x18/0xf0) from [<c00b5444>] (handle_pte_fault+0xcf4/0xdc8)
[<c00b5444>] (handle_pte_fault+0xcf4/0xdc8) from [<c00b6458>] (handle_mm_fault+0xf4/0x120)
[<c00b6458>] (handle_mm_fault+0xf4/0x120) from [<c0013754>] (do_page_fault+0xfc/0x354)
[<c0013754>] (do_page_fault+0xfc/0x354) from [<c0008400>] (do_DataAbort+0x2c/0x90)
[<c0008400>] (do_DataAbort+0x2c/0x90) from [<c0008fb4>] (__dabt_usr+0x34/0x40)

The bad pfn:fa442 is not system memory(mem=384M mem=512M at 7680M), after debugging, I find in page fault handler, will get wrong pfn from pte just after set pte, as follow:
do_anonymous_page()

{
	...
	set_pte_at(mm, address, page_table, entry);
	
	//debug code
	pfn = pte_pfn(entry);
	pr_info("pfn:0x%lx, pte:0x%llx\n", pfn, pte_val(entry));

	//read out the pte just set
	new_pte = pte_offset_map(pmd, address);
	new_pfn = pte_pfn(*new_pte);
	pr_info("new pfn:0x%lx, new pte:0x%llx\n", pfn, pte_val(entry));
	...
}

pfn: 0x1fa4f5, pte:0xc00001fa4f575f
new_pfn:0xfa4f5, new_pte:0xc00000fa4f5f5f //new pfn/pte is wrong.

The bug is happened in cpu_v7_set_pte_ext(ptep, pte):
when pte is 64-bit, for little-endian, will store low 32-bit in r2, high 32-bit in r3; for big-endian, will store low 32-bit in r3, high 32-bit in r2, this will cause wrong pfn stored in pte, so we should exchange r2 and r3 for big-endian.

Signed-off-by Jianguo Wu <[email protected]>

---
 arch/arm/mm/proc-v7-3level.S |   18 +++++++++++++-----
 1 files changed, 13 insertions(+), 5 deletions(-)

arch/arm/mm/proc-v7-3level.S +13 -5

index 01a719e..22e3ad6 100644
@@ -64,6 +64,14 @@ ENTRY(cpu_v7_switch_mm)
 	mov	pc, lr
 ENDPROC(cpu_v7_switch_mm)
 
+#ifdef __ARMEB__
+#define rl r3
+#define rh r2
+#else
+#define rl r2
+#define rh r3
+#endif
+
 /*
  * cpu_v7_set_pte_ext(ptep, pte)
  *

@@ -73,13 +81,13 @@ ENDPROC(cpu_v7_switch_mm)
  */
 ENTRY(cpu_v7_set_pte_ext)
 #ifdef CONFIG_MMU
-	tst	r2, #L_PTE_VALID
+	tst	rl, #L_PTE_VALID
 	beq	1f
-	tst	r3, #1 << (57 - 32)		@ L_PTE_NONE
-	bicne	r2, #L_PTE_VALID
+	tst	rh, #1 << (57 - 32)		@ L_PTE_NONE
+	bicne	rl, #L_PTE_VALID
 	bne	1f
-	tst	r3, #1 << (55 - 32)		@ L_PTE_DIRTY
-	orreq	r2, #L_PTE_RDONLY
+	tst	rh, #1 << (55 - 32)		@ L_PTE_DIRTY
+	orreq	rl, #L_PTE_RDONLY
 1:	strd	r2, r3, [r0]
 	ALT_SMP(W(nop))
 	ALT_UP (mcr	p15, 0, r0, c7, c10, 1)		@ flush_pte

Signature · 1 line

1.7.1

Jianguo Wu

author

2014-03-18 07:35 UTC #1 lore raw

Hi Russell,

Cloud you please take a look at this?

Thanks!

