[kvm-unit-tests PATCH v2 0/7] riscv: 32-bit should use phys_addr_t

[kvm-unit-tests PATCH v2 0/7] riscv: 32-bit should use phys_addr_t

[Andrew Jones]

For v2 not only do we use phys_addr_t where we should to allow unit tests
to pretend like high words matter on rv32, but we actually get it to work
by adding a few more patches. Some new DBCN tests will make use of it.

Andrew Jones (7):
  riscv: Fix virt_to_phys again
  riscv: setup: Apply VA_BASE check to rv64
  riscv: Support up to 34-bit physical addresses on rv32, sort of
  riscv: Track memory above 3G
  riscv: mmu: Sanity check input physical addresses
  riscv: Define and use PHYS_PAGE_MASK
  riscv: mmu: Ensure order of PTE update and sfence

 lib/memregions.h    |  1 +
 lib/riscv/asm/io.h  |  4 ++--
 lib/riscv/asm/mmu.h |  3 +++
 lib/riscv/mmu.c     | 45 +++++++++++++++++++++++++++++----------------
 lib/riscv/setup.c   | 19 +++++++++++++------
 lib/riscv/smp.c     |  7 ++++++-
 6 files changed, 54 insertions(+), 25 deletions(-)

-- 
2.45.2

[kvm-unit-tests PATCH v2 1/7] riscv: Fix virt_to_phys again

[Andrew Jones]

The last fix was a bit hasty since we didn't double check that
virt_to_phys() was the right place for the fix, rather than
virt_to_pte_phys(), and of course it was the latter... All
architectures add on the offset in virt_to_pte_phys() and then
simply wrap virt_to_pte_phys() with virt_to_phys(), if they
implement virt_to_phys() at all. RISCV shouldn't be different.

Fixes: e1dd4ea76894 ("riscv: Fix virt_to_phys")
Fixes: 23100d972705 ("riscv: Enable vmalloc")
Signed-off-by: Andrew Jones <andrew.jones@linux.dev>
---
 lib/riscv/mmu.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/riscv/mmu.c b/lib/riscv/mmu.c
index 165a7034bc69..2c9c4f376ac9 100644
--- a/lib/riscv/mmu.c
+++ b/lib/riscv/mmu.c
@@ -179,7 +179,7 @@ phys_addr_t virt_to_pte_phys(pgd_t *pgtable, void *virt)
 	if (!pte_val(*ptep))
 		return 0;
 
-	return __pa(pteval_to_ptep(pte_val(*ptep)));
+	return __pa(pteval_to_ptep(pte_val(*ptep))) | offset_in_page(virt);
 }
 
 unsigned long virt_to_phys(volatile void *address)
@@ -194,7 +194,7 @@ unsigned long virt_to_phys(volatile void *address)
 	paddr = virt_to_pte_phys(pgtable, (void *)address);
 	assert(sizeof(long) == 8 || !(paddr >> 32));
 
-	return (unsigned long)paddr | offset_in_page(address);
+	return (unsigned long)paddr;
 }
 
 void *phys_to_virt(unsigned long address)
-- 
2.45.2

[kvm-unit-tests PATCH v2 2/7] riscv: setup: Apply VA_BASE check to rv64

[Andrew Jones]

The VA_BASE check in setup() also applies to rv64, as is clear from
the later VA_BASE check in mem_allocator_init(), which ensures
freemem_start < freemem_end < VA_BASE.

Fixes: 6895ce6dc618 ("riscv: Populate memregions and switch to page allocator")
Signed-off-by: Andrew Jones <andrew.jones@linux.dev>
---
 lib/riscv/setup.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/riscv/setup.c b/lib/riscv/setup.c
index e0b5f6f7daf5..2c7792a5b0bd 100644
--- a/lib/riscv/setup.c
+++ b/lib/riscv/setup.c
@@ -193,7 +193,7 @@ void setup(const void *fdt, phys_addr_t freemem_start)
 	const char *bootargs;
 	int ret;
 
