[From nobody Tue Nov  9 03:47:34 2021
Return-Path: &lt;ardb@kernel.org&gt;
Received: from mail.kernel.org ([198.145.29.99]:57448)
 by pandora.armlinux.org.uk with esmtps (TLS1.2) tls
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2)
 (envelope-from &lt;ardb@kernel.org&gt;) id 1mfMGE-0005Nx-Jz
 for linux@armlinux.org.uk; Tue, 26 Oct 2021 14:13:02 +0100
Received: by mail.kernel.org (Postfix) with ESMTPSA id 41E3160E96;
 Tue, 26 Oct 2021 13:12:58 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org;
 s=k20201202; t=1635253979;
 bh=DzYIcyyysl0ZCevNgoF10+gTWz69EQy1FhtVoPf63g0=;
 h=From:To:Cc:Subject:Date:From;
 b=f02OkbT4Pe92WC44T3u6Z7fMy6a9ZA5i5QkEs3BMbJbJeZHW7AdZsthSG/KZo1CSb
 gWRQBsv33nXHZgOQutm/nppdBjrGuAunyXwqYqXQQXxPtmaNUj1ny3dD0uIHGl2Sol
 v6JJvS/SU8NaygXuFlgIzJdOqxlAM2YXkqCQD7gtkCa28ie+N1g+nFpppQGFzp52PC
 asl9GRc03iCObEfkcFDAIknBUm5yd6Tlhy/D5OL3sM33GU22xNZhY+9H2Bv+UAVSBY
 +DM5BOgSSpRU7RYa9f01rzB8D6exM20NscKWB8uSphh6uxoKpGdAdqK40K5AEnp4d0
 7efR94Eqe0JFQ==
From: Ard Biesheuvel &lt;ardb@kernel.org&gt;
To: linux@armlinux.org.uk
Cc: linus.walleij@linaro.org, arnd@arndb.de,
 linux-arm-kernel@lists.infradead.org, tglx@linutronix.de,
 quanyang.wang@windriver.com, Ard Biesheuvel &lt;ardb@kernel.org&gt;
Subject: [PATCH] kmap_local: don't assume kmap PTEs are linear arrays in memory
Date: Tue, 26 Oct 2021 15:12:49 +0200
Message-Id: &lt;20211026131249.3731275-1-ardb@kernel.org&gt;
X-Mailer: git-send-email 2.30.2
MIME-Version: 1.0
X-Developer-Signature: v=1; a=openpgp-sha256; l=5367; h=from:subject;
 bh=DzYIcyyysl0ZCevNgoF10+gTWz69EQy1FhtVoPf63g0=;
 b=owEB7QES/pANAwAKAcNPIjmS2Y8kAcsmYgBhd/7Qi8Yc675fO3Va489kJ/9piPzG6DVdJYLdk3sr
 cLNbHqaJAbMEAAEKAB0WIQT72WJ8QGnJQhU3VynDTyI5ktmPJAUCYXf+0AAKCRDDTyI5ktmPJGAhC/
 9jOAlCS2ntd81XY5Re6tOzgIIUfXJ/j27gxcXOT/dnrKSkij46gTb32ngnoEF51imDMjKrJcsXZS4a
 hyZIXZNjJJGAoLzCc5SfGpY5aYRN3C1eEvIkVfPQ9UhJG40VYpkBsZU1X9pKqG0JaWkH+zoz7egEYr
 HyRmFGvytEzh84l2II9VkBgHsfVx2HN0diPyGhMpEKZhvwdhyyhvfvgKs4nUJaAd0Is7s5h1nTOvLf
 C9zHnfUUdCF8L8LF1KOSG6DDkGEZuslzzasS9y7Hq14PzS9Uz1OGp9j6d2D0Ktt9a21w6pnv02hang
 hDxtL7xM2aLCqU4/rpG+3FDzjQP9Q6z10vv+kfBziYn5vJ2StDHaG4nRelEFoGAKZnvfM4RkZLBz7X
 SVd4je/pwNPIR7my6QkDw6lC7u5w3wo9zTRZozxj8kElpdWi1Y0OL4Oki/MpE46RapptlXcrsR9Zwt
 Ypm0B8UI0BibHmg3DDDJ47/BVKstpUPc6fyYE16AHuvj4=
X-Developer-Key: i=ardb@kernel.org; a=openpgp;
 fpr=F43D03328115A198C90016883D200E9CA6329909
Content-Transfer-Encoding: 8bit

The kmap_local conversion broke the ARM architecture, because the new
code assumes that all PTEs used for creating kmaps form a linear array
in memory, and uses array indexing to look up the kmap PTE belonging to
a certain kmap index.

On ARM, this cannot work, not only because the PTE pages may be
non-adjacent in memory, but also because ARM/!LPAE interleaves hardware
entries and extended entries (carrying software-only bits) in a way that
is not compatible with array indexing.

Fortunately, this only seems to affect configurations with more than 8
CPUs, due to the way the per-CPU kmap slots are organized in memory.

Work around this by permitting an architecture to set a Kconfig symbol
that signifies that the kmap PTEs do not form a lineary array in memory,
and so the only way to locate the appropriate one is to walk the page
tables.

Reported-by: Quanyang Wang &lt;quanyang.wang@windriver.com&gt;
Signed-off-by: Ard Biesheuvel &lt;ardb@kernel.org&gt;
---
 arch/arm/Kconfig |  1 +
 mm/Kconfig       |  3 +++
 mm/highmem.c     | 32 +++++++++++++++++++++-----------
 3 files changed, 25 insertions(+), 11 deletions(-)

diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 727c00c7d616..9aa0528f85de 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1467,6 +1467,7 @@ config HIGHMEM
 	bool &quot;High Memory Support&quot;
 	depends on MMU
 	select KMAP_LOCAL
+	select KMAP_LOCAL_NON_LINEAR_PTE_ARRAY
 	help
 	  The address space of ARM processors is only 4 Gigabytes large
 	  and it has to accommodate user address space, kernel address
diff --git a/mm/Kconfig b/mm/Kconfig
index d16ba9249bc5..c048dea7e342 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -887,6 +887,9 @@ config MAPPING_DIRTY_HELPERS
 config KMAP_LOCAL
 	bool
 
+config KMAP_LOCAL_NON_LINEAR_PTE_ARRAY
+	bool
+
 # struct io_mapping based helper.  Selected by drivers that need them
 config IO_MAPPING
 	bool
diff --git a/mm/highmem.c b/mm/highmem.c
index 4212ad0e4a19..1f0c8a52fd80 100644
--- a/mm/highmem.c
+++ b/mm/highmem.c
@@ -504,16 +504,22 @@ static inline int kmap_local_calc_idx(int idx)
 
 static pte_t *__kmap_pte;
 
-static pte_t *kmap_get_pte(void)
+static pte_t *kmap_get_pte(unsigned long vaddr, int idx)
 {
+	if (IS_ENABLED(CONFIG_KMAP_LOCAL_NON_LINEAR_PTE_ARRAY))
+		/*
+		 * Set by the arch if __kmap_pte[-idx] does not produce
+		 * the correct entry.
+		 */
+		return virt_to_kpte(vaddr);
 	if (!__kmap_pte)
 		__kmap_pte = virt_to_kpte(__fix_to_virt(FIX_KMAP_BEGIN));
-	return __kmap_pte;
+	return &amp;__kmap_pte[-idx];
 }
 
 void *__kmap_local_pfn_prot(unsigned long pfn, pgprot_t prot)
 {
-	pte_t pteval, *kmap_pte = kmap_get_pte();
+	pte_t pteval, *kmap_pte;
 	unsigned long vaddr;
 	int idx;
 
@@ -525,9 +531,10 @@ void *__kmap_local_pfn_prot(unsigned long pfn, pgprot_t prot)
 	preempt_disable();
 	idx = arch_kmap_local_map_idx(kmap_local_idx_push(), pfn);
 	vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
-	BUG_ON(!pte_none(*(kmap_pte - idx)));
+	kmap_pte = kmap_get_pte(vaddr, idx);
+	BUG_ON(!pte_none(*kmap_pte));
 	pteval = pfn_pte(pfn, prot);
-	arch_kmap_local_set_pte(&amp;init_mm, vaddr, kmap_pte - idx, pteval);
+	arch_kmap_local_set_pte(&amp;init_mm, vaddr, kmap_pte, pteval);
 	arch_kmap_local_post_map(vaddr, pteval);
 	current-&gt;kmap_ctrl.pteval[kmap_local_idx()] = pteval;
 	preempt_enable();
@@ -560,7 +567,7 @@ EXPORT_SYMBOL(__kmap_local_page_prot);
 void kunmap_local_indexed(void *vaddr)
 {
 	unsigned long addr = (unsigned long) vaddr &amp; PAGE_MASK;
-	pte_t *kmap_pte = kmap_get_pte();
+	pte_t *kmap_pte;
 	int idx;
 
 	if (addr &lt; __fix_to_virt(FIX_KMAP_END) ||
@@ -585,8 +592,9 @@ void kunmap_local_indexed(void *vaddr)
 	idx = arch_kmap_local_unmap_idx(kmap_local_idx(), addr);
 	WARN_ON_ONCE(addr != __fix_to_virt(FIX_KMAP_BEGIN + idx));
 
+	kmap_pte = kmap_get_pte(addr, idx);
 	arch_kmap_local_pre_unmap(addr);
-	pte_clear(&amp;init_mm, addr, kmap_pte - idx);
+	pte_clear(&amp;init_mm, addr, kmap_pte);
 	arch_kmap_local_post_unmap(addr);
 	current-&gt;kmap_ctrl.pteval[kmap_local_idx()] = __pte(0);
 	kmap_local_idx_pop();
@@ -608,7 +616,7 @@ EXPORT_SYMBOL(kunmap_local_indexed);
 void __kmap_local_sched_out(void)
 {
 	struct task_struct *tsk = current;
-	pte_t *kmap_pte = kmap_get_pte();
+	pte_t *kmap_pte;
 	int i;
 
 	/* Clear kmaps */
@@ -635,8 +643,9 @@ void __kmap_local_sched_out(void)
 		idx = arch_kmap_local_map_idx(i, pte_pfn(pteval));
 
 		addr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
+		kmap_pte = kmap_get_pte(addr, idx);
 		arch_kmap_local_pre_unmap(addr);
-		pte_clear(&amp;init_mm, addr, kmap_pte - idx);
+		pte_clear(&amp;init_mm, addr, kmap_pte);
 		arch_kmap_local_post_unmap(addr);
 	}
 }
@@ -644,7 +653,7 @@ void __kmap_local_sched_out(void)
 void __kmap_local_sched_in(void)
 {
 	struct task_struct *tsk = current;
-	pte_t *kmap_pte = kmap_get_pte();
+	pte_t *kmap_pte;
 	int i;
 
 	/* Restore kmaps */
@@ -664,7 +673,8 @@ void __kmap_local_sched_in(void)
 		/* See comment in __kmap_local_sched_out() */
 		idx = arch_kmap_local_map_idx(i, pte_pfn(pteval));
 		addr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
-		set_pte_at(&amp;init_mm, addr, kmap_pte - idx, pteval);
+		kmap_pte = kmap_get_pte(addr, idx);
+		set_pte_at(&amp;init_mm, addr, kmap_pte, pteval);
 		arch_kmap_local_post_map(addr, pteval);
 	}
 }
-- 
2.30.2


]