Quoted 90 lines · Jianguo Wu

When enable LPAE and big-endian in a hisilicon board, while specify mem=384M mem=512M at 7680M, will get bad page state:

Freeing unused kernel memory: 180K (c0466000 - c0493000)

BUG: Bad page state in process init  pfn:fa442
page:c7749840 count:0 mapcount:-1 mapping:  (null) index:0x0
page flags: 0x40000400(reserved)
Modules linked in:
CPU: 0 PID: 1 Comm: init Not tainted 3.10.27+ #66
[<c000f5f0>] (unwind_backtrace+0x0/0x11c) from [<c000cbc4>] (show_stack+0x10/0x14)
[<c000cbc4>] (show_stack+0x10/0x14) from [<c009e448>] (bad_page+0xd4/0x104)
[<c009e448>] (bad_page+0xd4/0x104) from [<c009e520>] (free_pages_prepare+0xa8/0x14c)
[<c009e520>] (free_pages_prepare+0xa8/0x14c) from [<c009f8ec>] (free_hot_cold_page+0x18/0xf0)
[<c009f8ec>] (free_hot_cold_page+0x18/0xf0) from [<c00b5444>] (handle_pte_fault+0xcf4/0xdc8)
[<c00b5444>] (handle_pte_fault+0xcf4/0xdc8) from [<c00b6458>] (handle_mm_fault+0xf4/0x120)
[<c00b6458>] (handle_mm_fault+0xf4/0x120) from [<c0013754>] (do_page_fault+0xfc/0x354)
[<c0013754>] (do_page_fault+0xfc/0x354) from [<c0008400>] (do_DataAbort+0x2c/0x90)
[<c0008400>] (do_DataAbort+0x2c/0x90) from [<c0008fb4>] (__dabt_usr+0x34/0x40)

The bad pfn:fa442 is not system memory(mem=384M mem=512M at 7680M), after debugging, I find in page fault handler, will get wrong pfn from pte just after set pte, as follow:
do_anonymous_page()

{
	...
	set_pte_at(mm, address, page_table, entry);
	
	//debug code
	pfn = pte_pfn(entry);
	pr_info("pfn:0x%lx, pte:0x%llx\n", pfn, pte_val(entry));

	//read out the pte just set
	new_pte = pte_offset_map(pmd, address);
	new_pfn = pte_pfn(*new_pte);
	pr_info("new pfn:0x%lx, new pte:0x%llx\n", pfn, pte_val(entry));
	...
}

pfn: 0x1fa4f5, pte:0xc00001fa4f575f
new_pfn:0xfa4f5, new_pte:0xc00000fa4f5f5f //new pfn/pte is wrong.

Signed-off-by Jianguo Wu <[email protected]>

---
 arch/arm/mm/proc-v7-3level.S |   18 +++++++++++++-----
 1 files changed, 13 insertions(+), 5 deletions(-)

arch/arm/mm/proc-v7-3level.S +13 -5

index 01a719e..22e3ad6 100644
@@ -64,6 +64,14 @@ ENTRY(cpu_v7_switch_mm)
 	mov	pc, lr
 ENDPROC(cpu_v7_switch_mm)
 
+#ifdef __ARMEB__
+#define rl r3
+#define rh r2
+#else
+#define rl r2
+#define rh r3
+#endif
+
 /*
  * cpu_v7_set_pte_ext(ptep, pte)
  *

@@ -73,13 +81,13 @@ ENDPROC(cpu_v7_switch_mm)
  */
 ENTRY(cpu_v7_set_pte_ext)
 #ifdef CONFIG_MMU
-	tst	r2, #L_PTE_VALID
+	tst	rl, #L_PTE_VALID
 	beq	1f
-	tst	r3, #1 << (57 - 32)		@ L_PTE_NONE
-	bicne	r2, #L_PTE_VALID
+	tst	rh, #1 << (57 - 32)		@ L_PTE_NONE
+	bicne	rl, #L_PTE_VALID
 	bne	1f
-	tst	r3, #1 << (55 - 32)		@ L_PTE_DIRTY
-	orreq	r2, #L_PTE_RDONLY
+	tst	rh, #1 << (55 - 32)		@ L_PTE_DIRTY
+	orreq	rl, #L_PTE_RDONLY
 1:	strd	r2, r3, [r0]
 	ALT_SMP(W(nop))
 	ALT_UP (mcr	p15, 0, r0, c7, c10, 1)		@ flush_pte

Will Deacon

2014-04-14 10:43 UTC #2 lore raw

(catching up on old email)

Quoted 1 line · Jianguo Wu

Cloud you please take a look at this?

