All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH v1] riscv: mm: Define PAGE_KERNEL_RO
@ 2026-10-18  2:36 Nickolai Zeldovich
  2026-10-18  2:47 ` Muchun Song
  2026-10-20  1:20 ` Jisheng Zhang
  0 siblings, 2 replies; 3+ messages in thread
From: Nickolai Zeldovich @ 2026-10-18  2:36 UTC (permalink / raw)
  To: Paul Walmsley, Palmer Dabbelt, Albert Ou
  Cc: Alexandre Ghiti, Muchun Song, linux-riscv, linux-kernel,
	Nickolai Zeldovich

Kernel mappings that generic code creates read-only are writable on
riscv. With HugeTLB vmemmap optimization (selected by riscv and on by
default with CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP_DEFAULT_ON), the tail
vmemmap pages of every optimized huge page are remapped to one shared
page with PAGE_KERNEL_RO so that a stray write to a tail struct page
faults. On riscv that remap keeps _PAGE_WRITE, so such a write silently
changes the struct pages of every optimized huge page instead.
early_memremap_ro() (EFI system and configuration tables), the
firmware loader's vmap() of the loaded image, and acpi_os_ioremap() for
EFI runtime code and NOMAP regions, which asks for a read-only mapping
precisely to avoid a writable mapping of executable code, are affected
the same way.

riscv defines PAGE_KERNEL_READ but not PAGE_KERNEL_RO, so
include/linux/pgtable.h falls back to "#define PAGE_KERNEL_RO
PAGE_KERNEL". Define PAGE_KERNEL_RO as PAGE_KERNEL_READ. FIXMAP_PAGE_RO
then follows from asm-generic/fixmap.h: early_memremap_ro() now passes
0xe3 instead of 0xe7 to __early_ioremap().

Tested on QEMU virt (riscv64, defconfig with
CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP_DEFAULT_ON and CONFIG_PTDUMP_DEBUGFS,
booted with hugepages=8): before, every vmemmap entry in
/sys/kernel/debug/kernel_page_tables has W set; after, the 28K of tail
vmemmap of each huge page is mapped R without W.

Fixes: a3c7d6b642e4 ("riscv: mm: hugetlb: Enable ARCH_WANT_HUGETLB_PAGE_OPTIMIZE_VMEMMAP")
Assisted-by: LLM
Signed-off-by: Nickolai Zeldovich <nickolai@csail.mit.edu>
---

Notes:
    Reproducer (riscv64 defconfig + CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP_DEFAULT_ON=y
    CONFIG_PTDUMP_DEBUGFS=y, QEMU virt): a static /init that prints the vmemmap
    part of the kernel page table dump.
    
      #include <stdio.h>
      #include <string.h>
      #include <sys/mount.h>
      #include <sys/reboot.h>
    
      int main(void)
      {
      	char line[256];
      	int in = 0;
      	FILE *f;
    
      	mount("sysfs", "/sys", "sysfs", 0, NULL);
      	mount("debugfs", "/sys/kernel/debug", "debugfs", 0, NULL);
      	f = fopen("/sys/kernel/debug/kernel_page_tables", "r");
      	while (f && fgets(line, sizeof(line), f)) {
      		if (strstr(line, "---[ "))
      			in = strstr(line, "vmemmap start") != NULL;
      		if (in)
      			fputs(line, stdout);
      	}
      	fflush(stdout);
      	reboot(RB_POWER_OFF);
      	return 0;
      }
    
      riscv64-linux-gnu-gcc -static -O2 -o init init.c
      qemu-system-riscv64 -M virt -cpu max -smp 2 -m 1G -nographic -kernel Image \
        -initrd initramfs.cpio -append "console=ttyS0 hugepages=8"
    
    Before (all vmemmap entries writable):
      0xff1c000002000000-0xff1c000002200000  0xbec00000  2M PTE  D A G . . W R V
      0xff1c000002200000-0xff1c000002800000  0xbea00000  6M PMD  D A G . . W R V
    
    After (each huge page: 4K head W, 28K tail read-only, shared page 0x81fd0000):
      0xff1c0000020a1000-0xff1c0000020a8000  0x81fd0000  28K PTE D A G . . . R V
      0xff1c0000020a8000-0xff1c0000020a9000  0x81fd6000   4K PTE D A G . . W R V
      0xff1c0000020a9000-0xff1c0000020b0000  0x81fd0000  28K PTE D A G . . . R V

 arch/riscv/include/asm/pgtable.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/riscv/include/asm/pgtable.h b/arch/riscv/include/asm/pgtable.h
index 40b1ed4f3ea8..13447181ceb7 100644
--- a/arch/riscv/include/asm/pgtable.h
+++ b/arch/riscv/include/asm/pgtable.h
@@ -189,6 +189,7 @@ extern struct pt_alloc_ops pt_ops __meminitdata;
 
 #define PAGE_KERNEL		__pgprot(_PAGE_KERNEL)
 #define PAGE_KERNEL_READ	__pgprot(_PAGE_KERNEL & ~_PAGE_WRITE)
+#define PAGE_KERNEL_RO		PAGE_KERNEL_READ
 #define PAGE_KERNEL_EXEC	__pgprot(_PAGE_KERNEL | _PAGE_EXEC)
 #define PAGE_KERNEL_READ_EXEC	__pgprot((_PAGE_KERNEL & ~_PAGE_WRITE) \
 					 | _PAGE_EXEC)

base-commit: 58161ead29e50d70a317ea26b472e0c7508e69da
-- 
2.53.0


_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

^ permalink raw reply related	[flat|nested] 3+ messages in thread
* Re: [PATCH v1] riscv: mm: Define PAGE_KERNEL_RO
  2026-10-18  2:36 [PATCH v1] riscv: mm: Define PAGE_KERNEL_RO Nickolai Zeldovich
@ 2026-10-18  2:47 ` Muchun Song
  2026-10-20  1:20 ` Jisheng Zhang
  1 sibling, 0 replies; 3+ messages in thread
From: Muchun Song @ 2026-10-18  2:47 UTC (permalink / raw)
  To: Nickolai Zeldovich
  Cc: Paul Walmsley, Palmer Dabbelt, Albert Ou, Alexandre Ghiti,
	linux-riscv, linux-kernel



> On Oct 18, 2026, at 10:36, Nickolai Zeldovich <nickolai@csail.mit.edu> wrote:
> 
> Kernel mappings that generic code creates read-only are writable on
> riscv. With HugeTLB vmemmap optimization (selected by riscv and on by
> default with CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP_DEFAULT_ON), the tail
> vmemmap pages of every optimized huge page are remapped to one shared
> page with PAGE_KERNEL_RO so that a stray write to a tail struct page
> faults. On riscv that remap keeps _PAGE_WRITE, so such a write silently
> changes the struct pages of every optimized huge page instead.

Yeah, I knew, I also have a similar fix locally to resolve this issue.

> early_memremap_ro() (EFI system and configuration tables), the
> firmware loader's vmap() of the loaded image, and acpi_os_ioremap() for
> EFI runtime code and NOMAP regions, which asks for a read-only mapping
> precisely to avoid a writable mapping of executable code, are affected
> the same way.

So it also does affect other components other than HVO, right?

> 
> riscv defines PAGE_KERNEL_READ but not PAGE_KERNEL_RO, so
> include/linux/pgtable.h falls back to "#define PAGE_KERNEL_RO
> PAGE_KERNEL". Define PAGE_KERNEL_RO as PAGE_KERNEL_READ. FIXMAP_PAGE_RO
> then follows from asm-generic/fixmap.h: early_memremap_ro() now passes
> 0xe3 instead of 0xe7 to __early_ioremap().
> 
> Tested on QEMU virt (riscv64, defconfig with
> CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP_DEFAULT_ON and CONFIG_PTDUMP_DEBUGFS,
> booted with hugepages=8): before, every vmemmap entry in
> /sys/kernel/debug/kernel_page_tables has W set; after, the 28K of tail
> vmemmap of each huge page is mapped R without W.
> 
> Fixes: a3c7d6b642e4 ("riscv: mm: hugetlb: Enable ARCH_WANT_HUGETLB_PAGE_OPTIMIZE_VMEMMAP")

If yes, so there may be earlier, more suitable Fixes commits?

