[PATCH v4 0/2] riscv: fix kprobes on minimal kernel configs

[PATCH v4 0/2] riscv: fix kprobes on minimal kernel configs

[Xiaofeng Yuan]

When building with an allnoconfig-derived minimal configuration
(without CONFIG_STRICT_MODULE_RWX), kprobes fails because
instruction slot pages from EXECMEM_KPROBES are read-only and
patch_map() bypasses the fixmap writable alias.

These two patches fix the infrastructure.

PATCH 1/2 changelog:
  v2: use CONFIG_STRICT_MODULE_RWX instead of ARCH_HAS_EXECMEM_ROX
  v3: add commit description
  v4: fix indent alignment

PATCH 2/2 changelog:
  v2: add commit description
  v3: early return when !CONFIG_STRICT_MODULE_RWX

Xiaofeng Yuan (2):
  riscv: mm: make EXECMEM_KPROBES writable without
    CONFIG_STRICT_MODULE_RWX
  riscv: patch: skip fixmap mapping when kernel text is already
    writable

 arch/riscv/kernel/patch.c | 4 ++--
 arch/riscv/mm/init.c      | 4 +++-
 2 files changed, 6 insertions(+), 2 deletions(-)

--
2.43.0


_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

[PATCH v4 1/2] riscv: mm: make EXECMEM_KPROBES writable without CONFIG_STRICT_MODULE_RWX

[Xiaofeng Yuan]

When CONFIG_STRICT_MODULE_RWX is not set, execmem cannot create
temporary writable mappings for read-only executable pages. In this
case, the execmem ranges must already have writable permissions.

Currently EXECMEM_KPROBES unconditionally uses PAGE_KERNEL_READ_EXEC,
which causes kprobe instruction slot writes to trigger page faults
on systems where CONFIG_STRICT_MODULE_RWX is not enabled.

Fix this by using PAGE_KERNEL_EXEC when CONFIG_STRICT_MODULE_RWX
is not available.

Signed-off-by: Xiaofeng Yuan <xiaofengmian@163.com>
---
v2: use CONFIG_STRICT_MODULE_RWX instead of CONFIG_ARCH_HAS_EXECMEM_ROX (per Nam Cao's review)
v3: add commit description
v4: fix indent alignment (per Nam Cao's review)
diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c
index 5b1b3c88b4..7951d72a12 100644
--- a/arch/riscv/mm/init.c
+++ b/arch/riscv/mm/init.c
@@ -1457,7 +1457,9 @@ struct execmem_info __init *execmem_arch_setup(void)
 			[EXECMEM_KPROBES] = {
 				.start	= VMALLOC_START,
 				.end	= VMALLOC_END,
-				.pgprot	= PAGE_KERNEL_READ_EXEC,
+				.pgprot	= IS_ENABLED(CONFIG_STRICT_MODULE_RWX) ?
+					  PAGE_KERNEL_READ_EXEC :
+					  PAGE_KERNEL_EXEC,
 				.alignment = 1,
 			},
 			[EXECMEM_BPF] = {
-- 
2.43.0


_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

[PATCH v4 2/2] riscv: patch: skip fixmap mapping when kernel text is already writable

[Xiaofeng Yuan]

Currently patch_map() always creates a temporary writable mapping via
fixmap for kernel text addresses, even when CONFIG_STRICT_MODULE_RWX
is disabled and the kernel text is already mapped with _PAGE_WRITE.

This is unnecessary overhead at best, and on minimal configurations
it can cause page faults.

Skip the fixmap path for kernel text when CONFIG_STRICT_MODULE_RWX
is not enabled, since the text pages are already writable in this case.

Signed-off-by: Xiaofeng Yuan <xiaofengmian@163.com>
---
v2: add commit description
v3: early return when !CONFIG_STRICT_MODULE_RWX (per Nam Cao's suggestion)
diff --git a/arch/riscv/kernel/patch.c b/arch/riscv/kernel/patch.c
index 16b243376f..caef41d5ef 100644
--- a/arch/riscv/kernel/patch.c
+++ b/arch/riscv/kernel/patch.c
@@ -44,15 +44,16 @@ static __always_inline void *patch_map(void *addr, const unsigned int fixmap)
 	uintptr_t uintaddr = (uintptr_t) addr;
 	phys_addr_t phys;
 