[...]

Quoted 19 lines · Jianguo Wu

Quoted 18 lines

When enable LPAE and big-endian in a hisilicon board, while specify mem=384M mem=512M at 7680M, will get bad page state:

Freeing unused kernel memory: 180K (c0466000 - c0493000)

BUG: Bad page state in process init  pfn:fa442
page:c7749840 count:0 mapcount:-1 mapping:  (null) index:0x0
page flags: 0x40000400(reserved)
Modules linked in:
CPU: 0 PID: 1 Comm: init Not tainted 3.10.27+ #66
[<c000f5f0>] (unwind_backtrace+0x0/0x11c) from [<c000cbc4>] (show_stack+0x10/0x14)
[<c000cbc4>] (show_stack+0x10/0x14) from [<c009e448>] (bad_page+0xd4/0x104)
[<c009e448>] (bad_page+0xd4/0x104) from [<c009e520>] (free_pages_prepare+0xa8/0x14c)
[<c009e520>] (free_pages_prepare+0xa8/0x14c) from [<c009f8ec>] (free_hot_cold_page+0x18/0xf0)
[<c009f8ec>] (free_hot_cold_page+0x18/0xf0) from [<c00b5444>] (handle_pte_fault+0xcf4/0xdc8)
[<c00b5444>] (handle_pte_fault+0xcf4/0xdc8) from [<c00b6458>] (handle_mm_fault+0xf4/0x120)
[<c00b6458>] (handle_mm_fault+0xf4/0x120) from [<c0013754>] (do_page_fault+0xfc/0x354)
[<c0013754>] (do_page_fault+0xfc/0x354) from [<c0008400>] (do_DataAbort+0x2c/0x90)
[<c0008400>] (do_DataAbort+0x2c/0x90) from [<c0008fb4>] (__dabt_usr+0x34/0x40)

[...]

Quoted 5 lines

Quoted 5 lines
The bug is happened in cpu_v7_set_pte_ext(ptep, pte):
when pte is 64-bit, for little-endian, will store low 32-bit in r2, high 32-bit in r3; for big-endian, will store low 32-bit in r3, high 32-bit in r2, this will cause wrong pfn stored in pte, so we should exchange r2 and r3 for big-endian.

I believe that Marc (added to CC) has been running LPAE-enabled, big-endian KVM guests without any issues, so it seems unlikely that we're storing the PTEs backwards. Can you check the configuration of SCTLR.EE?

