Re: [PATCH v5 3/3] ARM: dts: broadcom: Use CFE CPU bring-up on the XG6846B

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] ARM: dts: broadcom: xg6846b partial no-map removal breaks lowmem setup
--

commit 59829f1abd4c733fd749211767c1df938a47fd66
Author: Linus Walleij <linusw@kernel.org>

ARM: dts: broadcom: Use CFE CPU bring-up on the XG6846B

This commit disables the inherited PSCI node on the XG6846B board and
configures the CPUs to use the brcm,bca-smp enable-method with CFE's
holding pen release address on CPU1. It also removes no-map from the
secondary-boot reserved-memory node so the reservation does not fail
when overlapping the kernel's initial page tables.

> diff --git a/arch/arm/boot/dts/broadcom/bcm6846-genexis-xg6846b.dts b/arch/arm/boot/dts/broadcom/bcm6846-genexis-xg6846b.dts
> index a3616fb7b3a8d..45d4df5231109 100644
> --- a/arch/arm/boot/dts/broadcom/bcm6846-genexis-xg6846b.dts
> +++ b/arch/arm/boot/dts/broadcom/bcm6846-genexis-xg6846b.dts
> @@ -34,7 +34,7 @@ reserved-memory {
>  		ranges;
>  
>  		secondary-boot@0 {
> -			no-map;
> +			/* Includes the kernel's initial page tables. */
>  			reg = <0x00000000 0x00008000>;
>  		};
>  		pmc3-firmware@8000 {

[Severity: High]
As reported by Sashiko on v3 [1], does removing no-map from secondary-boot@0
while leaving no-map on the adjacent pmc3-firmware@8000 node cause an early
boot crash when booting a multiplatform kernel where TEXT_OFFSET is above
0x00108000 (such as multi_v7_defconfig, where CONFIG_ARCH_BCMBCA=y and
CONFIG_ARCH_MESON=y set TEXT_OFFSET to 0x00208000)?

On bcm6846_defconfig (TEXT_OFFSET = 0x00008000), arm_memblock_init() reserves
[KERNEL_START, KERNEL_END) starting at physical 0x00008000 before scanning
reserved-memory. When early_init_dt_reserve_memory() processes
pmc3-firmware@8000 with nomap set, memblock_is_region_reserved(0x8000,
0x100000) is true, so the reservation is rejected with -EBUSY and
memblock_mark_nomap() is never called.

However, when TEXT_OFFSET is 0x00208000, the kernel image and initial page
tables sit at physical 0x00204000 and above. During
early_init_fdt_scan_reserved_mem(), secondary-boot@0 ([0x00000000, 0x00008000))
is reserved without MEMBLOCK_NOMAP, while pmc3-firmware@8000 ([0x00008000,
0x00108000)) does not overlap the kernel reservation and succeeds in calling
memblock_mark_nomap(). This leaves [0x00000000, 0x00008000) as the first
mappable memblock.memory region ahead of the MEMBLOCK_NOMAP region at
[0x00008000, 0x00108000).

In arch/arm/mm/mmu.c:adjust_lowmem_bounds(), the second loop then checks
whether the end of that first usable range is aligned to PMD_SIZE:

	for_each_mem_range(i, &block_start, &block_end) {
		if (block_start < lowmem_limit) {
			if (!memblock_limit) {
				if (!IS_ALIGNED(block_start, PMD_SIZE))
					memblock_limit = block_start;
				else if (!IS_ALIGNED(block_end, PMD_SIZE))
					memblock_limit = lowmem_limit;
			}

Because block_end is 0x8000, memblock_limit is set to 0x8000, rounded down to
PMD_SIZE (0), and passed to memblock_set_current_limit(0).

Subsequently, in paging_init(), prepare_page_table() computes end from
memblock.memory.regions[0]:

	end = memblock.memory.regions[0].base + memblock.memory.regions[0].size;
	if (end >= arm_lowmem_limit)
		end = arm_lowmem_limit;

	for (addr = __phys_to_virt(end);
	     addr < VMALLOC_START; addr += PMD_SIZE)
		pmd_clear(pmd_off_k(addr));

With end == 0x8000, prepare_page_table() clears all kernel PMDs from
__phys_to_virt(0x8000) up to VMALLOC_START, unmapping the running kernel, and
map_lowmem() then underflows map.length = end - start when advancing start to
kernel_sec_end while end remains 0x8000.

[1] https://lore.kernel.org/r/sashiko-outbox-180435@kernel.org

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261105-genexis-xg6846-smp-v7-3-rc1-v5-0-4103df2588d3@kernel.org?part=3