[PATCH] arm64: hibernate: clone only the linear map that exists at runtime

[PATCH] arm64: hibernate: clone only the linear map that exists at runtime

[Breno Leitao]

This is similar to commit 1537e55728ec2 ("arm64: trans_pgd: clone only
the linear map that exists at runtime"), but in a different place.

swsusp_arch_resume() clones the kernel linear map with
trans_pgd_create_copy(..., PAGE_OFFSET, PAGE_END). PAGE_OFFSET comes
from the compile-time VA_BITS, so a CONFIG_ARM64_VA_BITS_52 kernel
booting on hardware without LPA2 -- vabits_actual is 48 and the fifth
level is folded -- hands the walk a 3.9PB window while its linear map
only spans the top 128TB.

On a VA_BITS_52 4k kernel with CONFIG_KASAN_GENERIC in a 4GB VM, I see:

  swapper/0: page allocation failure: order:0, mode:0x920(GFP_ATOMIC|__GFP_ZERO)
   hibernate_page_alloc+0x10/0x1c
   swsusp_arch_resume+0x70/0x320
   hibernation_restore+0xa4/0x138
   software_resume+0x15c/0x270
  PM: hibernation: Failed to load image, recovering.
  PM: hibernation: resume failed (-12)

Fix it by copying the linear map that is the actual one, not the
compiled one.

Fixes: a6bbf5d4d9d1 ("arm64: mm: Add definitions to support 5 levels of paging")
Signed-off-by: Breno Leitao <leitao@debian.org>
---
 arch/arm64/kernel/hibernate.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/kernel/hibernate.c b/arch/arm64/kernel/hibernate.c
index 7bf1174277772e..424291c547f02a 100644
--- a/arch/arm64/kernel/hibernate.c
+++ b/arch/arm64/kernel/hibernate.c
@@ -423,8 +423,8 @@ int __nocfi swsusp_arch_resume(void)
 	 * Create a second copy of just the linear map, and use this when
 	 * restoring.
 	 */
-	rc = trans_pgd_create_copy(&trans_info, &tmp_pg_dir, PAGE_OFFSET,
-				   PAGE_END);
+	rc = trans_pgd_create_copy(&trans_info, &tmp_pg_dir,
+				   _PAGE_OFFSET(vabits_actual), PAGE_END);
 	if (rc)
 		return rc;
 

---
base-commit: c68a982815dcce5464e3bf2a31ac94f5146c04ca
change-id: 20260910-arm64-hibernate-va52-f738ede2144f

Best regards,
--  
Breno Leitao <leitao@debian.org>

Re: [PATCH] arm64: hibernate: clone only the linear map that exists at runtime

[Ard Biesheuvel]

On Thu, 10 Sep 2026, at 15:53, Breno Leitao wrote:
> This is similar to commit 1537e55728ec2 ("arm64: trans_pgd: clone only
> the linear map that exists at runtime"), but in a different place.
>
> swsusp_arch_resume() clones the kernel linear map with
> trans_pgd_create_copy(..., PAGE_OFFSET, PAGE_END). PAGE_OFFSET comes
> from the compile-time VA_BITS, so a CONFIG_ARM64_VA_BITS_52 kernel
> booting on hardware without LPA2 -- vabits_actual is 48 and the fifth
> level is folded -- hands the walk a 3.9PB window while its linear map
> only spans the top 128TB.
>
> On a VA_BITS_52 4k kernel with CONFIG_KASAN_GENERIC in a 4GB VM, I see:
>
>   swapper/0: page allocation failure: order:0, mode:0x920(GFP_ATOMIC|__GFP_ZERO)
>    hibernate_page_alloc+0x10/0x1c
>    swsusp_arch_resume+0x70/0x320
>    hibernation_restore+0xa4/0x138
>    software_resume+0x15c/0x270
>   PM: hibernation: Failed to load image, recovering.
>   PM: hibernation: resume failed (-12)
>
> Fix it by copying the linear map that is the actual one, not the
> compiled one.
>
> Fixes: a6bbf5d4d9d1 ("arm64: mm: Add definitions to support 5 levels of paging")
> Signed-off-by: Breno Leitao <leitao@debian.org>
> ---
>  arch/arm64/kernel/hibernate.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>

Reviewed-by: Ard Biesheuvel <ardb@kernel.org>

> diff --git a/arch/arm64/kernel/hibernate.c b/arch/arm64/kernel/hibernate.c
> index 7bf1174277772e..424291c547f02a 100644
> --- a/arch/arm64/kernel/hibernate.c
> +++ b/arch/arm64/kernel/hibernate.c
> @@ -423,8 +423,8 @@ int __nocfi swsusp_arch_resume(void)
>  	 * Create a second copy of just the linear map, and use this when
>  	 * restoring.
>  	 */
> -	rc = trans_pgd_create_copy(&trans_info, &tmp_pg_dir, PAGE_OFFSET,
> -				   PAGE_END);
> +	rc = trans_pgd_create_copy(&trans_info, &tmp_pg_dir,
> +				   _PAGE_OFFSET(vabits_actual), PAGE_END);
>  	if (rc)
>  		return rc;
> 
>
> ---
> base-commit: c68a982815dcce5464e3bf2a31ac94f5146c04ca
> change-id: 20260910-arm64-hibernate-va52-f738ede2144f
>
> Best regards,
> --  
> Breno Leitao <leitao@debian.org>

Re: [PATCH] arm64: hibernate: clone only the linear map that exists at runtime

[Will Deacon]

On Thu, 10 Sep 2026 06:53:27 -0700, Breno Leitao wrote:
> This is similar to commit 1537e55728ec2 ("arm64: trans_pgd: clone only
> the linear map that exists at runtime"), but in a different place.
> 
> swsusp_arch_resume() clones the kernel linear map with
> trans_pgd_create_copy(..., PAGE_OFFSET, PAGE_END). PAGE_OFFSET comes
> from the compile-time VA_BITS, so a CONFIG_ARM64_VA_BITS_52 kernel
> booting on hardware without LPA2 -- vabits_actual is 48 and the fifth
> level is folded -- hands the walk a 3.9PB window while its linear map
> only spans the top 128TB.
> 
> [...]

Applied to arm64 (for-next/fixes), thanks!

[1/1] arm64: hibernate: clone only the linear map that exists at runtime
      https://git.kernel.org/arm64/c/e4a6f57d22e0

Cheers,
-- 
Will

https://fixes.arm64.dev
https://next.arm64.dev
https://will.arm64.dev