[PATCH 0/2] riscv: mm: fix set_memory_x() and kernel_page_present()

[PATCH 0/2] riscv: mm: fix set_memory_x() and kernel_page_present()

[Mike Rapoport (Microsoft)]

These are two riscv fixes I found while working on a generic
implementation of the set_memory APIs.

The first one stops set_memory_x() from making the linear map alias of
module and BPF text executable.

The second one makes kernel_page_present() report the pages removed from
the direct map as not present. Today it says they are mapped, and
hibernation could copy them without mapping them first.

---
Mike Rapoport (Microsoft) (2):
      riscv: do not make the linear map alias executable in set_memory_*()
      riscv: mm: check the valid bit in kernel_page_present()

 arch/riscv/mm/pageattr.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)
---
base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
change-id: 20261112-fixes-riscv-3e48788f58fe

--
Sincerely yours,
Mike.

[PATCH 1/2] riscv: do not make the linear map alias executable in set_memory_*()

[Mike Rapoport (Microsoft)]

set_memory_*() applies the requested change to the linear map alias of the
range. For set_memory_x() that makes the linear map alias of module text
and of BPF programs executable, although nothing should ever execute that
code through the linear map.

Keep _PAGE_EXEC out of the bits set_memory_*() sets on the linear map
alias.

Fixes: 311cd2f6e253 ("riscv: Fix set_memory_XX() and set_direct_map_XX() by splitting huge linear mappings")
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
---
 arch/riscv/mm/pageattr.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/arch/riscv/mm/pageattr.c b/arch/riscv/mm/pageattr.c
index 5b3cf326455db..b138113755359 100644
--- a/arch/riscv/mm/pageattr.c
+++ b/arch/riscv/mm/pageattr.c
@@ -271,6 +271,10 @@ static int __set_memory(unsigned long addr, int numpages, pgprot_t set_mask,
 		.set_mask = set_mask,
 		.clear_mask = clear_mask
 	};
+	struct pageattr_masks __maybe_unused lm_masks = {
+		.set_mask = __pgprot(pgprot_val(set_mask) & ~_PAGE_EXEC),
+		.clear_mask = clear_mask
+	};
 
 	if (!numpages)
 		return 0;
@@ -300,7 +304,8 @@ static int __set_memory(unsigned long addr, int numpages, pgprot_t set_mask,
 				goto unlock;
 
 			ret = walk_kernel_page_table_range(lm_start, lm_end,
-						    &pageattr_ops, NULL, &masks);
+						    &pageattr_ops, NULL,
+						    &lm_masks);
 			if (ret)
 				goto unlock;
 		}
@@ -318,7 +323,7 @@ static int __set_memory(unsigned long addr, int numpages, pgprot_t set_mask,
 			goto unlock;
 
 		ret = walk_kernel_page_table_range(lm_start, lm_end,
-					    &pageattr_ops, NULL, &masks);
+					    &pageattr_ops, NULL, &lm_masks);
 		if (ret)
 			goto unlock;
 	}

-- 
2.53.0

[PATCH 2/2] riscv: mm: check the valid bit in kernel_page_present()

[Mike Rapoport (Microsoft)]

set_direct_map_invalid_noflush() clears _PAGE_PRESENT, but the kernel
mappings keep _PAGE_PROT_NONE set: it used to be _PAGE_READ and now it is
the same bit as _PAGE_GLOBAL. pte_present() and pmd_present() still
return true for the invalidated entry. kernel_page_present() then reports
that an unmapped page is mapped, and hibernation copies it without
remapping it first.

Test _PAGE_PRESENT directly for PMD and PTE leaves.

Fixes: 32a0de886eb3 ("arch, mm: make kernel_page_present() always available")
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
---
 arch/riscv/mm/pageattr.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/arch/riscv/mm/pageattr.c b/arch/riscv/mm/pageattr.c
index b138113755359..62fbcf7cf36b6 100644
--- a/arch/riscv/mm/pageattr.c
+++ b/arch/riscv/mm/pageattr.c
@@ -453,8 +453,9 @@ bool kernel_page_present(struct page *page)
 	if (!pmd_present(pmdp_get(pmd)))
 		return false;
 	if (pmd_leaf(pmdp_get(pmd)))
-		return true;
+		return pmd_val(pmdp_get(pmd)) & _PAGE_PRESENT;
 
+	/* pte_present() is true for PAGE_KERNEL with _PAGE_PRESENT cleared */
 	pte = pte_offset_kernel(pmd, addr);
-	return pte_present(ptep_get(pte));
+	return pte_val(ptep_get(pte)) & _PAGE_PRESENT;
 }

-- 
2.53.0

Re: [PATCH 2/2] riscv: mm: check the valid bit in kernel_page_present()

[Jisheng Zhang]

On Thu, Nov 12, 2026 at 03:42:19PM +0200, Mike Rapoport (Microsoft) wrote:
> set_direct_map_invalid_noflush() clears _PAGE_PRESENT, but the kernel
> mappings keep _PAGE_PROT_NONE set: it used to be _PAGE_READ and now it is
> the same bit as _PAGE_GLOBAL. pte_present() and pmd_present() still
> return true for the invalidated entry. kernel_page_present() then reports
> that an unmapped page is mapped, and hibernation copies it without
> remapping it first.
> 
> Test _PAGE_PRESENT directly for PMD and PTE leaves.
> 
> Fixes: 32a0de886eb3 ("arch, mm: make kernel_page_present() always available")
> Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
> ---
>  arch/riscv/mm/pageattr.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/riscv/mm/pageattr.c b/arch/riscv/mm/pageattr.c
> index b138113755359..62fbcf7cf36b6 100644
> --- a/arch/riscv/mm/pageattr.c
> +++ b/arch/riscv/mm/pageattr.c
> @@ -453,8 +453,9 @@ bool kernel_page_present(struct page *page)
>  	if (!pmd_present(pmdp_get(pmd)))
>  		return false;
>  	if (pmd_leaf(pmdp_get(pmd)))
> -		return true;
> +		return pmd_val(pmdp_get(pmd)) & _PAGE_PRESENT;

so we call pmdp_get() up to 3 times, could we save its result
and reuse it?

>  
> +	/* pte_present() is true for PAGE_KERNEL with _PAGE_PRESENT cleared */
>  	pte = pte_offset_kernel(pmd, addr);
> -	return pte_present(ptep_get(pte));
> +	return pte_val(ptep_get(pte)) & _PAGE_PRESENT;
>  }
> 
> -- 
> 2.53.0
> 
> 
> _______________________________________________
> linux-riscv mailing list
> linux-riscv@lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/linux-riscv