Skip to content

[PW_SID:1153951] riscv: document the Sv32 virtual memory layout - #2551

Open
linux-riscv-bot wants to merge 9 commits into
workflow__riscv__fixesfrom
pw1153951
Open

[PW_SID:1153951] riscv: document the Sv32 virtual memory layout#2551
linux-riscv-bot wants to merge 9 commits into
workflow__riscv__fixesfrom
pw1153951

Conversation

@linux-riscv-bot

Copy link
Copy Markdown

PR for series 1153951 applied to workflow__riscv__fixes

Name: riscv: document the Sv32 virtual memory layout
URL: https://patchwork.kernel.org/project/linux-riscv/list/?series=1153951
Version: 1

ThreeBottleCap and others added 9 commits August 20, 2026 17:56
…_RWX

When CONFIG_STRICT_MODULE_RWX is not set, execmem cannot create
temporary writable mappings for read-only executable pages. In this
case, the execmem ranges must already have writable permissions.

Currently EXECMEM_KPROBES unconditionally uses PAGE_KERNEL_READ_EXEC,
which causes kprobe instruction slot writes to trigger page faults
on systems where CONFIG_STRICT_MODULE_RWX is not enabled.

Fix this by using PAGE_KERNEL_EXEC when CONFIG_STRICT_MODULE_RWX
is not available.

Signed-off-by: Xiaofeng Yuan <xiaofengmian@163.com>
Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Reviewed-by: Nam Cao <namcao@linutronix.de>
Link: https://patch.msgid.link/20260814082742.148403-2-xiaofengmian@163.com
Signed-off-by: Paul Walmsley <pjw@kernel.org>
patch_map() always creates a temporary writable mapping via fixmap for
kernel text addresses, even when CONFIG_STRICT_KERNEL_RWX is disabled
and the kernel text is already mapped with _PAGE_WRITE.

This is unnecessary overhead at best, and on minimal configurations
it can cause page faults.

Skip the fixmap path for kernel text when CONFIG_STRICT_KERNEL_RWX
is not enabled, since the text pages are already writable in that case.
The module text path is already gated on CONFIG_STRICT_MODULE_RWX and
is kept unchanged.

Reported-by: Klara Modin <klara@kasm.eu>
Closes: https://lore.kernel.org/all/ant_8TaBbov_GS4i@soda.int.kasm.eu/
Reported-by: Lad Prabhakar <prabhakar.csengg@gmail.com>
Closes: https://lore.kernel.org/all/CA+V-a8tQK8rih9SGGTyqrEBGpNkx4H0eX2YccCRrgkVAPr+EBg@mail.gmail.com/
Tested-by: Klara Modin <klarasmodin@gmail.com>
Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Link: https://patch.msgid.link/20260814082742.148403-3-xiaofengmian@163.com
Signed-off-by: Paul Walmsley <pjw@kernel.org>
This reverts commit 3033b2b.

The reverted patch is userspace-visible behavior change, not a bug fix.
The two variables here (pmm and pmlen) control two independent features:
pmm is the _hardware_ pointer masking mode that applies while executing
in userspace. pmlen is the shift amount that the _kernel_ uses when
untagging addresses; PMLEN_0 means no untagging occurs, so the kernel
does not accept tagged addresses in syscall arguments.

It is valid (as documented and tested by the self test) to enable
pointer masking without enabling the tagged address ABI. This separation
is necessary to allow userspace to create an execution environment
similar to what the kernel supports on arm64 by default, where TBI is
enabled but the tagged address ABI is not. (On arm64, there is no
equivalent to PR_PMLEN_MASK because TBI is always enabled.)

Signed-off-by: Samuel Holland <samuel.holland@sifive.com>
Link: https://patch.msgid.link/20260820014551.1979772-1-samuel.holland@sifive.com
Cc: stable@vger.kernel.org
Fixes: 3033b2b ("riscv: Reset pmm when PR_TAGGED_ADDR_ENABLE is not set")
Signed-off-by: Paul Walmsley <pjw@kernel.org>
Prefer the convenient string choice 'str_disabled_enabled()'
helper over hardcoded strings in 'setup_global_riscv_enable()'.

Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Link: https://patch.msgid.link/20260819160546.3219942-1-dmantipov@yandex.ru
Signed-off-by: Paul Walmsley <pjw@kernel.org>
The vendor-extension handlers reached from hwprobe_one_pair()
(hwprobe_isa_vendor_ext_thead_0() and friends) only OR the present bits
into pair->value via VENDOR_EXTENSION_SUPPORTED() and clear their own
missing bits; they assume the caller has already zeroed pair->value.

That holds for hwprobe_get_values() (it zeroes each pair) and
hwprobe_get_cpus() (it re-initializes its scratch pair per key), but not
for complete_hwprobe_vdso_data(), which reuses a single pair across all
keys without re-zeroing. A vendor key therefore inherits stale bits from
the previously probed key, and the wrong value is cached in the vDSO
all_cpu_hwprobe_values[] and handed to userspace on the fast patih.

Zero pair->value once at the top of hwprobe_one_pair() so every handler
starts from a clean value regardless of the caller, and drop the now
redundant zeroing in the *_BLOCK_SIZE cases. hwprobe_isa_ext0() keeps its
own zeroing because hwprobe_ext0_has() calls it directly, bypassing
hwprobe_one_pair().

Fixes: a5ea53d ("riscv: hwprobe: Add thead vendor extension probing")
Signed-off-by: Andy Chiu <tchiu@tenstorrent.com>
Reviewed-by: Jesse Taube <jtaubepe@redhat.com>
Link: https://patch.msgid.link/20260725001614.2578617-2-tchiu@tenstorrent.com
Cc: stable@vger.kernel.org
Signed-off-by: Paul Walmsley <pjw@kernel.org>
x86 did this in commit b0a848f ("x86/bugs: Make i386 use
GENERIC_BUG_RELATIVE_POINTERS")

powerpc did this in commit 1baa1f7 ("powerpc: Allow relative
pointers in bug table entries")

Similar as x86 and powerpc does, make RV32 use
GENERIC_BUG_RELATIVE_POINTERS for "there is only one code path." and
"less #ifdef is more better".

Signed-off-by: Jisheng Zhang <jszhang@kernel.org>
Link: https://patch.msgid.link/20260221024255.3552-1-jszhang@kernel.org
Signed-off-by: Paul Walmsley <pjw@kernel.org>
The RISC-V virtual memory layout documentation describes the 64-bit
paging modes but leaves the Sv32 section as a TODO.

Document the rv32_defconfig layout and clarify which boundaries depend
on the configured size of struct page. Distinguish the maximum direct-map
range from the portion backed by physical memory. Also explain why the
34-bit physical addresses encoded by Sv32 page table entries do not make
all of that address space usable as RAM by the current RV32 kernel.

Signed-off-by: Yu Jin <lambda.jinyu@gmail.com>
Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
RV32 defines TASK_SIZE as FIXADDR_START. Its value depends on
VMEMMAP_SIZE, which in turn depends on the configured size of struct
page. The fixed 0x9fc00000 value in the comment is therefore stale.

Describe the macro relationship instead of replacing one
configuration-specific address with another.

Signed-off-by: Yu Jin <lambda.jinyu@gmail.com>
Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 1: "[RFC,1/2] docs: riscv: document the Sv32 virtual memory layout"
build-rv32-defconfig
Desc: Builds riscv32 defconfig
Duration: 146.71 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 1: "[RFC,1/2] docs: riscv: document the Sv32 virtual memory layout"
build-rv64-clang-allmodconfig
Desc: Builds riscv64 allmodconfig with Clang, and checks for errors and added warnings
Duration: 1125.68 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 1: "[RFC,1/2] docs: riscv: document the Sv32 virtual memory layout"
build-rv64-gcc-allmodconfig
Desc: Builds riscv64 allmodconfig with GCC, and checks for errors and added warnings
Duration: 1435.14 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 1: "[RFC,1/2] docs: riscv: document the Sv32 virtual memory layout"
build-rv64-nommu-k210-defconfig
Desc: Builds riscv64 defconfig with NOMMU for K210
Duration: 28.45 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 1: "[RFC,1/2] docs: riscv: document the Sv32 virtual memory layout"
build-rv64-nommu-k210-virt
Desc: Builds riscv64 defconfig with NOMMU for the virt platform
Duration: 30.43 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 1: "[RFC,1/2] docs: riscv: document the Sv32 virtual memory layout"
checkpatch
Desc: Runs checkpatch.pl on the patch
Duration: 0.76 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 1: "[RFC,1/2] docs: riscv: document the Sv32 virtual memory layout"
dtb-warn-rv64
Desc: Checks for Device Tree warnings/errors
Duration: 90.06 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 1: "[RFC,1/2] docs: riscv: document the Sv32 virtual memory layout"
header-inline
Desc: Detects static functions without inline keyword in header files
Duration: 0.26 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 1: "[RFC,1/2] docs: riscv: document the Sv32 virtual memory layout"
kdoc
Desc: Detects for kdoc errors
Duration: 0.88 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 1: "[RFC,1/2] docs: riscv: document the Sv32 virtual memory layout"
module-param
Desc: Detect module_param changes
Duration: 0.26 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 1: "[RFC,1/2] docs: riscv: document the Sv32 virtual memory layout"
verify-fixes
Desc: Verifies that the Fixes: tags exist
Duration: 0.24 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 1: "[RFC,1/2] docs: riscv: document the Sv32 virtual memory layout"
verify-signedoff
Desc: Verifies that Signed-off-by: tags are correct
Duration: 0.31 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 2: "[RFC,2/2] riscv: mm: correct the stale RV32 TASK_SIZE comment"
build-rv32-defconfig
Desc: Builds riscv32 defconfig
Duration: 146.32 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 2: "[RFC,2/2] riscv: mm: correct the stale RV32 TASK_SIZE comment"
build-rv64-clang-allmodconfig
Desc: Builds riscv64 allmodconfig with Clang, and checks for errors and added warnings
Duration: 2442.94 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 2: "[RFC,2/2] riscv: mm: correct the stale RV32 TASK_SIZE comment"
build-rv64-gcc-allmodconfig
Desc: Builds riscv64 allmodconfig with GCC, and checks for errors and added warnings
Duration: 3126.77 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 2: "[RFC,2/2] riscv: mm: correct the stale RV32 TASK_SIZE comment"
build-rv64-nommu-k210-defconfig
Desc: Builds riscv64 defconfig with NOMMU for K210
Duration: 29.04 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 2: "[RFC,2/2] riscv: mm: correct the stale RV32 TASK_SIZE comment"
build-rv64-nommu-k210-virt
Desc: Builds riscv64 defconfig with NOMMU for the virt platform
Duration: 30.29 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 2: "[RFC,2/2] riscv: mm: correct the stale RV32 TASK_SIZE comment"
checkpatch
Desc: Runs checkpatch.pl on the patch
Duration: 0.76 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 2: "[RFC,2/2] riscv: mm: correct the stale RV32 TASK_SIZE comment"
dtb-warn-rv64
Desc: Checks for Device Tree warnings/errors
Duration: 89.74 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 2: "[RFC,2/2] riscv: mm: correct the stale RV32 TASK_SIZE comment"
header-inline
Desc: Detects static functions without inline keyword in header files
Duration: 0.26 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 2: "[RFC,2/2] riscv: mm: correct the stale RV32 TASK_SIZE comment"
kdoc
Desc: Detects for kdoc errors
Duration: 0.89 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 2: "[RFC,2/2] riscv: mm: correct the stale RV32 TASK_SIZE comment"
module-param
Desc: Detect module_param changes
Duration: 0.27 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 2: "[RFC,2/2] riscv: mm: correct the stale RV32 TASK_SIZE comment"
verify-fixes
Desc: Verifies that the Fixes: tags exist
Duration: 0.25 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 2: "[RFC,2/2] riscv: mm: correct the stale RV32 TASK_SIZE comment"
verify-signedoff
Desc: Verifies that Signed-off-by: tags are correct
Duration: 0.32 seconds
Result: PASS

@linux-riscv-bot
linux-riscv-bot force-pushed the workflow__riscv__fixes branch 6 times, most recently from 9ed823f to a54e736 Compare September 2, 2026 20:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants