[PATCH 0/2] riscv: fix kprobes on minimal kernel configs

[PATCH 0/2] riscv: fix kprobes on minimal kernel configs

[Xiaofeng Yuan]

When building with an allnoconfig-derived minimal configuration
(without CONFIG_STRICT_MODULE_RWX), kprobes fails because
instruction slot pages from EXECMEM_KPROBES are read-only and
patch_map() bypasses the fixmap writable alias.

These two patches fix the infrastructure.

Xiaofeng Yuan (2):
  riscv: mm: make EXECMEM_KPROBES writable without ARCH_HAS_EXECMEM_ROX
  riscv: patch: skip fixmap mapping when kernel text is already writable

Xiaofeng Yuan (2):
  riscv: mm: make EXECMEM_KPROBES writable without ARCH_HAS_EXECMEM_ROX
  riscv: patch: skip fixmap mapping when kernel text is already writable

 arch/riscv/kernel/patch.c | 3 ++-
 arch/riscv/mm/init.c      | 4 +++-
 2 files changed, 5 insertions(+), 2 deletions(-)

-- 
2.43.0

[PATCH 1/2] riscv: mm: make EXECMEM_KPROBES writable without ARCH_HAS_EXECMEM_ROX

[Xiaofeng Yuan]

When CONFIG_ARCH_HAS_EXECMEM_ROX is not set, execmem cannot create
temporary writable mappings for read-only executable pages. In this
case, the execmem ranges must already have writable permissions.

Currently EXECMEM_KPROBES unconditionally uses PAGE_KERNEL_READ_EXEC,
which causes kprobe instruction slot writes to trigger page faults
on systems where CONFIG_STRICT_MODULE_RWX is not enabled.

Fix this by using PAGE_KERNEL_EXEC when CONFIG_ARCH_HAS_EXECMEM_ROX
is not available.

Signed-off-by: Xiaofeng Yuan <xiaofengmian@163.com>
---
 arch/riscv/mm/init.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c
index 5b1b3c88b..21794e7bb 100644
--- a/arch/riscv/mm/init.c
+++ b/arch/riscv/mm/init.c
@@ -1457,7 +1457,9 @@ struct execmem_info __init *execmem_arch_setup(void)
 			[EXECMEM_KPROBES] = {
 				.start	= VMALLOC_START,
 				.end	= VMALLOC_END,
-				.pgprot	= PAGE_KERNEL_READ_EXEC,
+				.pgprot	= IS_ENABLED(CONFIG_ARCH_HAS_EXECMEM_ROX) ?
+					  PAGE_KERNEL_READ_EXEC :
+					  PAGE_KERNEL_EXEC,
 				.alignment = 1,
 			},
 			[EXECMEM_BPF] = {
-- 
2.43.0

[PATCH 2/2] riscv: patch: skip fixmap mapping when kernel text is already writable

[Xiaofeng Yuan]

Currently patch_map() always creates a temporary writable mapping via
fixmap for kernel text addresses, even when CONFIG_STRICT_KERNEL_RWX
is disabled and the kernel text is already mapped with _PAGE_WRITE.

This is unnecessary overhead at best, and on minimal configurations
it can cause page faults.

Skip the fixmap path for kernel text when CONFIG_STRICT_KERNEL_RWX
is not enabled, since the text pages are already writable in this case.

Signed-off-by: Xiaofeng Yuan <xiaofengmian@163.com>
---
 arch/riscv/kernel/patch.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/riscv/kernel/patch.c b/arch/riscv/kernel/patch.c
index 16b243376..b6e8e1e83 100644
--- a/arch/riscv/kernel/patch.c
+++ b/arch/riscv/kernel/patch.c
@@ -44,7 +44,8 @@ static __always_inline void *patch_map(void *addr, const unsigned int fixmap)
 	uintptr_t uintaddr = (uintptr_t) addr;
 	phys_addr_t phys;
 
-	if (core_kernel_text(uintaddr) || is_kernel_exittext(uintaddr)) {
+	if (IS_ENABLED(CONFIG_STRICT_KERNEL_RWX) &&
+	    (core_kernel_text(uintaddr) || is_kernel_exittext(uintaddr))) {
 		phys = __pa_symbol(addr);
 	} else if (IS_ENABLED(CONFIG_STRICT_MODULE_RWX)) {
 		struct page *page = vmalloc_to_page(addr);
-- 
2.43.0

Re: [PATCH 1/2] riscv: mm: make EXECMEM_KPROBES writable without ARCH_HAS_EXECMEM_ROX

[Nam Cao]

Xiaofeng Yuan <xiaofengmian@163.com> writes:
> diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c
> index 5b1b3c88b..21794e7bb 100644
> --- a/arch/riscv/mm/init.c
> +++ b/arch/riscv/mm/init.c
> @@ -1457,7 +1457,9 @@ struct execmem_info __init *execmem_arch_setup(void)
>  			[EXECMEM_KPROBES] = {
>  				.start	= VMALLOC_START,
>  				.end	= VMALLOC_END,
> -				.pgprot	= PAGE_KERNEL_READ_EXEC,
> +				.pgprot	= IS_ENABLED(CONFIG_ARCH_HAS_EXECMEM_ROX) ?
> +					  PAGE_KERNEL_READ_EXEC :
> +					  PAGE_KERNEL_EXEC,
>  				.alignment = 1,
>  			},
>  			[EXECMEM_BPF] = {

CONFIG_ARCH_HAS_EXECMEM_ROX=n for RISC-V, so this is just

	.pgprot	= PAGE_KERNEL_EXEC,

Since this is only needed when CONFIG_STRICT_MODULE_RWX=n, shouldn't the
condition be based on that instead?

Nam