+	if (!IS_ENABLED(CONFIG_STRICT_MODULE_RWX))
+		return addr;
+
 	if (core_kernel_text(uintaddr) || is_kernel_exittext(uintaddr)) {
 		phys = __pa_symbol(addr);
-	} else if (IS_ENABLED(CONFIG_STRICT_MODULE_RWX)) {
+	} else {
 		struct page *page = vmalloc_to_page(addr);
 
 		BUG_ON(!page);
 		phys = page_to_phys(page) + offset_in_page(addr);
-	} else {
-		return addr;
 	}
 
 	return (void *)set_fixmap_offset(fixmap, phys);
-- 
2.43.0


_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

Re: [PATCH v4 2/2] riscv: patch: skip fixmap mapping when kernel text is already writable

[Klara Modin]

Hi,

On 2026-07-20 03:22:57 +0000, Xiaofeng Yuan wrote:
> Currently patch_map() always creates a temporary writable mapping via
> fixmap for kernel text addresses, even when CONFIG_STRICT_MODULE_RWX
> is disabled and the kernel text is already mapped with _PAGE_WRITE.
> 
> This is unnecessary overhead at best, and on minimal configurations
> it can cause page faults.
> 
> Skip the fixmap path for kernel text when CONFIG_STRICT_MODULE_RWX
> is not enabled, since the text pages are already writable in this case.
> 
> Signed-off-by: Xiaofeng Yuan <xiaofengmian@163.com>
> ---
> v2: add commit description
> v3: early return when !CONFIG_STRICT_MODULE_RWX (per Nam Cao's suggestion)
> diff --git a/arch/riscv/kernel/patch.c b/arch/riscv/kernel/patch.c
> index 16b243376f..caef41d5ef 100644
> --- a/arch/riscv/kernel/patch.c
> +++ b/arch/riscv/kernel/patch.c
> @@ -44,15 +44,16 @@ static __always_inline void *patch_map(void *addr, const unsigned int fixmap)
>  	uintptr_t uintaddr = (uintptr_t) addr;
>  	phys_addr_t phys;
>  
> +	if (!IS_ENABLED(CONFIG_STRICT_MODULE_RWX))
> +		return addr;

Is this correct when STRICT_KERNEL_RWX is set and not STRICT_MODULE_RWX
(e.g. when modules are not enabled)?

> +
>  	if (core_kernel_text(uintaddr) || is_kernel_exittext(uintaddr)) {
>  		phys = __pa_symbol(addr);
> -	} else if (IS_ENABLED(CONFIG_STRICT_MODULE_RWX)) {
> +	} else {
>  		struct page *page = vmalloc_to_page(addr);
>  
>  		BUG_ON(!page);
>  		phys = page_to_phys(page) + offset_in_page(addr);
> -	} else {
> -		return addr;
>  	}
>  
>  	return (void *)set_fixmap_offset(fixmap, phys);
> -- 
> 2.43.0
> 

This patch causes the following oops on my BPI-F3:

 Unable to handle kernel paging request at virtual address 0000006789abce0b
 Current swapper/0 pgtable: 4K pagesize, 39-bit VAs, pgdp=0x000000000269d000
 [0000006789abce0b] pgd=0000000040031c01, p4d=0000000040031c01, pud=0000000040031c01, pmd=0000000000000000
 Oops [#1]
 Tainted: [W]=WARN
 Hardware name: Banana Pi BPI-F3 (DT)
 epc : kmem_cache_alloc_lru_noprof (/home/klara/git/linux/trees/bisect/mm/slub.c:4941)
  ra : __d_alloc (/home/klara/git/linux/trees/bisect/fs/dcache.c:1902)
 epc : ffffffff8038379e ra : ffffffff804053b2 sp : ffffffff82203ab0
  gp : ffffffff8248da18 tp : ffffffff822200c0 t0 : ffffffd7010660e8
  t1 : ffffffff921904d0 t2 : 000000005d6ccc9e s0 : ffffffff82203b30
  s1 : 0000000000000000 a0 : 0123456789abcdef a1 : ffffffd700b3f510
  a2 : 0000000000000cc0 a3 : 0000000000000002 a4 : 0000000000000000
  a5 : 0123456700000000 a6 : 00ffffffff899275 a7 : ffffffff82203918
  s2 : 0000000000000000 s3 : ffffffd700b3f000 s4 : ffffffff81a0d848
  s5 : ffffffff82492018 s6 : 0000000000000000 s7 : 00000000000003e8
  s8 : ffffffff814010e0 s9 : 0000000000000000 s10: 0000000000200000
  s11: 00000000024910d8 t3 : 0000000000000014 t4 : 0000000000000026
  t5 : 000000003137ae71 t6 : ffffffff82203b18 ssp : 0000000000000000
 status: 0000000200000120 badaddr: 0000006789abce0b cause: 000000000000000d
 kmem_cache_alloc_lru_noprof (/home/klara/git/linux/trees/bisect/mm/slub.c:4941)
 __d_alloc (/home/klara/git/linux/trees/bisect/fs/dcache.c:1902)
 d_make_root (/home/klara/git/linux/trees/bisect/fs/dcache.c:1999 /home/klara/git/linux/trees/bisect/fs/dcache.c:2213)
 shmem_fill_super (/home/klara/git/linux/trees/bisect/mm/shmem.c:5050)
 get_tree_nodev (/home/klara/git/linux/trees/bisect/fs/super.c:1273 /home/klara/git/linux/trees/bisect/fs/super.c:1292)
 shmem_get_tree (/home/klara/git/linux/trees/bisect/mm/shmem.c:5062)
 vfs_get_tree (/home/klara/git/linux/trees/bisect/fs/super.c:1700)
 fc_mount (/home/klara/git/linux/trees/bisect/fs/namespace.c:1198)
 vfs_kern_mount.part.0 (/home/klara/git/linux/trees/bisect/fs/namespace.c:1236)
 kern_mount (/home/klara/git/linux/trees/bisect/fs/namespace.c:6290 /home/klara/git/linux/trees/bisect/fs/namespace.c:6292)
 shmem_init (/home/klara/git/linux/trees/bisect/mm/shmem.c:5367)
 mnt_init (/home/klara/git/linux/trees/bisect/fs/namespace.c:6274)
 vfs_caches_init (/home/klara/git/linux/trees/bisect/fs/dcache.c:3517)
 start_kernel (/home/klara/git/linux/trees/bisect/init/main.c:1157)
 Code: 0001 0001 0001 7119 f8a2 f4a6 0100 f0ca ecce fc86 (6703) 01c5
 All code
 ========
    0:	0001                	.insn	2, 0x0001
    2:	0001                	.insn	2, 0x0001
    4:	0001                	.insn	2, 0x0001
    6:	7119                	.insn	2, 0x7119
    8:	f8a2                	.insn	2, 0xf8a2
    a:	f4a6                	.insn	2, 0xf4a6
    c:	0100                	.insn	2, 0x0100
    e:	f0ca                	.insn	2, 0xf0ca
   10:	ecce                	.insn	2, 0xecce
   12:	fc86                	.insn	2, 0xfc86
   14:*	01c56703          	lwu	a4,28(a0)		<-- trapping instruction
 
 Code starting with the faulting instruction
 ===========================================
    0:	01c56703          	lwu	a4,28(a0)
 ---[ end trace 0000000000000000 ]---
 Kernel panic - not syncing: Attempted to kill the idle task!

I have MODULES disabled and thus also STRICT_MODULE_RWX disabled, but
still STRICT_KERNEL_RWX enabled. I saw that an earlier version of this
patch[1] instead gated the first branch behind STRICT_KERNEL_RWX. That
version works fine for me.

Regards,
Klara Modin

Link: https://lore.kernel.org/lkml/20260719081037.5749-3-xiaofengmian@163.com [1]

 # bad: [66566bdc5a42d707d4c3f54587333db00e955268] Merge branch 'unstable/spacemit-k1-wdt' into unstable/next-local
 git bisect start 'HEAD'
 # status: waiting for 'good' commit(s), 'bad' commit known
 # good: [f5bbbfec59b4e2fb7520a91de3df8a6174325d6a] Merge tag 'probes-fixes-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
 git bisect good f5bbbfec59b4e2fb7520a91de3df8a6174325d6a
 # bad: [9eba0000697167ff6960428f7401e9f65f7abba3] Merge branch 'libcrypto-next' of https://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux.git
 git bisect bad 9eba0000697167ff6960428f7401e9f65f7abba3
 # bad: [6a66dbb2b9b0a0a5b1225052267c0eaedf34492d] Merge branch 'xtensa-for-next' of https://github.com/jcmvbkbc/linux-xtensa.git
 git bisect bad 6a66dbb2b9b0a0a5b1225052267c0eaedf34492d
 # good: [3787df98a48a0e699f6a06d4a42fc20597368db1] Merge branch 'for-next/core' of https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
 git bisect good 3787df98a48a0e699f6a06d4a42fc20597368db1
 # good: [aeba6e4f8ace1a3f016feb64c0a417c7ddcbcf6b] Merge tag 'qcom-arm64-for-7.3-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/dt
 git bisect good aeba6e4f8ace1a3f016feb64c0a417c7ddcbcf6b
 # good: [15213090630d0a4417dbcdef0de776cd2fac0fac] Merge branch 'for-next' of https://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap.git
 git bisect good 15213090630d0a4417dbcdef0de776cd2fac0fac
 # good: [e347a696fd95bc9b47e23e3d8ac7f6263ee502b2] Merge branch 'for-next' of https://git.kernel.org/pub/scm/linux/kernel/git/abelvesa/linux.git
 git bisect good e347a696fd95bc9b47e23e3d8ac7f6263ee502b2
 # good: [b7307ccce8238c792fb3a6412ca5cac9ba8784bc] Merge branch 'next' of https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git
 git bisect good b7307ccce8238c792fb3a6412ca5cac9ba8784bc
 # good: [b5d4268affa543793ccaf838a10915c2c9f0db1c] Merge branch 'features' into for-next
 git bisect good b5d4268affa543793ccaf838a10915c2c9f0db1c
 # good: [ebdec8d2c156b8e662cb350ce05b0f92275f6ffd] RISC-V: Add Ssccfg/Smcdeleg ISA extension definition and parsing
 git bisect good ebdec8d2c156b8e662cb350ce05b0f92275f6ffd
 # good: [f61959a3a8b5522eb43cf71f293e091417bbf11c] riscv: Add Ziccamoa, Ziccif, Ziccrse, and Za64rs to cpufeature and hwprobe
 git bisect good f61959a3a8b5522eb43cf71f293e091417bbf11c
 # bad: [54fefa110db4a407d96625b66a76d874713ddae2] riscv: patch: skip fixmap mapping when kernel text is already writable
 git bisect bad 54fefa110db4a407d96625b66a76d874713ddae2
 # good: [42cd1e1fc8995ec7ed5cc61957fc503eb065e0eb] riscv: alternative: Also patch the compat vDSO
 git bisect good 42cd1e1fc8995ec7ed5cc61957fc503eb065e0eb
 # good: [83ba459c9b5893590fd47177363b08b453a86168] riscv: mm: make EXECMEM_KPROBES writable without CONFIG_STRICT_MODULE_RWX
 git bisect good 83ba459c9b5893590fd47177363b08b453a86168
 # first 'bad' commit: [54fefa110db4a407d96625b66a76d874713ddae2] riscv: patch: skip fixmap mapping when kernel text is already writable
 

_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

Re: [PATCH v4 2/2] riscv: patch: skip fixmap mapping when kernel text is already writable

[Nam Cao]

Klara Modin <klara@kasm.eu> writes:
> I have MODULES disabled and thus also STRICT_MODULE_RWX disabled, but
> still STRICT_KERNEL_RWX enabled. I saw that an earlier version of this
> patch[1] instead gated the first branch behind STRICT_KERNEL_RWX. That
> version works fine for me.

Urgh, I got confused between STRICT_MODULE_RWX and STRICT_KERNEL_RWX, I
suggested the final version.

Xiaofeng, can you send a patch?

Nam

_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

Re: [PATCH v4 0/2] riscv: fix kprobes on minimal kernel configs

[Nam Cao]

Xiaofeng Yuan <xiaofengmian@163.com> writes:
> When building with an allnoconfig-derived minimal configuration
> (without CONFIG_STRICT_MODULE_RWX), kprobes fails because
> instruction slot pages from EXECMEM_KPROBES are read-only and
> patch_map() bypasses the fixmap writable alias.
>
> These two patches fix the infrastructure.

Reviewed-by: Nam Cao <namcao@linutronix.de>

_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

Re: [PATCH v4 0/2] riscv: fix kprobes on minimal kernel configs

[Paul Walmsley]

On Mon, 20 Jul 2026, Xiaofeng Yuan wrote:

> When building with an allnoconfig-derived minimal configuration
> (without CONFIG_STRICT_MODULE_RWX), kprobes fails because
> instruction slot pages from EXECMEM_KPROBES are read-only and
> patch_map() bypasses the fixmap writable alias.
> 
> These two patches fix the infrastructure.

Thanks, queued for v7.3.


- Paul

_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv