[PATCH] ARM: mm: reduce maximum number of CPUs if DEBUG_KMAP_LOCAL is enabled

[Peter Robinson]

On Tue, Feb 16, 2021 at 6:15 PM Ard Biesheuvel <ardb at kernel.org> wrote:
>
> The debugging code for kmap_local() doubles the number of fixmap slots
> allocated for kmap_local(), in order to use half of them as guard
> regions. This causes the fixmap region to grow downwards and collide
> with the newly added virtual DT mapping, which is obviously not good.
>
> One manifestation of this is EFI boot on a kernel built with NR_CPUS=32,
> which may pass the FDT in highmem, resulting in block entries that the
> fixmap code misidentifies as table entries, and subsequently tries to
> dereference using a phys-to-virt translation that is only valid for
> lowmem. This results in a cryptic splat such as the one below.
>
>   ftrace: allocating 45548 entries in 89 pages
>   8<--- cut here ---
>   Unable to handle kernel paging request at virtual address fc6006f0
>   pgd = (ptrval)
>   [fc6006f0] *pgd=80000040207003, *pmd=00000000
>   Internal error: Oops: a06 [#1] SMP ARM
>   Modules linked in:
>   CPU: 0 PID: 0 Comm: swapper Not tainted 5.11.0+ #382
>   Hardware name: Generic DT based system
>   PC is at cpu_ca15_set_pte_ext+0x24/0x30
>   LR is at __set_fixmap+0xe4/0x118
>   pc : [<c041ac9c>]    lr : [<c04189d8>]    psr: 400000d3
>   sp : c1601ed8  ip : 00400000  fp : 00800000
>   r10: 0000071f  r9 : 00421000  r8 : 00c00000
>   r7 : 00c00000  r6 : 0000071f  r5 : ffade000  r4 : 4040171f
>   r3 : 00c00000  r2 : 4040171f  r1 : c041ac78  r0 : fc6006f0
>   Flags: nZcv  IRQs off  FIQs off  Mode SVC_32  ISA ARM  Segment none
>   Control: 30c5387d  Table: 40203000  DAC: 00000001
>   Process swapper (pid: 0, stack limit = 0x(ptrval))
>
> So let's limit the supported number of CPUs to 16 when
> CONFIG_DEBUG_KMAP_LOCAL is in effect.
>
> Reported-by: Peter Robinson <pbrobinson at gmail.com>
> Signed-off-by: Ard Biesheuvel <ardb at kernel.org>
Tested-by: Peter Robinson <pbrobinson at gmail.com>

Tested with both a LPAE and non LPAE kernel.

> ---
>  arch/arm/Kconfig | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
>
> diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
> index 138248999df7..3d2c684eab77 100644
> --- a/arch/arm/Kconfig
> +++ b/arch/arm/Kconfig
> @@ -1310,9 +1310,15 @@ config KASAN_SHADOW_OFFSET
>
>  config NR_CPUS
>         int "Maximum number of CPUs (2-32)"
> -       range 2 32
> +       range 2 16 if DEBUG_KMAP_LOCAL
> +       range 2 32 if !DEBUG_KMAP_LOCAL
>         depends on SMP
>         default "4"
> +       help
> +         The maximum number of CPUs that the kernel can support.
> +         Up to 32 CPUs can be supported, or up to 16 if kmap_local()
> +         debugging is enabled, which uses half of the per-CPU fixmap
> +         slots as guard regions.
>
>  config HOTPLUG_CPU
>         bool "Support for hot-pluggable CPUs"
> --
> 2.30.0
>