-	assert(sizeof(long) == 8 || freemem_start < VA_BASE);
+	assert(freemem_start < VA_BASE);
 	freemem = __va(freemem_start);
 
 	freemem_push_fdt(&freemem, fdt);
-- 
2.45.2

[kvm-unit-tests PATCH v2 3/7] riscv: Support up to 34-bit physical addresses on rv32, sort of

[Andrew Jones]

Change virt_to_phys() and phys_to_virt() to use phys_addr_t instead
of unsigned long. This allows 32-bit builds to use physical addresses
over 32 bits wide (the spec allows up to 34 bits). But, to keep
things simple, we don't expect physical addresses wider than 32 bits
in most the library code (and that's ensured by sprinkling around
some asserts). IOW, the support is really only for unit tests which
want to test with an additional high memory region.

Signed-off-by: Andrew Jones <andrew.jones@linux.dev>
---
 lib/riscv/asm/io.h |  4 ++--
 lib/riscv/mmu.c    | 32 ++++++++++++++++++++------------
 lib/riscv/smp.c    |  7 ++++++-
 3 files changed, 28 insertions(+), 15 deletions(-)

diff --git a/lib/riscv/asm/io.h b/lib/riscv/asm/io.h
index 37a130e533c9..a48a9aa654dd 100644
--- a/lib/riscv/asm/io.h
+++ b/lib/riscv/asm/io.h
@@ -77,10 +77,10 @@ static inline u64 __raw_readq(const volatile void __iomem *addr)
 void __iomem *ioremap(phys_addr_t phys_addr, size_t size);
 
 #define virt_to_phys virt_to_phys
-unsigned long virt_to_phys(volatile void *address);
+phys_addr_t virt_to_phys(volatile void *address);
 
 #define phys_to_virt phys_to_virt
-void *phys_to_virt(unsigned long address);
+void *phys_to_virt(phys_addr_t address);
 
 #include <asm-generic/io.h>
 
diff --git a/lib/riscv/mmu.c b/lib/riscv/mmu.c
index 2c9c4f376ac9..6ab1f15a99ae 100644
--- a/lib/riscv/mmu.c
+++ b/lib/riscv/mmu.c
@@ -18,9 +18,16 @@ static int pte_index(uintptr_t vaddr, int level)
 	return (vaddr >> (PGDIR_BITS * level + PAGE_SHIFT)) & PGDIR_MASK;
 }
 
+static phys_addr_t pteval_to_phys_addr(pteval_t pteval)
+{
+	return (phys_addr_t)((pteval & PTE_PPN) >> PPN_SHIFT) << PAGE_SHIFT;
+}
+
 static pte_t *pteval_to_ptep(pteval_t pteval)
 {
-	return (pte_t *)(((pteval & PTE_PPN) >> PPN_SHIFT) << PAGE_SHIFT);
+	phys_addr_t paddr = pteval_to_phys_addr(pteval);
+	assert(paddr == __pa(paddr));
+	return (pte_t *)__pa(paddr);
 }
 
 static pteval_t ptep_to_pteval(pte_t *ptep)
@@ -106,7 +113,7 @@ void __mmu_enable(unsigned long satp)
 
 void mmu_enable(unsigned long mode, pgd_t *pgtable)
 {
-	unsigned long ppn = (unsigned long)pgtable >> PAGE_SHIFT;
+	unsigned long ppn = __pa(pgtable) >> PAGE_SHIFT;
 	unsigned long satp = mode | ppn;
 
 	assert(!(ppn & ~SATP_PPN));
@@ -118,6 +125,9 @@ void *setup_mmu(phys_addr_t top, void *opaque)
 	struct mem_region *r;
 	pgd_t *pgtable;
 
+	/* The initial page table uses an identity mapping. */
+	assert(top == __pa(top));
+
 	if (!__initial_pgtable)
 		__initial_pgtable = alloc_page();
 	pgtable = __initial_pgtable;
@@ -146,7 +156,8 @@ void __iomem *ioremap(phys_addr_t phys_addr, size_t size)
 	pgd_t *pgtable = current_pgtable();
 	bool flush = true;
 
