[PATCH] arm64: mm: fix accidental linear mapping of no-map reserved memory

[Lianghong Liu]

Hi Will,

Thanks for applying the patch, and apologies for my earlier reply. You
were right that it read like an AI-generated response — I had used LLVM
to help me parse your message and polish my wording, and it
ended up restating your question instead of answering it. That was my
fault, and I'll answer in my own words below.

To answer the question you actually asked on July 16 — "what practical
issues are you seeing on your system?":

I'm running v6.1.177-rt on a Cortex-A78AE (Armv8.2), 64K pages. The Device Tree
has four no-map regions, two of them sub-page and holding TEE memory the
firmware has marked inaccessible to the REE:

  reserved_region1 at A0100000 { reg = <0x0 0xA0100000 0x0 0x00400000>; no-map; }; /* 4 MiB          */
  reserved_region2 at A0500000 { reg = <0x0 0xA0500000 0x0 0x00002000>; no-map; }; /* 8 KiB, sub-page  */
  reserved_region3 at A2000000 { reg = <0x0 0xA2000000 0x0 0x00008000>; no-map; }; /* 32 KiB, sub-page */
  reserved_region4 at AB000000 { reg = <0x0 0xAB000000 0x0 0x00100000>; no-map; }; /* 1 MiB          */

Regions 2 and 3 should be unmapped. With the DStream debugger I see them
folded into one mapped span instead:

  0xFFFF000060000000-0xFFFF0000604FFFFF   <unmapped>
  0xFFFF000060500000-0xFFFF00006AFFFFFF   NP:0xA0500000-0xAAFFFFFF   Normal   RW
  0xFFFF00006B000000-0xFFFF00006B0FFFFF   <unmapped>

What should be two mappable ranges (0xA0502000-0xA2000000 and
0xA2008000-0xAB000000) get outward-rounded by `phys &= PAGE_MASK` in
__create_pgd_mapping_locked() into a single 0xA0500000-0xAB000000
mapping that covers both no-map regions.

The symptom on this hardware: the Cortex-A78AE's cache prefetcher
speculatively touches the now-mapped TEE pages, trips the firmware's
secure-memory protection, and raises spurious "REE accessed secure
memory" faults.

That's what the patch addresses — round the linear-map range inward so a
sub-page-aligned start/end can't pull the mapping back over an adjacent
no-map region. I'm grateful to Ard for supplying the piece I failed to:
for_each_mem_range() presents coalesced ranges, so the inward rounding
can't drop a page the allocator owns.

On the follow-ups you and Ard raised — I'd be glad to look at moving the
rounding into __create_pgd_mapping_locked() (or dropping it there and
leaving it to callers) as a separate change, and adding a WARN when a
linear-map range comes in non-page-aligned. I'll leave the applied patch
alone and send those as follow-ups if they still seem worthwhile.

Thanks again,
Lianghong Liu