> Assisted-by: LLM
> Signed-off-by: Nickolai Zeldovich <nickolai@csail.mit.edu>
> ---
> 
> Notes:
>    Reproducer (riscv64 defconfig + CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP_DEFAULT_ON=y
>    CONFIG_PTDUMP_DEBUGFS=y, QEMU virt): a static /init that prints the vmemmap
>    part of the kernel page table dump.
> 
>      #include <stdio.h>
>      #include <string.h>
>      #include <sys/mount.h>
>      #include <sys/reboot.h>
> 
>      int main(void)
>      {
>       	char line[256];
>       	int in = 0;
>       	FILE *f;
> 
>       	mount("sysfs", "/sys", "sysfs", 0, NULL);
>       	mount("debugfs", "/sys/kernel/debug", "debugfs", 0, NULL);
>       	f = fopen("/sys/kernel/debug/kernel_page_tables", "r");
>       	while (f && fgets(line, sizeof(line), f)) {
>       		if (strstr(line, "---[ "))
>       			in = strstr(line, "vmemmap start") != NULL;
>       		if (in)
>       			fputs(line, stdout);
>       	}
>       	fflush(stdout);
>       	reboot(RB_POWER_OFF);
>       	return 0;
>      }
> 
>      riscv64-linux-gnu-gcc -static -O2 -o init init.c
>      qemu-system-riscv64 -M virt -cpu max -smp 2 -m 1G -nographic -kernel Image \
>        -initrd initramfs.cpio -append "console=ttyS0 hugepages=8"
> 
>    Before (all vmemmap entries writable):
>      0xff1c000002000000-0xff1c000002200000  0xbec00000  2M PTE  D A G . . W R V
>      0xff1c000002200000-0xff1c000002800000  0xbea00000  6M PMD  D A G . . W R V
> 
>    After (each huge page: 4K head W, 28K tail read-only, shared page 0x81fd0000):
>      0xff1c0000020a1000-0xff1c0000020a8000  0x81fd0000  28K PTE D A G . . . R V
>      0xff1c0000020a8000-0xff1c0000020a9000  0x81fd6000   4K PTE D A G . . W R V
>      0xff1c0000020a9000-0xff1c0000020b0000  0x81fd0000  28K PTE D A G . . . R V
> 
> arch/riscv/include/asm/pgtable.h | 1 +
> 1 file changed, 1 insertion(+)
> 
> diff --git a/arch/riscv/include/asm/pgtable.h b/arch/riscv/include/asm/pgtable.h
> index 40b1ed4f3ea8..13447181ceb7 100644
> --- a/arch/riscv/include/asm/pgtable.h
> +++ b/arch/riscv/include/asm/pgtable.h
> @@ -189,6 +189,7 @@ extern struct pt_alloc_ops pt_ops __meminitdata;
> 
> #define PAGE_KERNEL __pgprot(_PAGE_KERNEL)
> #define PAGE_KERNEL_READ __pgprot(_PAGE_KERNEL & ~_PAGE_WRITE)
> +#define PAGE_KERNEL_RO PAGE_KERNEL_READ
> #define PAGE_KERNEL_EXEC __pgprot(_PAGE_KERNEL | _PAGE_EXEC)
> #define PAGE_KERNEL_READ_EXEC __pgprot((_PAGE_KERNEL & ~_PAGE_WRITE) \
> 					| _PAGE_EXEC)

Acked-by: Muchun Song <muchun.song@linux.dev>

Thanks.

> 
> base-commit: 58161ead29e50d70a317ea26b472e0c7508e69da
> -- 
> 2.53.0
> 


_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

^ permalink raw reply	[flat|nested] 3+ messages in thread
* Re: [PATCH v1] riscv: mm: Define PAGE_KERNEL_RO
  2026-10-18  2:36 [PATCH v1] riscv: mm: Define PAGE_KERNEL_RO Nickolai Zeldovich
  2026-10-18  2:47 ` Muchun Song
@ 2026-10-20  1:20 ` Jisheng Zhang
  1 sibling, 0 replies; 3+ messages in thread
From: Jisheng Zhang @ 2026-10-20  1:20 UTC (permalink / raw)
  To: Nickolai Zeldovich
  Cc: Paul Walmsley, Palmer Dabbelt, Albert Ou, Alexandre Ghiti,
	Muchun Song, linux-riscv, linux-kernel

On Sat, Oct 17, 2026 at 10:36:49PM -0400, Nickolai Zeldovich wrote:
> Kernel mappings that generic code creates read-only are writable on
> riscv. With HugeTLB vmemmap optimization (selected by riscv and on by
> default with CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP_DEFAULT_ON), the tail
> vmemmap pages of every optimized huge page are remapped to one shared
> page with PAGE_KERNEL_RO so that a stray write to a tail struct page
> faults. On riscv that remap keeps _PAGE_WRITE, so such a write silently
> changes the struct pages of every optimized huge page instead.
> early_memremap_ro() (EFI system and configuration tables), the
> firmware loader's vmap() of the loaded image, and acpi_os_ioremap() for
> EFI runtime code and NOMAP regions, which asks for a read-only mapping
> precisely to avoid a writable mapping of executable code, are affected
> the same way.
> 
> riscv defines PAGE_KERNEL_READ but not PAGE_KERNEL_RO, so
> include/linux/pgtable.h falls back to "#define PAGE_KERNEL_RO
> PAGE_KERNEL". Define PAGE_KERNEL_RO as PAGE_KERNEL_READ. FIXMAP_PAGE_RO
> then follows from asm-generic/fixmap.h: early_memremap_ro() now passes
> 0xe3 instead of 0xe7 to __early_ioremap().
> 
> Tested on QEMU virt (riscv64, defconfig with
> CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP_DEFAULT_ON and CONFIG_PTDUMP_DEBUGFS,
> booted with hugepages=8): before, every vmemmap entry in
> /sys/kernel/debug/kernel_page_tables has W set; after, the 28K of tail
> vmemmap of each huge page is mapped R without W.
> 
> Fixes: a3c7d6b642e4 ("riscv: mm: hugetlb: Enable ARCH_WANT_HUGETLB_PAGE_OPTIMIZE_VMEMMAP")
> Assisted-by: LLM
> Signed-off-by: Nickolai Zeldovich <nickolai@csail.mit.edu>

Reviewed-by: Jisheng Zhang <jszhang@kernel.org>

> ---
> 
> Notes:
>     Reproducer (riscv64 defconfig + CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP_DEFAULT_ON=y
>     CONFIG_PTDUMP_DEBUGFS=y, QEMU virt): a static /init that prints the vmemmap
>     part of the kernel page table dump.
>     
>       #include <stdio.h>
>       #include <string.h>
>       #include <sys/mount.h>
>       #include <sys/reboot.h>
>     
>       int main(void)
>       {
>       	char line[256];
>       	int in = 0;
>       	FILE *f;
>     
>       	mount("sysfs", "/sys", "sysfs", 0, NULL);
>       	mount("debugfs", "/sys/kernel/debug", "debugfs", 0, NULL);
>       	f = fopen("/sys/kernel/debug/kernel_page_tables", "r");
>       	while (f && fgets(line, sizeof(line), f)) {
>       		if (strstr(line, "---[ "))
>       			in = strstr(line, "vmemmap start") != NULL;
>       		if (in)
>       			fputs(line, stdout);
>       	}
>       	fflush(stdout);
>       	reboot(RB_POWER_OFF);
>       	return 0;
>       }
>     
>       riscv64-linux-gnu-gcc -static -O2 -o init init.c
>       qemu-system-riscv64 -M virt -cpu max -smp 2 -m 1G -nographic -kernel Image \
>         -initrd initramfs.cpio -append "console=ttyS0 hugepages=8"
>     
>     Before (all vmemmap entries writable):
>       0xff1c000002000000-0xff1c000002200000  0xbec00000  2M PTE  D A G . . W R V
>       0xff1c000002200000-0xff1c000002800000  0xbea00000  6M PMD  D A G . . W R V
>     
>     After (each huge page: 4K head W, 28K tail read-only, shared page 0x81fd0000):
>       0xff1c0000020a1000-0xff1c0000020a8000  0x81fd0000  28K PTE D A G . . . R V
>       0xff1c0000020a8000-0xff1c0000020a9000  0x81fd6000   4K PTE D A G . . W R V
>       0xff1c0000020a9000-0xff1c0000020b0000  0x81fd0000  28K PTE D A G . . . R V
> 
>  arch/riscv/include/asm/pgtable.h | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/arch/riscv/include/asm/pgtable.h b/arch/riscv/include/asm/pgtable.h
> index 40b1ed4f3ea8..13447181ceb7 100644
> --- a/arch/riscv/include/asm/pgtable.h
> +++ b/arch/riscv/include/asm/pgtable.h
> @@ -189,6 +189,7 @@ extern struct pt_alloc_ops pt_ops __meminitdata;
>  
>  #define PAGE_KERNEL		__pgprot(_PAGE_KERNEL)
>  #define PAGE_KERNEL_READ	__pgprot(_PAGE_KERNEL & ~_PAGE_WRITE)
> +#define PAGE_KERNEL_RO		PAGE_KERNEL_READ
>  #define PAGE_KERNEL_EXEC	__pgprot(_PAGE_KERNEL | _PAGE_EXEC)
>  #define PAGE_KERNEL_READ_EXEC	__pgprot((_PAGE_KERNEL & ~_PAGE_WRITE) \
>  					 | _PAGE_EXEC)
> 
> base-commit: 58161ead29e50d70a317ea26b472e0c7508e69da
> -- 
> 2.53.0
> 
> 
> _______________________________________________
> linux-riscv mailing list
> linux-riscv@lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/linux-riscv

_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

^ permalink raw reply	[flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-10-20  1:40 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-18  2:36 [PATCH v1] riscv: mm: Define PAGE_KERNEL_RO Nickolai Zeldovich
2026-10-18  2:47 ` Muchun Song
2026-10-20  1:20 ` Jisheng Zhang

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.