Will

Marc Zyngier

2014-04-14 11:14 UTC #3 lore raw

Quoted 35 lines · Will Deacon

(catching up on old email)
Quoted 1 line · Jianguo Wu
Cloud you please take a look at this?
[...]
Quoted 19 lines · Jianguo Wu
Quoted 18 lines
When enable LPAE and big-endian in a hisilicon board, while specify mem=384M mem=512M at 7680M, will get bad page state:
Freeing unused kernel memory: 180K (c0466000 - c0493000)
BUG: Bad page state in process init  pfn:fa442
page:c7749840 count:0 mapcount:-1 mapping:  (null) index:0x0
page flags: 0x40000400(reserved)
Modules linked in:
CPU: 0 PID: 1 Comm: init Not tainted 3.10.27+ #66
[<c000f5f0>] (unwind_backtrace+0x0/0x11c) from [<c000cbc4>] (show_stack+0x10/0x14)
[<c000cbc4>] (show_stack+0x10/0x14) from [<c009e448>] (bad_page+0xd4/0x104)
[<c009e448>] (bad_page+0xd4/0x104) from [<c009e520>] (free_pages_prepare+0xa8/0x14c)
[<c009e520>] (free_pages_prepare+0xa8/0x14c) from [<c009f8ec>] (free_hot_cold_page+0x18/0xf0)
[<c009f8ec>] (free_hot_cold_page+0x18/0xf0) from [<c00b5444>] (handle_pte_fault+0xcf4/0xdc8)
[<c00b5444>] (handle_pte_fault+0xcf4/0xdc8) from [<c00b6458>] (handle_mm_fault+0xf4/0x120)
[<c00b6458>] (handle_mm_fault+0xf4/0x120) from [<c0013754>] (do_page_fault+0xfc/0x354)
[<c0013754>] (do_page_fault+0xfc/0x354) from [<c0008400>] (do_DataAbort+0x2c/0x90)
[<c0008400>] (do_DataAbort+0x2c/0x90) from [<c0008fb4>] (__dabt_usr+0x34/0x40)
[...]
Quoted 5 lines
Quoted 5 lines
The bug is happened in cpu_v7_set_pte_ext(ptep, pte):
when pte is 64-bit, for little-endian, will store low 32-bit in r2, high 32-bit in r3; for big-endian, will store low 32-bit in r3, high 32-bit in r2, this will cause wrong pfn stored in pte, so we should exchange r2 and r3 for big-endian.

Quoted 3 lines

I believe that Marc (added to CC) has been running LPAE-enabled, big-endian KVM guests without any issues, so it seems unlikely that we're storing the PTEs backwards. Can you check the configuration of SCTLR.EE?

So, for the record:

root at when-the-lie-s-so-big:~# cat /proc/cpuinfo
processor : 0
model name : ARMv7 Processor rev 4 (v7b)
Features : swp half thumb fastmult vfp edsp thumbee neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae evtstrm
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x0
CPU part : 0xc07
CPU revision : 4

processor : 1
model name : ARMv7 Processor rev 4 (v7b)
Features : swp half thumb fastmult vfp edsp thumbee neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae evtstrm
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x0
CPU part : 0xc07
CPU revision : 4

Hardware : Dummy Virtual Machine
Revision : 0000
Serial : 0000000000000000
root at when-the-lie-s-so-big:~# uname -a
Linux when-the-lie-s-so-big 3.14.0+ #2465 SMP PREEMPT Tue Apr 8 13:05:11 BST 2014 armv7b GNU/Linux

Now, looking at the patch, I think it makes some sense:
- Depending on the endianness, we have to test the L_PTE_NONE in one word on the other, and possibly clear L_PTE_VALID
- Same for L_PTE_DIRTY, respectively setting L_PTE_RDONLY

The commit message looks wrong though, as it mention the PTE storage in memory (which looks completely fine to me, and explain why I was able to boot a guest). As none of my guest RAM is above 4GB IPA, I didn't see the corruption of bit 32 in the PTE (which should have been bit 0, corresponding to L_PTE_VALID).

So, provided that the commit message is rewritten to match the what it does, I'm fine with that patch.

Thanks,

M.

Signature · 1 line

Jazz is not dead. It just smells funny...

Jianguo Wu

author

2014-04-16 02:45 UTC #4 lore raw

Quoted 28 lines · Marc Zyngier

Quoted 27 lines · Will Deacon

(catching up on old email)

Quoted 1 line · Jianguo Wu

Cloud you please take a look at this?

[...]

Quoted 19 lines · Jianguo Wu

Quoted 18 lines

When enable LPAE and big-endian in a hisilicon board, while specify mem=384M mem=512M at 7680M, will get bad page state:

Freeing unused kernel memory: 180K (c0466000 - c0493000)