-	assert(sizeof(long) == 8 || !(phys_addr >> 32));
+	/* I/O is always identity mapped. */
+	assert(end == __pa(end));
 
 	if (!pgtable) {
 		if (!__initial_pgtable)
@@ -158,7 +169,7 @@ void __iomem *ioremap(phys_addr_t phys_addr, size_t size)
 	mmu_set_range_ptes(pgtable, start, start, end,
 			   __pgprot(_PAGE_READ | _PAGE_WRITE), flush);
 
-	return (void __iomem *)(unsigned long)phys_addr;
+	return (void __iomem *)__pa(phys_addr);
 }
 
 phys_addr_t virt_to_pte_phys(pgd_t *pgtable, void *virt)
@@ -179,27 +190,24 @@ phys_addr_t virt_to_pte_phys(pgd_t *pgtable, void *virt)
 	if (!pte_val(*ptep))
 		return 0;
 
-	return __pa(pteval_to_ptep(pte_val(*ptep))) | offset_in_page(virt);
+	return pteval_to_phys_addr(pte_val(*ptep)) | offset_in_page(virt);
 }
 
-unsigned long virt_to_phys(volatile void *address)
+phys_addr_t virt_to_phys(volatile void *address)
 {
 	unsigned long satp = csr_read(CSR_SATP);
 	pgd_t *pgtable = (pgd_t *)((satp & SATP_PPN) << PAGE_SHIFT);
-	phys_addr_t paddr;
 
 	if ((satp >> SATP_MODE_SHIFT) == 0)
 		return __pa(address);
 
-	paddr = virt_to_pte_phys(pgtable, (void *)address);
-	assert(sizeof(long) == 8 || !(paddr >> 32));
-
-	return (unsigned long)paddr;
+	return virt_to_pte_phys(pgtable, (void *)address);
 }
 
-void *phys_to_virt(unsigned long address)
+void *phys_to_virt(phys_addr_t address)
 {
 	/* @address must have an identity mapping for this to work. */
+	assert(address == __pa(address));
 	assert(virt_to_phys(__va(address)) == address);
 	return __va(address);
 }
diff --git a/lib/riscv/smp.c b/lib/riscv/smp.c
index 7e4bb5b76903..4d373e0a29a8 100644
--- a/lib/riscv/smp.c
+++ b/lib/riscv/smp.c
@@ -8,6 +8,7 @@
 #include <alloc_page.h>
 #include <cpumask.h>
 #include <asm/csr.h>
+#include <asm/io.h>
 #include <asm/mmu.h>
 #include <asm/page.h>
 #include <asm/processor.h>
@@ -36,6 +37,7 @@ secondary_func_t secondary_cinit(struct secondary_data *data)
 static void __smp_boot_secondary(int cpu, secondary_func_t func)
 {
 	struct secondary_data *sp = alloc_pages(1) + SZ_8K - 16;
+	phys_addr_t sp_phys;
 	struct sbiret ret;
 
 	sp -= sizeof(struct secondary_data);
@@ -43,7 +45,10 @@ static void __smp_boot_secondary(int cpu, secondary_func_t func)
 	sp->stvec = csr_read(CSR_STVEC);
 	sp->func = func;
 
-	ret = sbi_hart_start(cpus[cpu].hartid, (unsigned long)&secondary_entry, __pa(sp));
+	sp_phys = virt_to_phys(sp);
+	assert(sp_phys == __pa(sp_phys));
+
+	ret = sbi_hart_start(cpus[cpu].hartid, (unsigned long)&secondary_entry, __pa(sp_phys));
 	assert(ret.error == SBI_SUCCESS);
 }
 
-- 
2.45.2

[kvm-unit-tests PATCH v2 4/7] riscv: Track memory above 3G

[Andrew Jones]

We chop the main memory region (which gets identity mapped) off at
the 3G boundary because the virtual memory allocator claims the 3G-4G
address range. Unit tests may want to be able to access the higher
memory, though, so keep track of it by putting it in its own memory
region. Since the test framework isn't using that memory region, flag
it as unused so unit tests will be confident that they can use the
memory for whatever they like.

Signed-off-by: Andrew Jones <andrew.jones@linux.dev>
---
 lib/memregions.h  |  1 +
 lib/riscv/setup.c | 15 +++++++++++----
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/lib/memregions.h b/lib/memregions.h
index 1600530ad7bf..04027f61b84c 100644
--- a/lib/memregions.h
+++ b/lib/memregions.h
@@ -10,6 +10,7 @@
 #define MR_F_CODE			BIT(1)
 #define MR_F_RESERVED			BIT(2)
 #define MR_F_PERSISTENT			BIT(3)
+#define MR_F_UNUSED			BIT(4)
 #define MR_F_UNKNOWN			BIT(31)
 
 struct mem_region {
diff --git a/lib/riscv/setup.c b/lib/riscv/setup.c
index 2c7792a5b0bd..35829309c13d 100644
--- a/lib/riscv/setup.c
+++ b/lib/riscv/setup.c
@@ -85,8 +85,9 @@ static void cpu_init(void)
 	cpu0_calls_idle = true;
 }
 
-static void mem_allocator_init(phys_addr_t freemem_start, phys_addr_t freemem_end)
+static void mem_allocator_init(struct mem_region *freemem, phys_addr_t freemem_start)
 {
+	phys_addr_t freemem_end = freemem->end;
 	phys_addr_t base, top;
 
 	freemem_start = PAGE_ALIGN(freemem_start);
@@ -100,8 +101,14 @@ static void mem_allocator_init(phys_addr_t freemem_start, phys_addr_t freemem_en
 	 *
 	 * TODO: Allow the VA range to shrink and move.
 	 */
-	if (freemem_end > VA_BASE)
+	if (freemem_end > VA_BASE) {
+		struct mem_region *curr, *rest;
 		freemem_end = VA_BASE;
+		memregions_split(VA_BASE, &curr, &rest);
+		assert(curr == freemem);
+		if (rest)
+			rest->flags = MR_F_UNUSED;
+	}
 	assert(freemem_end - freemem_start >= SZ_1M * 16);
 
 	init_alloc_vpage(__va(VA_TOP));
@@ -135,7 +142,7 @@ static void mem_init(phys_addr_t freemem_start)
 	freemem = memregions_find(freemem_start);
 	assert(freemem && !(freemem->flags & (MR_F_IO | MR_F_CODE)));
 
-	mem_allocator_init(freemem_start, freemem->end);
+	mem_allocator_init(freemem, freemem_start);
 }
 
 static void freemem_push_fdt(void **freemem, const void *fdt)
@@ -248,7 +255,7 @@ static efi_status_t efi_mem_init(efi_bootinfo_t *efi_bootinfo)
 		freemem_push_fdt(&freemem, efi_bootinfo->fdt);
 
 	mmu_disable();
-	mem_allocator_init((unsigned long)freemem, freemem_mr->end);
+	mem_allocator_init(freemem_mr, (unsigned long)freemem);
 
 	return EFI_SUCCESS;
 }
-- 
2.45.2

[kvm-unit-tests PATCH v2 5/7] riscv: mmu: Sanity check input physical addresses

[Andrew Jones]

Ensure physical addresses aren't using bits they shouldn't be.

Signed-off-by: Andrew Jones <andrew.jones@linux.dev>
---
 lib/riscv/asm/mmu.h | 2 ++
 lib/riscv/mmu.c     | 4 ++++
 2 files changed, 6 insertions(+)

diff --git a/lib/riscv/asm/mmu.h b/lib/riscv/asm/mmu.h
index bb60f0895e2b..9cd760093666 100644
--- a/lib/riscv/asm/mmu.h
+++ b/lib/riscv/asm/mmu.h
@@ -6,6 +6,8 @@
 #include <asm/page.h>
 #include <asm/pgtable.h>
 
+#define PHYS_MASK	((phys_addr_t)SATP_PPN << PAGE_SHIFT | (PAGE_SIZE - 1))
+
 static inline pgd_t *current_pgtable(void)
 {
 	return (pgd_t *)((csr_read(CSR_SATP) & SATP_PPN) << PAGE_SHIFT);
diff --git a/lib/riscv/mmu.c b/lib/riscv/mmu.c
index 6ab1f15a99ae..24f9f90e51c3 100644
--- a/lib/riscv/mmu.c
+++ b/lib/riscv/mmu.c
@@ -77,6 +77,8 @@ pteval_t *install_page(pgd_t *pgtable, phys_addr_t phys, void *virt)
 	phys_addr_t paddr = phys & PAGE_MASK;
 	uintptr_t vaddr = (uintptr_t)virt & PAGE_MASK;
 
+	assert(phys == (phys & PHYS_MASK));
+
 	return __install_page(pgtable, paddr, vaddr,
 			      __pgprot(_PAGE_READ | _PAGE_WRITE), true);
 }
@@ -89,6 +91,8 @@ void mmu_set_range_ptes(pgd_t *pgtable, uintptr_t virt_offset,
 	uintptr_t vaddr = virt_offset & PAGE_MASK;
 	uintptr_t virt_end = phys_end - paddr + vaddr;
 
+	assert(phys_start == (phys_start & PHYS_MASK));
+	assert(phys_end == (phys_end & PHYS_MASK));
 	assert(phys_start < phys_end);
 
 	for (; vaddr < virt_end; vaddr += PAGE_SIZE, paddr += PAGE_SIZE)
-- 
2.45.2

[kvm-unit-tests PATCH v2 6/7] riscv: Define and use PHYS_PAGE_MASK

[Andrew Jones]

C doesn't extend the sign bit for unsigned types since there isn't a
sign bit to extend. This means a promotion of a u32 to a u64 results
in the upper 32 bits of the u64 being zero. When the u64 is then used
as a mask on another u64 the upper 32 bits get cleared, and that's
definitely not the intention of 'phys_addr & PAGE_MASK', which should
only clear the lower bits for page alignment. Create PHYS_PAGE_MASK
to do the right thing.

Signed-off-by: Andrew Jones <andrew.jones@linux.dev>
---
 lib/riscv/asm/mmu.h | 1 +
 lib/riscv/mmu.c     | 6 +++---
 lib/riscv/setup.c   | 2 +-
 3 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/lib/riscv/asm/mmu.h b/lib/riscv/asm/mmu.h
index 9cd760093666..28c332f11496 100644
--- a/lib/riscv/asm/mmu.h
+++ b/lib/riscv/asm/mmu.h
@@ -7,6 +7,7 @@
 #include <asm/pgtable.h>
 
 #define PHYS_MASK	((phys_addr_t)SATP_PPN << PAGE_SHIFT | (PAGE_SIZE - 1))
+#define PHYS_PAGE_MASK	(~((phys_addr_t)PAGE_SIZE - 1))
 
 static inline pgd_t *current_pgtable(void)
 {
diff --git a/lib/riscv/mmu.c b/lib/riscv/mmu.c
index 24f9f90e51c3..ce49e67be84b 100644
--- a/lib/riscv/mmu.c
+++ b/lib/riscv/mmu.c
@@ -74,7 +74,7 @@ static pteval_t *__install_page(pgd_t *pgtable, phys_addr_t paddr,
 
 pteval_t *install_page(pgd_t *pgtable, phys_addr_t phys, void *virt)
 {
-	phys_addr_t paddr = phys & PAGE_MASK;
+	phys_addr_t paddr = phys & PHYS_PAGE_MASK;
 	uintptr_t vaddr = (uintptr_t)virt & PAGE_MASK;
 
 	assert(phys == (phys & PHYS_MASK));
@@ -87,7 +87,7 @@ void mmu_set_range_ptes(pgd_t *pgtable, uintptr_t virt_offset,
 			phys_addr_t phys_start, phys_addr_t phys_end,
 			pgprot_t prot, bool flush)
 {
-	phys_addr_t paddr = phys_start & PAGE_MASK;
+	phys_addr_t paddr = phys_start & PHYS_PAGE_MASK;
 	uintptr_t vaddr = virt_offset & PAGE_MASK;
 	uintptr_t virt_end = phys_end - paddr + vaddr;
 
@@ -155,7 +155,7 @@ void *setup_mmu(phys_addr_t top, void *opaque)
 
 void __iomem *ioremap(phys_addr_t phys_addr, size_t size)
 {
-	phys_addr_t start = phys_addr & PAGE_MASK;
+	phys_addr_t start = phys_addr & PHYS_PAGE_MASK;
 	phys_addr_t end = PAGE_ALIGN(phys_addr + size);
 	pgd_t *pgtable = current_pgtable();
 	bool flush = true;
diff --git a/lib/riscv/setup.c b/lib/riscv/setup.c
index 35829309c13d..9a16f00093d7 100644
--- a/lib/riscv/setup.c
+++ b/lib/riscv/setup.c
@@ -91,7 +91,7 @@ static void mem_allocator_init(struct mem_region *freemem, phys_addr_t freemem_s
 	phys_addr_t base, top;
 
 	freemem_start = PAGE_ALIGN(freemem_start);
-	freemem_end &= PAGE_MASK;
+	freemem_end &= PHYS_PAGE_MASK;
 
 	/*
 	 * The assert below is mostly checking that the free memory doesn't
-- 
2.45.2

[kvm-unit-tests PATCH v2 7/7] riscv: mmu: Ensure order of PTE update and sfence

[Andrew Jones]

Use WRITE_ONCE to ensure the compiler won't order the page table
write after the TLB flush.

Signed-off-by: Andrew Jones <andrew.jones@linux.dev>
---
 lib/riscv/mmu.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/riscv/mmu.c b/lib/riscv/mmu.c
index ce49e67be84b..577c66aa77ba 100644
--- a/lib/riscv/mmu.c
+++ b/lib/riscv/mmu.c
@@ -64,7 +64,8 @@ static pteval_t *__install_page(pgd_t *pgtable, phys_addr_t paddr,
 	assert(!(ppn & ~PTE_PPN));
 
 	ptep = get_pte(pgtable, vaddr);
-	*ptep = __pte(pte | pgprot_val(prot) | _PAGE_PRESENT | _PAGE_ACCESSED | _PAGE_DIRTY);
+	pte |= pgprot_val(prot) | _PAGE_PRESENT | _PAGE_ACCESSED | _PAGE_DIRTY;
+	WRITE_ONCE(*ptep, __pte(pte));
 
 	if (flush)
 		local_flush_tlb_page(vaddr);
-- 
2.45.2

Re: [kvm-unit-tests PATCH v2 0/7] riscv: 32-bit should use phys_addr_t

[Andrew Jones]

On Mon, Aug 12, 2024 at 03:44:52PM GMT, Andrew Jones wrote:
> For v2 not only do we use phys_addr_t where we should to allow unit tests
> to pretend like high words matter on rv32, but we actually get it to work
> by adding a few more patches. Some new DBCN tests will make use of it.
> 
> Andrew Jones (7):
>   riscv: Fix virt_to_phys again
>   riscv: setup: Apply VA_BASE check to rv64
>   riscv: Support up to 34-bit physical addresses on rv32, sort of
>   riscv: Track memory above 3G
>   riscv: mmu: Sanity check input physical addresses
>   riscv: Define and use PHYS_PAGE_MASK
>   riscv: mmu: Ensure order of PTE update and sfence
> 
>  lib/memregions.h    |  1 +
>  lib/riscv/asm/io.h  |  4 ++--
>  lib/riscv/asm/mmu.h |  3 +++
>  lib/riscv/mmu.c     | 45 +++++++++++++++++++++++++++++----------------
>  lib/riscv/setup.c   | 19 +++++++++++++------
>  lib/riscv/smp.c     |  7 ++++++-
>  6 files changed, 54 insertions(+), 25 deletions(-)
> 
> -- 
> 2.45.2
>

Queued on riscv/queue, https://gitlab.com/jones-drew/kvm-unit-tests/-/commits/riscv%2Fqueue

drew