arch/arm64/include/asm/kernel-pgtable.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
From: Zhaoyang Huang <zhaoyang.huang@unisoc.com>
During debug of a kernel panic, we find that the pte_t of the final
part of [data, end] segment got overflow to the next page of
init_pg_end[1] which is the gap page before early_init_stack[2].
This should be introduced by the KERNEL_SEGMENT_COUNT's value is 5
which should be 6 as map_segment are called 6 times for the segments
of (text, stext, rodata, inittext, initdata, data+bss)
[1]
crash_arm64_v9.0.1> vtop ffffffed00601000
VIRTUAL PHYSICAL
ffffffed00601000 83401000
PAGE DIRECTORY: ffffffecffd62000
PGD: ffffffecffd62da0 => 10000000833fb003
PMD: ffffff80033fb018 => 10000000833fe003
PTE: ffffff80033fe008 => 68000083401f03
PAGE: 83401000
PTE PHYSICAL FLAGS
68000083401f03 83401000 (VALID|SHARED|AF|NG|PXN|UXN)
PAGE PHYSICAL MAPPING INDEX CNT FLAGS
fffffffec00d0040 83401000 0 0 1 4000 reserved
[2]
ffffffed002c8000 (r) __pi__data
ffffffed0054e000 (d) __pi___bss_start
ffffffed005f5000 (b) __pi_init_pg_dir
ffffffed005fe000 (b) __pi_init_pg_end
ffffffed005ff000 (B) early_init_stack
ffffffed00608000 (b) __pi__end
Signed-off-by: Zhaoyang Huang <zhaoyang.huang@unisoc.com>
---
arch/arm64/include/asm/kernel-pgtable.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/include/asm/kernel-pgtable.h b/arch/arm64/include/asm/kernel-pgtable.h
index 74a4f738c5f5..14dd1c52552a 100644
--- a/arch/arm64/include/asm/kernel-pgtable.h
+++ b/arch/arm64/include/asm/kernel-pgtable.h
@@ -64,8 +64,8 @@
#define INIT_IDMAP_FDT_PAGES (EARLY_PAGES(INIT_IDMAP_PGTABLE_LEVELS, 0UL, UL(MAX_FDT_SIZE), 1) - 1)
#define INIT_IDMAP_FDT_SIZE ((INIT_IDMAP_FDT_PAGES + EARLY_IDMAP_EXTRA_FDT_PAGES) * PAGE_SIZE)
-/* The number of segments in the kernel image (text, rodata, inittext, initdata, data+bss) */
-#define KERNEL_SEGMENT_COUNT 5
+/* The number of segments in the kernel image (text, stext, rodata, inittext, initdata, data+bss) */
+#define KERNEL_SEGMENT_COUNT 6
#if SWAPPER_BLOCK_SIZE > SEGMENT_ALIGN
#define EARLY_SEGMENT_EXTRA_PAGES (KERNEL_SEGMENT_COUNT + 1)
--
2.25.1
Hello Zhaoyang,
On Wed, 29 Apr 2026, at 08:17, zhaoyang.huang wrote:
> From: Zhaoyang Huang <zhaoyang.huang@unisoc.com>
>
> During debug of a kernel panic, we find that the pte_t of the final
> part of [data, end] segment got overflow to the next page of
> init_pg_end[1] which is the gap page before early_init_stack[2].
> This should be introduced by the KERNEL_SEGMENT_COUNT's value is 5
> which should be 6 as map_segment are called 6 times for the segments
> of (text, stext, rodata, inittext, initdata, data+bss)
>
> [1]
> crash_arm64_v9.0.1> vtop ffffffed00601000
> VIRTUAL PHYSICAL
> ffffffed00601000 83401000
>
> PAGE DIRECTORY: ffffffecffd62000
> PGD: ffffffecffd62da0 => 10000000833fb003
> PMD: ffffff80033fb018 => 10000000833fe003
> PTE: ffffff80033fe008 => 68000083401f03
> PAGE: 83401000
>
> PTE PHYSICAL FLAGS
> 68000083401f03 83401000 (VALID|SHARED|AF|NG|PXN|UXN)
>
> PAGE PHYSICAL MAPPING INDEX CNT FLAGS
> fffffffec00d0040 83401000 0 0 1 4000 reserved
>
> [2]
> ffffffed002c8000 (r) __pi__data
> ffffffed0054e000 (d) __pi___bss_start
> ffffffed005f5000 (b) __pi_init_pg_dir
> ffffffed005fe000 (b) __pi_init_pg_end
> ffffffed005ff000 (B) early_init_stack
> ffffffed00608000 (b) __pi__end
>
> Signed-off-by: Zhaoyang Huang <zhaoyang.huang@unisoc.com>
> ---
> arch/arm64/include/asm/kernel-pgtable.h | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/arch/arm64/include/asm/kernel-pgtable.h
> b/arch/arm64/include/asm/kernel-pgtable.h
> index 74a4f738c5f5..14dd1c52552a 100644
> --- a/arch/arm64/include/asm/kernel-pgtable.h
> +++ b/arch/arm64/include/asm/kernel-pgtable.h
> @@ -64,8 +64,8 @@
> #define INIT_IDMAP_FDT_PAGES (EARLY_PAGES(INIT_IDMAP_PGTABLE_LEVELS,
> 0UL, UL(MAX_FDT_SIZE), 1) - 1)
> #define INIT_IDMAP_FDT_SIZE ((INIT_IDMAP_FDT_PAGES +
> EARLY_IDMAP_EXTRA_FDT_PAGES) * PAGE_SIZE)
>
> -/* The number of segments in the kernel image (text, rodata, inittext,
> initdata, data+bss) */
> -#define KERNEL_SEGMENT_COUNT 5
> +/* The number of segments in the kernel image (text, stext, rodata,
> inittext, initdata, data+bss) */
> +#define KERNEL_SEGMENT_COUNT 6
>
> #if SWAPPER_BLOCK_SIZE > SEGMENT_ALIGN
> #define EARLY_SEGMENT_EXTRA_PAGES (KERNEL_SEGMENT_COUNT + 1)
I think the better fix would be
--- a/arch/arm64/include/asm/kernel-pgtable.h
+++ b/arch/arm64/include/asm/kernel-pgtable.h
@@ -68,7 +68,7 @@
#define KERNEL_SEGMENT_COUNT 5
#if SWAPPER_BLOCK_SIZE > SEGMENT_ALIGN
-#define EARLY_SEGMENT_EXTRA_PAGES (KERNEL_SEGMENT_COUNT + 1)
+#define EARLY_SEGMENT_EXTRA_PAGES (KERNEL_SEGMENT_COUNT + 2)
/*
* The initial ID map consists of the kernel image, mapped as two separate
* segments, and may appear misaligned wrt the swapper block size. This means
and add a line
Fixes: 5973a62efa34 ("arm64: map [_text, _stext) virtual address range non-executable+read-only")
On Wed, Apr 29, 2026 at 5:28 PM Ard Biesheuvel <ardb@kernel.org> wrote:
>
> Hello Zhaoyang,
>
> On Wed, 29 Apr 2026, at 08:17, zhaoyang.huang wrote:
> > From: Zhaoyang Huang <zhaoyang.huang@unisoc.com>
> >
> > During debug of a kernel panic, we find that the pte_t of the final
> > part of [data, end] segment got overflow to the next page of
> > init_pg_end[1] which is the gap page before early_init_stack[2].
> > This should be introduced by the KERNEL_SEGMENT_COUNT's value is 5
> > which should be 6 as map_segment are called 6 times for the segments
> > of (text, stext, rodata, inittext, initdata, data+bss)
> >
> > [1]
> > crash_arm64_v9.0.1> vtop ffffffed00601000
> > VIRTUAL PHYSICAL
> > ffffffed00601000 83401000
> >
> > PAGE DIRECTORY: ffffffecffd62000
> > PGD: ffffffecffd62da0 => 10000000833fb003
> > PMD: ffffff80033fb018 => 10000000833fe003
> > PTE: ffffff80033fe008 => 68000083401f03
> > PAGE: 83401000
> >
> > PTE PHYSICAL FLAGS
> > 68000083401f03 83401000 (VALID|SHARED|AF|NG|PXN|UXN)
> >
> > PAGE PHYSICAL MAPPING INDEX CNT FLAGS
> > fffffffec00d0040 83401000 0 0 1 4000 reserved
> >
> > [2]
> > ffffffed002c8000 (r) __pi__data
> > ffffffed0054e000 (d) __pi___bss_start
> > ffffffed005f5000 (b) __pi_init_pg_dir
> > ffffffed005fe000 (b) __pi_init_pg_end
> > ffffffed005ff000 (B) early_init_stack
> > ffffffed00608000 (b) __pi__end
> >
> > Signed-off-by: Zhaoyang Huang <zhaoyang.huang@unisoc.com>
> > ---
> > arch/arm64/include/asm/kernel-pgtable.h | 4 ++--
> > 1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/arch/arm64/include/asm/kernel-pgtable.h
> > b/arch/arm64/include/asm/kernel-pgtable.h
> > index 74a4f738c5f5..14dd1c52552a 100644
> > --- a/arch/arm64/include/asm/kernel-pgtable.h
> > +++ b/arch/arm64/include/asm/kernel-pgtable.h
> > @@ -64,8 +64,8 @@
> > #define INIT_IDMAP_FDT_PAGES (EARLY_PAGES(INIT_IDMAP_PGTABLE_LEVELS,
> > 0UL, UL(MAX_FDT_SIZE), 1) - 1)
> > #define INIT_IDMAP_FDT_SIZE ((INIT_IDMAP_FDT_PAGES +
> > EARLY_IDMAP_EXTRA_FDT_PAGES) * PAGE_SIZE)
> >
> > -/* The number of segments in the kernel image (text, rodata, inittext,
> > initdata, data+bss) */
> > -#define KERNEL_SEGMENT_COUNT 5
> > +/* The number of segments in the kernel image (text, stext, rodata,
> > inittext, initdata, data+bss) */
> > +#define KERNEL_SEGMENT_COUNT 6
> >
> > #if SWAPPER_BLOCK_SIZE > SEGMENT_ALIGN
> > #define EARLY_SEGMENT_EXTRA_PAGES (KERNEL_SEGMENT_COUNT + 1)
>
> I think the better fix would be
>
> --- a/arch/arm64/include/asm/kernel-pgtable.h
> +++ b/arch/arm64/include/asm/kernel-pgtable.h
> @@ -68,7 +68,7 @@
> #define KERNEL_SEGMENT_COUNT 5
>
> #if SWAPPER_BLOCK_SIZE > SEGMENT_ALIGN
> -#define EARLY_SEGMENT_EXTRA_PAGES (KERNEL_SEGMENT_COUNT + 1)
> +#define EARLY_SEGMENT_EXTRA_PAGES (KERNEL_SEGMENT_COUNT + 2)
Thanks for the comment. This makes sense since KERNEL_SEGMENT_COUNT is
also used for defining vmlinux_seg[] in declare_kernel_vmas.
> /*
> * The initial ID map consists of the kernel image, mapped as two separate
> * segments, and may appear misaligned wrt the swapper block size. This means
>
> and add a line
>
> Fixes: 5973a62efa34 ("arm64: map [_text, _stext) virtual address range non-executable+read-only")
>
>
On Thu, Apr 30, 2026 at 9:29 AM Zhaoyang Huang <huangzhaoyang@gmail.com> wrote:
>
> On Wed, Apr 29, 2026 at 5:28 PM Ard Biesheuvel <ardb@kernel.org> wrote:
> >
> > Hello Zhaoyang,
> >
> > On Wed, 29 Apr 2026, at 08:17, zhaoyang.huang wrote:
> > > From: Zhaoyang Huang <zhaoyang.huang@unisoc.com>
> > >
> > > During debug of a kernel panic, we find that the pte_t of the final
> > > part of [data, end] segment got overflow to the next page of
> > > init_pg_end[1] which is the gap page before early_init_stack[2].
> > > This should be introduced by the KERNEL_SEGMENT_COUNT's value is 5
> > > which should be 6 as map_segment are called 6 times for the segments
> > > of (text, stext, rodata, inittext, initdata, data+bss)
> > >
> > > [1]
> > > crash_arm64_v9.0.1> vtop ffffffed00601000
> > > VIRTUAL PHYSICAL
> > > ffffffed00601000 83401000
> > >
> > > PAGE DIRECTORY: ffffffecffd62000
> > > PGD: ffffffecffd62da0 => 10000000833fb003
> > > PMD: ffffff80033fb018 => 10000000833fe003
> > > PTE: ffffff80033fe008 => 68000083401f03
> > > PAGE: 83401000
> > >
> > > PTE PHYSICAL FLAGS
> > > 68000083401f03 83401000 (VALID|SHARED|AF|NG|PXN|UXN)
> > >
> > > PAGE PHYSICAL MAPPING INDEX CNT FLAGS
> > > fffffffec00d0040 83401000 0 0 1 4000 reserved
> > >
> > > [2]
> > > ffffffed002c8000 (r) __pi__data
> > > ffffffed0054e000 (d) __pi___bss_start
> > > ffffffed005f5000 (b) __pi_init_pg_dir
> > > ffffffed005fe000 (b) __pi_init_pg_end
> > > ffffffed005ff000 (B) early_init_stack
> > > ffffffed00608000 (b) __pi__end
> > >
> > > Signed-off-by: Zhaoyang Huang <zhaoyang.huang@unisoc.com>
> > > ---
> > > arch/arm64/include/asm/kernel-pgtable.h | 4 ++--
> > > 1 file changed, 2 insertions(+), 2 deletions(-)
> > >
> > > diff --git a/arch/arm64/include/asm/kernel-pgtable.h
> > > b/arch/arm64/include/asm/kernel-pgtable.h
> > > index 74a4f738c5f5..14dd1c52552a 100644
> > > --- a/arch/arm64/include/asm/kernel-pgtable.h
> > > +++ b/arch/arm64/include/asm/kernel-pgtable.h
> > > @@ -64,8 +64,8 @@
> > > #define INIT_IDMAP_FDT_PAGES (EARLY_PAGES(INIT_IDMAP_PGTABLE_LEVELS,
> > > 0UL, UL(MAX_FDT_SIZE), 1) - 1)
> > > #define INIT_IDMAP_FDT_SIZE ((INIT_IDMAP_FDT_PAGES +
> > > EARLY_IDMAP_EXTRA_FDT_PAGES) * PAGE_SIZE)
> > >
> > > -/* The number of segments in the kernel image (text, rodata, inittext,
> > > initdata, data+bss) */
> > > -#define KERNEL_SEGMENT_COUNT 5
> > > +/* The number of segments in the kernel image (text, stext, rodata,
> > > inittext, initdata, data+bss) */
> > > +#define KERNEL_SEGMENT_COUNT 6
> > >
> > > #if SWAPPER_BLOCK_SIZE > SEGMENT_ALIGN
> > > #define EARLY_SEGMENT_EXTRA_PAGES (KERNEL_SEGMENT_COUNT + 1)
> >
> > I think the better fix would be
> >
> > --- a/arch/arm64/include/asm/kernel-pgtable.h
> > +++ b/arch/arm64/include/asm/kernel-pgtable.h
> > @@ -68,7 +68,7 @@
> > #define KERNEL_SEGMENT_COUNT 5
> >
> > #if SWAPPER_BLOCK_SIZE > SEGMENT_ALIGN
> > -#define EARLY_SEGMENT_EXTRA_PAGES (KERNEL_SEGMENT_COUNT + 1)
> > +#define EARLY_SEGMENT_EXTRA_PAGES (KERNEL_SEGMENT_COUNT + 2)
> Thanks for the comment. This makes sense since KERNEL_SEGMENT_COUNT is
> also used for defining vmlinux_seg[] in declare_kernel_vmas.
Is the following fix more reasonable, since it makes both map_segment
and declare_kernel_vmas compatible with the value 6?
