[PATCH v5 0/2] riscv: fix text patching on minimal kernel configs

[PATCH v5 0/2] riscv: fix text patching on minimal kernel configs

[Xiaofeng Yuan]

This series fixes two related issues that break kprobes and kernel text
patching on RISC-V configurations where CONFIG_STRICT_MODULE_RWX is not
available (e.g. CONFIG_MODULES=n).

Patch 1 makes the EXECMEM_KPROBES range writable when
CONFIG_STRICT_MODULE_RWX is disabled, so kprobe instruction slot writes
do not fault on read-only executable pages.

Patch 2 makes patch_map() skip the temporary fixmap mapping when the
kernel text is already writable, i.e. when CONFIG_STRICT_KERNEL_RWX is
disabled. The module text path is still gated on CONFIG_STRICT_MODULE_RWX.

Changes since v4:
- 2/2: gate the kernel text fixmap on CONFIG_STRICT_KERNEL_RWX instead of
  returning early on !CONFIG_STRICT_MODULE_RWX. The v4 early return broke
  configs with CONFIG_MODULES=n, where CONFIG_STRICT_MODULE_RWX is
  unavailable but CONFIG_STRICT_KERNEL_RWX is still enabled and the kernel
  text is read-only, causing a boot-time kernel panic on BPI-F3 and RZ/Five
  (reported by Klara Modin and Lad Prabhakar).

Xiaofeng Yuan (2):
  riscv: mm: make EXECMEM_KPROBES writable without
    CONFIG_STRICT_MODULE_RWX
  riscv: patch: skip fixmap mapping when kernel text is already writable

 arch/riscv/kernel/patch.c | 2 ++
 arch/riscv/mm/init.c      | 4 +++-
 2 files changed, 5 insertions(+), 1 deletion(-)

-- 
2.43.0

[PATCH v5 1/2] riscv: mm: make EXECMEM_KPROBES writable without CONFIG_STRICT_MODULE_RWX

[Xiaofeng Yuan]

When CONFIG_STRICT_MODULE_RWX is not set, execmem cannot create
temporary writable mappings for read-only executable pages. In this
case, the execmem ranges must already have writable permissions.

Currently EXECMEM_KPROBES unconditionally uses PAGE_KERNEL_READ_EXEC,
which causes kprobe instruction slot writes to trigger page faults
on systems where CONFIG_STRICT_MODULE_RWX is not enabled.

Fix this by using PAGE_KERNEL_EXEC when CONFIG_STRICT_MODULE_RWX
is not available.

Signed-off-by: Xiaofeng Yuan <xiaofengmian@163.com>
---
 arch/riscv/mm/init.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c
index 85bdcce63a..b084a72e5d 100644
--- a/arch/riscv/mm/init.c
+++ b/arch/riscv/mm/init.c
@@ -1462,7 +1462,9 @@ struct execmem_info __init *execmem_arch_setup(void)
 			[EXECMEM_KPROBES] = {
 				.start	= VMALLOC_START,
 				.end	= VMALLOC_END,
-				.pgprot	= PAGE_KERNEL_READ_EXEC,
+				.pgprot	= IS_ENABLED(CONFIG_STRICT_MODULE_RWX) ?
+					  PAGE_KERNEL_READ_EXEC :
+					  PAGE_KERNEL_EXEC,
 				.alignment = 1,
 			},
 			[EXECMEM_BPF] = {
-- 
2.43.0

[PATCH v5 2/2] riscv: patch: skip fixmap mapping when kernel text is already writable

[Xiaofeng Yuan]

patch_map() always creates a temporary writable mapping via fixmap for
kernel text addresses, even when CONFIG_STRICT_KERNEL_RWX is disabled
and the kernel text is already mapped with _PAGE_WRITE.

This is unnecessary overhead at best, and on minimal configurations
it can cause page faults.

Skip the fixmap path for kernel text when CONFIG_STRICT_KERNEL_RWX
is not enabled, since the text pages are already writable in that case.
The module text path is already gated on CONFIG_STRICT_MODULE_RWX and
is kept unchanged.

Reported-by: Klara Modin <klara@kasm.eu>
Closes: https://lore.kernel.org/all/ant_8TaBbov_GS4i@soda.int.kasm.eu/
Reported-by: Lad Prabhakar <prabhakar.csengg@gmail.com>
Closes: https://lore.kernel.org/all/CA+V-a8tQK8rih9SGGTyqrEBGpNkx4H0eX2YccCRrgkVAPr+EBg@mail.gmail.com/
---
v5: fix the fixmap gating for kernel text. The v4 early return on
    CONFIG_STRICT_MODULE_RWX wrongly skipped the fixmap for kernel text
    too, which panics on configs with CONFIG_MODULES=n where
    CONFIG_STRICT_MODULE_RWX is unavailable but CONFIG_STRICT_KERNEL_RWX
    is still enabled and kernel text is read-only.
v3: early return when !CONFIG_STRICT_MODULE_RWX (per Nam Cao's suggestion)
v2: add commit description

Signed-off-by: Xiaofeng Yuan <xiaofengmian@163.com>
---
 arch/riscv/kernel/patch.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/riscv/kernel/patch.c b/arch/riscv/kernel/patch.c
index 16b243376f..2239c28981 100644
--- a/arch/riscv/kernel/patch.c
+++ b/arch/riscv/kernel/patch.c
@@ -45,6 +45,8 @@ static __always_inline void *patch_map(void *addr, const unsigned int fixmap)
 	phys_addr_t phys;
 
 	if (core_kernel_text(uintaddr) || is_kernel_exittext(uintaddr)) {
+		if (!IS_ENABLED(CONFIG_STRICT_KERNEL_RWX))
+			return addr;
 		phys = __pa_symbol(addr);
 	} else if (IS_ENABLED(CONFIG_STRICT_MODULE_RWX)) {
 		struct page *page = vmalloc_to_page(addr);
-- 
2.43.0

Re: [PATCH v5 2/2] riscv: patch: skip fixmap mapping when kernel text is already writable

[Klara Modin]

On 2026-08-14 08:27:42 +0000, Xiaofeng Yuan wrote:
> patch_map() always creates a temporary writable mapping via fixmap for
> kernel text addresses, even when CONFIG_STRICT_KERNEL_RWX is disabled
> and the kernel text is already mapped with _PAGE_WRITE.
> 
> This is unnecessary overhead at best, and on minimal configurations
> it can cause page faults.
> 
> Skip the fixmap path for kernel text when CONFIG_STRICT_KERNEL_RWX
> is not enabled, since the text pages are already writable in that case.
> The module text path is already gated on CONFIG_STRICT_MODULE_RWX and
> is kept unchanged.
> 
> Reported-by: Klara Modin <klara@kasm.eu>
> Closes: https://lore.kernel.org/all/ant_8TaBbov_GS4i@soda.int.kasm.eu/
> Reported-by: Lad Prabhakar <prabhakar.csengg@gmail.com>
> Closes: https://lore.kernel.org/all/CA+V-a8tQK8rih9SGGTyqrEBGpNkx4H0eX2YccCRrgkVAPr+EBg@mail.gmail.com/
> ---
> v5: fix the fixmap gating for kernel text. The v4 early return on
>     CONFIG_STRICT_MODULE_RWX wrongly skipped the fixmap for kernel text
>     too, which panics on configs with CONFIG_MODULES=n where
>     CONFIG_STRICT_MODULE_RWX is unavailable but CONFIG_STRICT_KERNEL_RWX
>     is still enabled and kernel text is read-only.
> v3: early return when !CONFIG_STRICT_MODULE_RWX (per Nam Cao's suggestion)
> v2: add commit description
> 
> Signed-off-by: Xiaofeng Yuan <xiaofengmian@163.com>

This version works fine for me.

Thanks,
Tested-by: Klara Modin <klarasmodin@gmail.com>

> ---
>  arch/riscv/kernel/patch.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/arch/riscv/kernel/patch.c b/arch/riscv/kernel/patch.c
> index 16b243376f..2239c28981 100644
> --- a/arch/riscv/kernel/patch.c
> +++ b/arch/riscv/kernel/patch.c
> @@ -45,6 +45,8 @@ static __always_inline void *patch_map(void *addr, const unsigned int fixmap)
>  	phys_addr_t phys;
>  
>  	if (core_kernel_text(uintaddr) || is_kernel_exittext(uintaddr)) {
> +		if (!IS_ENABLED(CONFIG_STRICT_KERNEL_RWX))
> +			return addr;
>  		phys = __pa_symbol(addr);
>  	} else if (IS_ENABLED(CONFIG_STRICT_MODULE_RWX)) {
>  		struct page *page = vmalloc_to_page(addr);
> -- 
> 2.43.0
> 

Re: [PATCH v5 1/2] riscv: mm: make EXECMEM_KPROBES writable without CONFIG_STRICT_MODULE_RWX

[Lad, Prabhakar]

On Fri, Aug 14, 2026 at 9:29 AM Xiaofeng Yuan <xiaofengmian@163.com> wrote:
>
> When CONFIG_STRICT_MODULE_RWX is not set, execmem cannot create
> temporary writable mappings for read-only executable pages. In this
> case, the execmem ranges must already have writable permissions.
>
> Currently EXECMEM_KPROBES unconditionally uses PAGE_KERNEL_READ_EXEC,
> which causes kprobe instruction slot writes to trigger page faults
> on systems where CONFIG_STRICT_MODULE_RWX is not enabled.
>
> Fix this by using PAGE_KERNEL_EXEC when CONFIG_STRICT_MODULE_RWX
> is not available.
>
> Signed-off-by: Xiaofeng Yuan <xiaofengmian@163.com>
> ---
>  arch/riscv/mm/init.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>

Cheers,
Prabhakar

> diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c
> index 85bdcce63a..b084a72e5d 100644
> --- a/arch/riscv/mm/init.c
> +++ b/arch/riscv/mm/init.c
> @@ -1462,7 +1462,9 @@ struct execmem_info __init *execmem_arch_setup(void)
>                         [EXECMEM_KPROBES] = {
>                                 .start  = VMALLOC_START,
>                                 .end    = VMALLOC_END,
> -                               .pgprot = PAGE_KERNEL_READ_EXEC,
> +                               .pgprot = IS_ENABLED(CONFIG_STRICT_MODULE_RWX) ?
> +                                         PAGE_KERNEL_READ_EXEC :
> +                                         PAGE_KERNEL_EXEC,
>                                 .alignment = 1,
>                         },
>                         [EXECMEM_BPF] = {
> --
> 2.43.0
>

Re: [PATCH v5 2/2] riscv: patch: skip fixmap mapping when kernel text is already writable

[Lad, Prabhakar]

On Fri, Aug 14, 2026 at 9:29 AM Xiaofeng Yuan <xiaofengmian@163.com> wrote:
>
> patch_map() always creates a temporary writable mapping via fixmap for
> kernel text addresses, even when CONFIG_STRICT_KERNEL_RWX is disabled
> and the kernel text is already mapped with _PAGE_WRITE.
>
> This is unnecessary overhead at best, and on minimal configurations
> it can cause page faults.
>
> Skip the fixmap path for kernel text when CONFIG_STRICT_KERNEL_RWX
> is not enabled, since the text pages are already writable in that case.
> The module text path is already gated on CONFIG_STRICT_MODULE_RWX and
> is kept unchanged.
>
> Reported-by: Klara Modin <klara@kasm.eu>
> Closes: https://lore.kernel.org/all/ant_8TaBbov_GS4i@soda.int.kasm.eu/
> Reported-by: Lad Prabhakar <prabhakar.csengg@gmail.com>
> Closes: https://lore.kernel.org/all/CA+V-a8tQK8rih9SGGTyqrEBGpNkx4H0eX2YccCRrgkVAPr+EBg@mail.gmail.com/
> ---
> v5: fix the fixmap gating for kernel text. The v4 early return on
>     CONFIG_STRICT_MODULE_RWX wrongly skipped the fixmap for kernel text
>     too, which panics on configs with CONFIG_MODULES=n where
>     CONFIG_STRICT_MODULE_RWX is unavailable but CONFIG_STRICT_KERNEL_RWX
>     is still enabled and kernel text is read-only.
> v3: early return when !CONFIG_STRICT_MODULE_RWX (per Nam Cao's suggestion)
> v2: add commit description
>
> Signed-off-by: Xiaofeng Yuan <xiaofengmian@163.com>
> ---
>  arch/riscv/kernel/patch.c | 2 ++
>  1 file changed, 2 insertions(+)
>
Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>

Cheers,
Prabhakar

> diff --git a/arch/riscv/kernel/patch.c b/arch/riscv/kernel/patch.c
> index 16b243376f..2239c28981 100644
> --- a/arch/riscv/kernel/patch.c
> +++ b/arch/riscv/kernel/patch.c
> @@ -45,6 +45,8 @@ static __always_inline void *patch_map(void *addr, const unsigned int fixmap)
>         phys_addr_t phys;
>
>         if (core_kernel_text(uintaddr) || is_kernel_exittext(uintaddr)) {
> +               if (!IS_ENABLED(CONFIG_STRICT_KERNEL_RWX))
> +                       return addr;
>                 phys = __pa_symbol(addr);
>         } else if (IS_ENABLED(CONFIG_STRICT_MODULE_RWX)) {
>                 struct page *page = vmalloc_to_page(addr);
> --
> 2.43.0
>

Re: [PATCH v5 0/2] riscv: fix text patching on minimal kernel configs

[Paul Walmsley]

On Fri, 14 Aug 2026, Xiaofeng Yuan wrote:

> This series fixes two related issues that break kprobes and kernel text
> patching on RISC-V configurations where CONFIG_STRICT_MODULE_RWX is not
> available (e.g. CONFIG_MODULES=n).
> 
> Patch 1 makes the EXECMEM_KPROBES range writable when
> CONFIG_STRICT_MODULE_RWX is disabled, so kprobe instruction slot writes
> do not fault on read-only executable pages.
> 
> Patch 2 makes patch_map() skip the temporary fixmap mapping when the
> kernel text is already writable, i.e. when CONFIG_STRICT_KERNEL_RWX is
> disabled. The module text path is still gated on CONFIG_STRICT_MODULE_RWX.

Thanks, queued for v7.3-rc.


- Paul