[PATCH] arm64: trans_pgd: clone only the linear map that exists at runtime

[PATCH] arm64: trans_pgd: clone only the linear map that exists at runtime

[Breno Leitao]

kexec_file_load() fails on arm64 if we have CONFIG_ARM64_VA_BITS_52 but
it runs on a !FEAT_LPA2 host (such as my loving Grace machine).

That is because trans_pgd_create_copy() uses the compile time
PAGE_OFFSET (VA 52) instead of the actual VA size (48 -- due to the lack
of LPA2). With the fifth level folded, pgd_none() is always false, so
the walk cannot skip the 15 extra PGDIR_SIZE slots, and they all alias
back to the same table: the whole kernel page table gets cloned 16
times, KASAN shadow included. Without KASAN it does not blow up, it just
wastes ~RAM/32 in page tables.

Fix it by copying the linear map that is the actual one, not the
compiled one.

Fixes: a6bbf5d4d9d1 ("arm64: mm: Add definitions to support 5 levels of paging")
Signed-off-by: Breno Leitao <leitao@debian.org>
---
 arch/arm64/kernel/machine_kexec.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/kernel/machine_kexec.c b/arch/arm64/kernel/machine_kexec.c
index c5693a32e49b0..8f9bc2327dc85 100644
--- a/arch/arm64/kernel/machine_kexec.c
+++ b/arch/arm64/kernel/machine_kexec.c
@@ -129,7 +129,8 @@ int machine_kexec_post_load(struct kimage *kimage)
 	}
 
 	/* Create a copy of the linear map */
-	rc = trans_pgd_create_copy(&info, &trans_pgd, PAGE_OFFSET, PAGE_END);
+	rc = trans_pgd_create_copy(&info, &trans_pgd,
+				   _PAGE_OFFSET(vabits_actual), PAGE_END);
 	if (rc)
 		return rc;
 	kimage->arch.ttbr1 = __pa(trans_pgd);

---
base-commit: b8809969e1d7a591e0f49dd464a5d04b3cf02ab1
change-id: 20260826-b4-arm64-trans-pgd-va52-0bb9b44dd896

Best regards,
--  
Breno Leitao <leitao@debian.org>

Re: [PATCH] arm64: trans_pgd: clone only the linear map that exists at runtime

[Yury MonZon]

I was trying to optimize that exact spot when I ran into your patch.
Thanks a ton, huge help!

Tested on Rockchip RK3576 (no FEAT_LPA2), 8GB, VA_BITS=52, 4K pages, loading a
39MB image with kexec_load():

  trans_pgd_create_copy()    2.231s -> 0.132s
  page table pages                51276  -> 4110
  whole kexec -l                     2.65s  -> ~0.42s
  memory held while loaded ~300MB -> 87MB

I did 5 kexec jumps, including images whose device tree is assembled from an
overlay so the segments land elsewhere, all booted fine.

before  2.416 2.428 2.466 2.635 2.693
after     0.408 0.414 0.414 0.417 0.419

Tested-by: Yury Smirnov <yurymonzon@gmail.com>

Thanks,
Yury


On Fri, Aug 28, 2026 at 11:28 AM Breno Leitao <leitao@debian.org> wrote:
>
> kexec_file_load() fails on arm64 if we have CONFIG_ARM64_VA_BITS_52 but
> it runs on a !FEAT_LPA2 host (such as my loving Grace machine).
>
> That is because trans_pgd_create_copy() uses the compile time
> PAGE_OFFSET (VA 52) instead of the actual VA size (48 -- due to the lack
> of LPA2). With the fifth level folded, pgd_none() is always false, so
> the walk cannot skip the 15 extra PGDIR_SIZE slots, and they all alias
> back to the same table: the whole kernel page table gets cloned 16
> times, KASAN shadow included. Without KASAN it does not blow up, it just
> wastes ~RAM/32 in page tables.
>
> Fix it by copying the linear map that is the actual one, not the
> compiled one.
>
> Fixes: a6bbf5d4d9d1 ("arm64: mm: Add definitions to support 5 levels of paging")
> Signed-off-by: Breno Leitao <leitao@debian.org>
> ---
>  arch/arm64/kernel/machine_kexec.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/arch/arm64/kernel/machine_kexec.c b/arch/arm64/kernel/machine_kexec.c
> index c5693a32e49b0..8f9bc2327dc85 100644
> --- a/arch/arm64/kernel/machine_kexec.c
> +++ b/arch/arm64/kernel/machine_kexec.c
> @@ -129,7 +129,8 @@ int machine_kexec_post_load(struct kimage *kimage)
>         }
>
>         /* Create a copy of the linear map */
> -       rc = trans_pgd_create_copy(&info, &trans_pgd, PAGE_OFFSET, PAGE_END);
> +       rc = trans_pgd_create_copy(&info, &trans_pgd,
> +                                  _PAGE_OFFSET(vabits_actual), PAGE_END);
>         if (rc)
>                 return rc;
>         kimage->arch.ttbr1 = __pa(trans_pgd);
>
> ---
> base-commit: b8809969e1d7a591e0f49dd464a5d04b3cf02ab1
> change-id: 20260826-b4-arm64-trans-pgd-va52-0bb9b44dd896
>
> Best regards,
> --
> Breno Leitao <leitao@debian.org>
>
>

Re: [PATCH] arm64: trans_pgd: clone only the linear map that exists at runtime

[Will Deacon]

On Fri, 28 Aug 2026 02:28:18 -0700, Breno Leitao wrote:
> kexec_file_load() fails on arm64 if we have CONFIG_ARM64_VA_BITS_52 but
> it runs on a !FEAT_LPA2 host (such as my loving Grace machine).
> 
> That is because trans_pgd_create_copy() uses the compile time
> PAGE_OFFSET (VA 52) instead of the actual VA size (48 -- due to the lack
> of LPA2). With the fifth level folded, pgd_none() is always false, so
> the walk cannot skip the 15 extra PGDIR_SIZE slots, and they all alias
> back to the same table: the whole kernel page table gets cloned 16
> times, KASAN shadow included. Without KASAN it does not blow up, it just
> wastes ~RAM/32 in page tables.
> 
> [...]

Applied to arm64 (for-next/fixes), thanks!

[1/1] arm64: trans_pgd: clone only the linear map that exists at runtime
      https://git.kernel.org/arm64/c/1537e55728ec

Cheers,
-- 
Will

https://fixes.arm64.dev
https://next.arm64.dev
https://will.arm64.dev