-/* The number of segments in the kernel image (text, rodata,
inittext, initdata, data+bss) */
-#define KERNEL_SEGMENT_COUNT 5
+/* The number of segments in the kernel image (text, stext, rodata,
inittext, initdata, data+bss) */
+#define KERNEL_SEGMENT_COUNT 6
static void __init declare_kernel_vmas(void)
{
- static struct vm_struct vmlinux_seg[KERNEL_SEGMENT_COUNT];
+ /*
+ * [_text, _stext) is mapped in init_pg_dir seperatly while they got
+ * merged into one here
+ */
+ static struct vm_struct vmlinux_seg[KERNEL_SEGMENT_COUNT - 1];
> > /*
> > * The initial ID map consists of the kernel image, mapped as two separate
> > * segments, and may appear misaligned wrt the swapper block size. This means
> >
> > and add a line
> >
> > Fixes: 5973a62efa34 ("arm64: map [_text, _stext) virtual address range non-executable+read-only")
> >
> >
On Wed, Apr 29, 2026 at 2:19 PM zhaoyang.huang <zhaoyang.huang@unisoc.com> wrote: > > From: Zhaoyang Huang <zhaoyang.huang@unisoc.com> > > During debug of a kernel panic, we find that the pte_t of the final > part of [data, end] segment got overflow to the next page of > init_pg_end[1] which is the gap page before early_init_stack[2]. > This should be introduced by the KERNEL_SEGMENT_COUNT's value is 5 > which should be 6 as map_segment are called 6 times for the segments > of (text, stext, rodata, inittext, initdata, data+bss) > > [1] > crash_arm64_v9.0.1> vtop ffffffed00601000 > VIRTUAL PHYSICAL > ffffffed00601000 83401000 > > PAGE DIRECTORY: ffffffecffd62000 > PGD: ffffffecffd62da0 => 10000000833fb003 > PMD: ffffff80033fb018 => 10000000833fe003 > PTE: ffffff80033fe008 => 68000083401f03 > PAGE: 83401000 > > PTE PHYSICAL FLAGS > 68000083401f03 83401000 (VALID|SHARED|AF|NG|PXN|UXN) > > PAGE PHYSICAL MAPPING INDEX CNT FLAGS > fffffffec00d0040 83401000 0 0 1 4000 reserved > > [2] > ffffffed002c8000 (r) __pi__data > ffffffed0054e000 (d) __pi___bss_start > ffffffed005f5000 (b) __pi_init_pg_dir > ffffffed005fe000 (b) __pi_init_pg_end > ffffffed005ff000 (B) early_init_stack > ffffffed00608000 (b) __pi__end > > Signed-off-by: Zhaoyang Huang <zhaoyang.huang@unisoc.com> > --- > arch/arm64/include/asm/kernel-pgtable.h | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/arch/arm64/include/asm/kernel-pgtable.h b/arch/arm64/include/asm/kernel-pgtable.h > index 74a4f738c5f5..14dd1c52552a 100644 > --- a/arch/arm64/include/asm/kernel-pgtable.h > +++ b/arch/arm64/include/asm/kernel-pgtable.h > @@ -64,8 +64,8 @@ > #define INIT_IDMAP_FDT_PAGES (EARLY_PAGES(INIT_IDMAP_PGTABLE_LEVELS, 0UL, UL(MAX_FDT_SIZE), 1) - 1) > #define INIT_IDMAP_FDT_SIZE ((INIT_IDMAP_FDT_PAGES + EARLY_IDMAP_EXTRA_FDT_PAGES) * PAGE_SIZE) > > -/* The number of segments in the kernel image (text, rodata, inittext, initdata, data+bss) */ > -#define KERNEL_SEGMENT_COUNT 5 > +/* The number of segments in the kernel image (text, stext, rodata, inittext, initdata, data+bss) */ > +#define KERNEL_SEGMENT_COUNT 6 > > #if SWAPPER_BLOCK_SIZE > SEGMENT_ALIGN > #define EARLY_SEGMENT_EXTRA_PAGES (KERNEL_SEGMENT_COUNT + 1) I just noticed that the page just behind init_pg_end which I called as guard page is designed as early_init_stack in vmlinux.lds.s. That could explain why I find the strings of aliases within idreg-override.c present in this page. ffffffed005fe000 (b) __pi_init_pg_end ... ffffffed005fec50: 77735f34366d7261 726c3d656876682e arm64_sw.hvhe=lr ffffffed005fec60: 00003d633d723d3d 0000000000000000 ==r=c=.......... ... ffffffed005ff000 (B) early_init_stack
© 2016 - 2026 Red Hat, Inc.