Re: [PATCH 1/1] x86/ioremap: Use is_vmalloc_addr in iounmap

[Alistair Popple <apopple@nvidia.com>]

Dan Williams <dan.j.williams@intel.com> writes:

> [ add Alistair and John ]
>
> Thomas Gleixner wrote:
>> On Thu, Aug 08 2024 at 09:39, Dan Williams wrote:
>> > Dan Williams wrote:
>> >> Apologies was trying to quickly reverse engineer how private memory
>> >> might be different than typical memremap_pages(), but it is indeed the
>> >> same in this aspect.
>> >> 
>> >> So the real difference is that the private memory case tries to
>> >> allocate physical memory by searching for holes in the iomem_resource
>> >> starting from U64_MAX. That might explain why only the private memory
>> >> case is violating assumptions with respect to high_memory spilling into
>> >> vmalloc space.
>> >
>> > Not U64_MAX, but it starts searching for free physical address space
>> > starting at MAX_PHYSMEM_BITS, see gfr_start().
>> 
>> Wait. MAX_PHYSMEM_BITS is either 46 (4-level) or 52 (5-level), which is
>> fully covered by the identity map space.
>> 
>> So even if the search starts from top of that space, how do we end up
>> with high_memory > VMALLOC_START?
>> 
>> That does not make any sense at all
>
> Max, or Alistair can you provide more details of how private memory spills over
> into the VMALLOC space on these platforms?

Well I was hoping pleading ignorance on x86 memory maps would get me out
of having to look too deeply :-) But alas...

It appears the problem originates in KASLR which can cause the VMALLOC
region to overlap with the top of the linear map.

> I too would have thought that MAX_PHYSMEM_BITS protects against this?

Me too, until about an hour ago. As noted above
request_free_mem_region() allocates from (1 << MAX_PHYSMEM_BITS) - 1
down. Therefore VMALLOC_START needs to be greater than PAGE_OFFSET + (1
<< MAX_PHYSMEM_BITS) - 1.  However the default configuration for KASLR
as set by RANDOMIZE_MEMORY_PHYSICAL_PADDING is to only provide 10TB
above what max_pfn is set to at boot time (and even then only if
CONFIG_MEMORY_HOTPLUG is enabled).

Obviously ZONE_DEVICE memory ends up being way above that and crosses
into the VMALLOC region. So I think the actual fix is something like:

---

diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index e36261b4ea14..c58d7b0f5bca 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -2277,6 +2277,7 @@ config RANDOMIZE_MEMORY_PHYSICAL_PADDING
        depends on RANDOMIZE_MEMORY
        default "0xa" if MEMORY_HOTPLUG
        default "0x0"
+       range 0x40 0x40 if GET_FREE_REGION
        range 0x1 0x40 if MEMORY_HOTPLUG
        range 0x0 0x40
        help