* Re: [PATCH v4 2/2] riscv: patch: skip fixmap mapping when kernel text is already writable
2026-07-20 3:22 ` [PATCH v4 2/2] riscv: patch: skip fixmap mapping when kernel text is already writable Xiaofeng Yuan
@ 2026-08-11 20:39 ` Klara Modin
2026-08-12 6:45 ` Nam Cao
2026-08-13 14:14 ` Lad, Prabhakar
1 sibling, 1 reply; 9+ messages in thread
From: Klara Modin @ 2026-08-11 20:39 UTC (permalink / raw)
To: Xiaofeng Yuan
Cc: Paul Walmsley, Palmer Dabbelt, Albert Ou, Alexandre Ghiti,
Nam Cao, linux-riscv, linux-kernel
Hi,
On 2026-07-20 03:22:57 +0000, Xiaofeng Yuan wrote:
> Currently patch_map() always creates a temporary writable mapping via
> fixmap for kernel text addresses, even when CONFIG_STRICT_MODULE_RWX
> is disabled and the kernel text is already mapped with _PAGE_WRITE.
>
> This is unnecessary overhead at best, and on minimal configurations
> it can cause page faults.
>
> Skip the fixmap path for kernel text when CONFIG_STRICT_MODULE_RWX
> is not enabled, since the text pages are already writable in this case.
>
> Signed-off-by: Xiaofeng Yuan <xiaofengmian@163.com>
> ---
> v2: add commit description
> v3: early return when !CONFIG_STRICT_MODULE_RWX (per Nam Cao's suggestion)
> diff --git a/arch/riscv/kernel/patch.c b/arch/riscv/kernel/patch.c
> index 16b243376f..caef41d5ef 100644
> --- a/arch/riscv/kernel/patch.c
> +++ b/arch/riscv/kernel/patch.c
> @@ -44,15 +44,16 @@ static __always_inline void *patch_map(void *addr, const unsigned int fixmap)
> uintptr_t uintaddr = (uintptr_t) addr;
> phys_addr_t phys;
>
> + if (!IS_ENABLED(CONFIG_STRICT_MODULE_RWX))
> + return addr;
Is this correct when STRICT_KERNEL_RWX is set and not STRICT_MODULE_RWX
(e.g. when modules are not enabled)?
> +
> if (core_kernel_text(uintaddr) || is_kernel_exittext(uintaddr)) {
> phys = __pa_symbol(addr);
> - } else if (IS_ENABLED(CONFIG_STRICT_MODULE_RWX)) {
> + } else {
> struct page *page = vmalloc_to_page(addr);
>
> BUG_ON(!page);
> phys = page_to_phys(page) + offset_in_page(addr);
> - } else {
> - return addr;
> }
>
> return (void *)set_fixmap_offset(fixmap, phys);
> --
> 2.43.0
>
This patch causes the following oops on my BPI-F3:
Unable to handle kernel paging request at virtual address 0000006789abce0b
Current swapper/0 pgtable: 4K pagesize, 39-bit VAs, pgdp=0x000000000269d000
[0000006789abce0b] pgd=0000000040031c01, p4d=0000000040031c01, pud=0000000040031c01, pmd=0000000000000000
Oops [#1]
Tainted: [W]=WARN
Hardware name: Banana Pi BPI-F3 (DT)
epc : kmem_cache_alloc_lru_noprof (/home/klara/git/linux/trees/bisect/mm/slub.c:4941)
ra : __d_alloc (/home/klara/git/linux/trees/bisect/fs/dcache.c:1902)
epc : ffffffff8038379e ra : ffffffff804053b2 sp : ffffffff82203ab0
gp : ffffffff8248da18 tp : ffffffff822200c0 t0 : ffffffd7010660e8
t1 : ffffffff921904d0 t2 : 000000005d6ccc9e s0 : ffffffff82203b30
s1 : 0000000000000000 a0 : 0123456789abcdef a1 : ffffffd700b3f510
a2 : 0000000000000cc0 a3 : 0000000000000002 a4 : 0000000000000000
a5 : 0123456700000000 a6 : 00ffffffff899275 a7 : ffffffff82203918
s2 : 0000000000000000 s3 : ffffffd700b3f000 s4 : ffffffff81a0d848
s5 : ffffffff82492018 s6 : 0000000000000000 s7 : 00000000000003e8
s8 : ffffffff814010e0 s9 : 0000000000000000 s10: 0000000000200000
s11: 00000000024910d8 t3 : 0000000000000014 t4 : 0000000000000026
t5 : 000000003137ae71 t6 : ffffffff82203b18 ssp : 0000000000000000
status: 0000000200000120 badaddr: 0000006789abce0b cause: 000000000000000d
kmem_cache_alloc_lru_noprof (/home/klara/git/linux/trees/bisect/mm/slub.c:4941)
__d_alloc (/home/klara/git/linux/trees/bisect/fs/dcache.c:1902)
d_make_root (/home/klara/git/linux/trees/bisect/fs/dcache.c:1999 /home/klara/git/linux/trees/bisect/fs/dcache.c:2213)
shmem_fill_super (/home/klara/git/linux/trees/bisect/mm/shmem.c:5050)
get_tree_nodev (/home/klara/git/linux/trees/bisect/fs/super.c:1273 /home/klara/git/linux/trees/bisect/fs/super.c:1292)
shmem_get_tree (/home/klara/git/linux/trees/bisect/mm/shmem.c:5062)
vfs_get_tree (/home/klara/git/linux/trees/bisect/fs/super.c:1700)
fc_mount (/home/klara/git/linux/trees/bisect/fs/namespace.c:1198)
vfs_kern_mount.part.0 (/home/klara/git/linux/trees/bisect/fs/namespace.c:1236)
kern_mount (/home/klara/git/linux/trees/bisect/fs/namespace.c:6290 /home/klara/git/linux/trees/bisect/fs/namespace.c:6292)
shmem_init (/home/klara/git/linux/trees/bisect/mm/shmem.c:5367)
mnt_init (/home/klara/git/linux/trees/bisect/fs/namespace.c:6274)
vfs_caches_init (/home/klara/git/linux/trees/bisect/fs/dcache.c:3517)
start_kernel (/home/klara/git/linux/trees/bisect/init/main.c:1157)
Code: 0001 0001 0001 7119 f8a2 f4a6 0100 f0ca ecce fc86 (6703) 01c5
All code
========
0: 0001 .insn 2, 0x0001
2: 0001 .insn 2, 0x0001
4: 0001 .insn 2, 0x0001
6: 7119 .insn 2, 0x7119
8: f8a2 .insn 2, 0xf8a2
a: f4a6 .insn 2, 0xf4a6
c: 0100 .insn 2, 0x0100
e: f0ca .insn 2, 0xf0ca
10: ecce .insn 2, 0xecce
12: fc86 .insn 2, 0xfc86
14:* 01c56703 lwu a4,28(a0) <-- trapping instruction
Code starting with the faulting instruction
===========================================
0: 01c56703 lwu a4,28(a0)
---[ end trace 0000000000000000 ]---
Kernel panic - not syncing: Attempted to kill the idle task!
I have MODULES disabled and thus also STRICT_MODULE_RWX disabled, but
still STRICT_KERNEL_RWX enabled. I saw that an earlier version of this
patch[1] instead gated the first branch behind STRICT_KERNEL_RWX. That
version works fine for me.
Regards,
Klara Modin
Link: https://lore.kernel.org/lkml/20260719081037.5749-3-xiaofengmian@163.com [1]
# bad: [66566bdc5a42d707d4c3f54587333db00e955268] Merge branch 'unstable/spacemit-k1-wdt' into unstable/next-local
git bisect start 'HEAD'
# status: waiting for 'good' commit(s), 'bad' commit known
# good: [f5bbbfec59b4e2fb7520a91de3df8a6174325d6a] Merge tag 'probes-fixes-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
git bisect good f5bbbfec59b4e2fb7520a91de3df8a6174325d6a
# bad: [9eba0000697167ff6960428f7401e9f65f7abba3] Merge branch 'libcrypto-next' of https://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux.git
git bisect bad 9eba0000697167ff6960428f7401e9f65f7abba3
# bad: [6a66dbb2b9b0a0a5b1225052267c0eaedf34492d] Merge branch 'xtensa-for-next' of https://github.com/jcmvbkbc/linux-xtensa.git
git bisect bad 6a66dbb2b9b0a0a5b1225052267c0eaedf34492d
# good: [3787df98a48a0e699f6a06d4a42fc20597368db1] Merge branch 'for-next/core' of https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
git bisect good 3787df98a48a0e699f6a06d4a42fc20597368db1
# good: [aeba6e4f8ace1a3f016feb64c0a417c7ddcbcf6b] Merge tag 'qcom-arm64-for-7.3-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/dt
git bisect good aeba6e4f8ace1a3f016feb64c0a417c7ddcbcf6b
# good: [15213090630d0a4417dbcdef0de776cd2fac0fac] Merge branch 'for-next' of https://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap.git
git bisect good 15213090630d0a4417dbcdef0de776cd2fac0fac
# good: [e347a696fd95bc9b47e23e3d8ac7f6263ee502b2] Merge branch 'for-next' of https://git.kernel.org/pub/scm/linux/kernel/git/abelvesa/linux.git
git bisect good e347a696fd95bc9b47e23e3d8ac7f6263ee502b2
# good: [b7307ccce8238c792fb3a6412ca5cac9ba8784bc] Merge branch 'next' of https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git
git bisect good b7307ccce8238c792fb3a6412ca5cac9ba8784bc
# good: [b5d4268affa543793ccaf838a10915c2c9f0db1c] Merge branch 'features' into for-next
git bisect good b5d4268affa543793ccaf838a10915c2c9f0db1c
# good: [ebdec8d2c156b8e662cb350ce05b0f92275f6ffd] RISC-V: Add Ssccfg/Smcdeleg ISA extension definition and parsing
git bisect good ebdec8d2c156b8e662cb350ce05b0f92275f6ffd
# good: [f61959a3a8b5522eb43cf71f293e091417bbf11c] riscv: Add Ziccamoa, Ziccif, Ziccrse, and Za64rs to cpufeature and hwprobe
git bisect good f61959a3a8b5522eb43cf71f293e091417bbf11c
# bad: [54fefa110db4a407d96625b66a76d874713ddae2] riscv: patch: skip fixmap mapping when kernel text is already writable
git bisect bad 54fefa110db4a407d96625b66a76d874713ddae2
# good: [42cd1e1fc8995ec7ed5cc61957fc503eb065e0eb] riscv: alternative: Also patch the compat vDSO
git bisect good 42cd1e1fc8995ec7ed5cc61957fc503eb065e0eb
# good: [83ba459c9b5893590fd47177363b08b453a86168] riscv: mm: make EXECMEM_KPROBES writable without CONFIG_STRICT_MODULE_RWX
git bisect good 83ba459c9b5893590fd47177363b08b453a86168
# first 'bad' commit: [54fefa110db4a407d96625b66a76d874713ddae2] riscv: patch: skip fixmap mapping when kernel text is already writable
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [PATCH v4 2/2] riscv: patch: skip fixmap mapping when kernel text is already writable
2026-07-20 3:22 ` [PATCH v4 2/2] riscv: patch: skip fixmap mapping when kernel text is already writable Xiaofeng Yuan
2026-08-11 20:39 ` Klara Modin
@ 2026-08-13 14:14 ` Lad, Prabhakar
1 sibling, 0 replies; 9+ messages in thread
From: Lad, Prabhakar @ 2026-08-13 14:14 UTC (permalink / raw)
To: Xiaofeng Yuan
Cc: Paul Walmsley, Palmer Dabbelt, Albert Ou, Alexandre Ghiti,
Nam Cao, linux-riscv, linux-kernel, Geert Uytterhoeven,
Linux-Renesas
Hi Xiaofeng,
Thank you for the patch.
On Mon, Jul 20, 2026 at 5:19 AM Xiaofeng Yuan <xiaofengmian@163.com> wrote:
>
> Currently patch_map() always creates a temporary writable mapping via
> fixmap for kernel text addresses, even when CONFIG_STRICT_MODULE_RWX
> is disabled and the kernel text is already mapped with _PAGE_WRITE.
>
> This is unnecessary overhead at best, and on minimal configurations
> it can cause page faults.
>
> Skip the fixmap path for kernel text when CONFIG_STRICT_MODULE_RWX
> is not enabled, since the text pages are already writable in this case.
>
> Signed-off-by: Xiaofeng Yuan <xiaofengmian@163.com>
> ---
> v2: add commit description
> v3: early return when !CONFIG_STRICT_MODULE_RWX (per Nam Cao's suggestion)
> diff --git a/arch/riscv/kernel/patch.c b/arch/riscv/kernel/patch.c
> index 16b243376f..caef41d5ef 100644
> --- a/arch/riscv/kernel/patch.c
> +++ b/arch/riscv/kernel/patch.c
> @@ -44,15 +44,16 @@ static __always_inline void *patch_map(void *addr, const unsigned int fixmap)
> uintptr_t uintaddr = (uintptr_t) addr;
> phys_addr_t phys;
>
> + if (!IS_ENABLED(CONFIG_STRICT_MODULE_RWX))
> + return addr;
> +
> if (core_kernel_text(uintaddr) || is_kernel_exittext(uintaddr)) {
> phys = __pa_symbol(addr);
> - } else if (IS_ENABLED(CONFIG_STRICT_MODULE_RWX)) {
> + } else {
> struct page *page = vmalloc_to_page(addr);
>
> BUG_ON(!page);
> phys = page_to_phys(page) + offset_in_page(addr);
> - } else {
> - return addr;
> }
>
With this patch applied and using renesas_defconfig I see below Oops
on SMARC RZ/Five.
[ 0.012814] printk: legacy console [tty0] enabled
[ 0.017634] Calibrating delay loop (skipped), value calculated
using timer frequency.. 24.00 BogoMIPS (lpj=48000)
[ 0.027914] pid_max: default: 32768 minimum: 301
[ 0.033876] Mount-cache hash table entries: 2048 (order: 2, 16384
bytes, linear)
[ 0.041343] Mountpoint-cache hash table entries: 2048 (order: 2,
16384 bytes, linear)
[ 0.049639] Unable to handle kernel paging request at virtual
address 0000006f89abce08
[ 0.057617] Current swapper/0 pgtable: 4K pagesize, 39-bit VAs,
pgdp=0x00000000494f9000
[ 0.065626] [0000006f89abce08] pgd=0000000000000000,
p4d=0000000000000000, pud=0000000000000000
[ 0.074352] Oops [#1]
[ 0.076635] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted
7.2.0-rc7-next-20260812 #21 PREEMPT
[ 0.085494] Hardware name: Renesas SMARC EVK based on r9a07g043f01 (DT)
[ 0.092096] epc : kmem_cache_alloc_lru_noprof+0x1a/0x1ba
[ 0.097418] ra : __d_alloc+0x42/0x188
[ 0.101177] epc : ffffffff80162e20 ra : ffffffff8019874e sp :
ffffffff81203b30
[ 0.108385] gp : ffffffff812ec750 tp : ffffffff8120c780 t0 :
ffffffd60189db18
[ 0.115593] t1 : 0000000000000014 t2 : 0000000016e00403 s0 :
ffffffff81203b90
[ 0.122809] s1 : ffffffd601895800 a0 : 89abcdef89abcdef a1 :
ffffffd601895d10
[ 0.130022] a2 : 0000000000000cc0 a3 : 0000000000000002 a4 :
dead4ead00000001
[ 0.137235] a5 : 0000000000000000 a6 : 000000001de3521b a7 :
ffffffffac7f4a0c
[ 0.144448] s2 : 0000000000000000 s3 : ffffffd601895800 s4 :
0000000000000000
[ 0.151660] s5 : 0000000000000000 s6 : ffffffff812ed018 s7 :
00000000000003e8
[ 0.158872] s8 : 00000000000003e6 s9 : 0000000000000000 s10:
0000000077f29340
[ 0.166084] s11: 0000000000000000 t3 : ffffffffa0aed022 t4 :
0000000002018efb
[ 0.173297] t5 : 00000000101d5200 t6 : ffffffff81203b68 ssp :
0000000000000000
[ 0.180596] status: 0000000200000120 badaddr: 0000006f89abce08
cause: 000000000000000d
[ 0.188502] [<ffffffff80162e20>] kmem_cache_alloc_lru_noprof+0x1a/0x1ba
[ 0.195116] [<ffffffff8019874e>] __d_alloc+0x42/0x188
[ 0.200171] [<ffffffff801988fe>] d_alloc_anon+0xe/0x16
[ 0.205314] [<ffffffff80198c90>] d_make_root+0x18/0x3a
[ 0.210457] [<ffffffff8012792a>] shmem_fill_super+0x218/0x244
[ 0.216210] [<ffffffff801865aa>] vfs_get_super+0x42/0x70
[ 0.221525] [<ffffffff801865e8>] get_tree_nodev+0x10/0x18
[ 0.226925] [<ffffffff80125e6a>] shmem_get_tree+0x14/0x1c
[ 0.232327] [<ffffffff801845ba>] vfs_get_tree+0x1a/0xb0
[ 0.237561] [<ffffffff801a1fa2>] fc_mount+0x10/0x32
[ 0.242445] [<ffffffff801a2016>] vfs_kern_mount.part.0+0x34/0x5c
[ 0.248451] [<ffffffff801a204c>] vfs_kern_mount+0xe/0x1a
[ 0.253764] [<ffffffff801a206c>] kern_mount+0x14/0x26
[ 0.258818] [<ffffffff8080f70a>] shmem_init+0xbe/0x150
[ 0.263963] [<ffffffff8081973e>] mnt_init+0x128/0x314
[ 0.269020] [<ffffffff80819316>] vfs_caches_init+0xa0/0xce
[ 0.274507] [<ffffffff80800fa2>] start_kernel+0x754/0x7ac
[ 0.279923] Code: 1080 e0ca ec86 fc4e f852 3783 5402 3423 fcf4 4781
(6783) 01c5
[ 0.287344] ---[ end trace 0000000000000000 ]---
[ 0.291986] Kernel panic - not syncing: Attempted to kill the idle task!
Reverting this patch fixed the issue.
Cheers,
Prabhakar
> return (void *)set_fixmap_offset(fixmap, phys);
> --
> 2.43.0
>
>
> _______________________________________________
> linux-riscv mailing list
> linux-riscv@lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/linux-riscv
^ permalink raw reply [flat|nested] 9+ messages in thread