BUG: Bad page state in process init  pfn:fa442
page:c7749840 count:0 mapcount:-1 mapping:  (null) index:0x0
page flags: 0x40000400(reserved)
Modules linked in:
CPU: 0 PID: 1 Comm: init Not tainted 3.10.27+ #66
[<c000f5f0>] (unwind_backtrace+0x0/0x11c) from [<c000cbc4>] (show_stack+0x10/0x14)
[<c000cbc4>] (show_stack+0x10/0x14) from [<c009e448>] (bad_page+0xd4/0x104)
[<c009e448>] (bad_page+0xd4/0x104) from [<c009e520>] (free_pages_prepare+0xa8/0x14c)
[<c009e520>] (free_pages_prepare+0xa8/0x14c) from [<c009f8ec>] (free_hot_cold_page+0x18/0xf0)
[<c009f8ec>] (free_hot_cold_page+0x18/0xf0) from [<c00b5444>] (handle_pte_fault+0xcf4/0xdc8)
[<c00b5444>] (handle_pte_fault+0xcf4/0xdc8) from [<c00b6458>] (handle_mm_fault+0xf4/0x120)
[<c00b6458>] (handle_mm_fault+0xf4/0x120) from [<c0013754>] (do_page_fault+0xfc/0x354)
[<c0013754>] (do_page_fault+0xfc/0x354) from [<c0008400>] (do_DataAbort+0x2c/0x90)
[<c0008400>] (do_DataAbort+0x2c/0x90) from [<c0008fb4>] (__dabt_usr+0x34/0x40)

Quoted 8 lines

Quoted 8 lines
[...]
Quoted 5 lines
Quoted 5 lines
The bug is happened in cpu_v7_set_pte_ext(ptep, pte):
when pte is 64-bit, for little-endian, will store low 32-bit in r2, high 32-bit in r3; for big-endian, will store low 32-bit in r3, high 32-bit in r2, this will cause wrong pfn stored in pte, so we should exchange r2 and r3 for big-endian.

Hi Marc,
How about this:

The bug is happened in cpu_v7_set_pte_ext(ptep, pte):
- It tests the L_PTE_NONE in one word on the other, and possibly clear L_PTE_VALID
tst r3, #1 << (57 - 32) @ L_PTE_NONE
bicne r2, #L_PTE_VALID
- Same for L_PTE_DIRTY, respectively setting L_PTE_RDONLY

As for LPAE, the pte is 64-bits, and the value of r2/r3 is depending on the endianness, for little-endian, will store low 32-bit in r2, high 32-bit in r3,
for big-endian, will store low 32-bit in r3, high 32-bit in r2,
this will cause wrong bit is cleared or set, and get wrong pfn.
So we should exchange r2 and r3 for big-endian.

Thanks,
Jianguo Wu.

Quoted 48 lines

Quoted 3 lines
I believe that Marc (added to CC) has been running LPAE-enabled, big-endian KVM guests without any issues, so it seems unlikely that we're storing the PTEs backwards. Can you check the configuration of SCTLR.EE?
So, for the record:
root at when-the-lie-s-so-big:~# cat /proc/cpuinfo
processor : 0
model name : ARMv7 Processor rev 4 (v7b)
Features : swp half thumb fastmult vfp edsp thumbee neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae evtstrm
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x0
CPU part : 0xc07
CPU revision : 4
processor : 1
model name : ARMv7 Processor rev 4 (v7b)
Features : swp half thumb fastmult vfp edsp thumbee neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae evtstrm
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x0
CPU part : 0xc07
CPU revision : 4
Hardware : Dummy Virtual Machine
Revision : 0000
Serial : 0000000000000000
root at when-the-lie-s-so-big:~# uname -a
Linux when-the-lie-s-so-big 3.14.0+ #2465 SMP PREEMPT Tue Apr 8 13:05:11 BST 2014 armv7b GNU/Linux
Now, looking at the patch, I think it makes some sense:
- Depending on the endianness, we have to test the L_PTE_NONE in one word on the other, and possibly clear L_PTE_VALID
- Same for L_PTE_DIRTY, respectively setting L_PTE_RDONLY
The commit message looks wrong though, as it mention the PTE storage in memory (which looks completely fine to me, and explain why I was able to boot a guest). As none of my guest RAM is above 4GB IPA, I didn't see the corruption of bit 32 in the PTE (which should have been bit 0, corresponding to L_PTE_VALID).
So, provided that the commit message is rewritten to match the what it does, I'm fine with that patch.
Thanks,
	M.

Marc Zyngier

2014-04-16 12:28 UTC #5 lore raw

Quoted 48 lines · Jianguo Wu

Quoted 28 lines · Marc Zyngier
Quoted 27 lines · Will Deacon
(catching up on old email)
Quoted 1 line · Jianguo Wu
Cloud you please take a look at this?
[...]
Quoted 19 lines · Jianguo Wu
Quoted 18 lines
When enable LPAE and big-endian in a hisilicon board, while specify mem=384M mem=512M at 7680M, will get bad page state:
Freeing unused kernel memory: 180K (c0466000 - c0493000)
BUG: Bad page state in process init  pfn:fa442
page:c7749840 count:0 mapcount:-1 mapping:  (null) index:0x0
page flags: 0x40000400(reserved)
Modules linked in:
CPU: 0 PID: 1 Comm: init Not tainted 3.10.27+ #66
[<c000f5f0>] (unwind_backtrace+0x0/0x11c) from [<c000cbc4>] (show_stack+0x10/0x14)
[<c000cbc4>] (show_stack+0x10/0x14) from [<c009e448>] (bad_page+0xd4/0x104)
[<c009e448>] (bad_page+0xd4/0x104) from [<c009e520>] (free_pages_prepare+0xa8/0x14c)
[<c009e520>] (free_pages_prepare+0xa8/0x14c) from [<c009f8ec>] (free_hot_cold_page+0x18/0xf0)
[<c009f8ec>] (free_hot_cold_page+0x18/0xf0) from [<c00b5444>] (handle_pte_fault+0xcf4/0xdc8)
[<c00b5444>] (handle_pte_fault+0xcf4/0xdc8) from [<c00b6458>] (handle_mm_fault+0xf4/0x120)
[<c00b6458>] (handle_mm_fault+0xf4/0x120) from [<c0013754>] (do_page_fault+0xfc/0x354)
[<c0013754>] (do_page_fault+0xfc/0x354) from [<c0008400>] (do_DataAbort+0x2c/0x90)
[<c0008400>] (do_DataAbort+0x2c/0x90) from [<c0008fb4>] (__dabt_usr+0x34/0x40)
Quoted 8 lines
Quoted 8 lines
[...]
Quoted 5 lines
Quoted 5 lines
The bug is happened in cpu_v7_set_pte_ext(ptep, pte):
when pte is 64-bit, for little-endian, will store low 32-bit in r2, high 32-bit in r3; for big-endian, will store low 32-bit in r3, high 32-bit in r2, this will cause wrong pfn stored in pte, so we should exchange r2 and r3 for big-endian.
Hi Marc,
How about this:
The bug is happened in cpu_v7_set_pte_ext(ptep, pte):
- It tests the L_PTE_NONE in one word on the other, and possibly clear L_PTE_VALID
tst r3, #1 << (57 - 32) @ L_PTE_NONE
bicne r2, #L_PTE_VALID
- Same for L_PTE_DIRTY, respectively setting L_PTE_RDONLY

Quoted 5 lines

As for LPAE, the pte is 64-bits, and the value of r2/r3 is depending on the endianness, for little-endian, will store low 32-bit in r2, high 32-bit in r3,
for big-endian, will store low 32-bit in r3, high 32-bit in r2,
this will cause wrong bit is cleared or set, and get wrong pfn.
So we should exchange r2 and r3 for big-endian.

May I suggest the following instead:

"An LPAE PTE is a 64bit quantity, passed to cpu_v7_set_pte_ext in the
r2 and r3 registers.
On an LE kernel, r2 contains the LSB of the PTE, and r3 the MSB. On a BE kernel, the assignment is reversed.

Unfortunately, the current code always assumes the LE case, leading to corruption of the PTE when clearing/setting bits.

This patch fixes this issue much like it has been done already in the cpu_v7_switch_mm case."

Cheers,

M.

Signature · 1 line

Jazz is not dead. It just smells funny...

Jianguo Wu

author

2014-04-17 04:05 UTC #6 lore raw

Quoted 62 lines · Marc Zyngier

Quoted 48 lines · Jianguo Wu
Quoted 28 lines · Marc Zyngier
Quoted 27 lines · Will Deacon
(catching up on old email)
Quoted 1 line · Jianguo Wu
Cloud you please take a look at this?
[...]
Quoted 19 lines · Jianguo Wu
Quoted 18 lines
When enable LPAE and big-endian in a hisilicon board, while specify mem=384M mem=512M at 7680M, will get bad page state:
Freeing unused kernel memory: 180K (c0466000 - c0493000)
BUG: Bad page state in process init  pfn:fa442
page:c7749840 count:0 mapcount:-1 mapping:  (null) index:0x0
page flags: 0x40000400(reserved)
Modules linked in:
CPU: 0 PID: 1 Comm: init Not tainted 3.10.27+ #66
[<c000f5f0>] (unwind_backtrace+0x0/0x11c) from [<c000cbc4>] (show_stack+0x10/0x14)
[<c000cbc4>] (show_stack+0x10/0x14) from [<c009e448>] (bad_page+0xd4/0x104)
[<c009e448>] (bad_page+0xd4/0x104) from [<c009e520>] (free_pages_prepare+0xa8/0x14c)
[<c009e520>] (free_pages_prepare+0xa8/0x14c) from [<c009f8ec>] (free_hot_cold_page+0x18/0xf0)
[<c009f8ec>] (free_hot_cold_page+0x18/0xf0) from [<c00b5444>] (handle_pte_fault+0xcf4/0xdc8)
[<c00b5444>] (handle_pte_fault+0xcf4/0xdc8) from [<c00b6458>] (handle_mm_fault+0xf4/0x120)
[<c00b6458>] (handle_mm_fault+0xf4/0x120) from [<c0013754>] (do_page_fault+0xfc/0x354)
[<c0013754>] (do_page_fault+0xfc/0x354) from [<c0008400>] (do_DataAbort+0x2c/0x90)
[<c0008400>] (do_DataAbort+0x2c/0x90) from [<c0008fb4>] (__dabt_usr+0x34/0x40)
Quoted 8 lines
Quoted 8 lines
[...]
Quoted 5 lines
Quoted 5 lines
The bug is happened in cpu_v7_set_pte_ext(ptep, pte):
when pte is 64-bit, for little-endian, will store low 32-bit in r2, high 32-bit in r3; for big-endian, will store low 32-bit in r3, high 32-bit in r2, this will cause wrong pfn stored in pte, so we should exchange r2 and r3 for big-endian.
Hi Marc,
How about this:
The bug is happened in cpu_v7_set_pte_ext(ptep, pte):
- It tests the L_PTE_NONE in one word on the other, and possibly clear L_PTE_VALID
tst r3, #1 << (57 - 32) @ L_PTE_NONE
bicne r2, #L_PTE_VALID
- Same for L_PTE_DIRTY, respectively setting L_PTE_RDONLY
Quoted 5 lines
As for LPAE, the pte is 64-bits, and the value of r2/r3 is depending on the endianness, for little-endian, will store low 32-bit in r2, high 32-bit in r3,
for big-endian, will store low 32-bit in r3, high 32-bit in r2,
this will cause wrong bit is cleared or set, and get wrong pfn.
So we should exchange r2 and r3 for big-endian.
May I suggest the following instead:
"An LPAE PTE is a 64bit quantity, passed to cpu_v7_set_pte_ext in the
r2 and r3 registers.
On an LE kernel, r2 contains the LSB of the PTE, and r3 the MSB. On a BE kernel, the assignment is reversed.

Quoted 6 lines

Unfortunately, the current code always assumes the LE case, leading to corruption of the PTE when clearing/setting bits.
This patch fixes this issue much like it has been done already in the cpu_v7_switch_mm case."

OK, I will sent a new version, thanks!

Quoted 3 lines

Cheers,
	M.