From nobody Mon May 25 01:58:49 2026 Received: from cstnet.cn (smtp81.cstnet.cn [159.226.251.81]) (using TLSv1.2 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A2EFC23C8C7 for ; Tue, 19 May 2026 17:06:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=159.226.251.81 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779210421; cv=none; b=tGmw/kN3EjmbodhcVD9lHW0QHpuTy5SFhEofAKQoHmKGTJgno48McOGkFriN4QsplakRPmnmNFhH1ELVtTjtDk1KP3j7vfTK9C+uxP17PeCdUPujCaC3S87F6c7CA9c4yjkRXynYkf8XiDcONG47akzzKdX/PqNmlg+Sh9f8Xg4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779210421; c=relaxed/simple; bh=XtTsY7EboxGmrh4iJuXgSUO6/5n32pgqe/k4iZfLWEk=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=nYS6/w/PmhF3I7m3VmpA9A/EVZBsnFGwgl+styh1jNxW4FmBqZlI3079t+62lHtszE3rIdXkXya9xYxbzz8ORIcjV4kCNw71rrVmARu57+g08UvrapqUWeyICN/W8a/uWsBQyPl+JdgyOjLl7T4C/hgeJLjtEDkidjtHb8cHJiU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn; spf=pass smtp.mailfrom=iscas.ac.cn; arc=none smtp.client-ip=159.226.251.81 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=iscas.ac.cn Received: from localhost.localdomain (unknown [223.166.95.230]) by APP-03 (Coremail) with SMTP id rQCowAAHKN+kmAxqeRCREQ--.741S2; Wed, 20 May 2026 01:06:44 +0800 (CST) From: Han Gao To: Paul Walmsley , Palmer Dabbelt , Albert Ou , Alexandre Ghiti , Song Shuai , =?UTF-8?q?Bj=C3=B6rn=20T=C3=B6pel?= , Breno Leitao , Kees Cook , Han Gao Cc: linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org, Han Gao Subject: [PATCH] riscv: kexec_file: Constrain segment placement to direct map Date: Wed, 20 May 2026 01:06:41 +0800 Message-ID: <20260519170641.123517-1-gaohan@iscas.ac.cn> X-Mailer: git-send-email 2.47.3 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: rQCowAAHKN+kmAxqeRCREQ--.741S2 X-Coremail-Antispam: 1UD129KBjvJXoW7tw43GrWUAr15Zw47CF1DAwb_yoW8Aw4rpa n8CF18XrZ5ZrySyFWxZr109345Wws5Gw42qrWUuryFv3ZxKw1DJr4q93ZIqr1UKFsY9FnY qryakFZIkrs5JaDanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUU9Y14x267AKxVW8JVW5JwAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2ocxC64kIII0Yj41l84x0c7CEw4AK67xGY2AK02 1l84ACjcxK6xIIjxv20xvE14v26r4j6ryUM28EF7xvwVC0I7IYx2IY6xkF7I0E14v26r4j 6F4UM28EF7xvwVC2z280aVAFwI0_Cr0_Gr1UM28EF7xvwVC2z280aVCY1x0267AKxVW8JV W8Jr1le2I262IYc4CY6c8Ij28IcVAaY2xG8wAqx4xG64xvF2IEw4CE5I8CrVC2j2WlYx0E 2Ix0cI8IcVAFwI0_JrI_JrylYx0Ex4A2jsIE14v26r1j6r4UMcvjeVCFs4IE7xkEbVWUJV W8JwACjcxG0xvY0x0EwIxGrwACjI8F5VA0II8E6IAqYI8I648v4I1lFIxGxcIEc7CjxVA2 Y2ka0xkIwI1lc7CjxVAaw2AFwI0_Jw0_GFyl42xK82IYc2Ij64vIr41l4I8I3I0E4IkC6x 0Yz7v_Jr0_Gr1lx2IqxVAqx4xG67AKxVWUJVWUGwC20s026x8GjcxK67AKxVWUGVWUWwC2 zVAF1VAY17CE14v26r1q6r43MIIYrxkI7VAKI48JMIIF0xvE2Ix0cI8IcVAFwI0_Jr0_JF 4lIxAIcVC0I7IYx2IY6xkF7I0E14v26r4j6F4UMIIF0xvE42xK8VAvwI8IcIk0rVWUJVWU CwCI42IY6I8E87Iv67AKxVWUJVW8JwCI42IY6I8E87Iv6xkF7I0E14v26r4j6r4UJbIYCT nIWIevJa73UjIFyTuYvjfUFg4SDUUUU X-CM-SenderInfo: xjdrxt3q6l2u1dvotugofq/1tbiBwsMDGoMfGlJ3gAAso Content-Type: text/plain; charset="utf-8" When kexec_file_load places segments with buf_max=3DULONG_MAX and top_down=3Dtrue, they land at the highest available physical addresses. On RISC-V the size of the linear mapping is determined by the active VM mode: SV39 caps the direct map at roughly 128GB, while SV48/SV57 extend the range substantially further. When the installed physical memory exceeds the direct map size of the active mode, top-down placement puts DTB/initrd at physical addresses outside the linearly mapped region. The kexec'd kernel cannot reach them during early boot, triggering a page fault at memcmp in start_kernel. Fix by constraining buf_max to PFN_PHYS(max_low_pfn), which reflects the runtime direct map boundary for the active VM mode (SV39/SV48/ SV57). This keeps all kexec segments within the linearly mapped region while preserving the upstream top_down allocation strategy. Signed-off-by: Han Gao --- arch/riscv/kernel/machine_kexec_file.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/riscv/kernel/machine_kexec_file.c b/arch/riscv/kernel/mac= hine_kexec_file.c index 54e2d9552e93..59d4bbc848a8 100644 --- a/arch/riscv/kernel/machine_kexec_file.c +++ b/arch/riscv/kernel/machine_kexec_file.c @@ -13,6 +13,7 @@ #include #include #include +#include #include #include #include @@ -266,7 +267,7 @@ int load_extra_segments(struct kimage *image, unsigned = long kernel_start, =20 kbuf.image =3D image; kbuf.buf_min =3D kernel_start + kernel_len; - kbuf.buf_max =3D ULONG_MAX; + kbuf.buf_max =3D PFN_PHYS(max_low_pfn); =20 #ifdef CONFIG_CRASH_DUMP /* Add elfcorehdr */ --=20 2.47.3